nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

CIFS and NTLM configuration

lgr

Hi,

My Alfresco (under linux debian) is configured for using ntlm. Webclient authentication works well.

The CIFS server is defined and worked well before ntlm configuration (using local alfresco user database) :

<host name="${localname}_A" domain="MYDOMAIN"/>
      <comment>Alfresco CIFS Server</comment>

      <!– Set to the broadcast mask for the subnet –>
      <broadcast>10.0.255.255</broadcast>

Then ntlm passthru is defined for ntlm authentication in CIFS (classic authenticator desactived):

<authenticator type="passthru">
        <Server>10.0.0.1</Server>
      </authenticator>
<!–
      <authenticator type="alfresco">
      </authenticator>
–>

Then the alfresco startup launches some errors, and the CIFS server does not start properly :

14:11:10,757 ERROR [alfresco.smb.protocol] File server configuration error, Wrong authentication setup for passthru authenticator
org.alfresco.error.AlfrescoRuntimeException: Wrong authentication setup for passthru authenticator
at org.alfresco.filesys.server.config.ServerConfiguration.processSecurityConfig(ServerConfiguration.java:1593)

I've read some posts inthe forum, and the wiki documentation, and nothing helped me out.

Configuring debug in log4j :

log4j.logger.org.alfresco.smb.protocol=debug
log4j.logger.org.alfresco.smb.protocol.auth=debug
(this line below does not output anything, only the two lines above do)
log4j.logger.org.alfresco.passthru.auth=debug

give me some more output before the exception :

14:10:53,135 DEBUG [org.alfresco.smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,135 DEBUG [smb.protocol.auth] Added passthru server [ad.mydomain.com:10.0.0.1ffline:0,0]
14:10:53,171 DEBUG [org.alfresco.smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [org.alfresco.smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [org.alfresco.smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [org.alfresco.smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [org.alfresco.smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]
14:10:53,171 DEBUG [smb.protocol.auth] New auth session from ged_1 to \\10.0.0.1\IPC$\
14:10:53,199 DEBUG [smb.protocol.auth] Trying address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected to address 10.0.0.1
14:10:53,204 DEBUG [smb.protocol.auth] Connected session, protocol : TCP/IP NetBIOS
14:10:53,221 DEBUG [smb.protocol.auth] SessionFactory: Negotiated SMB dialect NT LM 0.12
14:10:53,247 DEBUG [smb.protocol.auth] Passthru server online, [ad.mydomain.com:10.0.0.1nline:0,0]

Another information :
When re-enabling alfresco authenticator in file-servers.xml, startup goes well without errors :

<authenticator type="alfresco">
</authenticator>

But my user is disallowed to login via passthru :

14:45:11,249 DEBUG [alfresco.smb.protocol] Server session started
14:45:11,254 DEBUG [alfresco.smb.protocol] Negotiated SMB dialect - NT LM 0.12
14:45:11,257 DEBUG [alfresco.smb.protocol] Assigned protocol handler - org.alfresco.filesys.smb.server.NTProtocolHandler
14:45:11,269 DEBUG [smb.protocol.auth] NT Session setup from user=, password=none, ANSIpwd=00, domain=, os=Windows 2002 Service Pack 2 2600, VC=0, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa5a71008]
14:45:11,269 DEBUG [smb.protocol.auth] MID=8, UID=0, PID=65279
14:45:11,270 DEBUG [smb.protocol.auth] Null CIFS logon allowed
14:45:11,271 DEBUG [smb.protocol.auth] User logged on (type Null)
14:45:11,285 DEBUG [smb.protocol.auth] NT Session setup from user=lgr, password=5c84eabe5448c24cfb44bfff3f57690d57826d1b34dd9c8c, ANSIpwd=7aaa1b5945540fcfdb498558da0f7eacba95e19ce7a95d54, domain=MYDOMAIN, os=Windows 2002 Service Pack 2 2600, VC=1, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=4c0c262fa6a71008]
14:45:11,285 DEBUG [smb.protocol.auth] MID=16, UID=0, PID=65279
14:45:11,311 DEBUG [smb.protocol.auth] Authenticated user lgr sts=Disallow via Passthru
14:45:11,312 DEBUG [smb.protocol.auth] User lgr, access denied

Looking into the source, it looks like doMD4UserAuthentication fails, but i don't understand why.

