Alfresco does not seem to correctly chain Kerberos auth

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

xkahn

I have filed this as an issue (https://issues.alfresco.com/jira/browse/ALFCOM-3752), but wanted to raise it here too; maybe I'm missing something important.

I am authenticating users through Kerberos.  Some users will have a ticket already and will have their web browsers set up to handle Negotiate authentication and some will not.  So I would like Alfresco to try SSO first, and if it fails, request a username and password.

In testing this, I can set up password auth via Kerberos and failures chain to the next auth subsystem.  But SSO Kerberos does not.  Users simply see a blank page if the authentication fails.

Testing in Internet Explorer, users see a Windows Security dialog until they either enter valid credentials. (or they press cancel and see the blank page)  In Chrome, which doesn't support negotiate at all, users only see a blank page.  In firefox, users can only access the site if it is set up correctly AND they have a valid ticket; otherwise they see a blank page.

Nothing appears in the logs.  The last message my server reports is:

17:22:28,377 INFO  [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised WebFramework Web Script Container (in 62.619ms)
17:22:29,231 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework‍‍

xkahn

So the forum rules ask me not to reply to myself, but …  well, I have more information. 

The problem is the way Alfresco appears to handle Kerberos SSO authentication on the HTTP level.  When Kerberos SSO is enabled, Alfresco stops using the login page and instead uses browser based authentication.  This means it sends a "401 Unauthorized" response to the request.  This code requires a "WWW-Authenticate" header which tells the client (web browser) what authentication methods are supported.  Alfresco sends only ONE authentication method (ignoring any other methods listed in the Authentication chain) – the Negotiate method.  Alfresco leaves the body of the "401 Unauthorized" response blank.  This means that browsers which don't support Negotiate (or aren't set up correctly, or the user isn't allowed to access etc, etc) can only display a blank page.

So what should Alfresco do?  Alfresco could start supporting Basic HTTP authentication as a fallback if username/password authentication schemes are listed in the authentication chain.  In this case, the WWW-Authenticate header would list both the Negotiate method and the Basic method.  Alternatively (or additionally?) Alfresco should send some kind of message or page when sending a "401 Unauthorized" response.  Ideally, it would send the login page.  When checking if a user is authenticated, a correct cookie should be sufficient and the Basic login credentials would be as well.