nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Disabling guest access

rbramley

There doesn't seem to be a configuration parameter to enable/disable guest access…

org.alfresco.repo.security.authentication.AbstractAuthenticationComponent declares

protected abstract boolean implementationAllowsGuestLogin();
‍‍

and org.alfresco.repo.security.authentication.AuthenticationComponentImpl implements it as:

    @Override
    protected boolean implementationAllowsGuestLogin()
    {
        return true;
    }‍‍‍‍‍

If this is altered to return false, will Alfresco behave in the same way as pre-1.2RC1?
If so, are there any plans to make this configurable in repository.properties/Spring config?

Thanks,

Robin

Find more posts tagged with

Comments

steve

Hello,

You can disable guest access within the authentication-services-context.xml

The relevant section is:

    <bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
        <property name="authenticationDao">
            <ref bean="alfDaoImpl" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍‍

Change

        <property name="allowGuestLogin">
            <value>true</value>
        </property>
‍‍‍‍‍

To:

        <property name="allowGuestLogin">
            <value>false</value>
        </property>
‍‍‍‍‍

You can use the new extension configuration functionality to change this setting: see here

Hope this helps,

Steve

jora

when disabling the guest access, the link "Guest Home" is still visible. Can this also be disabled? Thanks.

kevinr

Not currently, please raise this as a JIRA issue.

Thanks,

Kevin

konalexiou

when disabling the guest access, the link "Guest Home" is still visible. Can this also be disabled? Thanks.

I noticed that it disappears when deleting the 'Guest Home' space. Is this a good way to disable the Guest Home ?

I am also trying to disable the Guest user and can't get it done.
I have installed the latest AlfrescoCommunity-2.9.0B in a Windows 20003 Server.
Can anybody help me with this ?

authentication-services-context.xml doesn't exist and even if i create it, still doesn't work.
also tried with ntlm-authentication-services-context.xml and can't work it out.

monitloth

If you use LDAP, you must also deactivate guest in his configuration file.

pescha

It appears that the above instructions no longer apply for Alfresco 3.2 preview 2

What is the new method for disabling guest access?

dward

In the very latest nightly builds, it's just a matter of setting

alfresco.authentication.allowGuestLogin=false

in your custom-repository.properties if you are using the preconfigured authentication chain.

For the preview release, this method of propagating defaults to the subsystems wasn't complete. So instead you have to provide an instance-specific override file.

So suppose your authentication.chain looks like the default one in repository.properties

authentication.chain=alfrescoNtlm1:alfrescoNtlm

This has a single instance called 'alfrescoNtlm1' of type alfrescoNtlm. Interestingly enough the alfrescoNtlm authentication subsystem type is capable of handling NTLM single-sign on but this is switched off by default.

Subsystem properties can be oveerriden in a classpath file with path

alfresco/extension/subsystems/<category>/<type>/<instance>

So to configure the alfrescoNtlm1 subsystem's properties, copy root\projects\repository\config\alfresco\subsystems\Authentication\alfrescoNtlm\alfresco-authentication.properties to %TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\alfrescoNtlm\alfrescoNtlm1\alfresco-authentication.properties and then edit as required.

A more complex authentication chain might look like this

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,ldap2:ldap

In which case you could configure each authentication subsystem instance separately using property files with appropriate paths.

More details on the new improved authentication chaining and configuring subsystems will be posted on the Wiki shortly.

pescha

I followed your instructions and now Alfresco does not login directly to guest by default. However, in the login window, I am still able to login as guest/guest. Is there a way to just delete the guest account altogether?

kevinr

Wiki docs for Alfresco Subsystems in 3.2 is starting to appear here: http://wiki.alfresco.com/wiki/Alfresco_Subsystems

As of Alfresco version 3.2, the subsystems are:

Authentication
    Handles all Alfresco's authentication related functions, including:

        * Password-based authentication
        * Single Sign-on (SSO) for WebClient, WebDAV, Web Scripts and Sharepoint
        * CIFS and FTP authentication
        * User registry export (LDAP only) 

    The subsystem is 'chained' so that multiple instances of different types can be configured and used together 
Synchronization
    Performs regular synchronization with the user registry exporters (usually LDAP directories) in the authentication chain 
File Servers
    Owns the CIFS, FTP and NFS servers 
Third Party
    Owns the OpenOffice, Swftools and ImageMagick content transformers 
IMAP
    Owns the IMAP service 
WCM Deployment Receiver 
    Part of WCM. WCM_Deployment_Engine 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Kevin

rdanner

Just to keep this thread up to date:

the spring code has been updated and should now be:

    <bean id="authenticationComponent"
          class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl" 
          parent="authenticationComponentBase">
        <property name="authenticationDao">
            <ref bean="authenticationDao" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>fasle</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

in your shared/classes/alfresco/extension area, add the above to your modified spring configuration.

I'd like to see this pulled out as a property in custom-repository.properties. I'll check and see if there is a ticket for this - would make things much cleaner/easier.

Hello,

You can disable guest access within the authentication-services-context.xml

The relevant section is:

    <bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl">
        <property name="authenticationDao">
            <ref bean="alfDaoImpl" />
        </property>
        <property name="authenticationManager">
            <ref bean="authenticationManager" />
        </property>
        <property name="allowGuestLogin">
            <value>true</value>
        </property>
    </bean>‍‍‍‍‍‍‍‍‍‍‍‍

Change

        <property name="allowGuestLogin">
            <value>true</value>
        </property>
‍‍‍‍‍

To:

        <property name="allowGuestLogin">
            <value>false</value>
        </property>
‍‍‍‍‍

You can use the new extension configuration functionality to change this setting: see here

Hope this helps,

Steve

gronfelt

I have an authentication chain looking like this:

authentication.chain=ldap1:ldap,ldap2:ldap
‍‍

In the properties files for each instance the following property is set:

ldap.authentication.allowGuestLogin=false
‍‍

However, Alfresco keeps spitting out error messages like this all the time:

08:31:07,840 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 07061383 Guest authentication not supported‍

My guess would be that Alfresco wants to authenticate the Guest account, but that's not possible since I've disabled the internal authentication. Any ideas on how to fix this the proper way?

kevinr

Are you using Share? As i have a feeling there may be an issue in 3.2 where the Guest account is required for it to work - we are looking at this to solve a similar issue with NTLM.

gronfelt

Yes, I'm using Share. I will try to enable guest authentication in my ldap properties files and then add a Guest user to one of my ldap directories, that should do the trick, right?

ofrxnz

hey, im using kerberos, i get a similar error when i start with a blank repository….

though, if i start alfresco with the absolute default authentication mechanism once, then switch back to kerberos without guest access it seems to work…until i completely blank out the database/data files again…