Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Hyland Connect
- Enterprise Platforms
- Alfresco
- Alfresco Archive
- FIXED: Labs 3 and LDAP and CIFS authentication AGA...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
FIXED: Labs 3 and LDAP and CIFS authentication AGAIN!
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-17-2009 04:44 PM
Hello
Just newly installed the 3.0.0 version (Stable 1526) and recognized that the ldap authentication together with CIFS authentication is already not working! Regular Login on the web interface and webdav works fine. Does somebody know whats the current state of this CIFS auth problem? Saw a lot of posts regarding similar problem but couldn't find a proper solution yet.
When enabling the debug mode for cifs auth I just getting this messages out (catalina.out):
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N1
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N2
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N3
….
Used the attached ldap-authentication-context.xml file together with the attached file-servers.xml file. Is there something wrong with the configuration or is the old authentication issue already not fixed? I always get a timeout exception on windows or linux client which seems to me that something fails while try to authenticate against the domain controller.
Tried it with 2.1 and it worked fine!
ldap-authentication-context.xml
file-severs.xml
Just newly installed the 3.0.0 version (Stable 1526) and recognized that the ldap authentication together with CIFS authentication is already not working! Regular Login on the web interface and webdav works fine. Does somebody know whats the current state of this CIFS auth problem? Saw a lot of posts regarding similar problem but couldn't find a proper solution yet.
When enabling the debug mode for cifs auth I just getting this messages out (catalina.out):
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N1
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N2
00:20:03,033 DEBUG [smb.protocol.auth] No PassthruDetails for N3
….
Used the attached ldap-authentication-context.xml file together with the attached file-servers.xml file. Is there something wrong with the configuration or is the old authentication issue already not fixed? I always get a timeout exception on windows or linux client which seems to me that something fails while try to authenticate against the domain controller.
Tried it with 2.1 and it worked fine!
ldap-authentication-context.xml
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
<!– The main configuration has moved into a properties file –>
<bean name="ldapAuthenticationPlaceholderConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
<property name="ignoreUnresolvablePlaceholders">
<value>true</value>
</property>
<property name="locations">
<value>classpath:alfresco/extension/ldap-authentication.properties</value>
</property>
</bean>
<!– DAO that rejects changes - LDAP is read only at the moment. It does allow users to be deleted with out warnings from the UI. –>
<bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
<property name="allowDeleteUser">
<value>true</value>
</property>
</bean>
<!– LDAP authentication configuration –>
<!–
You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
authentication routes, like Active Directory.
–>
<bean id="authenticationComponent"
class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl"
parent="authenticationComponentBase">
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="userNameFormat">
<!–
This maps between what the user types in and what is passed through to the underlying LDAP authentication.
"%s" - the user id is passed through without modification.
Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
"cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authenticate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
Usually for simple authentication. Simple authentication always uses the DN for the user.
–>
<value>uid=%s,ou=people,dc=intersoft-networks,dc=ch</value>
</property>
<property name="nodeService">
<ref bean="nodeService" />
</property>
<property name="personService">
<ref bean="personService" />
</property>
<property name="transactionService">
<ref bean="transactionService" />
</property>
<property name="escapeCommasInBind">
<value>false</value>
</property>
<property name="escapeCommasInUid">
<value>false</value>
</property>
</bean>
<!–
This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
to pull them out of the LDAP reopsitory
–>
<bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
<property name="initialDirContextEnvironment">
<map>
<!– The LDAP provider –>
<entry key="java.naming.factory.initial">
<value>${ldap.authentication.java.naming.factory.initial}</value>
</entry>
<!– The url to the LDAP server –>
<!– Note you can use space separated urls - they will be tried in turn until one works –>
<!– This could be used to authenticate against one or more ldap servers (you will not know which one ….) –>
<entry key="java.naming.provider.url">
<value>ldap://192.168.1.20:389</value>
</entry>
<!– The authentication mechanism to use –>
<!– Some sasl authentication mechanisms may require a realm to be set –>
<!– java.naming.security.sasl.realm –>
<!– The available options will depend on your LDAP provider –>
<entry key="java.naming.security.authentication">
<value>simple</value>
</entry>
<!– The id of a user who can read group and user information –>
<!– This does not go through the pattern substitution defined above and is used "as is" –>
<entry key="java.naming.security.principal">
<value>cn=config</value>
</entry>
<!– The password for the user defined above –>
<entry key="java.naming.security.credentials">
<value>[PASSWORD]</value>
</entry>
</map>
</property>
</bean>
<bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
<!–
The query to select objects that represent the users to import. For Active Directory: (objectclass=user)
–>
<property name="personQuery">
<value>(objectclass=zimbraAccount)</value>
</property>
<!–
The search base restricts the LDAP query to a sub section of tree on the LDAP server.
