nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

[SOLVED] NTLM Authentication on Share

jtp

I've got NTLM authentication and passthrough configured per the Labs3Stable PDF. Logging in to the /Alfresco interface works great. Going to /share causes a 500 server error. The key line out of the error page seems to be this:

java.lang.IllegalArgumentException: UserId is mandatory.
   org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:510)
   org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:491)
   org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:296)
   org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:310)

I've got logging enabled on both interfaces, but nothing is logged when i try to access /share

Anyone have any ideas on what might be off?

Find more posts tagged with

Comments

mikeh

Did you see this part of the wiki? http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM#Alfresco_Share_SSO_using_NTLM

Thanks,
Mike

jtp

Yes. I followed that section too, even noticing that the Wiki and install PDF show this:

<endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://yourserver:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
         </endpoint>‍‍‍‍‍‍‍‍

But the file that comes with Labs3Stable shows this:

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://yourserver:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>‍‍‍‍‍‍‍‍‍

Along with changing the endpoint url of course, I tried commenting out the external-auth section but the same result.

Also in the Installing labs3stable PDF, I think there's an error because when talking about Share, it tells you to change the alfresco web.xml (again). See below:

To use NTLM with Share, you must first enable NTLM for Alfresco Explorer web application. Then edit the
web.xml file in the <TOMCAT_HOME>\webapps\alfresco\WEB-INF folder and change the servlet
filter that is used for Share.

The Wiki words it differently.

jtp

I tried replacing just the share web.xml with the original, with no other changes. /Alfresco works the same with passthrough working fine. /Share brings up the login page now, but logging in with correct credentials takes me back to a 500 error, but with different information. This one says:

javax.servlet.ServletException: org.alfresco.web.site.exception.RequestContextException: Exception running UserFactory in HttpRequestContextFactory
   org.alfresco.web.site.servlet.DispatcherServlet.service(DispatcherServlet.java:130)
   javax.servlet.http.HttpServlet.service(HttpServlet.java:717)‍‍‍

and

org.alfresco.web.site.exception.UserFactoryException: Unable to create user - failed to retrieve user metadata: 
   org.alfresco.web.site.AlfrescoUserFactory.loadUser(AlfrescoUserFactory.java:159)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:169)
   org.alfresco.web.site.UserFactory.faultUser(UserFactory.java:110)
‍‍‍‍‍

In either situation the user ID just isn't making it through. I wouldn't be surprised if I misconfigured something but I'm just not sure what.

mikeh

Here's the NTLM passthru config we've got running on our internal Engineering Share instance:

ntlm-authentication-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
         <property name="allowSetEnabled" value="true" />
         <property name="allowGetEnabled" value="true" />
         <property name="allowDeleteUser" value="true" />
         <property name="allowCreateUser" value="true" />
   </bean>


   <!– The authentication component.                                      –>

   <!– Use the passthru authentication component to authenticate using    –>
   <!– user accounts on one or more Windows servers.                      –>

   <!– Properties that specify the server(s) to use for passthru          –>
   <!– authentication :-                                                  –>
   <!–   useLocalServer   use the local server for authentication         –>
   <!–   domain           use domain controllers from the specified domain–>
   <!–   servers          comma delimted list of server addresses or      –>
   <!–                    names                                           –>

   <bean id="authenticationComponent"
         class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl"
         parent="authenticationComponentBase">
       <property name="useLocalServer">
           <value>false</value>
       </property>
       <property name="servers">
           <value>*** YOUR PDC/BDC SERVER IP ADDRESS HERE ***</value>
       </property>
       <property name="personService">
           <ref bean="personService" />
       </property>
       <property name="nodeService">
           <ref bean="nodeService" />
       </property>
       <property name="transactionService">
           <ref bean="transactionComponent" />
       </property>
       <property name="guestAccess">
           <value>false</value>
       </property>
   </bean>

</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And Share's web.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

   <display-name>Alfresco Project Slingshot</display-name>    
   <description>Alfresco Project Slingshot application</description>
   
   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>
         classpath:alfresco/webscript-framework-application-context.xml
         classpath:alfresco/web-framework-application-context.xml
         classpath:alfresco/web-framework-model-context.xml
         classpath:alfresco/slingshot-application-context.xml
      </param-value>
      <description>Spring config file locations</description>
   </context-param>
   
   <!– For NTLM authentication support use the following filter –>
   <!– –>
   <filter>
      <filter-name>Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.site.servlet.NTLMAuthenticationFilter</filter-class>
      <init-param>
         <param-name>endpoint</param-name>
         <param-value>alfresco</param-value>
      </init-param>
   </filter>
  
   
   <!– For NTLM authentication support enable the following mappings –>
   <!– after enabling the NTLMAuthenticationFilter filter class above –>
   <!– –>
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/s/*</url-pattern>
   </filter-mapping>
  
