Hyland Connect

pacco_robin · ‎04-28-2014

Hi,

I followed some instructions to run the Sharepoint protcol with SSL on port 7070.

First changed vti-context.xml to use SSL, then added this to vti.properties:
vti.server.port=7070
vti.server.protocol=https
vti.server.ssl.keystore=/opt/alfresco-4.2.f/alf_data/keystore/ssl.keystore
vti.server.ssl.password=kT9X6oe68t
vti.server.url.path.prefix=/alfresco
vti.server.external.host=[hostname]
vti.server.external.port=7070
vti.server.external.protocol=https
vti.server.external.contextPath=/alfresco

Now I do get SSL, but as it is a self signed certificate I always get some warnings before I can open a document.
Also I see these info messages in catalina.out:
2014-04-28 13:36:38,268 INFO [vti.web.VtiRequestDispatcher] [1880889499@qtp-1454731198-0] Note - no handler was found for OPTIONS to uri='/zandbak/documentLibrary/'
2014-04-28 13:36:41,471 INFO [vti.web.VtiRequestDispatcher] [1880889499@qtp-1454731198-0] Note - no handler was found for HEAD to uri='/zandbak/documentLibrary/Zandbak.docx'
2014-04-28 13:36:44,200 INFO [vti.web.VtiRequestDispatcher] [780995441@qtp-1454731198-2] Note - no handler was found for GET to uri='/zandbak/documentLibrary/Zandbak.docx'
2014-04-28 13:36:53,006 INFO [vti.web.VtiRequestDispatcher] [780995441@qtp-1454731198-2] Note - no handler was found for GET to uri='/zandbak/documentLibrary/Zandbak.docx'

On this server I already installed a 3rd party certificate for Alfresco https traffic using the Apache mod.

Is it possible to use this 3rd party certificate for the Sharepoint protocol and how do I manage that?
Are the INFO messages in catalina.out important?

Thanks for your input.

Regards,

Frank

eswbitto · ‎04-29-2014

Take a look at this thread HERE

pacco_robin · ‎05-01-2014

That didn't work.
I get errors from Apache that RequestHeader is misspelled.

I am using Apache and mod_jk.

HTTPS for Alfresco is working fine and certificate looks ok.

This is my config in 000-default.conf:
<VirtualHost *:443>
 ServerName x.y.com
 SSLEngine On
 SSLCertificateFile /etc/ssl/certs/certificate.crt
 SSLCertificateKeyFile /etc/ssl/private/key.key
 SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt
 SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt
 <Location />
 SSLRequireSSL On
 SSLVerifyClient optional
 SSLRenegBufferSize 104860000
 SSLVerifyDepth 1
 SSLOptions +StdEnvVars +StrictRequire
 </Location>
 # Send everything for the context / to worker named worker1 via ajp13
 JkMount /* ajp13_worker
</VirtualHost>

Regards,

Frank

eswbitto · ‎05-02-2014

You should be able to use sharepoint/webdav with the SSL working. What distro are you using? Also, What does your virtual host look like? Did you make sure to add the Listen (port) in your ssl.conf?

pacco_robin · ‎05-06-2014

We use Ubuntu 12.04LTS.
I followed these steps: https://forums.alfresco.com/comment/145306#comment-145306
When I add the virtual host VirtualHost *:1111 I get the Apache errors.
You can check my virtual host in my previous reply.

Kind regards,
Frank

eswbitto · ‎05-06-2014

The logs that you initially posted won't point to a particular issue for this connection problem. I get the same logs and I have SSL working. I think it is part of a different issue. What does your apache logs say when trying to connect?

Question: Did you actually use the port 1111 as in the example or the default?