In this particular example we imported only the IT Department users.
–>
<property name="searchBase">
<value>dc=intersoft-networks,dc=ch</value>
</property>
<!–
The unique identifier for the user.THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT
For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"
In Active Directory this is most likely to be "sAMAccountName". This property is mandatory and must
appear on all users found by the query defined above.
–>
<property name="userIdAttributeName">
<value>uid</value>
</property>
<!– Services –>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory" />
</property>
<property name="personService">
<ref bean="personService"></ref>
</property>
<property name="namespaceService">
<ref bean="namespaceService" />
</property>
<!–
This property defines a mapping between attributes held on LDAP user objects and the properties of user
objects held in the repository. The key is the QName of an attribute in the repository, the value is the
attribute name from the user/ inetOrgPerson/.. object in the LDAP repository.
–>
<property name="attributeMapping">
<map>
<entry key="cm:userName">
<!– Must match the same attribute as userIdAttributeName –>
<value>uid</value>
</entry>
<entry key="cm:firstName">
<!– Active Directory: "givenName" –>
<value>givenName</value>
</entry>
<entry key="cm:lastName">
<!– Active Directory: "sn" –>
<value>sn</value>
</entry>
<entry key="cm:email">
<!– Active Directory: "???" –>
<value>zimbraMailAlias</value>
</entry>
<entry key="cm:organizationId">
<!– Active Directory: "???" –>
<value>company</value>
</entry>
<!– Always use the default –>
<entry key="cm:homeFolderProvider">
<value>userHomesHomeFolderProvider</value>
</entry>
</map>
</property>
<!– Set a default home folder provider. We configured it to create user home folder under "User Homes" space–>
<property name="attributeDefaults">
<map>
<entry key="cm:homeFolderProvider">
<value>userHomesHomeFolderProvider</value>
</entry>
</map>
</property>
</bean>
<bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
<!– The query to select objects that represent the groups to import. For Active Directory: (objectclass=group) –>
<property name="groupQuery">
<value>(objectclass=posixGroup)</value>
</property>
<!– The seach base restricts the LDAP query to a sub section of tree on the LDAP server. We reduced it to IT departments internal groups –>
<property name="searchBase">
<value>dc=intersoft-networks,dc=ch</value>
</property>
<!– The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above. –>
<property name="userIdAttributeName">
<value>sAMAccountName</value>
</property>
<!– An attribute that is a unique identifier for each group found. This is also the name of the group with the current group implementation.This is mandatory for any groups found. Active Directory: "cn" –>
<property name="groupIdAttributeName">
<value>cn</value>
</property>
<!– The objectClass attribute for group members. For each member of a group, the distinguished name is given.The object is looked up by its DN. If the object is of this class it is treated as a group. –>
<property name="groupType">
<value>memberUid</value>
</property>
<!– The objectClass attribute for person members.For each member of a group, the distinguished name is given.The object is looked up by its DN. If the object is of this class it is treated as a person –>
<property name="personType">
<value>memberUid</value>
</property>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory" />
</property>
<property name="namespaceService">
<ref bean="namespaceService" />
</property>
<!–
The repeating attribute on group objects (found by query or as sub groups) used to define membership of
the group. This is assumed to hold distinguished names oF other groups or users/people; the above types are
used to determine this.