   
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>
   
   <servlet>
      <servlet-name>apiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.WebScriptServlet</servlet-class>
      <init-param>
         <param-name>container</param-name>
         <param-value>webframework.webscripts.container</param-value>
      </init-param>
   </servlet>
   
   <servlet>
      <servlet-name>feedApiServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.WebScriptFeedServlet</servlet-class>
      <init-param>
         <param-name>container</param-name>
         <param-value>webframework.webscripts.container</param-value>
      </init-param>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.delegatingbasic</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>proxyServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.EndPointProxyServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>uriTemplateServlet</servlet-name>
      <servlet-class>org.alfresco.web.uri.UriTemplateServlet</servlet-class>
   </servlet>

   <!– The Web Framework Dispatcher Servlet –>
   <servlet>
      <servlet-name>pageRendererServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.DispatcherServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
   </servlet>
   
   <servlet>
      <servlet-name>frameworkControlServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.FrameworkControlServlet</servlet-class>
   </servlet>
   
   <servlet>
      <servlet-name>loginServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.LoginServlet</servlet-class>
   </servlet> 

   <servlet>
      <servlet-name>logoutServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.LogoutServlet</servlet-class>
   </servlet> 

   <servlet-mapping>
      <servlet-name>logoutServlet</servlet-name>
      <url-pattern>/logout</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>loginServlet</servlet-name>
      <url-pattern>/login/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>apiServlet</servlet-name>
      <url-pattern>/service/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>feedApiServlet</servlet-name>
      <url-pattern>/feedservice/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>proxyServlet</servlet-name>
      <url-pattern>/proxy/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>pageRendererServlet</servlet-name>
      <url-pattern>/page/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>pageRendererServlet</servlet-name>
      <url-pattern>/p/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>uriTemplateServlet</servlet-name>
      <url-pattern>/s/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>frameworkControlServlet</servlet-name>
      <url-pattern>/control/*</url-pattern>
   </servlet-mapping>
   
   <session-config>
      <session-timeout>30</session-timeout>
   </session-config>

   <!– welcome file list precedence order is index.jsp, then index.html –>
   <welcome-file-list>
      <welcome-file>index.jsp</welcome-file>
      <welcome-file>index.html</welcome-file>
   </welcome-file-list>

</web-app>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Does that help at all?
Mike

jtp

I checked and my files are the same except for the session timeout. Could anything else be to blame?

mikeh

The only other issue is that NTLM doesn't work well (at all…) with Safari/WebKit (and hence probably Chrome).

Mike

jtp

I'm using IE.

Is the webscript-framework-config-custom that has to be tweaked supposed to completely replace the non custom one? Because there's stuff in the regular one that's not in the custom.

jtp

MikeH,
Could I see your /alfresco web.xml and your webscript framework config custom.xml?

jtp

In the meantime, I changed the share web.xml and the webscript file back to normal. Alfresco interface still signs on automatically, and share signs on manually.

gcbastos

Hello!
I am having exactly the same problems described by JTP. I am using IE too.
When rolling back Share´s web.xml and webscript-framework-config-custom.xml, the Error 500 disappears and the login page for Share loads ok, but could not login with any account.
Any good news on this issue?

TIA.

jtp

Not on my side. The authentication is working on share but single/automatic sign on is not.

bashmaq

I have the same issue. I can log in to Alfresco Explorer through NTLM auth, but not to Alfresco Share (there is a message in the log - java.lang.IllegalArgumentException: UserId is mandatory).
For testing purposes I deployed "clean" share.war - with untouched web.xml and webscript-framework-config-custom.xml files. Alfresco Share now works, but asks for credentials (through standart Share`s login page ).

Somebody have working config for Share NTLM SSO?

mikeh

Somebody have working config for Share NTLM SSO?

Yes, the one I posted - it's the config we use internally.

Mike

mikeh

MikeH,
Could I see your /alfresco web.xml and your webscript framework config custom.xml?

Sorry, I missed this post.

The only difference between a "clean" web.xml and our NTLM one is the commented out pieces. No other files were updated in the Alfresco webapp.

Thanks,
Mike

bashmaq

Yes, the one I posted - it's the config we use internally.

