How to force Alfresco to use SPNEGO? (no Kerberos involved)

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

nicolasraoul

Hello all,

How can I force Alfresco to use SPNEGO?

I use Alfresco Enterprise 3.1 with its default <authenticator type="enterprise"/>
Wireshark shows that all SMB packets (from client and from server) contain a "Security blob" that contains an "NTLMSSP" block of data.
I have never managed to see any SPNEGO or GSS-API stuff in the packets using Alfresco.
Maybe because I am not using Kerberos?
Is there a way to force Alfresco to use SPNEGO even though there is no Kerberos involved?


————————————————————–
Before someone asks, here is why I want this:

I am facing the following bug:
- User logs into Windows
- User opens Internet Explorer 8 on Alfresco's Web Client
- User logs into Alfresco (not the same username as Windows)
- User clicks on any file's "View in CIFS"
- A connection error appears.
Reproducible 90% of the time. The important thing is that the share is not already mounted when the user clicks.

If I replace Alfresco with Samba, it works.
But if I configure Samba to "use spnego=no", the same error appears.

So I guess this bug appears when *not* using SPNEGO.
More on this bug: https://issues.alfresco.com/jira/browse/ALFCOM-3616

Thank you very much!
Nicolas Raoul

nicolasraoul

In EnterpriseCifsAuthenticator.java I have found what a piece of code that suggests there is such a possibility:

// Check if raw NTLMSSP or SPNEGO/NTLMSSP should be used
ConfigElement useSpnego = params.getChild("useSPNEGO");
if ( useSpnego != null) {
‍‍‍‍‍

But a Google search for Alfresco useSpnego only returns this source file… does not look like a popular configuration element!
If anyone has more information, it would be greatly appreciated 🙂

Cheers,
Nicolas Raoul