Does anyone know what's wrong with this configuration ?

Laurent.

Note1 : a fresh rebooted windows station made the same behaviour.
Note2 : a connection on the ftp server works well

Find more posts tagged with

Comments

dschmalz

Same configuration, different OS (Windows 2003 Server) but same error here. Tried with the various parameters but it doesn't work. Did you get any chance to solve this issue?

David

hfrank

Did anyone succeed to resolve this problem?

idahodeq

Has anyone figured this out yet? I'm having a heck of a time with NTLM + CIFS

steve

Hello,

There was an issue with NTLM and CIFS that crept in during the 1.3 timeframe.
This has been resolved for the 1.3 final.

Steve

hfrank

Hi, Steve,

Could you tell us when 1.3 final will be released?
Is it possible for us to correct it now?

Thanks for you reply.

Best Regards
Frank

Hello,

For hFrank : the final version was released this morning !

But I already have the problem with CIFS and NTLM in the final version

15:22:47,750 DEBUG [org.alfresco.smb.protocol.auth] NT Session setup from user=XXXXXX, password=d19c5ed3a1d421fc1aa8071cdde94e6a36ae6222a4c02389, ANSIpwd=08ab54cff8771fcd7f3ec1cf2fcc74575e55e2f14a159f21, domain=XXXX, os=Windows 2002 Service Pack 2 2600, VC=0, maxBuf=61440, maxMpx=4, authCtx=[NTLM,Challenge=c89999b8659088c2]
15:22:47,750 DEBUG [org.alfresco.smb.protocol.auth]&nbsp;&nbsp; MID=16, UID=0, PID=65279
15:22:47,750 DEBUG [org.alfresco.smb.protocol.auth] Authenticated user XXXXXX sts=Disallow via Passthru
15:22:47,750 DEBUG [org.alfresco.smb.protocol.auth] User XXXXXX, access denied‍‍‍‍‍

What to do ?
Thanks

hfrank

Hi,
I tested the final version also. Unfortunately it does not work as you tried.
In order to make sure <authenticator> in the file-servers.xml corrrect , I changed the <authenticator> from <authenticator type="alfresco"> to :

 <authenticator type="paththru"><Server>Domain controller ip</Server></authenticator>
‍‍‍

But when restarting alfresco, the following error occurred:

12:52:48,319 ERROR [org.alfresco.smb.protocol] File server configuration error, Wrong authentication setup for passthru authenticator
org.alfresco.error.AlfrescoRuntimeException: Wrong authentication setup for passthru authenticator
   at org.alfresco.filesys.server.config.ServerConfiguration.processSecurityConfig(ServerConfiguration.java:1594)
   at org.alfresco.filesys.server.config.ServerConfiguration.init(ServerConfiguration.java:489)
   at org.alfresco.filesys.server.config.ServerConfiguration.onApplicationEvent(ServerConfiguration.java:420)
‍‍‍‍‍‍‍

Any ideas?

Thanks
Frank

It's "passthru" not "paththru"

.

Edit : Even with "passthru" I can't open the folder…

"Access denied", "sts disallow via passthru"

.

Nobody has a solution ?

hfrank

Sure, it is passthru.
And also, i added the following lines:

<accessControl default="None">
  <protocol type="CIFS" access="Write"/>
  <user name="me" access="Write"/>
</accessControl>
‍‍‍‍‍‍

The world keeps unchanged.

Someone from developpers can help us ?

I'd like to install Alfreco 1.3.0 on a server next week, but if CIFS doesn't work, I'll have to install the 1.2.1 version.

Thanks

hfrank

hi, LC
Do you mean you can configure CIFS+NTLM under 1.2.1 but not under 1.3 ?

steve

Hello,

This issue has been fixed for 1.3E

http://www.alfresco.com/jira/browse/AR-691

Steve

Thanks, but I have the final release 1.3.0.

Will the problem be corrected in the community release ?

Thanks, but I have the final release 1.3.0.

Will the problem be corrected in the community release ?

