CORS configuration in ACS 7.0

[waqar1]

Hi,

        i have confiqured my active directory with acs 7.0 via yml docker.it was working fine but when i added cors configuration settings its not running any more.can any one help

YML FILE

alfresco:
image: alfresco/alfresco-content-repository-community:7.0.0
mem_limit: 1500m

environment:
JAVA_TOOL_OPTIONS: "
-Dencryption.keystore.type=JCEKS
-Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding
-Dencryption.keyAlgorithm=DESede
-Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore
-Dmetadata-keystore.password=mp6yc0UD9e
-Dmetadata-keystore.aliases=metadata
-Dmetadata-keystore.metadata.password=oKIWzVdEdA
-Dmetadata-keystore.metadata.algorithm=DESede
"
JAVA_OPTS: "
-Ddb.driver=org.postgresql.Driver
-Ddb.username=alfresco
-Ddb.password=alfresco
-Ddb.url=jdbcostgresql://postgres:5432/alfresco

-Dcors.enabled=true
-Dcors.allowed.origins=*

-Dsolr.host=solr6
-Dsolr.port=8983
-Dsolr.http.connection.timeout=1000
-Dsolr.secureComms=none
-Dsolr.base.url=/solr
-Dindex.subsystem.name=solr6
-Dshare.host=127.0.0.1
-Dshare.port=8080
-Dalfresco.host=localhost
-Dalfresco.port=8080
-Daos.baseUrlOverwrite=http://localhost:8080/alfresco/aos
-Dmessaging.broker.url=\"failovernio://activemq:61616)?timeout=3000&jms.useCompression=true\"
-Ddeployment.method=DOCKER_COMPOSE
-DlocalTransform.core-aio.url=http://transform-core-aio:8090/
-Dcsrf.filter.enabled=false
-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
-Dauthentication.chain=alfinst:alfrescoNtlm,ldap-ad1:ldap-ad
-Dldap.authentication.active=true
-Dldap.authentication.java.naming.security.authentication=simple
-Dldap.authentication.userNameFormat=%s@nust.edu.pk
-Dldap.authentication.java.naming.provider.url=ldap://nust.edu.pk:389
-Dldap.authentication.defaultAdministratorUserNames=Administrator,alfresco
-Dldap.synchronization.active=true
-Dldap.synchronization.java.naming.security.authentication=simple
-Dldap.synchronization.java.naming.security.principal=XYZ@nust.edu.pk
-Dldap.synchronization.java.naming.security.credentials=1234
-Dldap.synchronization.groupSearchBase=OU=NUST,DC=nust,DC=edu,DC=pk
-Dldap.synchronization.userSearchBase=OU=NUST,DC=nust,DC=edu,DC=pk
-Dldap.synchronization.userFirstNameAttributeName=givenName
-Dldap.synchronization.userLastNameAttributeName=sn
"

transform-core-aio:
image: alfresco/alfresco-transform-core-aio:2.3.10
mem_limit: 1536m
environment:
JAVA_OPTS: " -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
ports:
- 8090:8090

share:
image: alfresco/alfresco-share:7.0.0
mem_limit: 1g
environment:
REPO_HOST: "alfresco"
REPO_PORT: "8080"
JAVA_OPTS: "
-XX:MinRAMPercentage=50
-XX:MaxRAMPercentage=80
-Dalfresco.host=localhost
-Dalfresco.port=8080
-Dalfresco.context=alfresco
-Dalfresco.protocol=http
"

postgres:
image: postgres:13.1
mem_limit: 512m
environment:
- POSTGRES_PASSWORD=alfresco
- POSTGRES_USER=alfresco
- POSTGRES_DB=alfresco
command: postgres -c max_connections=300 -c log_min_messages=LOG
ports:
- 5432:5432

solr6:
image: alfresco/alfresco-search-services:2.0.1
mem_limit: 2g
environment:
#Solr needs to know how to register itself with Alfresco
- SOLR_ALFRESCO_HOST=alfresco
- SOLR_ALFRESCO_PORT=8080
#Alfresco needs to know how to call solr
- SOLR_SOLR_HOST=solr6
- SOLR_SOLR_PORT=8983
#Create the default alfresco and archive cores
- SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive
#HTTP by default
- ALFRESCO_SECURE_COMMS=none
ports:
- 8083:8983 #Browser port
activemq:
image: alfresco/alfresco-activemq:5.16.1
mem_limit: 1g
ports:
- 8161:8161 # Web Console
- 5672:5672 # AMQP
- 61616:61616 # OpenWire
- 61613:61613 # STOMP

proxy:
image: alfresco/alfresco-acs-nginx:3.1.1
mem_limit: 128m
environment:
DISABLE_PROMETHEUS: "true"
DISABLE_SYNCSERVICE: "true"
DISABLE_ADW: "true"
depends_on:
- alfresco
ports:
- 8080:8080
links:
- alfresco
- share

