nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

How to login as internal user with SSO working?

shazada

Hi guys,

First of all I'm not that active at the forums, because my company has an Enterprise partnership and I normally use the Alfresco Support.
I've seen the topics created here and a lot are very useful, so I'll try to be more active and post my questions on both sides.

My situation:
I've got Alfresco 3.2 Enterprise installed.
I need to have subsystems configured like this:
- Alfresco users (external) need to login in Share
- AD/LDAP users need to be synced in Alfresco, because users need to invite users from the company. So passthru just won't be enough.
- SSO needs to work for AD/LDAP users (which are synced in Share).

My subsystems chain is:
- alfrescoNtlm, passthru, ldap
- alfrecoNtlm: sso.enabled=false
- ldap: ldap.authentication.active=false
- passthru: sso.enabled=true

I've done this, because when enabling sso in AlfrescoNtlm, I can't login with the AD/LDAP users EVEN when they are created/synced in Alfresco

By choosing this way SSO works for AD/LDAP users even in Share!
The problem is that now alfresco/external users can't login in Share. In Explorer they can use: alfresco/faces/jsp/login.jsp and they get logged in –> so no problem.
In Share I haven't found a way to use a login. I've tried share/login.jsp –> you'll get a simple (ugly) login and when I try to login –> SSO from passthru get's invoked.
This is done because of the NTLMAuthenticationFilter runs on all pages.

So I'm a bit stuck.

Thanks!

Find more posts tagged with

Comments

dward

I'm afraid this is how we would expect it to work. Due to the restrictions of the NTLM / Kerberos protocols, SSO can only be handled by a single member of the authentication chain, because we don't get a chance to retry another member on failures. So SSO is always handled by the first member of the chain with SSO enabled.

So in this scenario, it would probably be best to stop using the internal accounts, remove alfrescoNtlm from the chain and create an equivalent administrator user in AD who is either named in your passthru.authentication.defaultAdministratorUserNames list, or is a member of the ALFRESCO_ADMINISTRATORS group.

shazada

I don't really agree with that. Because if this is how it 'should' work, then Why can you login in Explorer as an internal user?

I mean, is it hard to just bypass a certain page like the one in Explorer? alfresco\jsp\faces\login.jsp –> this one bypasses the SSO and tries Basic authentication.

In Share, every page\* goes to the NTLMAuthentication filter. I don't think it's that hard to just define a 'seperate' login page which doesn't goes through the NTLM filter and just does Basic Auth. like in Explorer.

I've searched through the NTLM filter and there is a session attribute like _login or something like that. So I have to 'define' my own page and send that attribute to the filter so it doesn't do SSO?

dward

I see, so your complaint is that internal users can still log in using a web form with SSO enabled in Alfresco Exporer, but not in Share. I have logged a bug.

https://issues.alfresco.com/jira/browse/ALF-1923

You may be able to get around it by coding your own version of org.alfresco.web.site.servlet.NTLMAuthenticationFilter that resorts to calling redirectToLoginPage when NTLM authentication fails.

open

We have come across this issue our selves.

Single sign on works great for our internal users, but we cant figure out how to give access to external users.

Am I correct to assume that the combination of SSO and giving external users access to Share isn't possible at this time?

Thanks

shazada

I see, so your complaint is that internal users can still log in using a web form with SSO enabled in Alfresco Exporer, but not in Share. I have logged a bug.

https://issues.alfresco.com/jira/browse/ALF-1923

You may be able to get around it by coding your own version of org.alfresco.web.site.servlet.NTLMAuthenticationFilter that resorts to calling redirectToLoginPage when NTLM authentication fails.

Yes, you're right. Explorer works fine, it's a bug in Share.

shazada

But how can I change the NTLMaut.filter.

Do you have any ideas? There is a login.jsp in the Share web-application. I've tried to modify it, so that it would send the login params to the NTLM filter, but eventually I'll see a SSO login.

dward

It would involve understanding the Java class I just mentioned and modifying it.

jc-lgms

hello,
have you find a solution?
thanks

juan

Issue is closed, but it does not work for me…. (3.4a)

Is there any workaround?

juan

The issue persists in 3.4b… isn't it?

kevinr

You are correct

this feature got broken during the SSO filter refactoring in 3.3. Fortunately this is now fixed in 3.3.5, 3.4 Enterprise and I've just merged the fixed to 3.4.c (revision 24328) ready for next Community release coming soon.

