nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Single Sign On using Windows Authentication

Hi,

What is the simplest method to enable single sign on so that when users try to access the Alfresco web client, they are automatically logged in via their Windows login credentials? We would still like to maintain the list of users within Alfresco. What type of configuration is required to do this?

I am using Alfresco Enterprise 3.1 on a Linux Ubuntu server.

Thanks.

Find more posts tagged with

Comments

Any suggestions on this anyone? Any help will be much appreciated.

Thanks.

I work with 3.2, but look this post http://forums.alfresco.com/en/viewtopic.php?f=9&t=21268 and http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems.
i use chain passthru1

asstrhru,ldap1:ldap-ad and kerberos1:kerberos. but must worka and with chain alfrescoNtlm1:alfrescoNtlm:ldap1:ldap-ad
if mozilla open in address

about:config

1. ntlm
network.automatic-ntlm-auth.trusted-uris=http://yourdomain
2.kerberos
network.negotiate-auth.trusted-uris=http://yourdomain

Ie7+
1.ntlm
automatic
2.kerberos read post http://forums.alfresco.com/en/viewtopic.php?f=9&t=21268

Ive edited the web.xml file to change the settings to use NTLM authentication, and Ive added the domain settings into the file-servers.xml file. Ive decided not to use NTLM Passthrough because I'd like to control the users within Alfresco.

When I try to access the Alfresco web client now, a Window pops up telling me to enter a username and password which then grants me access to the system. It no longer takes me to the Alfresco login page. But a couple of things…

- Its still not using my Windows credentials to authenticate me and grant me access to the system.
- Why is a window popping up telling me to enter my username and password?

I think I may be missing something in the configuration, such as not connecting to our company's domain controller properly. Does anyone have any ideas on how to get this to work?

Thanks.

What browser are you using?

Internet Explorer 7 at the moment. But I would also like this to work with Internet Explorer 8 and Mozilla Firefox.

Make sure you add the alfresco server to the "Local intranet" security zone. For that zone, select "Custom Level…" and check what the "User Authentication" settings are.

Thanks, I've got rid of the Window popping up now that used to ask me for my username and password.

How do I now link my Alfresco application to our company domain controller so that it grants access automatically to anyone in our company thats logged onto their Windows computer through our domain? Do I need to enable NTLM Passthrough for this, or can it be done without Passthrough?

Yes you need to use passthru authentication. And if you want all users and their attributes brought over before they log in, you probably need LDAP sync as well. If you were using v3.2 it would be so much easier to explain!

OK. So I'm in the process now of configuring the ntlm-authentication-context.xml file to use NTLM passthru. I have the following properties to edit in the authentication component bean:

- useLocalServer
- servers
- personService
- nodeService
- transactionService
- guestAccess

From my understanding, to get this to work I only need to edit the servers property tag to include the IP address of the server where our domain controller is located? What about the domain name itself, where does that go in here? I've already put the domain name into the DomainMappings tag in the file-servers.xml file.

Also what about the other properties in here, do I need to edit them? And finally do I need to add in the protocolOrder property and set it to either NetBIOS or TCPIP?

Any help much appreciated.

No need to use IP addresses.

set useLocalServer=false

servers=NAMEOFDOMAIN\nameofserver,nameofserver

If you are doing this in a .properties file, the backslash has to be escaped with another backslash. If you are doing it in the XML file directly, it won't.

You should include your server with and without a domain prefix so that JLAN knows where to send it to when the client doesn't send a domain (weird I know).

Just tried that but its not working. When I try to access the web client it pops up a Window asking for my credentials, and when I enter my Windows username and password or the username and password of a previously created user in Alfresco, it doesnt accept the credentials and just prompts me for them again.

When you say nameofsever you mean the name of the server where our Active Directory is located right? I have looked in the log files and it says the following…

15:58:01,228 User

Smiley Frustrated

ystem ERROR [smb.protocol.auth] No valid CIFS authentication combination available
15:58:01,228 User

Smiley Frustrated

ystem ERROR [smb.protocol.auth] Either enable Kerberos support or use an authentication component that supports MD4 hashed passwords
15:58:01,230 User

Smiley Frustrated

ystem ERROR [alfresco.smb.protocol] CIFS server configuration error, Invalid CIFS authenticator configuration
16:00:10,662 ERROR [app.servlet.NTLMAuthenticationFilter] Client EU01956 using NTLMv2 logon, not valid with passthru authentication

Also do I need to set anything in the other properties (personService, nodeService, transactionService, guestAccess, protocolOrder) in the ntlm-authentication-context.xml file?

