Alfresco + LDAP failing to open with SSO

[alejandrosl]

Hello,

I'm trying to setup Alfresco 3.3 CE (on Windows XP) in order to connect to a LDAP server (Active Directory) and allow the users to log in using passthru, that is, with the same username and password they have used to log in on Windows, not having to type them again on their browsers. In Firefox I got prompted for username and password, and if I type them I get this on alfresco.log:

10:06:08,036 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] New NTLM auth request from 127.0.0.1 (127.0.0.1:1510) SID:3A91F6953EBF5D7201BD8E07A2B25F55
10:06:17,442 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type1 [Type1:0xa2088207,Domain:<NotSet>,Wks:<NotSet>]
10:06:17,458 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Failed to map client IP 127.0.0.1 to a domain
10:06:17,458 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Client domain null
10:06:19,474 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Sending NTLM type2 to client - [Type2:0x80000203,Target:IZ-10023A,Ch:17318cfd0b20155e]
10:06:19,520 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type3 [Type3:,LM:473a4f279c1411faa9d1ec1d165eaed0f8f6f4cb8527e489,NTLM:904b616eae04753f5011038fe4487c5544dc1427266ca3a9,Dom:,User:aserrano,Wks:IZ-10023]
10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Updated cached NTLM details
10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] User logged on via NTLM, [myusername,Wks:IZ-10023,Dom:,AuthSrv:IZ-10023A,Thu May 06 10:06:19 BST 2010]
10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Session reinitialised - redirecting to initially configured page
10:06:19,942 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication not required (user), chaining …‍‍‍‍‍‍‍‍‍‍

If I go to about:config and I tweak network.automatic-ntlm-auth-trusted.uris to add it the value http://localhost:8080/alfresco I get an error logging in, the same error that I get using Internet Explorer instead of Firefox:

net.sf.acegisecurity.AuthenticationServiceException: Failed to open passthru auth session 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticatePassthru(NTLMAuthenticationComponentImpl.java:783) 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticate(NTLMAuthenticationComponentImpl.java:554) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
at java.lang.reflect.Method.invoke(Method.java:597) 
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150) 
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) 
at $Proxy192.authenticate(Unknown Source) 
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.processType1(BaseNTLMAuthenticationFilter.java:395) 
at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.doFilter(BaseNTLMAuthenticationFilter.java:307) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
at java.lang.reflect.Method.invoke(Method.java:597) 
at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:103) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) 
at $Proxy203.doFilter(Unknown Source) 
at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) 
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845) 
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) 
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) 
at java.lang.Thread.run(Thread.java:619) 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

If I'm not wrong, the only file in which I need to add or modify configurations is alfresco-global.properties. I attach it under these lines. What am I missing?

###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=C:/Alfresco/alf_data

#
# Sample database connection properties
#————-
db.name=alfresco
db.username=alfresco
db.password=alfresco
db.host=localhost
db.port=3306

#
# External locations
#————-
ooo.exe=C:/Alfresco/OpenOffice/OpenOffice3/program/soffice.exe
ooo.enabled=true
#img.root=C:/Alfresco/ImageMagick-6.6.1-Q16
img.root=C:/Alfresco/ImageMagick
img.exe=C:/Alfresco/ImageMagick/bin/convert.exe
swf.exe=C:/Alfresco/SWFTools/pdf2swf.exe

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://localhost:3306/alfresco

#
# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)
#
#db.driver=org.postgresql.Driver
#db.url=jdbc:postgresql://localhost:5432/alfresco

#
# Index Recovery Mode
#————-
#index.recovery.mode=AUTO

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service.  The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties 
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match. For example:
#   .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
authentication.chain=passthru1:passthru,ldap1:ldap,alfrescoNtlm1:alfrescoNtlm

passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=MYDOMAIN\\myserver,myserver
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=MYDOMAIN\\myadminuser
#Timeout value when opening a session to an authentication server, in milliseconds
passthru.authentication.connectTimeout=30000
#Offline server check interval in seconds
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true

ntlm.authentication.sso.enabled=true
ntlm.authentication.mapUnknownUserToGuest=false