Thanks,

Kev

jc-lgms

Thanks!

dranakan

Hello,

I'am using the 34D. How can we change user in Share ? (when the SSO is activated).

Thank.

g_sri

Hello,

I am using 3.4.d and want to integrate alfresco share with one of my other web application.Also i need to find the maximum file size that can be uploaded and where i can set the quota for each user created by me .Also can we archive the documents uploaded and how can we integrate the LDAP with 3.4.d.

Thanks in advance

dranakan

Hello,

This are links allowing changing user when SSO is enable.

Explorer : http://ged:8080/alfresco/faces/jsp/extension/login.jsp
Share : (Restart browser if SSO user is connected) http://ged:8080/share/page?pt=login
‍‍‍

rob

Hi!

if acces with external user to alfresco explorer and Share (http://myHost/share or http://myHost/alfresco) work fine,
but Share not work when acces (http://myHost:8080/share/page?pt=login) with internal user!

My configuration is:

- alfresco 3.4.d CE
- authentication whit SSO via shibboleth

portion of my alfresco-global.properties:

authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm
external.authentication.proxyUserName=
external.authentication.proxyHeader=X-Alfresco-Remote-User
external.authentication.enabled=true
external.authentication.userIdPattern=
‍‍‍‍‍‍‍

portion of my share-config-custom.xml:

<config evaluator="string-compare" condition="Remote">
      <remote>
         <!– keystore>
             <path>alfresco/web-extension/alfresco-system.p12</path>
             <type>pkcs12</type>
             <password>alfresco-system</password>
         </keystore –>

         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

my log:

SEVERE: Servlet.service() for servlet Spring Surf Dispatcher Servlet threw exception
org.json.JSONException: A JSONObject text must begin with '{' at character 47
        at org.json.JSONTokener.syntaxError(JSONTokener.java:413)
        at org.json.JSONObject.<init>(JSONObject.java:180)
        at org.json.JSONObject.<init>(JSONObject.java:420)
        at org.springframework.extensions.surf.support.AlfrescoUserFactory.loadUser(AlfrescoUserFactory.java:182)
        at org.springframework.extensions.surf.support.AbstractUserFactory.initialiseUser(AbstractUserFactory.java:176)
        at org.springframework.extensions.surf.support.AbstractUserFactory.initialiseUser(AbstractUserFactory.java:99)
        at org.springframework.extensions.surf.RequestContextUtil.initialiseUser(RequestContextUtil.java:203)
        at org.springframework.extensions.surf.RequestContextUtil.populateRequestContext(RequestContextUtil.java:176)
        at org.springframework.extensions.surf.RequestContextUtil.populateRequestContext(RequestContextUtil.java:131)
        at org.springframework.extensions.surf.mvc.AbstractWebFrameworkView.populateRequestContext(AbstractWebFrameworkView.java:349)
        at org.springframework.extensions.surf.mvc.AbstractWebFrameworkView.renderMergedOutputModel(AbstractWebFrameworkView.java:259)
        at org.springframework.web.servlet.view.AbstractView.render(AbstractView.java:250)
        at org.springframework.web.servlet.DispatcherServlet.render(DispatcherServlet.java:1060)
        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:798)
        at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:716)
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:647)
        at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:552)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.alfresco.web.site.servlet.MTAuthenticationFilter.doFilter(MTAuthenticationFilter.java:74)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.alfresco.web.site.servlet.SSOAuthenticationFilter.challengeOrPassThrough(SSOAuthenticationFilter.java:587)
        at org.alfresco.web.site.servlet.SSOAuthenticationFilter.doFilter(SSOAuthenticationFilter.java:331)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
        at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:852)
        at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
        at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
        at java.lang.Thread.run(Thread.java:619)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Thanks for any help you can give me

thanks