The CIFS server isn't happy. You will have to configure the enterprise CIFS authenticator (see file-servers.xml). But that doesn't explain why you can't log in.

The reason why you can't log in is because you must be using a post-XP Windows installation that has NTLM v1 support switched off by default.

To use passthru, you need to enable NTLM v1 on the client machines. Otherwise it might be best to use Kerberos SSO. See

http://wiki.alfresco.com/wiki/Configuring_the_CIFS_and_web_servers_for_Kerberos/AD_integration

OK I've fixed the CIFS error I was getting by configuring the file-servers.xml file, and it doesnt show those errors in the log file anymore.

But how do I enable NTLM v1 on the client machines?

Is your Google broken or something?

Try http://www.technologyquestions.com/technology/windows-vista/50823-force-ntlm-vista-home-premium.html

I tried Googling for it but couldnt find much on enabling NTLM v1, everything seemed to point me towards enabling NTLM v2.

But anyway I tried your link, changed the settings on my computer to use NTLM v1 and it works perfect!!! I also got another two users to enable NTLM v1 and access the Alfresco web client and it worked for them too!

Thanks a lot!

Smiley Very Happy

Maybe my Google is better than yours!

Just a question, in the article http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM, it says:

Note that since Alfresco 3.0 NTLMv2 is now supported which is more secure that the NTLMv1 previously supported - and NTLMv2 will automatically downgrade to NTLMv1 if the client does not support it.

So if our client machines do not support NTLMv2 and only support NTLMv1, then why doesnt the Alfresco server automatically downgrade to NTLMv1 if thats what it says in the article?

It also says two paragraphs later

Note that the support of NTLMv2 is only for configurations storing psswords (or hashes) in Alfresco. As NTLMv2 has been designed to avoid "man-in-the-middle" attacks, any passthru authentication is impossible.

In v3.2 terms this means it only works with the alfrescoNtlm subsystem - not the passthru subsystem. But that would mean storing copies of everyones password in Alfresco and would rule out LDAP sync.

So is it possible to force Alfresco 3.1 Enterprise to use NTLM v2 possibly by storing everones passwords (or hashes) in the database or something? Or is this only an Alfresco 3.2 thing?

I am currently getting issues in that by reverting my client machine to use NTLM v1 for Alfresco single sign on, Microsoft Outlook is always prompting me for my username and password each time I start it up because Outlook was previously using NTLM v2 authentication.

If you set

authentication.chain=alfrescoNtlm1:alfrescoNtlm
ntlm.authentication.sso.enabled=true

in alfresco-global.properties then you will have NTLM v2 SSO with the alfresco database. You'll have to create the users manually, though, as LDAP sync assumes that authentication information is stored externally.

I cant find an alfresco-global.properties file in Alfresco 3.1 Enterprise. Is there anywhere else I can set these properties?

I can see an alfresco-shared.properties file in the WEB-INF/classes/alfresco directory.

Sorry. Forgot we we were talking about v3.1.

You just need to configure the NTLM authentication filters. See

http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM

Do you mean follow the section in Alfresco Explorer and WebDav SSO using NTLM ? I've already done this according to how the article describes it. Which part within this section can I force the Alfresco server to use NTLM v2?

Just DON'T do the passthru configuration stuff in this section

http://wiki.alfresco.com/wiki/3.0_Configuring_NTLM#NTLM_Passthru_Authentication

Leave the default alfresco authentication component in place. It will then favour NTLM v2 and will only downgrade to v1 if required by the client.

If I dont do the passthru thing then where does the Alfresco server look for the Active Directory? Because previously in the 'ntlm-authentication-context.xml' file there was a servers property which contained the address of the Active Directory server. If Im not using this file anymore then where do I put the address of the Active Directory server?

It doesn't speak to Active Directory at all in this case. It has its own copy of the username and password.

Ah right. So I need to create a set of users in Alfresco with the same usernames and passwords as the people in our domain? And I do not need to follow the Domain Mappings section in that article either?

That's correct.