I got authentication with Active Directory working

[jmeehan]

Desktop Actions didn't work in Labs 3 B on Linux or Windows, so I installed Community 2.1 on a CentOS 4.6 Linux server.

I got it working by following the JAAS section of the Enterprise Security and Authentication Configuration WIKI, and configuring the CIFS passthru authenticator described in the CIFS Server Authentication WIKI (The only option I use is the Server option).

LDAP isn't a good solution becuase you can't use your normal account name…you have to use a distinguished name (DN).

NTLM worked Ok for the web interface, but I couldn't get it to work with CIFS (JLAN-46?).

The problem with the Configuring the CIFS and web servers for Kerberos/AD integration WIKI is:

1. The keytab is optional and over-complicates things
2. The Kerberos authentication web filter, in web.xml, is not available in Community 2.1

[aususer]

Can you post your configs… I am having issues getting Kerberos working with AD.
I have plenty of experiance in the [not working] passthru method for CIFS in Labs 3b and 3c…
so keen to see how you got it to work.

[jmeehan]

[size=150]From the JAAS section of the Enterprise Security and Authentication Configuration WIKI[/size]
tomcat/shared/classes/alfresco/extension/jaas-authentication-context.xml:

<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'><beans>    <!– The authentication component.                                      –>    <!– Jass authentication - most of the config goes somewhere else       –>           <bean id="authenticationComponent"                  class="org.alfresco.repo.security.authentication.jaas.JAASAuthenticationComponent">        <property name="realm">            <value>AMALFI.LG.COM</value>        </property>        <property name="jaasConfigEntryName">            <value>Alfresco</value>        </property>    </bean>    <!– DAO that rejects changes - JAAS is read only at the moment.      –>    <!– It does allow users to be deleted with out warnings from the UI. –>    <!– The user is still present in JAAS, only the personal information is removed from alfresco. –>         <bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >        <property name="allowDeleteUser">            <value>true</value>        </property>    </bean>    </beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

/usr/java/jdk1.5.0_04/jre/lib/security/java.security:

…## Default login configuration file##login.config.url.1=file:${user.home}/.java.login.configlogin.config.url.1=file:${java.home}/lib/security/java.login.config…‍‍‍‍‍‍‍

/usr/java/jdk1.5.0_04/jre/lib/security/java.login.config:

Alfresco {   com.sun.security.auth.module.Krb5LoginModule sufficient;};‍‍‍‍

/etc/krb5.conf (I already had Kerberos working on this server before I knew what Alfresco was):

[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log[kdc] profile = /var/kerberos/krb5kdc/kdc.conf[appdefaults] pam = {   debug = false   ticket_lifetime = 36000   renew_lifetime = 36000   forwardable = true   krb4_convert = false }[libdefaults]   ticket_lifetime = 24000   default_realm = AMALFI.LG.COM   dns_lookup_realm = false   dns_lookup_kdc = false   default_tkt_enctypes = des-cbc-md5 des-cbc-crc   default_tgs_enctypes = des-cbc-md5 des-cbc-crc [realms]   AMALFI.LG.COM = {      kdc = srv-lg3.amalfi.lg.com:88      kdc = ssvrc14.amalfi.lg.com:88     admin_server = srv-lg3.amalfi.lg.com:749     kpasswd_server = srv-lg3.amalfi.lg.com:464     kpasswd_protocol = SET_CHANGE     default_domain = amalfi.lg.com     } [domain_realm]     .amalfi.lg.com = AMALFI.LG.COM     amalfi.lg.com = AMALFI.LG.COM‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[size=150]From the CIFS Server Authentication WIKI[/size]
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/file-servers.xml:

<alfresco-config area="file-servers">   <config evaluator="string-compare" condition="CIFS Server">          <serverEnable enabled="true"/>      <host name="${localname}" domain="amalfilg"/>      <comment>Alfresco CIFS Server</comment>      <!– Set to the broadcast mask for the subnet –>      <broadcast>255.255.255.255</broadcast>      <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>      <tcpipSMB platforms="linux,solaris,macosx"/>      <netBIOSSMB platforms="linux,solaris,macosx"/>           <!– Can be mapped to non-privileged ports, then use firewall rules to forward                    requests from the standard ports –>          <!–           <tcpipSMB port="1445" platforms="linux,solaris,macosx"/>      <netBIOSSMB sessionPort="1139" namePort="1137" datagramPort="1138" platforms="linux,solaris,macosx"/>          –><!–              <hostAnnounce interval="5"/>–>      <!– Use Win32 NetBIOS interface on Windows –>      <Win32NetBIOS/>      <Win32Announce interval="5"/><!–      <WINS>         <primary>1.2.3.4</primary>         <secondary>5.6.7.8</secondary>      </WINS>–>      <sessionDebug flags="Negotiate,Socket"/>   </config>   <config evaluator="string-compare" condition="FTP Server">          <serverEnable enabled="true"/><!–      <debug flags="File,Search,Error,Directory,Info,DataPort"/> –>   </config>      <config evaluator="string-compare" condition="NFS Server">          <serverEnable enabled="false"/>   </config>   <config evaluator="string-compare" condition="Filesystems">          <filesystems>                                   <!– Alfresco repository access shared filesystem –>         <filesystem name="Alfresco">            <store>workspace://SpacesStore</store>            <rootPath>/app:company_home</rootPath>                        <!– Add a URL file to each folder that links back to the web client –>                        <urlFile>               <filename>__AlfrescoClient.url</filename>               <webpath>http://${localname}:8080/alfresco/</webpath>            </urlFile>                        <!– Mark locked files as offline –>                     <offlineFiles/>                        <!– Desktop actions –>                        <!– Uses a client-side application to trigger a server-side action                         –>                        <!–   Echo - displays a message echoed from the server                                     –>                        <!–   URL  - launches a URL via the Windows shell                                          –>                        <!–   CmdLine - launches the Notepad application                                           –>                        <!–   CheckInOut - checks files in/out, drag and drop files onto the application           –>                        <!–   JavaScript - run a server-side script                                                –>                        <!–   JavaScriptURL - server-side script that generates a URL to the folder using a ticket –>                        <!–                   to avoid having to logon                                             –><!–                        <desktopActions>                                <global>                    <path>alfresco/desktop/Alfresco.exe</path>                                        <webpath>http://${localname}:8080/alfresco/</webpath>                                </global>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.EchoDesktopAction</class>                                        <name>Echo</name>                                <filename>__AlfrescoEcho.exe</filename>                                </action>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.URLDesktopAction</class>                                        <name>URL</name>                                <filename>__AlfrescoURL.exe</filename>                                </action>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.CmdLineDesktopAction</class>                                        <name>CmdLine</name>                                <filename>__AlfrescoCmd.exe</filename>                                </action>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.CheckInOutDesktopAction</class>                                        <name>CheckInOut</name>                                <filename>__AlfrescoCheckInOut.exe</filename>                                </action>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.JavaScriptDesktopAction</class>                                        <name>JavaScript</name>                                        <filename>__AlfrescoScript.exe</filename>                                        <script>alfresco/desktop/dumpRequest.js</script>                                        <attributes>anyFiles, multiplePaths , allowNoParams</attributes>                                        <preprocess>confirm, copyToTarget</preprocess>                                </action>                                <action>                                        <class>org.alfresco.filesys.smb.server.repo.desk.JavaScriptDesktopAction</class>                                        <name>JavaScriptURL</name>                                        <filename>__AlfrescoDetails.exe</filename>                                        <script>alfresco/desktop/showDetails.js</script>                                        <attributes>anyFiles</attributes>                                        <preprocess>copyToTarget</preprocess>                                </action>                        </desktopActions>–>                                                                       <!–            <accessControl default="Write">               <user name="admin" access="Write"/>               <address subnet="90.1.0.0" mask="255.255.0.0" access="Write"/>            </accessControl>–>         </filesystem>                                   <!– AVM virtualization view of all stores/versions for WCM –>         <avmfilesystem name="AVM">            <virtualView/>         </avmfilesystem>                        </filesystems>   </config>   <config evaluator="string-compare" condition="Filesystem Security">      <authenticator type="passthru">          <Server>ssvrc14,srv-lg3</Server>      </authenticator><!–      <globalAccessControl default="None">         <user name="admin" access="Write"/>         <address ip="90.1.0.90" access="Write"/>      </globalAccessControl>      <users>         <localuser name="user">            <password>user</password>            <comment>Normal user account</comment>         </localuser>         <localuser name="administrator">            <password>admin</password>            <administrator/>            <comment>Administrator account</comment>         </localuser>      </users>–>   </config></alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[meansartin14]

jmeehan - So, if I understand correctly, you now have Alfresco Community Labs 2.1 running on a CentOS 4.6 Linux server, authenticating via Kerberos against an Active Directory server for BOTH CIFS AND the Web UI?

And you accomplished this by following the directions in the JAAS section of the Enterprise Security and Authentication Wiki for the Web UI configuration and the directions in the CIFS Server Authentication Wiki for the CIFS server configuration?

Had you tried these exact same configurations with Alfresco Community Labs 3c?

[jmeehan]

Yes, Community 2.1 (Not Labs), CentOS4.6, Kerberos authentication via AD for both CIFS and Web UI.

We're using Community 2.1 since desktop actions didn't work in Labs 3 B.

I haven't tried the same configuration for Labs 3 B. If you try, and it doesn't work, you may try using the Kerberos authentication web filter, in web.xml, from 'Configuring the CIFS and web servers for Kerberos/AD integration', which is not available in Community 2.1.

[meansartin14]

I have started a thread that I hope to eventually turn into a AlfrescoWiki page for how to configure Active Directory authentication for both CIFS and the Web Interface in Alfresco Labs 3c.

Please see my thread:
[ERROR]Alfresco Engineers: CIFS auth does not work. Sugg?

Please come join in the discussion, or at least subscribe to the thread. I want to try to get everyone having these types of issues into the thread so that we can get a large collection of experiences and configurations.

We WILL find the answer for how to enable Active Directory authentication with CIFS in Alfresco!!