nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Sharepoint Protocol over SSL

krich

I have 3.2 Community up and running and have applied the vti.module amp to get SharePoint Protocol working. Everything is working fine accessing the URL http://mydomain.com:7070/alfresco with Office 2007 documents but I need to utilize the SharePoint protocol over the Internet and need to use the protocol over SSL. I have tried creating a reverse proxy with Apache2 and can map /alfresco as web folders but it will not work with Office 2007.

My question is whether or not there is a way to enable SSL in the Jetty 6.1.14 server included in the module or if anyone has had success implementing a reverse proxy or some other form of gateway. Passing credentials or accessing confidential files without encryption is not an option.

Find more posts tagged with

Comments

perom

I am also interested if anyone have succeeded in getting sharepoint protocol implementation on alfresco to work over apache SSL.
anyone?

perom

Ok, I managed on my own
I ended up with two virtual hosts on Apache. One to handle AJP and Alfresco, the other to handle SPP implementation:

<VirtualHost #name or IP#:443>
ServerName yourservername:443
ErrorLog logs/log location
TransferLog logs/log location
LogLevel warn
<Proxy *>
Order Deny,Allow
Allow from all
</Proxy>
RewriteEngine On
ProxyRequests Off
CacheDisable *
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

SSLCertificateFile /etc/pki/tls/certs/your_ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/your_ca.key

SSLProxyEngine On
ProxyPass /alfresco/ http://yourservername:7070/alfresco/
ProxyPassReverse /alfresco/ http://yourservername:7070/alfresco/
ProxyPass /_vti_bin/ http://yourservername:7070/_vti_bin/
ProxyPassReverse /_vti_bin/ http://yourservername:7070/_vti_bin/
ProxyPass /_vti_inf.html http://yourservername:7070/_vti_inf.html
ProxyPassReverse /_vti_inf.html http://yourservername:7070/_vti_inf.html
ProxyPass /_vti_history/ http://yourservername:7070/_vti_history/
ProxyPassReverse /_vti_history/ http://yourservername:7070/_vti_history/

RewriteCond %{SERVER_PORT} !443
RewriteRule ^(.*)$ https://yourservername/$1 [R,L]
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

</VirtualHost>

Also, to pass it correctly to Apache on port 443, exclude in documentlist.js and documentlist-min.js:

oRecord.setData("onlineEditUrl", window.location.protocol + "//" + window.location.hostname + ":" + me.options.vtiServer.port + "/" + $combine("alfresco", loc.site, loc.container, loc.path, loc.file));

cheers

pbkoob

Where are the settings for the Virtual server you created for WSS located on your server>

gulikoza

Hi,

I spent a week figuring this out. Perom's solution never worked for me (the returned webpage still has http://x.x.x.x:7070 links). I finally made it work with mod_sed:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <Location /sharepoint>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetOutputFilter Sed
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OutputSed "s/http:\/\/alfresco.mycompany.com:7070/https:\/\/alfresco.mycompany.com/g"

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetInputFilter Sed
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; InputSed "s/https:\/\/alfresco.mycompany.com/http:\/\/alfresco.mycompany.com:7070/g"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </Location>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <LocationMatch /_vti(.*)>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetOutputFilter Sed
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; OutputSed "s/http:\/\/alfresco.mycompany.com:7070/https:\/\/alfresco.mycompany.com/g"

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SetInputFilter Sed
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; InputSed "s/https:\/\/alfresco.mycompany.com/http:\/\/alfresco.mycompany.com:7070/g"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </LocationMatch>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; # Sharepoint access
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPass /sharepoint http://alfresco.mycompany.com:7070/sharepoint
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPassReverse /sharepoint http://alfresco.mycompany.com:7070/sharepoint

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPass /_vti_bin/ http://alfresco.mycompany.com:7070/_vti_bin/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPassReverse /_vti_bin/ http://alfresco.mycompany.com:7070/_vti_bin/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPass /_vti_inf.html http://alfresco.mycompany.com:7070/_vti_inf.html
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPassReverse /_vti_inf.html http://alfresco.mycompany.com:7070/_vti_inf.html
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPass /_vti_history/ http://alfresco.mycompany.com:7070/_vti_history/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ProxyPassReverse /_vti_history/ http://alfresco.mycompany.com:7070/_vti_history/
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

(I also changed vti.alfresco.deployment.context=/sharepoint in alfresco-global.properties to make /sharepoint. I guess it would be possible to do it with proxy as well, now that I made it work).
I haven't tested it all yet, I'm happy that the folder opens and works

. Please post any suggestions or comments you might have!

goldmar

I've tried the suggested configuration (even with mod_sed) but it does not work for me. Using vti over port 7070 works, however when I try the same with https://mydomain.tld/sharepoint I first get an authentification window (so the Proxy Forwarding works!) but afterwards there is a "Could not open URL" error. Any ideas? Is there any way to debug this?

