nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Configuring AOS to not use basic authentication

cajova_houba

Hello,

we're using Alfresco Community 7. One of the features used is "Open file in [MS Office App]" in the Alfresco Share. Microsoft has started to block basic auth sign-in prompts, so we're unable to use this feature. Instead we have to download the file, edit it, save it, and upload it again.

We've put the instance of Alfresco behind Keycloak and assumed this would then get picked by the AOS as well and instead of basic auth sign-in, user would be redirected to the Keycloak where he would perform sign-in. However, this is not the case and when opening word/excel/... documents, the MS Office application still uses basic auth.

I figured out this could be an AOS configuration issue, as it's the component of Alfresco responsible for interaction with MS Office, however, I wasn't able to find any information on this in AOS documentation.

So, my question is, what would be the correct way to solve this? There's a similar question but without any answer. One of the responses to another question on this topic mentions changing Windows group policy settings as a workaround but we would rather use SSO.

Thanks in advance.

Find more posts tagged with

Alfresco Content Services

Accepted answers

michele123

Hello,

@cajova_houba kynectwrote:
Hello,
we're using Alfresco Community 7. One of the features used is "Open file in [MS Office App]" in the Alfresco Share. Microsoft has started to block basic auth sign-in prompts, so we're unable to use this feature. Instead we have to download the file, edit it, save it, and upload it again.
We've put the instance of Alfresco behind Keycloak and assumed this would then get picked by the AOS as well and instead of basic auth sign-in, user would be redirected to the Keycloak where he would perform sign-in. However, this is not the case and when opening word/excel/... documents, the MS Office application still uses basic auth.
I figured out this could be an AOS configuration issue, as it's the component of Alfresco responsible for interaction with MS Office, however, I wasn't able to find any information on this in AOS documentation.
So, my question is, what would be the correct way to solve this? There's a similar question but without any answer. One of the responses to another question on this topic mentions changing Windows group policy settings as a workaround but we would rather use SSO.
Thanks in advance.

To resolve the issue of Alfresco using basic authentication for MS Office integration even when behind Keycloak, it's essential to verify the correct configuration of both systems, including SSO settings and client credentials. Inspecting the AOS configuration for any specific settings related to MS Office integration is also crucial. If necessary, update Alfresco or AOS to the latest versions and consider third-party integrations for enhanced functionality. Additionally, consult the Alfresco community or support channels for tailored guidance and to address any network-related issues that might be affecting the communication between Alfresco, Keycloak, and MS Office.

franktucker907

Hello,
Check AOS Configuration: Ensure that AOS is correctly configured to use Keycloak for authentication. This might involve updating the AOS configuration files to point to your Keycloak instance and ensuring that the necessary authentication protocols are supported.
Update AOS Version: Make sure you are using the latest version of AOS, as newer versions may have fixes or improvements related to SSO integration. flyingtogether ual com
Keycloak Configuration: Verify that Keycloak is properly set up to handle SSO for your Alfresco instance. This includes ensuring that the correct client settings and redirect URIs are configured.
Windows Group Policy: While you prefer not to use this workaround, it’s worth noting that adjusting Windows Group Policy settings can sometimes help with SSO issues. Specifically, you might need to enable certain policies related to authentication and credential delegation.
Best Regards
franktucker907

cajova_houba

The setup we're running is:

1. A Keycloak instance with a dedicated realm and public (=no credentials) OIDC client for Alfresco.

2. Alfresco instance configured to use the Keycloak as an authentication provider

authentication.chain=<your custom idp name>:identity-service,alfrescoNtlm1:alfrescoNtlm
identity-service.auth-server-url=<your idp url>
identity-service.realm=<name of the realm in KC>
identity-service.resource=<name of the OIDC client>

That alfrescoNtlm is an Alfresco's own inbuilt identity provider.

This has worked until recently. Couple of days/weeks ago we started getting the "Ms Office has blocked access to ..." again. I have no idea why as our setup did not change and I'm currently in the process of debugging it.

All comments

michele123

Hello,

@cajova_houba kynectwrote:
Hello,
we're using Alfresco Community 7. One of the features used is "Open file in [MS Office App]" in the Alfresco Share. Microsoft has started to block basic auth sign-in prompts, so we're unable to use this feature. Instead we have to download the file, edit it, save it, and upload it again.
We've put the instance of Alfresco behind Keycloak and assumed this would then get picked by the AOS as well and instead of basic auth sign-in, user would be redirected to the Keycloak where he would perform sign-in. However, this is not the case and when opening word/excel/... documents, the MS Office application still uses basic auth.
I figured out this could be an AOS configuration issue, as it's the component of Alfresco responsible for interaction with MS Office, however, I wasn't able to find any information on this in AOS documentation.
So, my question is, what would be the correct way to solve this? There's a similar question but without any answer. One of the responses to another question on this topic mentions changing Windows group policy settings as a workaround but we would rather use SSO.
Thanks in advance.

franktucker907

cajova_houba

Hi,

thank you for the suggestions, in my case the issue was outdated version of AOS (1.1.6). Upgrading AOS to 1.5.0 which is compatible with Alfresco Community 7.3 fixed the issue and when using "Edit in MS Office" action, the user is displayed Keycloak sign-in window.

Thank you very much!

atTheBeach

Hi - this is very confusing. Are you saying that when you click 'Edit in Microsoft Office' you get a Keycloak login form, and this authorises the user, and you can then edit the file?

I didn't think this was possible (we're on AOS 1.6.0). We also run Keycloak, but have to bypass Keycloak if the edit functionality is required. There doesn't seem to be any way to set AOS to use any of MS's Modern Auth methods - have you found some way to do this? How do you tell ACS about the client secret/etc?

Overwerkt

We discussed Microsoft's security/authorization change with our Hyland Account Manager or CSM. We have many users who want to edit documents in their native application. We do not want them downloading documents offline to edit them, then reuploading them. We were told Alfresco Identify Services is what we would need:

https://docs.alfresco.com/identity-service/latest/

atTheBeach

I don't think your Hyland Account Manager can be right, but I've only spent 15 minutes looking at the Identity Services docs. I'll have another look later in the week. Identity Services looks like it just duplicates the Keycloak functionality - I don't want a new realm, a new OIDC client, and so on. I can already get an access token directly from Keycloak.

The problem is convincing AOS to use OIDC rather than HTTP Basic. AOS has to communicate over HTTP with the Office app, and listen for the response, and pop up a Keycloak login form, which will produce the token to send on to the Office app. I can't see anything in your link that handles this - surely it must be done in AOS itself?

@cajova_houbasays "when using "Edit in MS Office" action, the user is displayed Keycloak sign-in window", but it seems impossible that simply updating to AOS 1.5.0 could have done this. There must be something else.

acsme

Hi!
Any actual solution for the problem?

atTheBeach

I haven't found anything. I think Hyland's pretty keen to terminate the Community stuff.

acsme

Even with Keycloak configured, I still can't use MS Office to access Alfresco via MS Edge. The error:
"This zero machine is configured to authenticate with OIDC. Please use a client that supports OFBA to access this resource."
Any help, please?