NTLM (No valid CIFS authentication combination available)

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

fstnboy

Hi all,

I´ve got installed the Alfresco Community version 2.1.0. We were working with the LDAP sync anc everything was going ok, but the fact that our AD just leave us to export 1000 users, so as there are more than 1000 we needed to change our configuration. Then we thought that we don´t need to import users, so a simple NTLM configuration should work.

The conf I have is the next:

web.xml

<filter>
      <filter-name>Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AuthenticationFilter</filter-class>
      
      <!– For Novell IChain support use the following filter –>
      <!–
        <filter-class>org.alfresco.web.app.servlet.NovellIChainsHTTPRequestAuthenticationFilter</filter-class>
      –>
      
      <!– For NTLM authentication support use the following filter –>
        <filter-class>org.alfresco.web.app.servlet.NTLMAuthenticationFilter</filter-class>
   </filter>
   
   <filter>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <filter-class>org.alfresco.repo.webdav.auth.AuthenticationFilter</filter-class>
   
      <!– For NTLM authentication support use the following filter –>
        <filter-class>org.alfresco.repo.webdav.auth.NTLMAuthenticationFilter</filter-class>
   </filter>

   <filter>
      <filter-name>Admin Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.app.servlet.AdminAuthenticationFilter</filter-class>
   </filter>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/faces/*</url-pattern>
   </filter-mapping>
   
   <!– For NTLM authentication support enable the following mapping –>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/navigate/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/command/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/template/*</url-pattern>
   </filter-mapping>
      
   <filter-mapping>
      <filter-name>WebDAV Authentication Filter</filter-name>
      <url-pattern>/webdav/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/admin/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/categories/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/groups/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/delete-user.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/users/users.jsp</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Admin Authentication Filter</filter-name>
      <url-pattern>/faces/jsp/dialog/system-info.jsp</url-pattern>
   </filter-mapping>

   <listener>
      <listener-class>org.apache.myfaces.webapp.StartupServletContextListener</listener-class>
   </listener>
   
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>
   
   <listener>
      <listener-class>org.alfresco.web.app.ContextListener</listener-class>
   </listener>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ntlm-authentication-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

    <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao">
       
    </bean>

    <!– The authentication component.                                      –>

    <!– Use the passthru authentication component to authenticate using    –>
    <!– user accounts on one or more Windows servers.                      –>
    
    <!– Properties that specify the server(s) to use for passthru          –>
    <!– authentication :-                                                  –>
    <!–   useLocalServer   use the local server for authentication         –>
    <!–   domain           use domain controllers from the specified domain–>
    <!–   servers          comma delimted list of server addresses or      –>
    <!–                    names                                           –>
       
    <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl">
        <!–
        <property name="useLocalServer">
            <value>true</value>
        </property>
        –>
        
        <property name="servers">
            <value>madcndc2.lig.local:389</value>
        </property>
        
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionComponent" />
        </property>
        <property name="guestAccess">
            <value>false</value>
        </property>
    </bean>
    
</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Did I miss something?

ofrxnz

You probably need to edit the file-server.xml or file-server-custom.xml file.  the first is actually in the deployed WAR file.  The second is in the "Shared" configuration folder.

If possible you should edit the second though the CIFS server is probably not defined there by default but when you get a chance you should migrate it to the shared location.  its easier for maintenance.

Usually, when i see this happen the authentication mechanism is set to "enterprise" and i dont have an enterprise authentication setup (or pay for it).

I believe if you are prior to version 3 and not an enterprise customer you probably need to use the "alfresco" authentication mechanism or the "passthru" mechanism.  Don't take my word for this though

here is the 2 cent version of what you are looking for,need to add/change in the definition of the CIFS server.  found in one of the two files above.  This will be defined for every file server type make sure you are working in the CIFS portion or you will break something. 

change this

      <authenticator type="enterprise">
      </authenticator>


into this

      <authenticator type="alfresco">
      </authenticator>




here is the relevant quote and authentication options from

http://wiki.alfresco.com/wiki/Enterprise_Security_and_Authentication_Configuration

CIFS
    alfresco - to be used with the Alfresco NTLMAuthenticationComponentImpl or an authentication component that supports MD4 password hashes. The NTLMAuthenticationComponentImpl supports NTLMv1 passthrough authentication. If the CIFS client supports single sign on using NTLMv1 then the NTLMAuthenticationComponentImpl can be used for SSO; NTLMv2 is not supported at all for this option. An authentication component that supports MD4 password hashes can be used to carry out an NTLMv1 authentication sequence with the client application but not single sign on.

    passthru - which allows configuration of authentication direct against one or more AD servers. The repository must be configured so that it authenticates against the same AD server using something like LDAP or JAAS+Kerberos. This option does not support SSO. Pasthrough authentication is only supported for NTLMv1.

    enterprise - which supports using any authentication component that can provide the MD4 password hash (currently only the default Alfresco authentication component). The MD4 hash will be used for NTLMv1 or NTLMv2 authentication depending on the client/server negotiation. This does not support SSO.

    enterprise - this option can also be configured to support Kerberos authentication. This supports SSO for CIFS clients that support Kerberos.

On another note, CIFS can be really picky with the following portion of the NTLM configuation

<property name="servers">
            <value>madcndc2.lig.local:389</value>
        </property>

There are a ton of slightly different variations on this so play around

in Labs 3 Stable i have mine defined as

<property name="servers">
            <value>DOMAIN/<server name or IP></value>
        </property>

I prefer using the IP notation

so for your setup try something like

<property name="servers">
            <value>LIG/madcndc2</value>
        </property>