pacco_robin · ‎05-08-2014

<body>
I retried with a new approach! Let me explain the steps I take.
Previously I installed Apache, mod_jk and mod_ssl to make SSL work with Alfresco. 
This is explained here: http://forums.alfresco.com/forum/installation-upgrades-configuration-integration/configuration/chang...
These setup works perfectly. I can connect to https://alfrescoserver.ourdomain.com and I can see my third party certificate.
Now I wanted to setup this certificate for Sharepoint communication.
1. I opened port 1111 in ufw. 
sudo ufw allow 1111 
I get some warnings: 
WARN: Duplicate profile 'Apache', using last found 
WARN: Duplicate profile 'Apache Secure', using last found 
WARN: Duplicate profile 'Apache Full', using last found 
Rule added 
Rule added (v6) 
But when I check the status, port 1111 is added.
2. I change the vti.properties at this location: /opt/alfresco-4.2.f/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/module/org.alfresco.module.vti/context
Here I have: 
vti.server.port=7070 
vti.server.protocol=https 
vti.server.ssl.keystore=/opt/alfresco-4.2.f/alf_data/keystore/ssl.keystore 
vti.server.ssl.password=kT9X6oe68t 
vti.server.url.path.prefix=/alfresco 
vti.server.external.host=alfrescoserver.ourdomain.com 
vti.server.external.port=7070 
vti.server.external.protocol=https 
vti.server.external.contextPath=/alfresco
I changed this: 
vti.server.external.host=alfrescoserver.ourdomain.com 
vti.server.external.port=1111 
vti.server.external.protocol=https
3. I added virtualhost *:1111 in 000-default.conf at this location: /etc/apache2/sites-available
<VirtualHost *:1111> 
ServerName alfrescoserver.ourdomain.com 
SSLEngine On 
SSLCertificateFile /etc/ssl/certs/alfrescoserver.ourdomain.com.crt 
SSLCertificateKeyFile /etc/ssl/private/alfrescoserver.ourdomain.com.key 
SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt 
SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt 
<Location /> 
SSLRequireSSL On 
SSLVerifyClient optional 
SSLRenegBufferSize 104860000 
SSLVerifyDepth 1 
SSLOptions +StdEnvVars +StrictRequire 
</Location> 
# Send everything for the context / to worker named worker1 via ajp13 
JkMount /* ajp13_worker 
</VirtualHost>
VirtualHost *:1111 now looks exactly the same as VirtualHost *:443
4. I changed vti-context.xml at this location: /opt/alfresco-4.2.f/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/module/org.alfresco.module.vti/context
 <!– Use this Connector for plain text (non-SSL) communications –> 
<!– 
<bean id="vtiServerConnector" class="org.mortbay.jetty.bio.SocketConnector"> 
<property name="port"> 
<value>${vti.server.port}</value> 
</property> 
<property name="headerBufferSize"> 
<value>32768</value> 
</property> 
</bean> 
–>
 <!– Use this Connector instead for SSL communications –> 
<!– You will need to set the location of the KeyStore holding your –> 
<!– server certificate, along with the KeyStore password –> 
<!– You should also update the vti.server.protocol property to https –>
 <bean id="vtiServerConnector" class="org.mortbay.jetty.security.SslSocketConnector"> 
<property name="port"> 
<value>${vti.server.port}</value> 
</property> 
<property name="headerBufferSize"> 
<value>32768</value> 
</property> 
<property name="maxIdleTime"> 
<value>30000</value> 
</property> 
<property name="keystore"> 
<value>${vti.server.ssl.keystore}</value> 
</property> 
<property name="keyPassword"> 
<value>${vti.server.ssl.password}</value> 
</property> 
<property name="password"> 
<value>${vti.server.ssl.password}</value> 
</property> 
<property name="keystoreType"> 
<value>JCEKS</value> 
</property> 
</bean>
I commented out non-SSL communication and uncommented SSL communication.
5. I changed ports.conf at this location: /etc/apache2
<IfModule ssl_module> 
Listen 443 
Listen 1111 
</IfModule>
<IfModule mod_gnutls.c> 
Listen 443 
Listen 1111 
</IfModule>
6. I restarted the Alfresco server
When I try to edit a document online Word starts up, but I only see a message about Word contacting the server and then Word opens without any document.
</body>

pacco_robin · ‎05-08-2014

<body>
When I put in this virtualhost I get this error trying to restart Apache. 
 
<VirtualHost *:1111> 
ServerName alfrescoserver.ourdomain.com 
SSLEngine On 
SSLCertificateFile /etc/ssl/certs/alfrescoserver.ourdomain.com.crt 
SSLCertificateKeyFile /etc/ssl/private/alfrescoserver.ourdomain.com.key 
SSLCertificateChainFile /etc/ssl/certs/AddTrustExternalCARoot.crt 
SSLCertificateChainFile /etc/ssl/certs/PositiveSSLCA2.crt 
RequestHeader set X-Forwarded-Proto "https" 
ProxyPass / ajp://127.0.0.1:7070/ 
ProxyPassReverse / ajp:127.0.0.1:7070/ 
ProxyTimeout 300 
SSLProxyEngine on
 <Proxy *> 
Allow from all 
</Proxy> 
</VirtualHost>
 Error is: 
 
* Starting web server apache2 * 
* The apache2 configtest failed. 
Output of config test was: 
AH00526: Syntax error on line 69 of /etc/apache2/sites-enabled/000-default.conf: 
Invalid command 'RequestHeader', perhaps misspelled or defined by a module not i ncluded in the server configuration 
Action 'configtest' failed. 
The Apache error log may have more information. 
 
