nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

CIFS Issues

durrell

This is my last remaining issue with my Alfresco implementation.

I can't map drives to Alfresco, nor can I authenticate by just trying to connect to \\alfresco.

Error log is telling me this:

11:32:23,721 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=7, auth ctx=[NTLM,Challenge=299c1e9102a9485e]
11:32:23,725 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
11:32:23,727 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
11:32:23,734 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
11:32:23,735 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter

I'm also having an issue from within the Alfresco site. It seems to want to append an "a" to the Alfresco hostname within all of the download links. That can't work, since obviously our Alfresco hostname is simple "alfresco".

Any ideas? I can get more log information if necessary. I'm running on an Ubuntu server and running Alfresco as root (for now, since I haven't changed the CIFS ports to non-privileged ports).

Find more posts tagged with

Comments

jarrett

can you post your file-servers-custom.xml ?

durrell

<alfresco-config area="file-servers">
<config evaluator="string-compare" condition="CIFS Server"
 replace="true">
          <serverEnable enabled="true"/>
          <host name="${localname}A" domain="MYDOMAIN"/>
          <!– The name attribute can use the special token of
 {localname} to use the local servers host name and generate a unique name by prepending/appending to it. –>
          <comment>Alfresco CIFS Server</comment>

          <!– Set to the broadcast mask for the subnet –>
          <broadcast>255.255.0.0</broadcast>

          <!– Use Java socket based NetBIOS over TCP/IP and native SMB on linux –>
          <tcpipSMB platforms="linux,solaris,macosx"/>
          <netBIOSSMB platforms="linux,solaris,macosx"/>

          <!– Use Win32 NetBIOS interface on Windows –>
          <Win32NetBIOS/>
          <Win32Announce interval="5"/>
          <hostAnnounce interval="5"/>

          <!–The following defines the authentication connector to an AD server –>
          <authenticator type="passthru">
               <!– within the following tag place a comma delimited list of your AD servers that Alfresco should talk to–>
               <Server>10.0.1.1</Server>
          </authenticator>

          <sessionDebug flags="Negotiate,Socket"/>
</config>
</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ofrxnz

This is one of the places where the "A" comes in…..I think there may be one in web-client.config as well. I know the web-client.config files hold things like the cifs domain suffix

this is line 5 of the config you posted

<host name="${localname}A" domain="MYDOMAIN"/>

you will want

<host name="${localname}" domain="MYDOMAIN"/>

The A is added because when alfresco runs on windows, windows fights alfresco for controll of the cifs like no one's business

durrell

Yeah, I noticed that. I went ahead and edited it.

The interesting thing is that it sees the Alfresco server fine when I used \\alfresco, and according to the logs we are authenticating properly and a session is opening up, but it declines my credentials and acts like they aren't correct.

I'm assuming I just have something misconfigured, I just can't figure out what it is.

ofrxnz

could you post your file-servers-config-custom.xml file as well as any custom authentication files you are using…

it should be in the "tomcat->shared" directory…..also, if your not using that could you post the "file-servers.properties" file

there are some restrictions on authentication mechanisms for cifs

durrell

I posted the file-servers-config earliier.

I am using strictly LDAP authentication with the "simple" auth method, no Kerberos or anything. What would you need to see?

ofrxnz

Thats it…

LDAP does not support CIFS.

you will have to use NTLM(alfresco or passthru) or Kerberos.

here is a link to the 3.2 information…I remember the same was true for every previous version i looked at too.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#What_are_the_Authentication_Subsystems.3F

Passthru is not hard to setup if you are using Active directory 2k3 and if you are using 2k7(8?) you probably want to use kerberos

durrell

Well I have CIFS configured to use Passthru and it appears to authenticate somewhat. It's just failing right after that.

Maybe I'm missing some sort of configuration somewhere?

ofrxnz

Could you post your authentication configuration.

durrell

I'm assuming you mean ldap-authentication.properties.


# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP^M
# - simple
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s
ldap.authentication.userNameFormat=%s@domain.com

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://[server name]:389

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=[username]

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=[password]

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
~‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ofrxnz

LDAP alone wont enable CIFS to work, you will need to configure NTLM using the ntlm-authentication-context.xml.samples file.

take a look at this.
http://wiki.alfresco.com/wiki/Configuring_NTLM#NTLM_Passthru_Authentication

This page should work for any alfresco version prior to 3.2

you only need to the the "NTLM passthru authentication" section and below.

Assuming you are running Active Directory 2k3 for authentication you dont need to use the "domain" configuration but just the server configuration and if you have two domain controllers 10.0.0.1 and 10.0.0.2 for the domain company.com

servers=COMPANY\10.0.0.1,COMPANY\10.0.0.2,10.0.0.1

on monday, i can get a copy of the working config i have used.

NTLM will use ports TCP:445, TCP139, UDP138, UDP137 (if i remember correctly)

durrell

Man, this is great. Thanks a ton for the guidance.

I'm actually using Windows Server 2008 with Active Directory. Does that make a difference?

ofrxnz

If memory serves me, NTLM is being fazed out in 2008 so it is not enabled by default. Though can be enabled.