ERROR Details

fresco_1 | 09-Aug-2021 09:32:42.403 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/usr/local/tomcat/webapps/alfresco] has finished in [94,806] ms
alfresco_1 | 09-Aug-2021 09:32:42.433 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
alfresco_1 | 09-Aug-2021 09:32:42.484 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [103639] milliseconds
solr6_1 | 2021-08-09 09:32:42.670 ERROR (searcherExecutor-8-thread-1-processing-x:alfresco) [ x:alfresco] o.a.s.t.ModelTracker Model tracking failed for core: alfresco
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090000 api/solr/modelsdiff return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getModelsDiff(SOLRAPIClient.java:1103)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModelsImpl(ModelTracker.java:313)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModels(ModelTracker.java:275)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.ensureFirstModelSync(ModelTracker.java:297)
solr6_1 | at org.alfresco.solr.lifecycle.SolrCoreLoadListener.createModelTracker(SolrCoreLoadListener.java:341)
solr6_1 | at org.alfresco.solr.lifecycle.SolrCoreLoadListener.newSearcher(SolrCoreLoadListener.java:135)
solr6_1 | at org.apache.solr.core.SolrCore.lambda$getSearcher$15(SolrCore.java:2249)
solr6_1 | at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
solr6_1 | at org.apache.solr.common.util.ExecutorUtil$MDCAwareThreadPoolExecutor.lambda$execute$0(ExecutorUtil.java:229)
solr6_1 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
solr6_1 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
solr6_1 | at java.base/java.lang.Thread.run(Thread.java:834)
solr6_1 | 2021-08-09 09:32:42.749 WARN (searcherExecutor-7-thread-1-processing-x:archive) [ x:archive] o.a.s.t.MetadataTracker nextTxCommitTimeService is not available. Upgrade your ACS Repository version in order to use this feature: archive - GetNextTxCommitTime return status is 404 when invoking api/solr/nextTransaction?fromCommitTime=0
solr6_1 | 2021-08-09 09:32:42.751 WARN (searcherExecutor-8-thread-1-processing-x:alfresco) [ x:alfresco] o.a.s.t.MetadataTracker nextTxCommitTimeService is not available. Upgrade your ACS Repository version in order to use this feature: alfresco - GetNextTxCommitTime return status is 404 when invoking api/solr/nextTransaction?fromCommitTime=0
solr6_1 | 2021-08-09 09:32:50.156 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-1) [ ] o.a.s.t.AbstractTracker [alfresco / MODEL@1197316477 / IT #1628501570024] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090001 api/solr/modelsdiff return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getModelsDiff(SOLRAPIClient.java:1103)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModelsImpl(ModelTracker.java:313)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModels(ModelTracker.java:275)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.doTrack(ModelTracker.java:235)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.191 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-2) [ ] o.a.s.t.AbstractTracker [alfresco / ACL@221768688 / IT #1628501570027] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090003 api/solr/aclchangesets return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getAclChangeSets(SOLRAPIClient.java:185)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.checkRepoAndIndexConsistency(AclTracker.java:417)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.trackRepository(AclTracker.java:398)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.doTrack(AclTracker.java:161)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.ActivatableTracker.track(ActivatableTracker.java:97)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.178 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-13) [ ] o.a.s.t.AbstractTracker [archive / NODE_STATE_PUBLISHER@249059573 / IT #1628501570054] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090002 GetTransactions return status is 404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getTransactions(SOLRAPIClient.java:441)
solr6_1 | at org.alfresco.solr.tracker.ShardStatePublisher.doTrack(ShardStatePublisher.java:91)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.200 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-3) [ ] o.a.s.t.AbstractTracker [archive / ACL@1231985689 / IT #1628501570030] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090004 api/solr/aclchangesets return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getAclChangeSets(SOLRAPIClient.java:185)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.checkRepoAndIndexConsistency(AclTracker.java:417)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.trackRepository(AclTracker.java:398)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.doTrack(AclTracker.java:161)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.ActivatableTracker.track(ActivatableTracker.java:97)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.233 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-12) [ ] o.a.s.t.AbstractTracker [alfresco / NODE_STATE_PUBLISHER@466006752 / IT #1628501570052] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090005 GetTransactions return status is 404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getTransactions(SOLRAPIClient.java:441)
solr6_1 | at org.alfresco.solr.tracker.ShardStatePublisher.doTrack(ShardStatePublisher.java:91)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
alfresco_1 | 09-Aug-2021 09:32:54.027 INFO [JobLockService1] org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading Illegal access: this web application instance has been stopped already. Could not load [org.alfresco.repo.lock.JobLockServiceImpl$4]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
alfresco_1 | java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.alfresco.repo.lock.JobLockServiceImpl$4]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)

[abhinavmishra14 · Accepted solution]

@waqar1  Like mentioned earlier, settings as per https://docs.alfresco.com/content-services/latest/config/repository/#cors-configuration or https://docs.alfresco.com/content-services/6.1/config/repository/#cross-origin-resource-sharing-cors... doesn't work and seems broken at repo layer. 

