CIFS and LDAP

[linuxos77]

I know this has been discussed ad-naseum but I'm looking for a quick anwser to my question and can't seem to find it…  I have Alfresco 3.2r CE installed on Redhat Linux Enterprise 5.  It's using LDAP authentication and syncronization working fine and I can log into Share and Alfresco content management without problem, however CIFS does not work.  I know CIFS does not work with LDAP, however it does work against the local Alfresco accounts. 

Since I have LDAP syncronization working (I can log in as admin and see all my LDAP users are created in Alfresco), shouldn't I be able to configure an authentication chain to then use local alfresco accounts for CIFS?  CIFS works for my admin user but not the users that were created via LDAP syncronizations.

So……  Is there any way I can have LDAP authentication (or syncronization) work for creating all my users, but also have CIFS authenticate against those users created via LDAP in Alfresco?  We use eDirectory for LDAP (ie not AD).

[wiz561]

Plus 1 for help with this.

I'm running into the same problem.  The wiki instructions on setting this up are a little confusing for the newbie.  I have a similar backend (openldap, not AD), and I'm pretty much in the same situation as the original poster.

Sorry for not responding with an answer; hoping somebody can shed some light on this.

[gronfelt]

Passwords are not synched, even if you synchronize with LDAP, Alfresco will still authenticate by looking up the users in the LDAP directory. However, this cannot be done with CIFS connections, because of differences in the password hashing, so you need to have Alfrescos internal Ntlm authentication enabled if CIFS access is going to work. Of course this means that you have to keep your passwords synched somehow, between your Alfresco server and your directory server, if you wan't your users to be able to use the same password everywhere.

One solution to that might be to set up a common backend, such as a Samba Domain Controller.

[gyro_gearless]

Hi folks,
may i join the club?

Im currently stuck with -perhaps- the same kind of problem: OpenLDAP (as part of Zimbra); Samba PDC, authenticating against LDAP (works fine); Alfreso authenticating against LDAP (worked for 3.0, now i am migrating to 3.2); and finally Alfresco CIFS (only works with Alfresco internal authentication so far).

Now i am quite confused what would be the best method to make ALfresco CIFS working? Anyone has done this successfully? Would Kerberos be helpful?

And, BTW: why cant Alfresco CIFS authenticate against my LDAP? Obviously Samba can do this, and i am not aware that the Samba folks have supernatural powers 

Cheers
Gyro

[dward]

It should be possible to use the passthru subsystem in your authentication chain to authenticate against Samba. See

http://forums.alfresco.com/en/viewtopic.php?f=9&t=21091

[wiz561]

Thanks for the responses.  Here's my setup….

I'm using FreeIPA for openldap authentication.  It doesn't kerberos too, but i'm not playing with that just yet.  On my alfresco box, I have samba running on it and authenticating against the freeipa openldap server.  In the smb.conf, I have passdb backend = ldapsam:ldap//freeipa.foo.org/.

I followed the instructions in a couple of places.  Here is what I did to get it to work.

Running Alfresco-Community-3.2r2-Linux-x86.

# vi /opt/Alfresco/tomcat/shared/classes/alfresco-global.properties

– add the following –
authentication.chain=passthru1assthru,ldap1:ldap
cifs.domain=<set to workgroup name in smb.conf>

# Configure NTLM passthru to SAMBA Server
ntlm.authentication.sso.enabled=false
ntlm.authentication.authenticateCIFS=false
passthru.authentication.sso.enabled=false
passthru.authentication.allowGuestLogin=true

passthru.authentication.servers=<ip address of samba server>
passthru.authentication.domain=<workgroup name in smb.conf>
passthru.authentication.useLocalServer=false
passthru.authentication.defaultAdministratorUserNames=adminusers
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP,NETBIOS
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true

ldap.authentication.java.naming.provider.url=ldap://<freeipa.something.org>:389 (must mod to your own ldap)
ldap.synchronization.java.naming.security.principal=alfresco@<domain name> (must mod to your own ldap)
ldap.synchronization.java.naming.security.credentials=<ldap password> (must mod to your own ldap)
ldap.synchronization.groupSearchBase=cn=Groups,cn=accounts,dc=<domain> (must mod to your own ldap)
ldap.synchronization.userSearchBase=cn=Users,cn=accounts,dc=<domain> (must mod to your own ldap)

—-cut—-

# cd /opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/
# cp -R ldap ldap1
# vi ldap1/ldap-authentication.properties

change the information around in here for your ldap server.  I had to make a number of changes, all variations to the groupsearchbase and usersearchbase above.

Now what happens is that it uses samba/windows domain authentication.  It uses the local samba server as a proxy to the ldap server.  It seems to work alright, but I have a feeling like I don't have samba setup correctly on my end.  This is not an alfresco problem and just something I'm doing goofy. 

I hope this can help some of you out!

[dranakan]

Hello,

Does anyone have a sample of smb.conf in this situation ?

Thanks