CIFS configuration error on ntlm / passthru / ldap-ad chain

[david_labbe]

Hi there,

after fiddling a lot and reading a number of useful posts / books / blogs, I managed to get the basic ldap-ad synchronisation to work. I can now get the users registered in the domain controller to logon to alfresco without having to create them in Alfresco. Great.

Next step is to set the passthru system so that the users do not have to provide credential when they go on the alfresco web client or the CIFS "shared drive".

The way I configured the authentication system is as follows:

in [TOMCAT_HOME]/shared/classes/alfresco-global.properties:

authentication.chain=alfrescoNtlm1:alfrescoNtlm, passthru1:passthru, ldap-ad1:ldap-ad‍

For AlfrescoNtlm:

in [TOMCAT_HOME]/shared/classes/alfresco/extension/subsystems/Authentication/alfrescoNtlm/alfrescoNtlm1/alfresco-authentication.properties:

alfresco.authentication.allowGuestLogin=false
alfresco.authentication.authenticateCIFS=false‍‍

in [TOMCAT_HOME]/shared/classes/alfresco/extension/subsystems/Authentication/alfrescoNtlm/alfrescoNtlm1/ntlm-filter.properties:

ntlm.authentication.sso.enabled=false
ntlm.authentication.mapUnknownUserToGuest=false‍‍

For passthru

in [TOMCAT_HOME]/shared/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1/passthru-authentication-context.properties:

passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=myDomain\\myAuthenticationServer.myDomain
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=myAdministratorUserName
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true‍‍‍‍‍‍‍‍‍‍

in [TOMCAT_HOME]/shared/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1/ntlm-filter.properties:
ntlm.authentication.sso.enabled=false
ntlm.authentication.mapUnknownUserToGuest=false

ntlm.authentication.sso.enabled=false
ntlm.authentication.mapUnknownUserToGuest=false‍‍

For ldap-ad

in [TOMCAT_HOME]/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap-ad1/ldap-ad-authentication.properties:

ldap.authentication.active=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@myDomain
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://myLdapServer.myDomain:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=myAdministratorUserName
ldap.authentication.java.naming.security.principal=CN=Administrator,CN=Users,DC=myDomain
ldap.authentication.java.naming.security.credentials=myAdministratorCredentials

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=CN=Administrator,CN=Users,DC=myDomain
ldap.synchronization.java.naming.security.credentials=myAdministratorCredentials
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=myGroupSearchBaseString
ldap.synchronization.userSearchBase=myUserSearchBaseString
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Restarting the server gives me the following error:

INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'fileServers' subsystem, ID: [fileServers, default]
INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1]
INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1] complete
INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1]
INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
WARN  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://<myLdapServer>:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://<myLdapServer>:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://<myLdapServer>:389
INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://<myLdapServer>:389
INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1] complete
INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, passthru1]
INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]

ERROR [org.alfresco.fileserver] CIFS server configuration error, Cannot find class [org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter] for bean with name 'webscriptAuthenticationFilter' defined in file [/srv/tomcat6/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/ntlm-filter-context.xml]; nested exception is java.lang.ClassNotFoundException: org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter
org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter] for bean with name 'webscriptAuthenticationFilter' defined in file [/srv/tomcat6/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/ntlm-filter-context.xml]; nested exception is java.lang.ClassNotFoundException: org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter
   at org.springframework.beans.factory.support.AbstractBeanFactory.resolveBeanClass(AbstractBeanFactory.java:1208)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.predictBeanType(AbstractAutowireCapableBeanFactory.java:568)
   at org.springframework.beans.factory.support.AbstractBeanFactory.isFactoryBean(AbstractBeanFactory.java:1277)
   at org.springframework.beans.factory.support.AbstractBeanFactory.isFactoryBean(AbstractBeanFactory.java:844)
   at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:539)
   at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:842)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:416)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:624)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:458)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:440)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:221)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory.getApplicationContext(ChildApplicationContextFactory.java:336)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.getApplicationContext(DefaultChildApplicationContextManager.java:289)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.start(DefaultChildApplicationContextManager.java:248)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:458)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:440)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:221)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager.getInstanceIds(DefaultChildApplicationContextManager.java:145)
   at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:64)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy181.isActive(Unknown Source)
   at org.alfresco.filesys.config.ServerConfigurationBean.processCIFSServerConfig(ServerConfigurationBean.java:170)
   at org.alfresco.filesys.AbstractServerConfigurationBean.init(AbstractServerConfigurationBean.java:469)
   at org.alfresco.filesys.AbstractServerConfigurationBean.onApplicationEvent(AbstractServerConfigurationBean.java:818)
   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:97)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:294)
   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:858)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:419)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:624)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:458)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:386)
   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:97)
   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEvent(SafeApplicationEventMulticaster.java:78)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:294)
   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:858)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:419)
   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:261)
   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:192)
   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)
   at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:63)
   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3934)
   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4429)
   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:526)
   at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:637)
   at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:563)
   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:498)
   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1258)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:321)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
   at org.apache.catalina.core.StandardHost.start(StandardHost.java:722)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
   at org.apache.catalina.core.StandardService.start(StandardService.java:516)
   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
   at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:597)
   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Caused by: java.lang.ClassNotFoundException: org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter
   at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1399)
   at org.apache.catalina.loader.WebappClassLoader.loadClass(WebappClassLoader.java:1245)
   at org.springframework.util.ClassUtils.forName(ClassUtils.java:258)
   at org.springframework.beans.factory.support.AbstractBeanDefinition.resolveBeanClass(AbstractBeanDefinition.java:408)
   at org.springframework.beans.factory.support.AbstractBeanFactory.doResolveBeanClass(AbstractBeanFactory.java:1229)
   at org.springframework.beans.factory.support.AbstractBeanFactory.resolveBeanClass(AbstractBeanFactory.java:1200)
   … 64 more‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Anybody have any idea what might be causing the problem?