Hmmm…Already tried it, but still no luck… It`s strange - instructions on a wiki seems so easy - few uncommented sections and one changed parameter… Almost nowhere to make a mistake. But logs are the same:

 http-8080-Processor24 ERROR [[localhost].[/share].[pageRendererServlet]] Servlet.service() for servlet pageRendererServlet threw exception
org.alfresco.error.AlfrescoRuntimeException: Unable to retrieve object: site-index of type: page
        at org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:140)
        at org.alfresco.web.site.Model.getObject(Model.java:513)
        at org.alfresco.web.site.Model.getPage(Model.java:165)
        at org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
        at org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
        at org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
        at org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
        at org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:210)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
        at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:393)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870)
        at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
        at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
        at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
        at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685)
        at java.lang.Thread.run(Thread.java:619)
Caused by: org.alfresco.web.framework.exception.ModelObjectPersisterException: Error loading object id: site-index from persister id: RemoteStore_alfresco/site-data/pages_page
        at org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:110)
        at org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:136)
        … 22 more
Caused by: org.alfresco.web.framework.exception.ModelObjectPersisterException: Failure to load model object for path: site-index.xml
        at org.alfresco.web.framework.StoreModelObjectPersister.getObjectByPath(StoreModelObjectPersister.java:170)
        at org.alfresco.web.framework.StoreModelObjectPersister.getObject(StoreModelObjectPersister.java:108)
        at org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:106)
        … 23 more
Caused by: java.lang.IllegalArgumentException: UserId is mandatory.
        at org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:510)
        at org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:491)
        at org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:296)
        at org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:310)
        at org.alfresco.web.site.AbstractRequestContext.getCredentialVault(AbstractRequestContext.java:435)
        at org.alfresco.web.framework.WebFrameworkConnectorProvider.provide(WebFrameworkConnectorProvider.java:80)
        at org.alfresco.web.scripts.RemoteStore.getConnector(RemoteStore.java:739)
        at org.alfresco.web.scripts.RemoteStore.callGet(RemoteStore.java:693)
        at org.alfresco.web.scripts.RemoteStore.hasDocument(RemoteStore.java:344)
        at org.alfresco.web.framework.StoreModelObjectPersister.getObjectByPath(StoreModelObjectPersister.java:136)
        … 25 more ‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And another thing - this message didn`t change even when I accidentially broke the Alfresco - NTLM binding. Looks like Share and Alfresco doesn`t see each other.

jtp

I'm using IE.

Is the webscript-framework-config-custom that has to be tweaked supposed to completely replace the non custom one? Because there's stuff in the regular one that's not in the custom.

Mike,
Did you have an answer to this question?

jtp

MikeH,
Could I see your /alfresco web.xml and your webscript framework config custom.xml?
Sorry, I missed this post.

The only difference between a "clean" web.xml and our NTLM one is the commented out pieces. No other files were updated in the Alfresco webapp.

Thanks,
Mike

I'd still like to see an "official" one because there are inconsistencies in the documentation for both files. The webscript discrepancy I pointed out early in this thread. The web.xml discrepancy involves the assignment of the /wcs url pattern to both the standard authentication filter and the webscript authentication filter in the documentation. Can you do that?

  <filter-mapping>
     <filter-name>Authentication Filter</filter-name>
     <url-pattern>/wcservice/*</url-pattern>
  </filter-mapping>
  
  <filter-mapping>
     <filter-name>Authentication Filter</filter-name>
     <url-pattern>/wcs/*</url-pattern>
  </filter-mapping>‍‍‍‍‍‍‍‍‍

  <filter-mapping>
     <filter-name>WebScript NTLM Authentication Filter</filter-name>
     <url-pattern>/wcservice/*</url-pattern>
  </filter-mapping>
  
  <filter-mapping>
     <filter-name>WebScript NTLM Authentication Filter</filter-name>
     <url-pattern>/wcs/*</url-pattern>
  </filter-mapping>‍‍‍‍‍‍‍‍‍

mikeh

There should only be one mapping - you need to comment out the ones replaced by the NTLM auth config.

<?xml version='1.0' encoding='UTF-8'?>

<!DOCTYPE web-app PUBLIC
  "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
  "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
   <display-name>Alfresco Web Client</display-name>

   <description>Alfresco Web Client</description>

   <context-param>
      <param-name>org.jboss.jbossfaces.WAR_BUNDLES_JSF_IMPL</param-name>
      <param-value>true</param-value>
   </context-param>

   <context-param>
      <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
      <param-value>server</param-value>
   </context-param>

   <context-param>
      <param-name>javax.faces.CONFIG_FILES</param-name>
      <param-value>/WEB-INF/faces-config-app.xml,/WEB-INF/faces-config-beans.xml,/WEB-INF/faces-config-navigation.xml,/WEB-INF/faces-config-common.xml,/WEB-INF/faces-config-repo.xml,/WEB-INF/faces-config-wcm.xml,/WEB-INF/faces-config-custom.xml,/WEB-INF/faces-config-enterprise.xml</param-value>
   </context-param>

   <context-param>
      <param-name>org.apache.myfaces.ALLOW_JAVASCRIPT</param-name>
      <param-value>true</param-value>
   </context-param>

   <context-param>
      <param-name>org.apache.myfaces.DETECT_JAVASCRIPT</param-name>
      <param-value>false</param-value>
      <description>This is an EXPERIMENTAL feature, so leave it off for now!</description>
   </context-param>

