CIFS and NTLM configuration

[lgr]

Hi,

My Alfresco (under linux debian) is configured for using ntlm. Webclient authentication works well.

The CIFS server is defined and worked well before ntlm configuration (using local alfresco user database) :

<host name="${localname}_A" domain="MYDOMAIN"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>10.0.255.255</broadcast>

Then ntlm passthru is defined for ntlm authentication in CIFS (classic authenticator desactived):

<authenticator type="passthru">
        <Server>10.0.0.1</Server>
      </authenticator>
<!–
      <authenticator type="alfresco">
      </authenticator>
–>

Then the alfresco startup launches some errors, and the CIFS server does not start properly :

14:11:10,757 ERROR [alfresco.smb.protocol] File server configuration error, Wrong authentication setup for passthru authenticator
org.alfresco.error.AlfrescoRuntimeException: Wrong authentication setup for passthru authenticator
        at org.alfresco.filesys.server.config.ServerConfiguration.processSecurityConfig(ServerConfiguration.java:1593)

I've read some posts inthe forum, and the wiki documentation, and nothing helped me out.

Configuring debug in log4j :

log4j.logger.org.alfresco.smb.protocol=debug
log4j.logger.org.alfresco.smb.protocol.auth=debug
(this line below does not output anything, only the two lines above do)
log4j.logger.org.alfresco.passthru.auth=debug

give me some more output before the exception :

14:10:53,135 DEBUG [org.alfresco.smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,135 DEBUG [smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,171 DEBUG [org.alfresco.smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [org.alfresco.smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [org.alfresco.smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [org.alfresco.smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]
14:10:53,171 DEBUG [smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]

Another information :
When re-enabling alfresco authenticator in file-servers.xml, startup goes well without errors :

<authenticator type="alfresco">
      </authenticator>

But my user is disallowed to login via passthru :

14:45:11,249 DEBUG [alfresco.smb.protocol] Server session started
14:45:11,254 DEBUG [alfresco.smb.protocol] Negotiated SMB dialect - NT LM 0.12
14:45:11,257 DEBUG [alfresco.smb.protocol] Assigned protocol handler - org.alfresco.filesys.smb.server.NTProtocolHandler
14:45:11,269 DEBUG [smb.protocol.auth] NT Session setup from user=, password=none, ANSIpwd=00, domain=, os=Windows 2002 Service Pack 2 2600, VC=0, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa5a71008]
14:45:11,269 DEBUG [smb.protocol.auth]   MID=8, UID=0, PID=65279
14:45:11,270 DEBUG [smb.protocol.auth] Null CIFS logon allowed
14:45:11,271 DEBUG [smb.protocol.auth] User  logged on  (type Null)
14:45:11,285 DEBUG [smb.protocol.auth] NT Session setup from user=lgr, password=5c84eabe5448c24cfb44bfff3f57690d57826d1b34dd9c8c, ANSIpwd=7aaa1b5945540fcfdb498558da0f7eacba95e19ce7a95d54, domain=MYDOMAIN, os=Windows 2002 Service Pack 2 2600, VC=1, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa6a71008]
14:45:11,285 DEBUG [smb.protocol.auth]   MID=16, UID=0, PID=65279
14:45:11,311 DEBUG [smb.protocol.auth] Authenticated user lgr sts=Disallow via Passthru
14:45:11,312 DEBUG [smb.protocol.auth] User lgr, access denied

Looking into the source, it looks like doMD4UserAuthentication fails, but i don't understand why.

Does anyone know what's wrong with this configuration ?

Laurent.

Note1 : a fresh rebooted windows station made the same behaviour.
Note2 : a connection on the ftp server works well

[nilas]

I have to apologize  ops:  I made a mistake.

I overwrite the alfresco.war file, AFTER the tomcat server was already started once. This way the repository.jar was the original one.

The AlfrescoAuthenticator class file I compiled works perfectly.

Thanks to Wahu for his reply and to Kevin (and Alfresco developers) for the fix….

Finally I can start testing 1.3.0 on my test-environment. Can't wait  


Nicola

[daviddst]

Hi all,

Thanks a lot to Wahu for sending me the fix (and to the developers as well).

But, I'm sorry, I didn't find where I should install the files (there are not on my system)

ServerConfiguration.class
AlfrescoAnthentificator.class

Any ideas ?

Thanks again,

David.

[wahu]

You must replace the classes file in repository.jar and put that new jar file to    alfresco.war

[jgreen]

I find myself in a bit of a mess in trying to follow this.

I've been tracking development builds, so have Rev 90 of this file, which seems to has references to DesktopActions, and probably some other files, so I can't use it as a base to make the appropriate changes. 

SVN Mirror is giving me a Berkly DB out of locks message, so I cannot revert to older source.

Where can I get V1.3 Java, or patched .Class files.

Also, it does not appear that the change to the NTLMMode check has made it into the source yet, will this be in 1.4, or is some other work-around being developed.

Thanks for all the good work on this bug,

[lc]

Someone can send me modified files for Alfresco 1.3.0 please ?

Thanks .

[pparkinson]

Been following this thread as well as experiencing the same problem while trying to enable passthru in CIFS:

…"CIFS server configuration error, Wrong authentication setup for passthru authenticator"…

I'm currently running Jboss 4.04, Alfresco 1.3 Enterprise Edition on SUSE 8.  Not being a developer, I have not attempted to make code changes and have not swapped out class files.

My question is, before I do all that, has the problem benn corrected in alfresco 1.3.1 EE or is the solution to this problem still the same?

Thanks in advance guys!

[flashypants]

Hi all,
is it correct that the version of Al F. available on Sourceforge is generally broken in the SMB/CIFS department?

Or is it only passthru authentication that does not work?

[kevinr]

The latest version on sourceforge (1.4 preview) contains the fixes for the above problem.

Thanks,

Kevin

[avigano]

I have installated the 1.4 preview, but I still got the same error.

"CIFS server configuration error, Wrong authentication setup for passthru authenticator".

NTLM passthru is working fine for the web interface.

Any help about it?

[wahu]

As my previous post, you need to modify "org.alfresco.filesys.server.config.ServerConfiguration" to resolve the error "CIFS server configuration error, Wrong authentication setup for passthru authenticator".