#
# IMAP
#————-
#imap.server.enabled=true
#imap.server.port=143
#imap.server.host=localhost

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

ldap.authentication.active=false
ldap.synchronization.active=true

# How to map the user id entered by the user to that passed through to LDAP
# - simple
# - this must be a DN and would be something like
# CN=%s,DC=company,DC=com
# - digest
# - usually pass through what is entered
# %s
ldap.authentication.userNameFormat=MYDOMAIN\\%s

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# Allow or not guest users
ldap.authentication.allowGuestLogin=true
alfresco.authentication.allowGuestLogin=false

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://lpad1.myserver.com:389

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=MYDOMAIN\\myprincipal
# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=mypassword

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

#
# This properties file is used to configure LDAP syncronisation
#

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=MYDOMAIN\\myprincipal
# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=mypassword

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# The timestamp format
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The query to find the people to import
#ldap.synchronization.personQuery=(objectclass=inetOrgPerson)
ldap.synchronization.personQuery=(objectclass=user)

# The search base of the query to find people to import
ldap.synchronization.personSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=com
ldap.synchronization.userSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=com

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=cn

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=ou

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronization.groupQuery=(objectclass=groupOfUniqueNames)

# The search base to use to find group objects
ldap.synchronization.groupSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=com

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
#ldap.synchronization.groupType=groupOfUniqueNames

# The person type in LDAP
#ldap.synchronization.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
#ldap.synchronization.groupMemberAttributeName=uniqueMember
ldap.synchronization.groupMemberAttributeName=member

# The cron expression defining when people imports should take place
ldap.synchronization.import.person.cron=0 */10 * * * ?

# The cron expression defining when group imports should take place
ldap.synchronization.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronization.import.group.clearAllChildren=true

synchronization.synchronizeChangesOnly=true

filesystem.name=Alfresco
#filesystem.acl.global.defaultAccessLevel=
filesystem.domainMappings=MYDOMAIN
filesystem.domainMappings.value.MYDOMAIN.rangeFrom=192.168.0.0
filesystem.domainMappings.value.MYDOMAIN.rangeTo=192.168.0.255
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[alejandrosl]

Well, I've got some improvements but it doesn't perform SSO at all. On alfresco-global.properties I've set:

authentication.chain=passthru1:passthru

passthru.authentication.servers=xx.xx.xx.xx,MYDOMAIN\\myserver,myserver

ldap.authentication.userNameFormat=%s

ldap.authentication.java.naming.security.principal=myprincipal

ldap.synchronization.java.naming.security.principal=MYDOMAIN\\myprincipal
‍‍‍‍‍‍‍‍‍‍

The rest of that file remains the same. Now I get this output in alfresco.log when opening a browser and trying to access to Alfresco Explorer:

14:50:32,090 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] New NTLM auth request from 127.0.0.1 (127.0.0.1:1183) SID:C6A349B892D4200CAE444773526874C5
14:50:32,105 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type1 [Type1:0xa208b207,Domain:INERZA,Wks:IZ-10023]
14:50:32,105 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Client domain INERZA
14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Processing request: /alfresco/wcservice/api/search/keyword/description.xml SID:null
14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Found webscript with no authentication - set NO_AUTH_REQUIRED flag.
14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication not required (filter), chaining …‍‍‍‍‍‍

If I set

ntlm.authentication.sso.enabled=false‍

then Alfresco asks me for username and password, and it's possible to login with any user from the AD, but I would like SSO to be working properly. Any idea?

[alejandrosl]

Well, switching the authentication chain to

authentication.chain=ldap1:ldap,passthru1:passthru‍

also

ntlm.authentication.sso.enabled=false‍

and other minor changes I've managed to login with any user from the LDAP server (Alfresco has properly imported users and groups), but obviously without SSO, e.g, typing username and password on the browser. If I try to enable the SSO (as I would like), I get the error described on the first message of this thread. Anyone knows why?

[mannobug]

Hi I'm in the same situoation of your configuration do you solve the problem or you still sync ldap without SSO?
Thanks.
Emmanuele

[alejandrosl]

Hi Emmanuele,

unfortunately I still haven't solved the problem. Please let me know if you find out something. Thanks.

[zapatdlo]

Hi,

I'm facing the same problem, did someone found solution?
I tried on Alfresco community versions - 3.2r, 3.3, 3.3g.

The only solutions is - turn off SSO and use default login

[tverin]

try moving your AD configuration in a subsystem like
tomcat/shared/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1/passthru.properties