Active Directory: "member" –>
<property name="memberAttribute">
<value>memberUid</value>
</property>
<property name="authorityDAO">
<ref bean="authorityDAO" />
</property>
</bean>
<bean id="ldapPeopleTrigger" class="org.alfresco.util.TriggerBean">
<property name="jobDetail">
<bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapPeopleImport" />
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 5 minutes of starting the repository –>
<property name="startDelay">
<value>180</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<value>360000</value>
</property>
<property name="scheduler">
<ref bean="schedulerFactory" />
</property>
</bean>
<bean id="ldapGroupTrigger" class="org.alfresco.util.TriggerBean">
<property name="jobDetail">
<bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapGroupImport" />
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 5 minutes of starting the repository –>
<property name="startDelay">
<value>18000</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<value>3600000</value>
</property>
<property name="scheduler">
<ref bean="schedulerFactory" />
</property>
</bean>
<!– The bean that imports xml describing people –>
<bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponentWithBehaviour" />
</property>
<property name="transactionService">
<ref bean="transactionComponent" />
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent" />
</property>
<property name="exportSource">
<ref bean="ldapPeopleExportSource" />
</property>
<!– The store that contains people - this should not be changed –>
<property name="storeRef">
<value>${spaces.store}</value>
</property>
<!– The location of people nodes within the store defined above - this should not be changed –>
<property name="path">
<value>/${system.system_container.childname}/${system.people_container.childname}</value>
</property>
<!– If true, clear all existing people before import, if false update/add people from the xml –>
<property name="clearAllChildren">
<value>false</value>
</property>
<property name="nodeService">
<ref bean="nodeService" />
</property>
<property name="searchService">
<ref bean="searchService" />
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService" />
</property>
<property name="caches">
<set>
<ref bean="permissionsAccessCache" />
</set>
</property>
</bean>
<!– The bean that imports xml descibing groups –>
<bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponentWithBehaviour" />
</property>
<property name="transactionService">
<ref bean="transactionComponent" />
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent" />
</property>
<property name="exportSource">
<ref bean="ldapGroupExportSource" />
</property>
<!– The store that contains group information - this should not be changed –>
<property name="storeRef">
<value>${alfresco_user_store.store}</value>
</property>
<!– The location of group information in the store above - this should not be changed –>
<property name="path">
<value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>
</property>
<!– If true, clear all existing groups before import, if false update/add groups from the xml –>
<property name="clearAllChildren">
<value>false</value>
</property>
<property name="nodeService">
<ref bean="nodeService" />
</property>
<property name="searchService">
<ref bean="searchService" />
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService" />
</property>
<!– caches to clear on import of groups –>
<property name="caches">
<set>
<ref bean="userToAuthorityCache" />
<ref bean="permissionsAccessCache" />
</set>
</property>
<!– userToAuthorityCache –>
</bean>
</beans>
file-severs.xml
<alfresco-config area="file-servers">
<config evaluator="string-compare" condition="CIFS Server">
<serverEnable enabled="true"/>
<host name="TIBERIAS" domain="ISN.CH"/>
<comment>Alfresco CIFS Server</comment>
<!– Set to the broadcast mask for the subnet –>
<broadcast>192.168.1.255</broadcast>
<bindto>192.168.1.30</bindto>
<!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
<tcpipSMB platforms="linux,solaris,macosx"/>
<netBIOSSMB platforms="linux,solaris,macosx"/>
<!– Can be mapped to non-privileged ports, then use firewall rules to forward
requests from the standard ports –>
<!–
<tcpipSMB port="1445" platforms="linux,solaris,macosx"/>
<netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>
–>
<hostAnnounce interval="5"/>
<!– Use Win32 NetBIOS interface on Windows –>
<Win32NetBIOS/>
<Win32Announce interval="5"/>
<!– CIFS authentication –>
<!–
<authenticator type="alfresco">
</authenticator>
–>
<authenticator type="enterprise"></authenticator>
<!–
<authenticator type="passthru">
<Server>192.168.1.10</Server>
</authenticator>
–>
<!–
<authenticator type="enterprise">
</authenticator>
–>
<WINS>
<primary>192.168.1.10</primary>
<secondary>192.168.1.10</secondary>
</WINS>
<sessionDebug flags="Negotiate,Socket"/>
</config>
<config evaluator="string-compare" condition="FTP Server">
<serverEnable enabled="true"/>
