How to force Alfresco to use SPNEGO? (no Kerberos involved)

[nicolasraoul]

Hello all,

How can I force Alfresco to use SPNEGO?

I use Alfresco Enterprise 3.1 with its default <authenticator type="enterprise"/>
Wireshark shows that all SMB packets (from client and from server) contain a "Security blob" that contains an "NTLMSSP" block of data.
I have never managed to see any SPNEGO or GSS-API stuff in the packets using Alfresco.
Maybe because I am not using Kerberos?
Is there a way to force Alfresco to use SPNEGO even though there is no Kerberos involved?


————————————————————–
Before someone asks, here is why I want this:

I am facing the following bug:
- User logs into Windows
- User opens Internet Explorer 8 on Alfresco's Web Client
- User logs into Alfresco (not the same username as Windows)
- User clicks on any file's "View in CIFS"
- A connection error appears.
Reproducible 90% of the time. The important thing is that the share is not already mounted when the user clicks.

If I replace Alfresco with Samba, it works.
But if I configure Samba to "use spnego=no", the same error appears.

So I guess this bug appears when *not* using SPNEGO.
More on this bug: https://issues.alfresco.com/jira/browse/ALFCOM-3616

Thank you very much!
Nicolas Raoul

[nicolasraoul]

In EnterpriseCifsAuthenticator.java I have found what a piece of code that suggests there is such a possibility:

// Check if raw NTLMSSP or SPNEGO/NTLMSSP should be used
ConfigElement useSpnego = params.getChild("useSPNEGO");
if ( useSpnego != null) {
‍‍‍‍‍

But a Google search for Alfresco useSpnego only returns this source file… does not look like a popular configuration element!
If anyone has more information, it would be greatly appreciated 🙂

Cheers,
Nicolas Raoul

[nicolasraoul]

For anyone who would need it, here is how to force Alfreco to use SPNEGO:

<authenticator type="enterprise">
          <useSPNEGO/>
</authenticator>
‍‍‍‍‍

Hope this helps someone in the future,
Nicolas Raoul.