Alfresco + LDAP failing to open with SSO

[alejandrosl]

Hello,

I'm trying to setup Alfresco 3.3 CE (on Windows XP) in order to connect to a LDAP server (Active Directory) and allow the users to log in using passthru, that is, with the same username and password they have used to log in on Windows, not having to type them again on their browsers. In Firefox I got prompted for username and password, and if I type them I get this on alfresco.log:

10:06:08,036 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] New NTLM auth request from 127.0.0.1 (127.0.0.1:1510) SID:3A91F6953EBF5D7201BD8E07A2B25F5510:06:17,442 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type1 [Type1:0xa2088207,Domain:<NotSet>,Wks:<NotSet>]10:06:17,458 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Failed to map client IP 127.0.0.1 to a domain10:06:17,458 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Client domain null10:06:19,474 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Sending NTLM type2 to client - [Type2:0x80000203,Target:IZ-10023A,Ch:17318cfd0b20155e]10:06:19,520 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type3 [Type3:,LM:473a4f279c1411faa9d1ec1d165eaed0f8f6f4cb8527e489,NTLM:904b616eae04753f5011038fe4487c5544dc1427266ca3a9,Dom:,User:aserrano,Wks:IZ-10023]10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Updated cached NTLM details10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] User logged on via NTLM, [myusername,Wks:IZ-10023,Dom:,AuthSrv:IZ-10023A,Thu May 06 10:06:19 BST 2010]10:06:19,880 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Session reinitialised - redirecting to initially configured page10:06:19,942 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication not required (user), chaining …‍‍‍‍‍‍‍‍‍‍

If I go to about:config and I tweak network.automatic-ntlm-auth-trusted.uris to add it the value http://localhost:8080/alfresco I get an error logging in, the same error that I get using Internet Explorer instead of Firefox:

net.sf.acegisecurity.AuthenticationServiceException: Failed to open passthru auth session at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticatePassthru(NTLMAuthenticationComponentImpl.java:783) at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticate(NTLMAuthenticationComponentImpl.java:554) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307) at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150) at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) at $Proxy192.authenticate(Unknown Source) at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.processType1(BaseNTLMAuthenticationFilter.java:395) at org.alfresco.repo.webdav.auth.BaseNTLMAuthenticationFilter.doFilter(BaseNTLMAuthenticationFilter.java:307) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:103) at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172) at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202) at $Proxy203.doFilter(Unknown Source) at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:82) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286) at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583) at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) at java.lang.Thread.run(Thread.java:619) ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

If I'm not wrong, the only file in which I need to add or modify configurations is alfresco-global.properties. I attach it under these lines. What am I missing?