<bindto>192.168.1.30</bindto>
<!– Run on a non-privileged port –>
<!–
<port>1121</port>
–>
<!– FTP authentication –>
–> <!– <authenticator type="alfresco"/>
<authenticator type="passthru">
<Server>192.168.1.10</Server>
</authenticator>
<!– <debug flags="File,Search,Error,Directory,Info,DataPort"/> –>
</config>
<config evaluator="string-compare" condition="NFS Server">
<serverEnable enabled="false"/>
</config>
<config evaluator="string-compare" condition="Filesystems">
<filesystems>
<!– Alfresco repository access shared filesystem –>
<filesystem name="Alfresco">
<store>workspace://SpacesStore</store>
<rootPath>/app:company_home</rootPath>
<!– Add a URL file to each folder that links back to the web client –>
<urlFile>
<filename>__AlfrescoClient.url</filename>
<webpath>http://${localname}:8080/alfresco/</webpath>
</urlFile>
<!– Mark locked files as offline –>
<offlineFiles/>
<!– Desktop actions –>
<!– Uses a client-side application to trigger a server-side action –>
<!– Echo - displays a message echoed from the server –>
<!– URL - launches a URL via the Windows shell –>
<!– CmdLine - launches the Notepad application –>
<!– CheckInOut - checks files in/out, drag and drop files onto the application –>
<!– JavaScript - run a server-side script –>
<!– JavaScriptURL - server-side script that generates a URL to the folder using a ticket –>
<!– to avoid having to logon –>
<!–
<desktopActions>
<global>
<path>alfresco/desktop/Alfresco.exe</path>
<webpath>http://${localname}:8080/alfresco/</webpath>
</global>
<action>
<class>org.alfresco.filesys.repo.desk.EchoDesktopAction</class>
<name>Echo</name>
<filename>__AlfrescoEcho.exe</filename>
</action>
<action>
<class>org.alfresco.filesys.repo.desk.URLDesktopAction</class>
<name>URL</name>
<filename>__AlfrescoURL.exe</filename>
</action>
<action>
<class>org.alfresco.filesys.repo.desk.CmdLineDesktopAction</class>
<name>CmdLine</name>
<filename>__AlfrescoCmd.exe</filename>
</action>
<action>
<class>org.alfresco.filesys.repo.desk.CheckInOutDesktopAction</class>
<name>CheckInOut</name>
<filename>__AlfrescoCheckInOut.exe</filename>
</action>
<action>
<class>org.alfresco.filesys.repo.desk.JavaScriptDesktopAction</class>
<name>JavaScript</name>
<filename>__AlfrescoScript.exe</filename>
<script>alfresco/desktop/dumpRequest.js</script>
<attributes>anyFiles, multiplePaths , allowNoParams</attributes>
<preprocess>confirm, copyToTarget</preprocess>
</action>
<action>
<class>org.alfresco.filesys.repo.desk.JavaScriptDesktopAction</class>
<name>JavaScriptURL</name>
<filename>__AlfrescoDetails.exe</filename>
<script>alfresco/desktop/showDetails.js</script>
<attributes>anyFiles</attributes>
<preprocess>copyToTarget</preprocess>
</action>
</desktopActions>
–>
<!–
<accessControl default="Write">
<user name="admin" access="Write"/>
<address subnet="90.1.0.0" mask="255.255.0.0" access="Write"/>
</accessControl>
–>
</filesystem>
<!– AVM virtualization view of all stores/versions for WCM –>
<!– virtual view can be any of the following: normal, site, staging, author, preview –>
<avmfilesystem name="AVM">
<virtualView stores="site,staging,author" />
</avmfilesystem>
</filesystems>
</config>
<config evaluator="string-compare" condition="Filesystem Security">
<authenticator type="passthru">
<Server>192.168.1.30</Server>
</authenticator>
<!– Domain mappings used for passthri authentication routing –>
<!–
<authenticator type="alfresco">
</authenticator>
–>
<DomainMappings>
<Domain name="ISN.CH" subnet="192.168.1.0" mask="192.168.1.255"/>
</DomainMappings>
<!– Custom share mapper when multi-tenancy is enabled –>
<!–
<shareMapper type="multi-tenant">
<debug/>
</shareMapper>
–>
<!–
<globalAccessControl default="None">
<user name="admin" access="Write"/>
<address ip="90.1.0.90" access="Write"/>
</globalAccessControl>
–>
</config>
</alfresco-config>
Labels:
- Labels:
-
Archive
1 REPLY 1
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
02-17-2009 05:49 PM
Hello
At last I got it working, after long reading many documents. Found the solution on:
https://issues.alfresco.com/jira/browse/ALFCOM-2165
May it possible that this informations flow into the community documentation in the wiki please?
Thanks
At last I got it working, after long reading many documents. Found the solution on:
https://issues.alfresco.com/jira/browse/ALFCOM-2165
May it possible that this informations flow into the community documentation in the wiki please?
Thanks
Related Content
- How to call Alfresco REST APIs using OAuth instead of Basic Auth? in Alfresco Forum
- Authentication from Java Rest APi extension project in Alfresco Forum
- Alfresco Community Edition 23.4 Release Notes in Alfresco Blog
- How to authenticate at API in Alfresco 23.2.0 Comminity addition in Alfresco Forum
- ldapS configuration for samba-ad in Alfresco Forum
Getting started
Tags
Find what you came for
We want to make your experience in Hyland Connect as valuable as possible, so we put together some helpful links.