Also, is there a way to limit the interfaces Alfresco VTI is listening on? (Similar to "cifs.bindto")

ebogaard

This is a funny thing, we've encountered as well.
We had 2 choices:
1. use mod_sed to rewrite the URLs. Result of this is that you can sign in and go directly to the sites and document library, but you can't checkin or checkout documents from office.
2. don't use mod_sed. Result of this is that you need to change the view from webview to any other view in office when switching in a site to the document library.

Rewriting the URLs some more only resulted in other things breaking. Ultimately we've chosen to use option 2, because of the added/needed functionality.

We've filed a bug report in april, but Alfresco keeps delaying the solution: https://issues.alfresco.com/jira/browse/ALF-2503?page=com.atlassian.jira.plugin.system.issuetabpanels%3Aall-tabpanel

goldmar

I've tested it some more now. When I wrote my last post I had an error in my Apache proxy configuration, that's why it did not work. Now it's the same as ebogaard describes.

1) Using mod_sed as written above it's not possible to update documents from office anymore. I can browse the document library and open documents, but I get read-only access.

2) Not using mod_sed everything works but then Office seems to use the original URL (without https) to open documents, so the connection is not encrypted anymore. That makes using https pointless…

ebogaard, in your bug report you've suggested a solution to the problem. Does it fix this problem completely? If it does, why did they not make this change - afterall these are only two lines of code?! Can you please upload an updated vti module which includes your fix?

ebogaard

I'm afraid the suggested solution doesn't work as expected.
You can test this yourself, as the .ftl is editable in je .amp (and je installed .jar), no compilation needed.

So I'm afraid we have to wait for Alfresco to fix this. Hope this happens soon!

goldmar

I've tried extracting the jar file with vti installed and there was noFileOpenDialog.ftl file. I think they have compiled it into classes in the new version, so you have to get the source, edit and the file and recompile everything… well, I guess I'd do that but since you say that it "does not work as expected" I'll just sit and wait untill the Alfresco team provides a solution. I hope they'll fix it in the next release. WebDAV works great for copying files for us but when opening .doc files in Word via WebDAV we often get errors when trying to save / update the file (instead one has to save the updated file locally and overwrite the old file by moving the new document with Explorer - very uncomfortable).

So there is no alternative to the vti extension right now. Also, WebDAV does not work with Windows 7…

erny1803

Hello.

I have proxied VTI to a different port with Apache and it's still working, algthough, I didn't changed the context:

Listen 81
<VirtualHost *:81>
    ServerAdmin webmaster@localhost
    ServerName alfresco.localdomain 
    ServerAlias alfrescolocal
    DocumentRoot /var/www
    <Proxy *>
        AddDefaultCharset off
        Order deny,allow
        Allow from all
    </Proxy>

    ProxyVia On
    ProxyPreserveHost On
    ProxyPass / http://alfrescolocal:7070/
    ProxyPassReverse / http://alfrescolocal:7070/

</VirtualHost>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now I'm trying to specify RewriteRules to mix both in the same VirtualHost. What I saw is the following should be mapped:

*_vti*
/resources
*documentLibrary*
*.asmx
*.vti

What I saw that changing

vti.alfresco.deployment.context ‍

property didn't work, as it is used from VTI module (Jetty) to contact Alfresco. See: tomcat/webapps/alfresco/WEB-INF/classes/alfresco/module/org.alfresco.module.vti/context/{vti-context.xml,vti-handler-alfresco3-context.xml}

erny1803

I tried using a RewriteRule based on User-Agent, but it doesn't work:

RewriteCond %{HTTP_USER_AGENT}  "^Microsoft Office.*"
RewriteRule ^/(.*) http://alfrescolocal:7070/$1 [P,L]‍‍

Word uses also connections through other applications, including IE.

The following settings in a normal Apache VirtualHost is working for me with Word 2003 and Alfresco Enterprise 3.2r. (You have to enable mod_rewrite & mod_proxy, of course.) Could anyone confirm this? (There is duplicate authentication.)

    ProxyVia On
    ProxyRequests Off
    ProxyPreserveHost On
    RewriteEngine On
    RewriteRule ^/(.*_vti.*)$ http://localhost:7070/$1 [P,L]
    RewriteRule ^/(resources.*)$ http://localhost:7070/$1 [P,L]
    RewriteRule ^/(.*\.asmx)$ http://localhost:7070/$1 [P,L]
    RewriteRule ^/(.*\.vti)$ http://localhost:7070/$1 [P,L]
    RewriteCond %{HTTP_USER_AGENT} "^Microsoft Office.*"
    RewriteRule ^/(.*documentLibrary.*)$ http://localhost:7070/$1 [P,L]
    ProxyPass / ajp://localhost:8009/
    ProxyPassReverse / ajp://localhost:8009/

‍‍‍‍‍‍‍‍‍‍‍‍‍‍