################################# Common Alfresco Properties ################################## Sample custom content and index data location#————-dir.root=C:/Alfresco/alf_data## Sample database connection properties#————-db.name=alfrescodb.username=alfrescodb.password=alfrescodb.host=localhostdb.port=3306## External locations#————-ooo.exe=C:/Alfresco/OpenOffice/OpenOffice3/program/soffice.exeooo.enabled=true#img.root=C:/Alfresco/ImageMagick-6.6.1-Q16img.root=C:/Alfresco/ImageMagickimg.exe=C:/Alfresco/ImageMagick/bin/convert.exeswf.exe=C:/Alfresco/SWFTools/pdf2swf.exe## MySQL connection#————-db.driver=org.gjt.mm.mysql.Driverdb.url=jdbc:mysql://localhost:3306/alfresco## PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)##db.driver=org.postgresql.Driver#db.url=jdbc:postgresql://localhost:5432/alfresco## Index Recovery Mode#————-#index.recovery.mode=AUTO## Outbound Email Configuration#————-#mail.host=#mail.port=25#mail.username=anonymous#mail.password=#mail.encoding=UTF-8#mail.from.default=alfresco@alfresco.org#mail.smtp.auth=false## Alfresco Email Service and Email Server#————-# Enable/Disable the inbound email service.  The service could be used by processes other than# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.#————-#email.inbound.enabled=true# Email Server properties #————-#email.server.enabled=true#email.server.port=25#email.server.domain=alfresco.com#email.inbound.unknownUser=anonymous# A comma separated list of email REGEX patterns of allowed senders.# If there are any values in the list then all sender email addresses# must match. For example:#   .*\@alfresco\.com, .*\@alfresco\.org# Allow anyone:#————-#email.server.allowed.senders=.*## The default authentication chain# To configure external authentication subsystems see:# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#————-authentication.chain=passthru1:passthru,ldap1:ldap,alfrescoNtlm1:alfrescoNtlmpassthru.authentication.useLocalServer=falsepassthru.authentication.domain=passthru.authentication.servers=MYDOMAIN\\myserver,myserverpassthru.authentication.guestAccess=falsepassthru.authentication.defaultAdministratorUserNames=MYDOMAIN\\myadminuser#Timeout value when opening a session to an authentication server, in millisecondspassthru.authentication.connectTimeout=30000#Offline server check interval in secondspassthru.authentication.offlineCheckInterval=300passthru.authentication.protocolOrder=NetBIOS,TCPIPpassthru.authentication.authenticateCIFS=truepassthru.authentication.authenticateFTP=truentlm.authentication.sso.enabled=truentlm.authentication.mapUnknownUserToGuest=false## IMAP#————-#imap.server.enabled=true#imap.server.port=143#imap.server.host=localhost## This properties file brings together the common options for LDAP authentication rather than editing the bean definitions#ldap.authentication.active=falseldap.synchronization.active=true# How to map the user id entered by the user to that passed through to LDAP# - simple# - this must be a DN and would be something like# CN=%s,DC=company,DC=com# - digest# - usually pass through what is entered# %sldap.authentication.userNameFormat=MYDOMAIN\\%s# The LDAP context factory to useldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory# Allow or not guest usersldap.authentication.allowGuestLogin=truealfresco.authentication.allowGuestLogin=false# The URL to connect to the LDAP serverldap.authentication.java.naming.provider.url=ldap://lpad1.myserver.com:389# The authentication mechanism to use#ldap.authentication.java.naming.security.authentication=DIGEST-MD5ldap.authentication.java.naming.security.authentication=simple# The default principal to use (only used for LDAP sync)ldap.authentication.java.naming.security.principal=MYDOMAIN\\myprincipal# The password for the default principal (only used for LDAP sync)ldap.authentication.java.naming.security.credentials=mypassword# Escape commas entered by the user at bind time# Useful when using simple authentication and the CN is part of the DN and contains commasldap.authentication.escapeCommasInBind=false# Escape commas entered by the user when setting the authenticated user# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is# pulled in as part of an LDAP sync# If this option is set to true it will break the default home folder provider as space names can not contain \ldap.authentication.escapeCommasInUid=false## This properties file is used to configure LDAP syncronisation## The default principal to bind with (only used for LDAP sync). This should be a UPN or DNldap.synchronization.java.naming.security.principal=MYDOMAIN\\myprincipal# The password for the default principal (only used for LDAP sync)ldap.synchronization.java.naming.security.credentials=mypassword# If positive, this property indicates that RFC 2696 paged results should be# used to split query results into batches of the specified size. This# overcomes any size limits imposed by the LDAP server.ldap.synchronization.queryBatchSize=1000# The timestamp formatldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'# The query to find the people to import#ldap.synchronization.personQuery=(objectclass=inetOrgPerson)ldap.synchronization.personQuery=(objectclass=user)# The search base of the query to find people to importldap.synchronization.personSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=comldap.synchronization.userSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=com# The attribute name on people objects found in LDAP to use as the uid in Alfrescoldap.synchronization.userIdAttributeName=cn# The attribute on person objects in LDAP to map to the first name property in Alfrescoldap.synchronization.userFirstNameAttributeName=givenName# The attribute on person objects in LDAP to map to the last name property in Alfrescoldap.synchronization.userLastNameAttributeName=sn# The attribute on person objects in LDAP to map to the email property in Alfrescoldap.synchronization.userEmailAttributeName=mail# The attribute on person objects in LDAP to map to the organizational id property in Alfrescoldap.synchronization.userOrganizationalIdAttributeName=ou# The default home folder provider to use for people created via LDAP importldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider# The query to find group objectsldap.synchronization.groupQuery=(objectclass=groupOfUniqueNames)# The search base to use to find group objectsldap.synchronization.groupSearchBase=ou=serviport.com,ou=MyOU,dc=myserver,dc=com# The attribute on LDAP group objects to map to the gid property in Alfrecsoldap.synchronization.groupIdAttributeName=cn# The group type in LDAP#ldap.synchronization.groupType=groupOfUniqueNames# The person type in LDAP#ldap.synchronization.personType=inetOrgPerson# The attribute in LDAP on group objects that defines the DN for its members#ldap.synchronization.groupMemberAttributeName=uniqueMemberldap.synchronization.groupMemberAttributeName=member# The cron expression defining when people imports should take placeldap.synchronization.import.person.cron=0 */10 * * * ?# The cron expression defining when group imports should take placeldap.synchronization.import.group.cron=0 30 * * * ?# Should all groups be cleared out at import time?# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)# - setting this to true means old group definitions will be tidied up.ldap.synchronization.import.group.clearAllChildren=truesynchronization.synchronizeChangesOnly=truefilesystem.name=Alfresco#filesystem.acl.global.defaultAccessLevel=filesystem.domainMappings=MYDOMAINfilesystem.domainMappings.value.MYDOMAIN.rangeFrom=192.168.0.0filesystem.domainMappings.value.MYDOMAIN.rangeTo=192.168.0.255‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[alejandrosl]

