It's enabled, yes.When I try to connect to \\ALF (it's the hostname) from a XP client, I get an authentication screen, but no login succeeds.Unfortunatly, I get no entry in the log for failed login or anything else.Doing a wireshark trace, I can see SMB packets with STATUS_LOGON_FAILUREConnecting to \\AlfA doesn't work (connection times out)Here is my config:Authentication chain:authentication.chain=kerberos1:kerberos,ldap-ad1:ldap-ad,alfrescoNtlm1:alfrescoNtlm
kerberos-authentication.properties:
kerberos.authentication.realm=DOMAIN.LOCAL
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=true
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.defaultAdministratorUserNames=admin
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.cifs.password=***
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.http.password=***
kerberos.authentication.defaultAdministratorUserNames=admin
kerberos.authentication.browser.ticketLogons=true
ldap-ad-authentication.properties
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=uid\=%s,dc\=domain,dc\=local
ldap.authentication.java.naming.provider.url=ldap://192.168.1.13:389
ldap.authentication.java.naming.security.authentication=SIMPLE
ldap.authentication.java.naming.security.principal=ldapsync@domain.local
ldap.authentication.java.naming.security.credentials=***
alfresco-authentication.properties
alfresco.authentication.sso.enabled=false
alfresco.authentication.allowGuestLogin=false
alfresco.authentication.authenticateCIFS=false
file-servers-properties:
### CIFS Server Configuration ###
cifs.enabled=true
cifs.serverName=alf.domain.local
cifs.domain=DOMAIN.LOCAL
cifs.hostannounce=true
# properties for non-Windows servers with Java-based SMB implementation
# Specifies the broadcast mask for the network.
#cifs.broadcast=
# Specifies the network adapter to bind to. If not specified the server will bind to all available adapters/addresses.
cifs.bindto=192.168.1.127
# Controls the port used to listen for the SMB over TCP/IP protocol (or native SMB), supported by Win2000 and above clients. The default port is 445.
#cifs.tcpipSMB.port=
# Enables the use of IP v6 in addition to IP v4 for native SMB. When true, the server will listen for incoming connections on IPv6 and IPv4 sockets.
#cifs.ipv6.enabled=false
# Controls the NetBIOS name server port to listen on. The default is 137.
#cifs.netBIOSSMB.namePort=
# Controls the NetBIOS datagram port. The default is 138.
#cifs.netBIOSSMB.datagramPort=
# Controls the NetBIOS session port to listen on for incoming session requests. The default is 139.
#cifs.netBIOSSMB.sessionPort=
# Disables the new NIO based CIFS server code and reverts to using the older socket based code.
#cifs.disableNIO=false
# Optional WINS server primary and secondary IP addresses. Ignored if autoDetectEnabled=true
cifs.WINS.autoDetectEnabled=true
cifs.WINS.primary=192.168.1.13
cifs.WINS.secondary=192.168.1.4
### FTP Server Configuration ###
ftp.enabled=true
ftp.port=21
ftp.ipv6.enabled=false
# FTP data port range, a value of 0:0 disables the data port range and will use the next available port
# Valid range is 1024-65535
ftp.dataPortFrom=0
ftp.dataPortTo=0
also tried default cifs.serverName=${localname}A
, without success/etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = DOMAIN.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes
[realms]
TECH.WTG = {
kdc = dc1.domain.local:88
admin_server = dc1.domain.local:749
default_domain = domain.local
}
[domain_realm]
dc1.domain.local = DOMAIN.LOCAL
.dc1.domain.local = DOMAIN.LOCAL
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
Created keytables, SPN and everything Kerberos specifc else.Kerberos with SSO is working fine, as well as LDAP-sync (config not posted).Maybe a problem of the authentication chain?
