nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco with Tomcat-native SSO

roman

Hello folkz,

I'm tryin to use alfresco with the tomcat-native single sign on.

<Valve className="org.apache.catalina.authenticator.SingleSignOn" />…‍

the login page appears… just as it should be…

now what i have to do is to pass alfresco a username (who was logged on)
which i can get from the HttpServletRequest (getUserPrincipal().getName())
and alfresco should load proper home space and settings…
I'm trying to write an own authentication filter… is it the right way?
what should i take care of? tried to do it like in the
NovellIChainsHTTPRequestAuthenticationFilter but it doesn't work

please help
best regards

Find more posts tagged with

Comments

rivetlogic

Hi,

Take a look at HTTPRequestAuthenticationFilter.java

Regards,

–Alaaeldin

roman

hi RivetLogic,

thx for reply, i've tried to write an own auth-filter and took the HTTPRequestAuthenticationFilter as a basis.
In my view function setAuthenticatedUser(HttpServletRequest, HttpSession, String userName) should create an athenticated user by his username
i retrieve the username and call this function and get following error:

org.alfresco.error.AlfrescoRuntimeException: Transaction must be active and synchronization is required

org.alfresco.error.AlfrescoRuntimeException: Transaction must be active and synchronization is required
at org.alfresco.repo.transaction.AlfrescoTransactionSupport.registerSynchronizations(AlfrescoTransactionSupport.java:399)
at org.alfresco.repo.transaction.AlfrescoTransactionSupport.getSynchronization(AlfrescoTransactionSupport.java:384)
at org.alfresco.repo.transaction.AlfrescoTransactionSupport.bindDaoService(AlfrescoTransactionSupport.java:238)
at org.alfresco.repo.transaction.TransactionalDaoInterceptor.invoke(TransactionalDaoInterceptor.java:66)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
at $Proxy1.getNode(Unknown Source)
at org.alfresco.repo.node.db.DbNodeServiceImpl.exists(DbNodeServiceImpl.java:166)
at sun.reflect.GeneratedMethodAccessor196.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:281)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:187)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:154)
at org.alfresco.repo.transaction.TransactionResourceInterceptor.invoke(TransactionResourceInterceptor.java:129)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
at $Proxy2.exists(Unknown Source)
at sun.reflect.GeneratedMethodAccessor196.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.alfresco.repo.service.StoreRedirectorProxyFactory$RedirectorInvocationHandler.invoke(StoreRedirectorProxyFactory.java:221)
at $Proxy3.exists(Unknown Source)
at sun.reflect.GeneratedMethodAccessor196.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:281)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:187)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:154)
at org.alfresco.repo.node.MLPropertyInterceptor.invoke(MLPropertyInterceptor.java:211)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
at $Proxy2.exists(Unknown Source)
at org.alfresco.repo.security.authentication.RepositoryAuthenticationDao.getUserOrNull(RepositoryAuthenticationDao.java:164)
at org.alfresco.repo.security.authentication.RepositoryAuthenticationDao.loadUserByUsername(RepositoryAuthenticationDao.java:113)
at org.alfresco.repo.security.authentication.AuthenticationComponentImpl.getUserDetails(AuthenticationComponentImpl.java:98)
at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.setCurrentUser(AbstractAuthenticationComponent.java:97)
at de.swipe.alfresco.web.app.servlet.TomcatSSOAuthenticationFilter.setAuthenticatedUser(TomcatSSOAuthenticationFilter.java:145)
at de.swipe.alfresco.web.app.servlet.TomcatSSOAuthenticationFilter.doFilter(TomcatSSOAuthenticationFilter.java:122)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:524)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:419)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:869)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:664)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:80)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:619) 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

exactly when i try to set the user to the authentication component:
authComponent.setCurrentUsername(userName);

do you have an idea why?

best regards

rivetlogic

Hi,

Since you're attempting to run in SSO mode and allow users to automatically be authenticated in Alfresco via a servlet filter you should wire Alfresco's authentication component(s) accordingly. This means that Alfresco should not attempt to authenticate users using the default authentication component unless of course that's what you want to do in which case you should use chaining and write your own authentication component.

If you just want users to authenticate via the servlet filter (which I'm assuming is what you're trying to do here) you should wire the SimpleAcceptOrRejectAllAuthenticationComponent. I believe the full package name would be org.alfresco.repo.security.authentication.SimpleAcceptOrRejectAllAuthenticationComponentImpl. You would also need to set the "accept" property to "false".