The settings are broken only with "*", valid urls works fine though. You may not be wanted to do this setting for prod as it is not recommended. Allowing only valid trusted remote origins as suggested. 

However, workaround given here does work for me.

This is what i did to test the workaround:

1- downloaded the two jar files:

https://repo1.maven.org/maven2/com/thetransactioncompany/cors-filter/2.5/cors-filter-2.5.jar

https://repo1.maven.org/maven2/com/thetransactioncompany/java-property-utils/1.9.1/java-property-uti...

2- Copied them to $TOMCAT_DIR/webapps/alfresco/WEB-INF/lib/ using DockerFile. 

Note: if you have non containerized setup, then copy the jars in $ALF_HOME/modules/platform directory. Refer this doc to understand simple modules: https://docs.alfresco.com/content-services/latest/develop/extension-packaging/#simplemodule

3- Taken the latest copy of web.xml from here: https://raw.githubusercontent.com/Alfresco/alfresco-community-repo/master/packaging/war/src/main/web...

 4- Updated it with CORS filters as suggested here: https://docs.alfresco.com/content-services/6.1/config/repository/#cross-origin-resource-sharing-cors... and kept the value for cors filter as

<init-param>
  <param-name>cors.allowOrigin</param-name>
   <param-value>*</param-value>
</init-param>

5- Copied the web.xml to $TOMCAT_DIR/webapps/alfresco/WEB-INF/web.xml via DockerFile, you can also use "sed" tool to update the web.xml file within the image without downloading a local copy as well. 

  <filter>
     <filter-name>CORS</filter-name>
     <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
     <init-param>
         <param-name>cors.allowGenericHttpRequests</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
         <param-name>cors.allowOrigin</param-name>
         <param-value>*</param-value>
     </init-param>
     <init-param>
         <param-name>cors.allowSubdomains</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportedMethods</param-name>
         <param-value>GET, HEAD, POST, PUT, DELETE, OPTIONS</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportedHeaders</param-name>
         <param-value>origin, authorization, x-file-size, x-file-name, content-type, accept, x-file-type, range</param-value>
     </init-param>
     <init-param>
         <param-name>cors.exposedHeaders</param-name>
         <param-value>Accept-Ranges, Content-Encoding, Content-Length, Content-Range</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportsCredentials</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
          <param-name>cors.maxAge</param-name>
          <param-value>3600</param-value>
     </init-param>
   </filter>

   <filter-mapping>
     <filter-name>CORS</filter-name>
     <url-pattern>/api/*</url-pattern>
     <url-pattern>/service/*</url-pattern>
     <url-pattern>/s/*</url-pattern>
     <url-pattern>/cmisbrowser/*</url-pattern>
     <url-pattern>/definitions/*</url-pattern>
 </filter-mapping>

   

FROM alfresco/alfresco-content-repository-community:7.1.0-M1

ARG TOMCAT_DIR=/usr/local/tomcat

# Copy any third party libraries if there are any
COPY Dockerfile libs/*.jar $TOMCAT_DIR/webapps/alfresco/WEB-INF/lib/

#Copy updated web.xml
COPY web.xml $TOMCAT_DIR/webapps/alfresco/WEB-INF/web.xml

6- Built the images and launched the containers. 

docker-compose up --build

To test used this simple code:

index.html

<!DOCTYPE html>
<html>

    <head>
        <meta charset="utf-8"/>
        <title>CORS Test</title>
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
        <script type='text/javascript' src="cors-test.js"></script>
    </head>
    <body onLoad='main();'>
    </body>
</html>

cors-test.js

function main()
{
    console.log("main invoked...");
    console.log("ajax request to the api that require cors enabled");
    $.ajax
    ({
        dataType: "xml",
        url: "http://localhost:7080/alfresco/s/api/login?u=admin&pw=admin",
        success: function(data)
        {
            console.log("log response on success");
            console.log(data);
        }
    });
}

Checkout this demo project in case you want to reference: https://github.com/abhinavmishra14/enable-cors-acs-demo

[akreienbring1]

I'm using ACS 7.2.0.1 and at least Alfresco starts up normally when i configure:

cors.allowed.origins=*

cors.support.credentials=false