CIFS and NTLM configuration

[lgr]

Hi,

My Alfresco (under linux debian) is configured for using ntlm. Webclient authentication works well.

The CIFS server is defined and worked well before ntlm configuration (using local alfresco user database) :

<host name="${localname}_A" domain="MYDOMAIN"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>10.0.255.255</broadcast>

Then ntlm passthru is defined for ntlm authentication in CIFS (classic authenticator desactived):

<authenticator type="passthru">
        <Server>10.0.0.1</Server>
      </authenticator>
<!–
      <authenticator type="alfresco">
      </authenticator>
–>

Then the alfresco startup launches some errors, and the CIFS server does not start properly :

14:11:10,757 ERROR [alfresco.smb.protocol] File server configuration error, Wrong authentication setup for passthru authenticator
org.alfresco.error.AlfrescoRuntimeException: Wrong authentication setup for passthru authenticator
        at org.alfresco.filesys.server.config.ServerConfiguration.processSecurityConfig(ServerConfiguration.java:1593)

I've read some posts inthe forum, and the wiki documentation, and nothing helped me out.

Configuring debug in log4j :

log4j.logger.org.alfresco.smb.protocol=debug
log4j.logger.org.alfresco.smb.protocol.auth=debug
(this line below does not output anything, only the two lines above do)
log4j.logger.org.alfresco.passthru.auth=debug

give me some more output before the exception :

14:10:53,135 DEBUG [org.alfresco.smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,135 DEBUG [smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,171 DEBUG [org.alfresco.smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [org.alfresco.smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [org.alfresco.smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [org.alfresco.smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]
14:10:53,171 DEBUG [smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]

Another information :
When re-enabling alfresco authenticator in file-servers.xml, startup goes well without errors :

<authenticator type="alfresco">
      </authenticator>

But my user is disallowed to login via passthru :

14:45:11,249 DEBUG [alfresco.smb.protocol] Server session started
14:45:11,254 DEBUG [alfresco.smb.protocol] Negotiated SMB dialect - NT LM 0.12
14:45:11,257 DEBUG [alfresco.smb.protocol] Assigned protocol handler - org.alfresco.filesys.smb.server.NTProtocolHandler
14:45:11,269 DEBUG [smb.protocol.auth] NT Session setup from user=, password=none, ANSIpwd=00, domain=, os=Windows 2002 Service Pack 2 2600, VC=0, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa5a71008]
14:45:11,269 DEBUG [smb.protocol.auth]   MID=8, UID=0, PID=65279
14:45:11,270 DEBUG [smb.protocol.auth] Null CIFS logon allowed
14:45:11,271 DEBUG [smb.protocol.auth] User  logged on  (type Null)
14:45:11,285 DEBUG [smb.protocol.auth] NT Session setup from user=lgr, password=5c84eabe5448c24cfb44bfff3f57690d57826d1b34dd9c8c, ANSIpwd=7aaa1b5945540fcfdb498558da0f7eacba95e19ce7a95d54, domain=MYDOMAIN, os=Windows 2002 Service Pack 2 2600, VC=1, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa6a71008]
14:45:11,285 DEBUG [smb.protocol.auth]   MID=16, UID=0, PID=65279
14:45:11,311 DEBUG [smb.protocol.auth] Authenticated user lgr sts=Disallow via Passthru
14:45:11,312 DEBUG [smb.protocol.auth] User lgr, access denied

Looking into the source, it looks like doMD4UserAuthentication fails, but i don't understand why.

Does anyone know what's wrong with this configuration ?

Laurent.

Note1 : a fresh rebooted windows station made the same behaviour.
Note2 : a connection on the ftp server works well

[davin_c]

Kevin,

Thanks for the reply. I'll try and retrieve the file sometime soon (I'm not really sure how to retrieve from SVN).

Davin

[kevinr]

This may help:
http://wiki.alfresco.com/wiki/Alfresco_SVN_Development_Environment

[timconst]

I retrieved the org.alfresco.filesys.server.auth.ntlm.AlfrescoAuthenticator file from the SVN.  I'm not sure what to do with it. 

I originally installed Alfresco using the alfresco-1.3.0-windows-community.exe

I'm using Alfresco on a Windows 2003 Server and downloaded from the SVN using TortoiseSVN.

[kevinr]

You will need to compile the code as per the instructions on the wiki. So I suggest using the build scripts that you get from SVN. Once the .class file is compiled, you can patch it into the repository.jar file inside the alfresco.war file. So you will need to unpack your existing alfresco.war file and then unpack the repository.jar from it, overwrite the .class file in the appropriate package folder and then repack the jar and war files. You can then overwrite your old WAR file in your Alfresco deployment with the new one.

Thanks,

Kevin

[wahu]

OK. I successfully made the CIFS work with passthru authenticaion.
In addition to retrieve and compile the org.alfresco.filesys.server.auth.ntlm.AlfrescoAuthenticator, I also modify the org.alfresco.filesys.server.config.ServerConfiguration as following:
from

 if (authType.equalsIgnoreCase("passthru")) {
if ( ntlmMode != NTLMMode.NONE)
throw new AlfrescoRuntimeException("Wrong authentication setup for passthru authenticator");
‍‍‍‍‍

to

 if (authType.equalsIgnoreCase("passthru")) {
if ( ntlmMode != NTLMMode.PASS_THROUGH)
throw new AlfrescoRuntimeException("Wrong authentication setup for passthru authenticator");
‍‍‍‍‍

[kevinr]

That's great news.

Cheers,

Kevin

[unknown-user]

Could anyone post the recompiled files. I'm not a developer and don't know how to solve this . I'm very interested getting CIFS to work.

Thank you.

[wahu]

I can mail you the recompiled class files.
However, you still need to know how to replace the old files in repository.jar & alfresco.war

[nilas]

Hi,

I followed the instruction provided by Kevin: recompiled the sources, unpack .war and repository.jar, packed the recompiled AlfrescoAuthenticator.class in the original alfresco.war file, but… it didn't work.  :evil:

I also tried to follow "wahu" suggestion regarding ServerConfiguration.class but it didn't work as well.

I tried to patch the 1.3.0 alfresco.war tomcat-bundle release and the 1.4-build54 alfresco.war tomcat-bundle. Nothing to do…

Wahu, may I send you my .class files to see if they work on your environment? Let me know.

Help!

Nicola

[wahu]

I mailed Tiwanaku the compiled classes and he replied it works well.

May I know what error message you got after setting log4j.logger.org.alfresco.smb.protocol.auth=debug  in log4j.properties file?

BTW, please execute the command "net view \\servername_a" in client side and tell me the message.