   <context-param>
      <param-name>org.apache.myfaces.SERIALIZE_STATE_IN_SESSION</param-name>
      <param-value>false</param-value>
      <description>Stop MyFaces from Serializing the state to the session</description>
   </context-param>

    <!– TODO: Change this to false for production –>
    <context-param>
        <param-name>org.apache.myfaces.PRETTY_HTML</param-name>
        <param-value>true</param-value>
        <description>
            If true, rendered HTML code will be formatted, so that it is "human readable".
            i.e. additional line separators and whitespace will be written, that do not
            influence the HTML code.
            Default: "true"
        </description>
    </context-param>

    <context-param>
        <param-name>org.apache.myfaces.AUTO_SCROLL</param-name>
        <param-value>false</param-value>
        <description>
            If true, a javascript function will be rendered that is able to restore the
            former vertical scroll on every request. Convenient feature if you have pages
            with long lists and you do not want the browser page to always jump to the top
            if you trigger a link or button action that stays on the same page.
            Default: "false"
        </description>
    </context-param>

   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>
         classpath:alfresco/application-context.xml
         classpath:alfresco/webscript-framework-application-context.xml
         classpath:alfresco/web-client-application-context.xml
         classpath:alfresco/web-scripts-application-context.xml
         classpath:alfresco/web-services-application-context.xml

         <!–
         To give final control over the tuning of the custom environment,
         the custom-web-context.xml file is processed last (note:
         custom-web-context.xml isn't part of the source tree itself).
         –>
         classpath*:alfresco/extension/custom-web-context.xml

      </param-value>
      <description>Spring config file locations</description>
   </context-param>

   <filter>
      <filter-name>Authentication Filter</filter-name>
     <!–
    <filter-class>org.alfresco.web.app.servlet.AuthenticationFilter</filter-class>
      –>
      <!– For NTLM authentication support use the following filter, also see the filter-mapping section –>
      <!—->
      <filter-class>org.alfresco.web.app.servlet.NTLMAuthenticationFilter</filter-class>
      
      
      <!– For Novell IChain support use the following filter –>
      <!–
      <filter-class>org.alfresco.web.app.servlet.NovellIChainsHTTPRequestAuthenticationFilter</filter-class>
      –>
   </filter>

   <!– For NTLM authentication support use the following filter, also see the filter-mapping section –>
   <filter>
      <filter-name>WebScript NTLM Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.WebScriptNTLMAuthenticationFilter</filter-class>
   </filter>


   <filter>
      <filter-name>WebDAV Authentication Filter</filter-name>
<!–     
 <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class>
–>      
      <!– For NTLM authentication support use the following filter –>
      <!– –>
      <filter-class>org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter</filter-class>
     
   </filter>

   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>


   <!– For NTLM authentication support enable the following mappings –>
   <!– after enabling the NTLMAuthenticationFilter filter classes above –>
   <!– –>
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/download/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/n/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/c/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/t/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/d/*</url-pattern>
   </filter-mapping>
  
<!– 
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/wcservice/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/wcs/*</url-pattern>
   </filter-mapping>
–>

   
   <filter-mapping>
      <filter-name>WebScript NTLM Authentication Filter</filter-name>
      <url-pattern>/wcservice/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>WebScript NTLM Authentication Filter</filter-name>
      <url-pattern>/wcs/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/ajax/*</url-pattern>
   </filter-mapping>

   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <url-pattern>/webdav/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/admin/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/categories/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/groups/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/delete-user.jsp</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/users.jsp</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/admin/system-info.jsp</url-pattern>
   </filter-mapping>


   <listener>
      <listener-class>org.apache.myfaces.webapp.StartupServletContextListener</listener-class>
   </listener>

   <listener>
      <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
   </listener>
   
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>

   <listener>
      <listener-class>org.alfresco.web.app.ContextListener</listener-class>
   </listener>

   <!– Faces Servlet –>
   <servlet>
      <servlet-name>Faces Servlet</servlet-name>
      <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
   </servlet>

   <servlet>
      <servlet-name>uploadFile</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.UploadFileServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>uploadContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.UploadContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>downloadContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.DownloadContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>downloadRawContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.DownloadRawContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>guestDownloadContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.GuestDownloadContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>guestTemplateContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.GuestTemplateContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>externalAccess</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.ExternalAccessServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>templateContent</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.TemplateContentServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>commandServlet</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.CommandServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>ajaxServlet</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.ajax.AjaxServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>axis</servlet-name>
      <servlet-class>org.apache.axis.transport.http.AxisServlet</servlet-class>
      <load-on-startup>5</load-on-startup>
   </servlet>

   <servlet>
      <servlet-name>CXFServlet</servlet-name>
      <servlet-class>org.apache.cxf.transport.servlet.CXFServlet</servlet-class>
      <load-on-startup>6</load-on-startup>
   </servlet>