You may want to take a look at kerberos. it seems to be replacing NTLM and uses ports tcp:88 and udp88 (i think)

I have set this up once….IT went a lot easier than it looked….The only querk was the application on AD that generates teh key literally crashed every time i ran it. But, the key was still good.

http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

ofrxnz

I forgot to mention you can combine NTLM+LDAP or Kerberos+LDAP.

alfresco will use NTLM or Kerberos for authentication and LDAP to synchronize user accounts

durrell

LDAP sync is working perfectly, as is authentication.

As long as I have a way for users to authenticate via Active Directory, I don't care how it happens.

Using the ntlm-authentication-context.xml file, I got this in the logs:


12:54:20,235 DEBUG [org.alfresco.smb.protocol.auth] Mapped client /10.0.7.201 to domain null
12:54:20,341 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=4, auth ctx=[NTLM,Challenge=235f636b3e9c3ea9]
12:54:20,398 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,401 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,491 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,491 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,534 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,535 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:20,578 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:20,579 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
12:54:29,865 DEBUG [org.alfresco.smb.protocol.auth] Mapped client /10.0.7.201 to domain null
12:54:29,869 DEBUG [org.alfresco.smb.protocol.auth] Passthru sessId=5, auth ctx=[NTLM,Challenge=474b6022dbeb0c50]
12:54:44,913 DEBUG [org.alfresco.smb.protocol.auth] Using Write transaction
12:54:44,916 ERROR [org.alfresco.smb.protocol.auth] org.alfresco.jlan.smb.SMBException: Invalid parameter
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Any ideas?

ofrxnz

Mapped client /10.0.7.201 to domain null

looks like you need to manually map NTLM domains in alfresco….

basicaly they are rules that say, if the client doesn't specify their domain, assume this is their domain based on their ipaddress

you can enter multiple domain/subnets by simply repeating the Domain Name line for each one

<DomainMappings>
  <Domain name="ALFRESCO" subnet="192.168.1.0" mask="192.168.1.255"/>
</DomainMappings>
‍‍‍‍

durrell

Where does that need to be mapped? The same file?

ofrxnz

yeah, I think it is nested in the same parent sections as the "server" "local", etc….Ill have to wait till tomorrow til i can get a config and double check

durrell

I believe that is the only section in that file that houses any config, so I'll try that and if it doesn't work then tomorrow I'll get a working config from you to base mine off of.

durrell

I found the correct file and specified the domain, but it's still not working.

ofrxnz

Sorry for the delay here is that config. it works for me …..It doesnt have the domain mappings in it, but it will choak if they are in the wrong spot….

some things to throw out, Is alfresco running as "root" if not, the CIFS ports may be privlaged and you may need to port map around it…

general firewall issues….

in this config DOMAIN = domain withouth the suffix…..eg domain.com is wrong

domain must be ALL CAPS

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <bean id="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
         <property name="allowSetEnabled" value="true" />
         <property name="allowGetEnabled" value="true" />
         <property name="allowDeleteUser" value="true" />
         <property name="allowCreateUser" value="true" />
   </bean>


   <!– The authentication component.                                      –>

   <!– Use the passthru authentication component to authenticate using    –>
   <!– user accounts on one or more Windows servers.                      –>

   <!– Properties that specify the server(s) to use for passthru          –>
   <!– authentication :-                                                  –>
   <!–   useLocalServer   use the local server for authentication         –>
   <!–   domain           use domain controllers from the specified domain–>
   <!–   servers          comma delimted list of server addresses or      –>
   <!–                    names                                           –>

   <bean id="authenticationComponent"
         class="org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl"
         parent="authenticationComponentBase">
       <property name="useLocalServer">
           <value>false</value>
       </property>
       <property name="servers">
           <value>DOMAIN\10.0.0.1,DOMAIN\10.0.0.2,10.0.0.1</value>
       </property>
       <property name="personService">
           <ref bean="personService" />
       </property>
       <property name="nodeService">
           <ref bean="nodeService" />
       </property>
       <property name="transactionService">
           <ref bean="transactionComponent" />
       </property>
       <property name="guestAccess">
           <value>false</value>
       </property>


   </bean>

</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

durrell

NTLM broke my authentication completely when I used that config. No errors in the log, it just wouldn't authenticate.

I believe we're going to use Kerberos, and we're going to let Alfresco's support team take care of it. We purchased our enterprise license this week, so this coming week we'll be opening a support ticket.

I'll update this thread when we find the solution and get it working. I'm hoping that Kerberos does the trick.

womer

I've been looking around for an answer related to this statement below. I need to enter multiple subnets for the same domain, but when I add a second Domain name line, I get an error stating there's multiple mappings for the same domain. To be honest, I don't even care, is there a global subnet/mask that would encompass every possible IP/subnet combo? I only have the one domain, but 12,000 clients across multiple subnets like 192.168.1.*, 172.16.* and 10.*

Thanks,
Scott

Mapped client /10.0.7.201 to domain null

looks like you need to manually map NTLM domains in alfresco….

basicaly they are rules that say, if the client doesn't specify their domain, assume this is their domain based on their ipaddress

you can enter multiple domain/subnets by simply repeating the Domain Name line for each one
<DomainMappings>
  <Domain name="ALFRESCO" subnet="192.168.1.0" mask="192.168.1.255"/>
</DomainMappings>
‍‍‍‍