Thanks in advance for any help.

Regards

David

[david_labbe]

I also tried to invert the authentication chain as follows:


in [TOMCAT_HOME]/shared/classes/alfresco-global.properties:

authentication.chain=alfrescoNtlm1:alfrescoNtlm, ldap-ad1:ldap-ad, passthru1:passthru‍

but same results…

[dward]

It appears a regression has crept in since the 3.3G community release. The passthru SSO configuration has somehow got out of sync.

I logged and fixed

http://issues.alfresco.com/jira/browse/ALF-3737

I have added a unit test so that this will not be a problem in the future.

So you can either build from the latest code on HEAD or a workaround is to simply copy

$TOMCAT_HOME/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/alfrescoNtlm/ntlm-filter-context.xml to

$TOMCAT_HOME/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/ntlm-filter-context.xml

Thanks.

[david_labbe]

Thanks David, it worked like a charm!

[david_labbe]

Maybe I spoke to quickly…

the fix works in the sense that I do not get the error previously encountered, and my log file does show that the CIFS server is started. However, I cannot access the CIFS shared drive anymore.

This is the error I now get:

17:08:17,857 DEBUG [org.alfresco.fileserver] Open authenticate session to [<myDomain>\<myWorkstation>:<myWorkstationIP>:Online:12,Thu Jul 01 17:08:06 CEST 2010]
17:08:18,063 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=14, auth ctx=[NTLM,Challenge=813badbe08ee5f2e]
17:08:18,092 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
17:08:18,105 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Logon failure‍‍‍‍

Any idea?

Thanks again for the help.

David

[david_labbe]

my bad, I had forgotten to update the file-servers-custom.xml file tom indicate that CIFS authentication was done using passthru:

      <!– CIFS authentication –>
      <!– Available types are 'alfresco', 'passthru' and 'enterprise' –>
      <authenticator type="passthru"/>
      
      <!– CIFS Passthru authentication sample –>
      <!– Also see the <DomainMappings> config in the 'Filesystem Security' section below –>
      <authenticator type="passthru">
        <Server><myDomain>\<myLdapServer></Server>
        <protocolOrder>TCPIP,NetBIOS</protocolOrder>
        <offlineCheckInterval>60</offlineCheckInterval>
      </authenticator>‍‍‍‍‍‍‍‍‍‍‍

Dop!

Thanks

David

[david_labbe]

Strangely enough, I can only access the CIFS "shared drive" if I use the IP address of the CIFS server (i.e. alfresco server). If i use the server name, then I get nowhere. The webclient works however without a glitch with the server name, i.e. : http://<myAflrescoServerName>:8080/alfresco

This was not an issue when I only used the alfrescoNtlm and ldap-ad authentication chain. Adding the passthru seems to have buggered something somewhere…

Any idea?

Cheers

David

[dward]

Why are you using file-servers-custom.xml? This file isn't used in Alfresco v3.2.

The up to date documentation is all here http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems. You shouldn't have to reconfigure the file servers at all for authentication. They now just react to what's in your authentication chain.

I think your log just shows that someone is failing to authenticate.

It may be that Windows has cached an invalid password for you against the alfresco server's real name. Remove any stored crendentials from the Windows Control Panel (its location varies depending on your Windows version so best to google that).

Putting this line in log4j.properties might reveal more information in the logs

log4j.logger.org.alfresco.smb.protocol.auth=debug

Check from a different client computer just to make sure it's nothing to do with one particular client.