   <servlet>
      <servlet-name>WebDAV</servlet-name>
      <servlet-class>org.alfresco.repo.webdav.WebDAVServlet</servlet-class>
      <init-param>
         <param-name>store</param-name>
         <param-value>workspace://SpacesStore</param-value>
      </init-param>
      <init-param>
         <param-name>rootPath</param-name>
         <param-value>/app:company_home</param-value>
      </init-param>
      <load-on-startup>5</load-on-startup>
   </servlet>

   <servlet>
      <servlet-name>apiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.WebScriptServlet</servlet-class>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.basic</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>wcapiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.WebScriptServlet</servlet-class>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.webclient</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>portalapiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.WebScriptServlet</servlet-class>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.webclient</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>facebookServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.facebook.FacebookServlet</servlet-class>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.facebook</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>fbapiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.facebook.FacebookAPIServlet</servlet-class>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.facebook</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>proxyServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.HTTPProxyServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>workflowDefinitionImageServlet</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.WorkflowDefinitionImageServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>JBPMDeployProcessServlet</servlet-name>
      <servlet-class>org.alfresco.web.app.servlet.JBPMDeployProcessServlet</servlet-class>
   </servlet>

   <servlet-mapping>
      <servlet-name>Faces Servlet</servlet-name>
      <url-pattern>/faces/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>uploadFile</servlet-name>
      <url-pattern>/uploadFileServlet</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>uploadContent</servlet-name>
      <url-pattern>/upload/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>downloadContent</servlet-name>
      <url-pattern>/download/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>downloadContent</servlet-name>
      <url-pattern>/d/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>downloadRawContent</servlet-name>
      <url-pattern>/dr</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>guestDownloadContent</servlet-name>
      <url-pattern>/guestDownload/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>guestDownloadContent</servlet-name>
      <url-pattern>/gd/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>templateContent</servlet-name>
      <url-pattern>/template/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>templateContent</servlet-name>
      <url-pattern>/t/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>guestTemplateContent</servlet-name>
      <url-pattern>/guestTemplate/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>guestTemplateContent</servlet-name>
      <url-pattern>/gt/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>externalAccess</servlet-name>
      <url-pattern>/navigate/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>externalAccess</servlet-name>
      <url-pattern>/n/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>commandServlet</servlet-name>
      <url-pattern>/command/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>commandServlet</servlet-name>
      <url-pattern>/c/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>ajaxServlet</servlet-name>
      <url-pattern>/ajax/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>axis</servlet-name>
      <url-pattern>/api/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>CXFServlet</servlet-name>
      <url-pattern>/cmis/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
        <servlet-name>WebDAV</servlet-name>
        <url-pattern>/webdav/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>apiServlet</servlet-name>
      <url-pattern>/service/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>apiServlet</servlet-name>
      <url-pattern>/s/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>wcapiServlet</servlet-name>
      <url-pattern>/wcservice/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>wcapiServlet</servlet-name>
      <url-pattern>/wcs/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>portalapiServlet</servlet-name>
      <url-pattern>/168service/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>portalapiServlet</servlet-name>
      <url-pattern>/168s/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>facebookServlet</servlet-name>
      <url-pattern>/facebook/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>facebookServlet</servlet-name>
      <url-pattern>/fb/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>fbapiServlet</servlet-name>
      <url-pattern>/fbservice/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>fbapiServlet</servlet-name>
      <url-pattern>/fbs/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>proxyServlet</servlet-name>
      <url-pattern>/proxy</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>JBPMDeployProcessServlet</servlet-name>
      <url-pattern>/jbpm/deployprocess</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>workflowDefinitionImageServlet</servlet-name>
      <url-pattern>/workflowdefinitionimage/*</url-pattern>
   </servlet-mapping>

   <session-config>
      <session-timeout>60</session-timeout>
   </session-config>

   <welcome-file-list>
      <welcome-file>index.jsp</welcome-file>
   </welcome-file-list>

   <error-page>
      <exception-type>java.lang.Exception</exception-type>
      <location>/jsp/error.jsp</location>
   </error-page>

</web-app>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Is the webscript-framework-config-custom that has to be tweaked supposed to completely replace the non custom one? Because there's stuff in the regular one that's not in the custom.

No, it it meant to override only those sections specifically in the custom config (if that makes sense?)

Mike

bashmaq

Still no good. Which debug entries in log4j.properties could help me to trace authentication process between Share and Alfresco?

ofrxnz

Hey i'm getting the same error. and have tried numerous variations configuring it.

So, ill go ahead and post my error and configs to see if anyone has any ideas.

Thanks in advance. This community rocks!!

I am running alfresco on Windows server 2k3 R2 fully updated with the firewall disabled for now. I used the full Labs 3 Stable install package. So far, NTLM authentication is working, LDAP synchronization is working, CIFS and FTP are functional. These authenticate against a similarly patched/updated Active Directory server.