Well, I've got some improvements but it doesn't perform SSO at all. On alfresco-global.properties I've set:

authentication.chain=passthru1:passthrupassthru.authentication.servers=xx.xx.xx.xx,MYDOMAIN\\myserver,myserverldap.authentication.userNameFormat=%sldap.authentication.java.naming.security.principal=myprincipalldap.synchronization.java.naming.security.principal=MYDOMAIN\\myprincipal‍‍‍‍‍‍‍‍‍‍

The rest of that file remains the same. Now I get this output in alfresco.log when opening a browser and trying to access to Alfresco Explorer:

14:50:32,090 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] New NTLM auth request from 127.0.0.1 (127.0.0.1:1183) SID:C6A349B892D4200CAE444773526874C514:50:32,105 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Received type1 [Type1:0xa208b207,Domain:INERZA,Wks:IZ-10023]14:50:32,105 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Client domain INERZA14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Processing request: /alfresco/wcservice/api/search/keyword/description.xml SID:null14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Found webscript with no authentication - set NO_AUTH_REQUIRED flag.14:50:33,075 DEBUG [org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication not required (filter), chaining …‍‍‍‍‍‍

If I set

ntlm.authentication.sso.enabled=false‍

then Alfresco asks me for username and password, and it's possible to login with any user from the AD, but I would like SSO to be working properly. Any idea?

[alejandrosl]

Well, switching the authentication chain to

authentication.chain=ldap1:ldap,passthru1:passthru‍

also

ntlm.authentication.sso.enabled=false‍

and other minor changes I've managed to login with any user from the LDAP server (Alfresco has properly imported users and groups), but obviously without SSO, e.g, typing username and password on the browser. If I try to enable the SSO (as I would like), I get the error described on the first message of this thread. Anyone knows why?

[mannobug]

Hi I'm in the same situoation of your configuration do you solve the problem or you still sync ldap without SSO?
Thanks.
Emmanuele

[alejandrosl]

Hi Emmanuele,

unfortunately I still haven't solved the problem. Please let me know if you find out something. Thanks.

[zapatdlo]

Hi,

I'm facing the same problem, did someone found solution?
I tried on Alfresco community versions - 3.2r, 3.3, 3.3g.

The only solutions is - turn off SSO and use default login

[tverin]

try moving your AD configuration in a subsystem like
tomcat/shared/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1/passthru.properties