SSO with Kerberos - non SSO users login problem

[jacobp]

Hi everyone,

I have problem with Alfresco SSO using Kerberos. I managed to configure Kerberos and it works successfully. Users inside ActiveDirectory domain can use Share and Alfresco without the need for log in.

Problem I have is that non SSO users (computer with account that is not in domain) have problem logging in. Once user tries to open http://server/share/ he gets browser credential prompt which does not work no matter what username and password you enter (even admin). Users have to click cancel on that credential prompt and then they are redirected to share log in page where they can successfully log in.

How can non SSO users be redirected to login screen without unnecessary credential prompt.

Thank you in advance.

[afaust]

Hello,

it is a bit hard for Alfresco to guess which client can sign in with SSO and which cannot. It is advisable that non-SSO-capable users be provided with a direct link to the login page which prevents a popup. But if you want to have a single go-to address / link, you are out of luck - either SSO is attempted or not, either way you have problems with a part of your user base.

Regards
Axel

[jacobp]

Thank you for your reply.

So you want to say that there is no way for Alfresco to redirect user to form based authentication after failed SSO without unnecessary credential request.
If that is the case I'm not sure why is there redirect at all because it is not functional. Users don't expect to press cancel when they are asked for credentials so in the end they will never get to the form authentication.

[loftux]

The pop-up is Internet Explorer specific, if you use another browser like Firefox where SSO fails the failover is to the correct login form. If I remember correctly.

I'm not sure if this is some IE implementation you cannot workaround or if it is Alfresco implementation that needs a fix. Try filing an issue at https://issues.alfresco.com/.

[afaust]

In this case, it is Internet Explorer specific - Alfresco already provides as much info to the browser as possible to behave correctly.
Whenever Internet Explorer is related to a problem, in 80 % of the cases, it is the Internet Explorer which messes up… Just my experience.

[haa05]

Hi Jacob,

did you ever find a solution to avoid this unwanted authentication popup in IE?
We are faced with the same problem.

Thanks!
Arno