My client is a fully patched windows XP pro box on the domain using IE and Firefox as the browser.

SSO is fully functional for Alfresco web interface, WebDav, and CIFS. IE will SSO into everything, Firefox is not configured to so i can see if it prompts for a password.

Share produces the following error when configured using the Alfresco 3 NTLM/SSO page in the wiki and everything i noticed in this thread.

Neither IE will SSO or FireFox will prompt for credentials

Error

HTTP Status 500 - 

——————————————————————————–

type Exception report

message 

description The server encountered an internal error () that prevented it from fulfilling this request.

exception 

org.alfresco.error.AlfrescoRuntimeException: Unable to retrieve object: site-index of type: page
   org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:140)
   org.alfresco.web.site.Model.getObject(Model.java:513)
   org.alfresco.web.site.Model.getPage(Model.java:165)
   org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
   org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
   org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)


root cause 

org.alfresco.web.framework.exception.ModelObjectPersisterException: Error loading object id: site-index from persister id: RemoteStore_alfresco/site-data/pages_page
   org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:110)
   org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:136)
   org.alfresco.web.site.Model.getObject(Model.java:513)
   org.alfresco.web.site.Model.getPage(Model.java:165)
   org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
   org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
   org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)


root cause 

org.alfresco.web.framework.exception.ModelObjectPersisterException: Failure to load model object for path: site-index.xml
   org.alfresco.web.framework.StoreModelObjectPersister.getObjectByPath(StoreModelObjectPersister.java:170)
   org.alfresco.web.framework.StoreModelObjectPersister.getObject(StoreModelObjectPersister.java:108)
   org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:106)
   org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:136)
   org.alfresco.web.site.Model.getObject(Model.java:513)
   org.alfresco.web.site.Model.getPage(Model.java:165)
   org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
   org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
   org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)


root cause 

java.lang.IllegalArgumentException: UserId is mandatory.
   org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:510)
   org.alfresco.connector.ConnectorService.getCredentialVault(ConnectorService.java:491)
   org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:296)
   org.alfresco.web.site.FrameworkHelper.getCredentialVault(FrameworkHelper.java:310)
   org.alfresco.web.site.AbstractRequestContext.getCredentialVault(AbstractRequestContext.java:435)
   org.alfresco.web.framework.WebFrameworkConnectorProvider.provide(WebFrameworkConnectorProvider.java:80)
   org.alfresco.web.scripts.RemoteStore.getConnector(RemoteStore.java:739)
   org.alfresco.web.scripts.RemoteStore.callGet(RemoteStore.java:693)
   org.alfresco.web.scripts.RemoteStore.hasDocument(RemoteStore.java:344)
   org.alfresco.web.framework.StoreModelObjectPersister.getObjectByPath(StoreModelObjectPersister.java:136)
   org.alfresco.web.framework.StoreModelObjectPersister.getObject(StoreModelObjectPersister.java:108)
   org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:106)
   org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:136)
   org.alfresco.web.site.Model.getObject(Model.java:513)
   org.alfresco.web.site.Model.getPage(Model.java:165)
   org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
   org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
   org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
   org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
   org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ntlm-authentication-context.xml. I have tried several different ways to define the the servers

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
         <property name="allowSetEnabled" value="true" />
         <property name="allowGetEnabled" value="true" />
         <property name="allowDeleteUser" value="true" />
         <property name="allowCreateUser" value="true" />
   </bean>


   <!– The authentication component.                                      –>

   <!– Use the passthru authentication component to authenticate using    –>
   <!– user accounts on one or more Windows servers.                      –>

   <!– Properties that specify the server(s) to use for passthru          –>
   <!– authentication :-                                                  –>
   <!–   useLocalServer   use the local server for authentication         –>
   <!–   domain           use domain controllers from the specified domain–>
   <!–   servers          comma delimted list of server addresses or      –>
   <!–                    names                                           –>

   <bean id="authenticationComponent"
         class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl"
         parent="authenticationComponentBase">
       <property name="useLocalServer">
           <value>false</value>
       </property>
       <property name="servers">
           <value>DOMAIN\<IP of DC 1>,DOMAIN\<IP of DC 2>,<IP of DC 1></value>
       </property>
       <property name="personService">
           <ref bean="personService" />
       </property>
       <property name="nodeService">
           <ref bean="nodeService" />
       </property>
       <property name="transactionService">
           <ref bean="transactionComponent" />
       </property>
       <property name="guestAccess">
           <value>false</value>
       </property>
   </bean>

</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

webscript-framework-config-custom.xml I have tried several variations on teh URL including http://server:8080/alfresco/wcs, http://server.domain.com:8080/alfresco/wcs, https://server/alfresco/wcs, https://server.domain.com/alfresco/wcs. HTTPS works fine from a user standpoint. I have also tried a lagging / after wcs.

