Authentication Api

[carlosjl]

Hello!
My environment is composed of Alfresco 3.4 Community Edition and I integrated with SSO Jasig Cas Server.

The users authenticate without problem and users that do not exist are self-created (createmissinpeople).
But, I have a problem when I access to url http://my.alfresco.com/alfresco/api . I can only authenticate with internal user admin:admin.
When I try conect (get ticket) to http://my.alfresco.com/alfresco/service/login?u=pepe&pw=pepe0 I recived Error Authentication Failure.
I added external user pepe to alfresco admin group but the problem contiues.


Any Idea?.

Thank's.

[mrogers]

Lots more details please.  What's your authentication configuration.    How do you expect pepe to authenticate?

And are you really trying to connect to my.alfresco.com?

[mrogers]

Lots more details please.  What's your authentication configuration.    How do you expect pepe to authenticate?

And are you really trying to connect to my.alfresco.com?

[carlosjl]

Hi! mrogers, thank you for quick response.

My authentication configuration is:

-. alfresco-global.properties
## Enable CAS Authentication (External subsystem)###
external.authentication.enabled=true
authentication.chain=cas:external,alfrescoNtlm1:alfrescoNtlm
external.authentication.defaultAdministratorUserNames=adminenterprise

-. share-config-custom.xml

  <!– Custom Config to Cas –>

   <config evaluator="string-compare" condition="Remote">
      <remote>

         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://www.myenterprise.org/bollo/funfu/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>

-. Alfresco Explorer (web.xml)

<!– CAS Loguin –>
   <filter>
      <filter-name>CAS Authentication Filter</filter-name>
      <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
      <init-param>
         <param-name>casServerLoginUrl</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/alfresco</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS Validation Filter</filter-name>
      <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class>
      <init-param>
         <param-name>casServerUrlPrefix</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/alfresco</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
   </filter>
<!—->

<!– CAS Login–>
   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
<filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
<!—->

-. Share (web.xml)

<!– CAS Loguin –>
   <filter>
      <filter-name>CAS Authentication Filter</filter-name>
      <filter-class>org.jasig.cas.client.authentication.AuthenticationFilter</filter-class>
      <init-param>
         <param-name>casServerLoginUrl</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/share</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS Validation Filter</filter-name>
      <filter-class>org.jasig.cas.client.validation.Cas10TicketValidationFilter</filter-class>
      <init-param>
         <param-name>casServerUrlPrefix</param-name>
         <param-value>https://www.myenterprise.org/education/nosh/cas/login</param-value>
      </init-param>
      <init-param>
         <param-name>serverName</param-name>
         <param-value>http://www.myenterprise.org/bollo/funfu/share</param-value>
      </init-param>
   </filter>
   <filter>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <filter-class>org.jasig.cas.client.util.HttpServletRequestWrapperFilter</filter-class>
   </filter>
<!– /CAS –>


<!– CAS –>
   <filter-mapping>
      <filter-name>CAS Authentication Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS Validation Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CAS HttpServletRequest Wrapper Filter</filter-name>
      <url-pattern>/*</url-pattern>
   </filter-mapping>
<!– /CAS –>


Tell me if you need more information.
Thank's for all.

[mrogers]

The problem is that the login WebScript is working with username / password.   Rather than the sso token which is generated by your cas server.

Can you add something to the authentication chain (such as an ldap connection) to allow username/ password validation for your external users?    In addition it would be worth studying how share sso authentication works,  somehow it calls web scripts with sso ( unfortunately I don't personally know about that) so there may be another way to run a WebScript or getting a ticket.