Problem with CIFS authentication and kerberos

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

lme

We have a problem while trying to authenticate our CIFS users with Kerberos/JAAS.

Context :
- alfresco-community-tomcat-1.3.0
- linux Debian/Sarge
- Java 1.5.0_05

From a fresh alfresco install, I added these 2 files :
- tomcat/shared/classes/alfresco/extension/jaas-authentication-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    <!– The authentication component.                                      –>

    <!– Jass authentication - most of the config goes somewhere else       –>
       
    <bean id="authenticationComponentImpl" 
                 class="org.alfresco.repo.security.authentication.jaas.JAASAuthenticationComponent">
        <property name="realm">
            <value>MYDOMAIN.PRIV</value>
        </property>
        <property name="jaasConfigEntryName">
            <value>Alfresco</value>
        </property>
    </bean>

      <bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
           <property name="proxyInterfaces">
                  <value>
                      org.alfresco.repo.security.authentication.MutableAuthenticationDao
                  </value>
           </property>
           <property name="transactionManager">
                  <ref bean="transactionManager" />
           </property>
           <property name="target">
                  <bean class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" />
           </property>
           <property name="transactionAttributes">
                <props>
                     <prop key="*">${server.transaction.mode.default}</prop>
                </props>
           </property>
       </bean>

</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

- tomcat/shared/classes/alfresco/extension/file-servers-custom.xml

<alfresco-config area="file-servers">

   <config evaluator="string-compare" condition="CIFS Server">
      <host name="${localname}_A" domain="MYDOMAIN"/>
   </config>

   <config evaluator="string-compare" condition="Filesystem Security">
      <authenticator type="enterprise">
        <KDC>kdcserver.mydomain.priv</KDC>
        <Realm>MYDOMAIN.PRIV</Realm>
        <Password>mypassword</Password>
      </authenticator>
   </config>

</alfresco-config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The Kerberos server is up and running. I could add some user and authenticate with them in the web interface. I added a special user "cifs/ged2_a" (ged2 is the server name where alfresco is installed). In the Kerberos logfile, I could see that this user is used when alfresco is started.

All authentication works (web client, ftp, web dave), but CIFS fails.

log when trying to log in from a Windows box :

15:37:29,428 DEBUG [alfresco.smb.protocol] TCP-SMB session request received from 192.168.1.65
15:37:29,439 DEBUG [alfresco.smb.protocol] Waiting for TCP-SMB session request …
15:37:29,439 DEBUG [alfresco.smb.protocol] Server session started
15:37:29,441 DEBUG [alfresco.smb.protocol] Negotiated SMB dialect - NT LM 0.12
15:37:29,488 DEBUG [alfresco.smb.protocol] Assigned protocol handler - org.alfresco.filesys.smb.server.NTProtocolHandler
15:37:29,491 DEBUG [smb.protocol.auth] NT Session setup SPNEGO, MID=1488, UID=0, PID=65279
15:37:29,590 DEBUG [smb.protocol.auth] User  logged on  (type Normal)
15:37:29,592 DEBUG [smb.protocol.auth] NT Session setup SPNEGO, MID=1496, UID=0, PID=65279
15:37:29,596 WARN  [smb.protocol.auth] Authentication component does not support MD4 password hashes

log when trying to log in with smbclient :

smbclient //ged2/Alfresco -k‍

I must use 'ged2' instead of 'ged2_a', because smbclient is unable to resolv ged2_a address.

11:37:45,609 DEBUG [alfresco.smb.protocol] TCP-SMB session request received from 192.168.1.206
11:37:45,609 DEBUG [alfresco.smb.protocol] Waiting for TCP-SMB session request …
11:37:45,609 DEBUG [alfresco.smb.protocol] Server session started
11:37:45,621 DEBUG [alfresco.smb.protocol] Negotiated SMB dialect - NT LM 0.12
11:37:45,621 DEBUG [alfresco.smb.protocol] Assigned protocol handler - org.alfresco.filesys.smb.server.NTProtocolHandler
11:37:45,625 DEBUG [smb.protocol.auth] NT Session setup SPNEGO, MID=2, UID=0, PID=2876
GSSException: No valid credentials provided
  No valid credentials provided (Mechanism level: Failed to find any Kerberos Key)
11:37:45,656 ERROR [alfresco.smb.protocol] Closing session due to exception
java.lang.NullPointerException
        at org.alfresco.filesys.server.auth.EnterpriseCifsAuthenticator.doSpnegoSessionSetup(EnterpriseCifsAuthenticator.java:1054)
        at org.alfresco.filesys.server.auth.EnterpriseCifsAuthenticator.processSessionSetup(EnterpriseCifsAuthenticator.java:624)
        at org.alfresco.filesys.smb.server.NTProtocolHandler.procSessionSetup(NTProtocolHandler.java:399)
        at org.alfresco.filesys.smb.server.NTProtocolHandler.runProtocol(NTProtocolHandler.java:213)
        at org.alfresco.filesys.smb.server.SMBSrvSession.run(SMBSrvSession.java:1554)
        at java.lang.Thread.run(Thread.java:595)

Is it possible to configure CIFS to use Kerberos without using NTLM and Active Directory ? Is there something special to configure on the Kerberos server and client ?
Do you have any hint ? This is the only issue we encounter on this project.

hfrank

Any Comments from Alfresco team?