<alfresco-config>
   
   <!– Overriding endpoints to reference a remote Alfresco server –>
   <!–
   <config evaluator="string-compare" condition="Remote">
      <remote>

         <endpoint>
            <id>alfresco-noauth</id>
            <name>Alfresco - unauthenticated access</name>
            <description>Access to Alfresco Repository WebScripts that do not require authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://<server>:8080/alfresco/s</endpoint-url>
            <identity>none</identity>
         </endpoint>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://<server>:8080/alfresco/s</endpoint-url>
            <identity>user</identity>
         </endpoint>

         <endpoint>
            <id>alfresco-feed</id>
            <name>Alfresco Feed</name>
            <description>Alfresco Feed - supports basic HTTP authentication</description>
            <connector-id>http</connector-id>
            <endpoint-url>http://<server>:8080/alfresco/s</endpoint-url>
            <basic-auth>true</basic-auth>
            <identity>user</identity>
         </endpoint>
         
      </remote>
   </config>
   –>
   
   <!– Overriding endpoints to reference an Alfresco server with NTLM filter enabled –>
   <!– NOTE: the NTLM Authentication Filter must be enabled for both repository and web-tier web.xml –>
   <!– NOTE: if utilising a load balancer between web-tier and repository cluster, the "sticky –>
   <!–       sessions" feature of your load balancer must be used when NTLM filter is active –>
   <!—->
   <config evaluator="string-compare" condition="Remote">
      <remote>
         
         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://server.domain.local:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
         
      </remote>
   </config>
   <!—->

</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Share web.xml. this is the file i have mucked around the least with.

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

   <display-name>Alfresco Project Slingshot</display-name>    
   <description>Alfresco Project Slingshot application</description>
   
   <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>
         classpath:alfresco/webscript-framework-application-context.xml
         classpath:alfresco/web-framework-application-context.xml
         classpath:alfresco/web-framework-model-context.xml
         classpath:alfresco/slingshot-application-context.xml
      </param-value>
      <description>Spring config file locations</description>
   </context-param>
   
   <!– For NTLM authentication support use the following filter –>
   <!– –>
   <filter>
      <filter-name>Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.site.servlet.NTLMAuthenticationFilter</filter-class>
      <init-param>
         <param-name>endpoint</param-name>
         <param-value>alfresco</param-value>
      </init-param>
   </filter>
   
 <!–  –>
   <!– For NTLM authentication support enable the following mappings –>
   <!– after enabling the NTLMAuthenticationFilter filter class above –>
   <!– –>
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/s/*</url-pattern>
   </filter-mapping>
  <!—->
   
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>
   
   <servlet>
      <servlet-name>apiServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.WebScriptServlet</servlet-class>
      <init-param>
         <param-name>container</param-name>
         <param-value>webframework.webscripts.container</param-value>
      </init-param>
      <!–
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.basic</param-value>
      </init-param>
      –>
   </servlet>
   
   <servlet>
      <servlet-name>feedApiServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.WebScriptFeedServlet</servlet-class>
      <init-param>
         <param-name>container</param-name>
         <param-value>webframework.webscripts.container</param-value>
      </init-param>
      <init-param>
         <param-name>authenticator</param-name>
         <param-value>webscripts.authenticator.delegatingbasic</param-value>
      </init-param>
   </servlet>

   <servlet>
      <servlet-name>proxyServlet</servlet-name>
      <servlet-class>org.alfresco.web.scripts.servlet.EndPointProxyServlet</servlet-class>
   </servlet>

   <servlet>
      <servlet-name>uriTemplateServlet</servlet-name>
      <servlet-class>org.alfresco.web.uri.UriTemplateServlet</servlet-class>
   </servlet>

   <!– The Web Framework Dispatcher Servlet –>
   <servlet>
      <servlet-name>pageRendererServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.DispatcherServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
   </servlet>
   
   <servlet>
      <servlet-name>frameworkControlServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.FrameworkControlServlet</servlet-class>
   </servlet>
   
   <servlet>
      <servlet-name>loginServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.LoginServlet</servlet-class>
   </servlet> 

   <servlet>
      <servlet-name>logoutServlet</servlet-name>
      <servlet-class>org.alfresco.web.site.servlet.LogoutServlet</servlet-class>
   </servlet> 

   <servlet-mapping>
      <servlet-name>logoutServlet</servlet-name>
      <url-pattern>/logout</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>loginServlet</servlet-name>
      <url-pattern>/login/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>apiServlet</servlet-name>
      <url-pattern>/service/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>feedApiServlet</servlet-name>
      <url-pattern>/feedservice/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>proxyServlet</servlet-name>
      <url-pattern>/proxy/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>pageRendererServlet</servlet-name>
      <url-pattern>/page/*</url-pattern>
   </servlet-mapping>