That way your authentication component will simply reject all authentication requests and you'll be able to directly set the user using the setCurrentUser method in your servlet filter. This will also get rid of the exception you're getting since in this case a transaction is not required.

Hope this helps,

–Alaaeldin

roman

fantastic, it works! SimpleAcceptOrRejectAllAuthenticationComponentImpl rulez

thanxalot RivetLogic

great

roman

Hello,
one more question… can i use this SimpleAcceptOrRejectAllAuthenticationComponentImpl with chaining?
if i just configure this component in the authentication-services-context.xml i'll get a problem with cifs…
bad cifs server configuration.

here is my chaining-authentication-context.xml:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <!– Chaining –>

   <bean id="authenticationService" class="org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl">
      <property name="authenticationServices">
         <list>
            <ref bean="authenticationServiceImplTomcatSSO"/>
            <!– <ref bean="authenticationServiceImplLDAP"/> –>
         </list>
      </property>
<!– 
      <property name="mutableAuthenticationService">
         <ref bean="authenticationServiceImplAlfresco"/>
      </property>
 –>
   </bean>

   <!– Alfresco Auth –>
<!– 
   <bean id="authenticationServiceImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
      <property name="authenticationDao">
         <ref bean="authenticationDaoAlfresco"/>
      </property>
      <property name="ticketComponent">
         <ref bean="ticketComponent"/>
      </property>
      <property name="authenticationComponent">
         <ref bean="authenticationComponentImplAlfresco"/>
      </property>
   </bean>

   <bean id="authenticationDaoAlfresco" class="org.alfresco.repo.security.authentication.RepositoryAuthenticationDao">
      <property name="nodeService">
         <ref bean="nodeService"/>
      </property>
      <property name="dictionaryService">
         <ref bean="dictionaryService"/>
      </property>
      <property name="namespaceService">
         <ref bean="namespaceService"/>
      </property>
      <property name="searchService">
         <ref bean="searchService"/>
      </property>
      <property name="userNamesAreCaseSensitive">
         <value>${user.name.caseSensitive}</value>
      </property>
      <property name="passwordEncoder">
         <ref bean="passwordEncoder"/>
      </property>
   </bean>

   <bean id="authenticationComponentImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
      <property name="authenticationDao">
         <ref bean="authenticationDaoAlfresco"/>
      </property>
      <property name="authenticationManager">
         <ref bean="authenticationManager"/>
      </property>
      <property name="allowGuestLogin">
         <value>true</value>
      </property>
   </bean>
 –>
   <!– LDAP Auth –>
<!– 
   <bean id="authenticationServiceImplLDAP" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
      <property name="authenticationDao">
         <ref bean="authenticationDaoLDAP" />
      </property>
      <property name="ticketComponent">
         <ref bean="ticketComponent" />
      </property>
      <property name="authenticationComponent">
         <ref bean="authenticationComponentImplLDAP" />
      </property>
   </bean>

   <bean id="authenticationComponentImplLDAP" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
      <property name="LDAPInitialDirContextFactory">
         <ref bean="ldapInitialDirContextFactory"/>
      </property>
      <property name="userNameFormat">
         <value>uid=%s,ou=swipe.de,ou=users,o=swipe,dc=swipe,dc=de</value>
      </property>
   </bean>

   <bean id="authenticationDaoLDAP" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
 –>
   <!– Tomcat SSO Auth –>
   <bean id="authenticationServiceImplTomcatSSO" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
      <property name="authenticationDao">
         <ref bean="authenticationDaoTomcatSSO"/>
      </property>
      <property name="ticketComponent">
         <ref bean="ticketComponent"/>
      </property>
      <property name="authenticationComponent">
         <ref bean="authenticationComponentImplTomcatSSO"/>
      </property>
   </bean>
   
   <bean id="authenticationComponentImplTomcatSSO" class="org.alfresco.repo.security.authentication.SimpleAcceptOrRejectAllAuthenticationComponentImpl">
      <property name="accept">
         <value>true</value>
      </property>    
   </bean>
   
   <bean id="authenticationDaoTomcatSSO" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

but this componet (SimpleAcceptOrRejectAllAuthenticationComponentImpl) is not used. i've tried to debug…
what I'm doing wrong?

best regards
roman