nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Basic SSO and NTLM help, please... Getting frustrated...

deaconboogie

This is really wearing me down… :shock:

I'm using 3.2 and have read http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems pretty heavily, and I still can't seem to get this to work correctly.

All I want to do is the following:

1. User visits an Alfresco page and based on the logged in domain user, logs in as that user.
2. If the browser presents no NTLM, it prompts and the user can enter (DOMAIN\user or user@domain).

I need to use passthru because I don't want to worry about password sync-up.

Here are the only file modifications I've made to alfresco-global.properties:

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru

ntlm.authentication.sso.enabled=true
ntlm.authentication.mapUnknownUserToGuest=false
passthru.authentication.domain=MYDOMAIN
passthru.authentication.servers=MYDOMAIN\\dc.mydomain.local
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true
passthru.authentication.guestAccess=true
passthru.authentication.defaultAdministratorUserNames=administrator
‍‍‍‍‍‍‍‍‍‍‍

Right now, it prompts me for credentials, but it wont accept anything I put in other than the local default admin/admin Alfresco user credentials.

Can anyone share some straightforward, non-confusing examples or help me untangle the above configuration?

Thanks!

Find more posts tagged with

Comments

dward

Try this

passthru.authentication.domain=
passthru.authentication.servers=MYDOMAIN\\dc.mydomain.local,dc.mydomain.local

Don't use the userLocalServer, domain or servers properties at the same time. They are mutually exclusive. If you set domain, it will try to work out your domain server from the domain name. It's most reliable to list the servers explicitly as above. Include a server without a domain mapping as a 'fallback' when no domain is specified in the authentication request.

deaconboogie

Try this

Trying… Alfresco sure takes a long time to start. Close to five minutes. It makes testing changes that much more painful…

What kind of hoops am I going to go through to get Share working with this? I read in another thread that NTLM is broken with 3.2?

dward

Well in the upcoming enterprise version you can edit these settings using Jconsole without restarting the entire system but I guess that's no consolation.

We expect to have a fix for Share NTLM very soon.

deaconboogie

Try this

No dice. Same problem as before.

BTW: I am sure that NTLM is enabled and the URL is in my intranet site list.

How can I enable some form of debugging for the authentication so I can see what possible issue it is having?

dward

Same problem as before what?

dward

Oh I see. Please forgive me. I re-read the original post. Have an idea…

dward

In the authentication subsystems wiki, it explains that SSO and CIFS authentication cannot be chained. You have two SSO-capable subsystems in your chain

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1

assthru

therefore the first enabled one in the chain (alfrescoNtlm1) will do the SSO authentication.

Probably best to take alfresco out the chain

authentication.chain=passthru1

assthru

Or if you really do want Alfresco internal users to be able to log in as well as domain users, you are going to have to switch off sso.enabled on both subsystems.

This is a limitation imposed on us by the NTLM negotiation mechanism.

deaconboogie

In the authentication subsystems wiki, it explains that SSO and CIFS authentication cannot be chained. You have two SSO-capable subsystems in your chain

authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru

Okay, that makes sense… I was going off of the example that seemed to describe what I want at first glance. I probably misread it in the panic.

The fact that it's called "alfrescoNtml" when it may or may not have anything to do with NTLM may have thrown me off… I mean, if it says NTLM and it has to do with the local Alfresco user database, in the context of creating local users with matching password hashes, it seems confusing. And even my just-stated understanding may be grossly inaccurate.

The chain modification above seems to work. However… I found another somewhat disturbing issue:

It looks like all three variations of the login/credentials work (user@domain, domain\user, user)

Notice my passthru.authentication.defaultAdministratorUserNames contains just "administrator". When I log in as administrator@domain or domain\administrator, I do not receive the administrative icon in the toolbar. When I log in as just "administrator", I do get the admin icon.

Won't this cause issues if the user is not using NTLM and has to type their credentials?

_sax

I'm trying to understand SSO systems right.
I try to use ldap sync and therefore use ldap-ad as second part of my authentication chain. To log the synced users in, I use passthru with SSO and CIFS enabled. This is working good. But I still would like to be able to use the internal guest account for webscripts or what may come.
So my requirements are: syncing from ldap-ad, sso through browser, cifs and having a guest account.
If I add alfrescoNtlm to the authentication chain I'm either able to login by SSO as 'me', but having no guest account (log saying '[org.alfresco.web.app.servlet.NTLMAuthenticationFilter] Authentication failed, 06150006 Account disabled' when trying to manually sign on as guest) or having a usable guest account, which is auto-signing me on regardless of my real username.
Is this a NTLM-limitation, or did I do something wrong? I tested almost every combination in the authentication chain and of the true/false options that come with the subsystems.

Thanks a lot for the clarifying statements in this forum!

dward

It would appear that guest logons are validated against the back-end domain server. So you would have to actually enable the domain guest account to enable guest logins using passthru.

_sax

Okay, thank you! I checked webscripts, and they are working, even though I'm not able to login manually as guest. So all is well

wiz561

OK, I have a similar situation. Bottom line is that I got the web authentication working by using the information in this post.

I'm having a problem with trying to authenticate with my AD credentials to the cifs share. I can login to the share using the local default admin/admin username and password, but can't use my AD credentials.

I have a feeling that I didn't set an option up properly. Can somebody assist in giving a hint on how to accomplish this?