Please ?

hfrank

It seems the bug fix pace of community Edition is slower than the Enterprise Edition. So we decided to pay for the Enterprise Network edition.

bhavin_t

or is there a patch available in the source tree that can be downloaded?

thanks
bhavin

kevinr

We have merged multiple bug fixes from Enterprise to Community with the latest Alfresco release:

http://sourceforge.net/project/showfiles.php?group_id=143373&package_id=157460&release_id=434594

Thanks.

Kevin

davin_c

Hi,

I've been following this post to see if I could resolve the same issue. I'm currently using the latest Alfresco release for Tomcat (alfresco-community-tomcat-1.4.ODF-Build54.tar.gz) and am still having the same issues with CIFS passthru authentication.

Davin

kevinr

Appologies, I have been informed that the bug fix was merged into the HEAD codeline after the latest ODF release. I can confirm that the fix is definitely in the SVN HEAD today.

The file you are interesting in is:
org.alfresco.filesys.server.auth.ntlm.AlfrescoAuthenticator

It can be obtained and built from SVN.

Thanks,

Kevin

davin_c

Kevin,

Thanks for the reply. I'll try and retrieve the file sometime soon (I'm not really sure how to retrieve from SVN).

Davin

kevinr

This may help:
http://wiki.alfresco.com/wiki/Alfresco_SVN_Development_Environment

timconst

I retrieved the org.alfresco.filesys.server.auth.ntlm.AlfrescoAuthenticator file from the SVN. I'm not sure what to do with it.

I originally installed Alfresco using the alfresco-1.3.0-windows-community.exe

I'm using Alfresco on a Windows 2003 Server and downloaded from the SVN using TortoiseSVN.

kevinr

You will need to compile the code as per the instructions on the wiki. So I suggest using the build scripts that you get from SVN. Once the .class file is compiled, you can patch it into the repository.jar file inside the alfresco.war file. So you will need to unpack your existing alfresco.war file and then unpack the repository.jar from it, overwrite the .class file in the appropriate package folder and then repack the jar and war files. You can then overwrite your old WAR file in your Alfresco deployment with the new one.

Thanks,

Kevin

wahu

OK. I successfully made the CIFS work with passthru authenticaion.
In addition to retrieve and compile the org.alfresco.filesys.server.auth.ntlm.AlfrescoAuthenticator, I also modify the org.alfresco.filesys.server.config.ServerConfiguration as following:
from

 if (authType.equalsIgnoreCase("passthru")) {
if ( ntlmMode != NTLMMode.NONE)
throw new AlfrescoRuntimeException("Wrong authentication setup for passthru authenticator");
‍‍‍‍‍

 if (authType.equalsIgnoreCase("passthru")) {
if ( ntlmMode != NTLMMode.PASS_THROUGH)
throw new AlfrescoRuntimeException("Wrong authentication setup for passthru authenticator");
‍‍‍‍‍

kevinr

That's great news.

Cheers,

Kevin

unknown-user

Could anyone post the recompiled files. I'm not a developer and don't know how to solve this

. I'm very interested getting CIFS to work.

Thank you.

wahu

I can mail you the recompiled class files.
However, you still need to know how to replace the old files in repository.jar & alfresco.war

nilas

Hi,

I followed the instruction provided by Kevin: recompiled the sources, unpack .war and repository.jar, packed the recompiled AlfrescoAuthenticator.class in the original alfresco.war file, but… it didn't work. :evil:

I also tried to follow "wahu" suggestion regarding ServerConfiguration.class but it didn't work as well.

I tried to patch the 1.3.0 alfresco.war tomcat-bundle release and the 1.4-build54 alfresco.war tomcat-bundle. Nothing to do…

Wahu, may I send you my .class files to see if they work on your environment? Let me know.

Help!

Nicola

wahu

I mailed Tiwanaku the compiled classes and he replied it works well.

May I know what error message you got after setting log4j.logger.org.alfresco.smb.protocol.auth=debug in log4j.properties file?

BTW, please execute the command "net view \\servername_a" in client side and tell me the message.

nilas

I have to apologize

ops: I made a mistake.

I overwrite the alfresco.war file, AFTER the tomcat server was already started once. This way the repository.jar was the original one.

The AlfrescoAuthenticator class file I compiled works perfectly.

Thanks to Wahu for his reply and to Kevin (and Alfresco developers) for the fix….

Finally I can start testing 1.3.0 on my test-environment. Can't wait

Nicola