   <servlet-mapping>
      <servlet-name>pageRendererServlet</servlet-name>
      <url-pattern>/p/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>uriTemplateServlet</servlet-name>
      <url-pattern>/s/*</url-pattern>
   </servlet-mapping>
   
   <servlet-mapping>
      <servlet-name>frameworkControlServlet</servlet-name>
      <url-pattern>/control/*</url-pattern>
   </servlet-mapping>
   
   <session-config>
      <session-timeout>60</session-timeout>
   </session-config>

   <!– welcome file list precedence order is index.jsp, then index.html –>
   <welcome-file-list>
      <welcome-file>index.jsp</welcome-file>
      <welcome-file>index.html</welcome-file>
   </welcome-file-list>

</web-app>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

bashmaq

Tried different configs too but it doesn`t help a lot. Full Alfresco Final distributive on Windows XP and separate WAR deployed on CentOS 5.2 shows the same error.
Is there any tracing/debugging possibilities?

jtp

Whenever I turn on the NTLM debug lines, it only records action on /alfresco, never for /share.

ivan_plestina

https://issues.alfresco.com/jira/browse/ALFCOM-2579

docgreen

I have got the same problem.

SSO ist not possible for Share, but is working for alfresco. I've tried Labs3 and the last nightly build on Windows 2003 an also on CentOS 5.2. Both with Java 1.6u12.

Have someome already found a solution?

jtp

No luck here. The JIRA ticket has 6 votes but no action yet.

kevinr

this error:

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

org.alfresco.error.AlfrescoRuntimeException: Unable to retrieve object: site-index of type: page
&nbsp;&nbsp; org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:140)
&nbsp;&nbsp; org.alfresco.web.site.Model.getObject(Model.java:513)
&nbsp;&nbsp; org.alfresco.web.site.Model.getPage(Model.java:165)
&nbsp;&nbsp; org.alfresco.web.site.SlingshotPageMapper.executeMapper(SlingshotPageMapper.java:197)
&nbsp;&nbsp; org.alfresco.web.site.AbstractPageMapper.execute(AbstractPageMapper.java:62)
&nbsp;&nbsp; org.alfresco.web.site.DefaultRequestContextFactory.newInstance(DefaultRequestContextFactory.java:109)
&nbsp;&nbsp; org.alfresco.web.site.FrameworkHelper.initRequestContext(FrameworkHelper.java:188)
&nbsp;&nbsp; org.alfresco.web.site.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:144)

root cause

org.alfresco.web.framework.exception.ModelObjectPersisterException: Error loading object id: site-index from persister id: RemoteStore_alfresco/site-data/pages_page
&nbsp;&nbsp; org.alfresco.web.framework.MultiModelObjectPersister.getObject(MultiModelObjectPersister.java:110)
&nbsp;&nbsp; org.alfresco.web.framework.ModelObjectManager.getObject(ModelObjectManager.java:136
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

means the docs haven't been followed here: http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM#Alfresco_Share_SSO_using_NTLM
BUT i fully except a whole bunch of people are saying it's not working

I know it's working in 3.0 Enterprise, 3.0.1 Enterprise and the new 3.1 Enterprise. And in theory Labs 3D has all the fixes rolled up from 3.0.1 so those docs should be correct. I will give it a go myself here following those instructions and let you know ASAP.

Cheers,

Kev

jtp

Thanks Kev.
I would not be surprised if I screwed something up. It's been known to happen

. I, and the 14 people who voted for the JIRA ticket are looking forward to your results!

If I can provide any of my files to help, let me know.

kevinr

No problem, I believe calling 14+ people "wrong" would be extremely foolish without trying it myself especially since this comment from the JIRA bug:

Share SSO doesn't work when configured by wiki http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM#Alfresco_Share_SSO_using_NTLM

Alfresco version is Labs 3 Stable, build 1526. Note that share.war from a bit older nightly releases does work with same config. Also check http://forums.alfresco.com/en/viewtopic.php?f=47&t=16472&st=0&sk=t&sd=a&start=15

does worry me that a change sneaked into Labs that shouldn't have… If so I'll try and find out exactly what it was and provide you with a patched class or new config if at all possible.

Thanks,

Kev

kevinr

Please see https://issues.alfresco.com/jira/browse/ALFCOM-2579 (now FIXED) for solution.

Kev

kevinr

FYI if you don't fancy pulling the latest web-framework code from SVN and building it to get the patched class, i have made it available here:
http://wiki.alfresco.com/w/images/2/2c/WebFrameworkConnectorProvider_Share_NTLMfix_Labs3E.zip

You will need to patch it into your alfresco-web-framework.jar here:
\alfresco-labs-tomcat-3Stable\tomcat\webapps\share\WEB-INF\lib\alfresco-web-framework.jar

Hope this helps

Kev