There is no information in the error log.
 

</body>

eswbitto · ‎05-08-2014

DO you have this as a module to load in your apache config?


headers_module modules/mod_headers.so
‍‍‍

It sounds like you don't have the module installed.

Also your vti-context.xml file should look like this.


<!–
    <bean id="vtiServerConnector" class="org.mortbay.jetty.bio.SocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>32768</value>
        </property>
    </bean>
–>

    <bean id="vtiServerConnector" class="org.mortbay.jetty.ajp.Ajp13SocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>8192</value>
        </property>
    </bean>



    <!– Use this Connector instead for SSL communications –>
    <!– You will need to set the location of the KeyStore holding your –>
    <!–  server certificate, along with the KeyStore password –>
    <!– You should also update the vti.server.protocol property to https –>
<!–
    <bean id="vtiServerConnector" class="org.mortbay.jetty.security.SslSocketConnector">
        <property name="port">
             <value>${vti.server.port}</value>
        </property>
        <property name="headerBufferSize">
             <value>32768</value>
        </property>
        <property name="maxIdleTime">
             <value>30000</value>
        </property>
        <property name="keystore">
             <value>${vti.server.ssl.keystore}</value>
        </property>
        <property name="keyPassword">
             <value>${vti.server.ssl.password}</value>
        </property>
        <property name="password">
             <value>${vti.server.ssl.password}</value>
        </property>
        <property name="keystoreType">
             <value>JCEKS</value>
        </property>
    </bean> 
–>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Yes the second SSL snippet that comes with Alfresco is commented out.

pacco_robin · ‎05-13-2014

I added headers_module modules/mod_headers.so to httpd.conf. Apache told me module was already there.
I changed vti-context.xml to your settings.
Realized that I didn't download jetty-ajp-6.1.14.jar. So I did.
For the Apache errors I enabled mod proxy_http.

Alfresco now starts perfectly without errors.

But when I try to edit a Word or Excel file online Office warns me that the file at port 1111 can be harmful. Then Word or Excel starts and finally I get a message that the file (https://servername.domain.com:1111/path_to_file/file) cannot be opened.

This is driving me nuts!!!

When I look at your explanation in the other post I skipped creating the tomcat connector. I already enabled SSL through mod_jk. I suppose the worker is also defined (if I look at my virtualhost:443).
Added virtualhost:1111 the way you explained.

No errors in catalina.out and this is what I find in the Apache error log:
[Tue May 13 10:34:11.276856 2014] [ssl:error] [pid 2849:tid 139913534048000] [client 10.0.1.111:17642] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesSt...
[Tue May 13 10:34:11.430631 2014] [ssl:error] [pid 2849:tid 139913458513664] [client 10.0.1.111:17644] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesSt...
[Tue May 13 10:34:11.434038 2014] [ssl:error] [pid 2849:tid 139913542440704] [client 10.0.1.111:17645] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesSt...
[Tue May 13 10:34:11.436806 2014] [ssl:error] [pid 2849:tid 139913617975040] [client 10.0.1.111:17647] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesSt...
[Tue May 13 10:34:11.461485 2014] [ssl:error] [pid 2849:tid 139913626367744] [client 10.0.1.111:17646] AH02261: Re-negotiation handshake failed: Not accepted by client!?, referer: https://alfresco.ourdomain.com/share/page/site/zandbak/document-details?nodeRef=workspace://SpacesSt...
[Tue May 13 10:34:14.559882 2014] [proxy:warn] [pid 2849:tid 139913643153152] [client 10.0.1.111:17654] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:16.924618 2014] [proxy:warn] [pid 2849:tid 139913601189632] [client 10.0.1.111:17655] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/Zandbak.docx. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:16.952391 2014] [proxy:warn] [pid 2849:tid 139913559226112] [client 10.0.1.111:17656] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.
[Tue May 13 10:34:17.053874 2014] [proxy:warn] [pid 2849:tid 139913576011520] [client 10.0.1.111:17657] AH01144: No protocol handler was valid for the URL /alfresco/zandbak/documentLibrary/Zandbak.docx. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.

Hyland Connect

Use SSL with Sharepoint protocol