nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

NTLM authentication config for Share 3.4

brano_funk

Hi,

I recently implemented the alfresco 3.4 version to make test.
I don't arrive to configure share to do NTLM authentication, i try to do the same configuration than the 3.3, but it seems it doesn't work. SSO is enable for passthru systems and i edited web.xml and share-config-custom.xml, after i cannot login to share. NTLM works perfectly with alfresco explorer.

Any ideas ?

Thanks & Regards
Bruno

Find more posts tagged with

Comments

kevinr

Hi,

The web-tier SSO filters were refactored in 3.4 - so instead of multiple filters (NTLM, Kerberos etc.) that you previously enabled in web.xml, there is now a single SSO filter that controls all.
It also means that you no longer need to edit web.xml - infact you should revert your changes. It should look like this:

   <filter>
      <description>Share SSO authentication support filter.</description>
      <filter-name>Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.site.servlet.SSOAuthenticationFilter</filter-class>
      <init-param>
         <param-name>endpoint</param-name>
         <param-value>alfresco</param-value>
      </init-param>
   </filter>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>
   
   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/proxy/*</url-pattern>
   </filter-mapping>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

the filter is "always on" and automatically routes NTLM etc. if Share is configured to use it, so the share-config-custom.xml configuration is the same, i.e. you need to enable this section:

   <config evaluator="string-compare" condition="Remote">
      <remote>
         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

and that's it! I will update the wiki appropriately now.

Kev

kevinr

I have updated the wiki: http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Alfresco_Share_SSO_using_NTLM

Sorry for the confusion! But hopefully it is better now you do not need to edit web.xml.

Kev

brano_funk

Hi kevinr,

I made the update on my configuration files but it doesn't work.
My web.xml file :

<?xml version='1.0' encoding='UTF-8'?>
<web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4">

   <display-name>Alfresco Project Slingshot</display-name>
   <description>Alfresco Project Slingshot application</description>

   <context-param>
      <param-name>org.jboss.jbossfaces.WAR_BUNDLES_JSF_IMPL</param-name>
      <param-value>true</param-value>
   </context-param>

   <!– Spring Application Context location and context class –>
   <context-param>
      <description>Spring config file location</description>
      <param-name>contextConfigLocation</param-name>
      <param-value>/WEB-INF/classes/web-application-config.xml</param-value>
   </context-param>

   <filter>
      <description>Set HTTP cache Expires header 30 days forward for a mapping.</description>
      <filter-name>CacheExpiresFilter</filter-name>
      <filter-class>org.alfresco.web.scripts.servlet.StaticAssetCacheFilter</filter-class>
      <init-param>
         <description>Add an Expires Header 30 days forward</description>
         <param-name>expires</param-name>
         <param-value>30</param-value>
      </init-param>
   </filter>

   <filter>
      <description>MT authentication support - NOTE: does not support portlets</description>
      <filter-name>MTAuthentationFilter</filter-name>
      <filter-class>org.alfresco.web.site.servlet.MTAuthenticationFilter</filter-class>
   </filter>

   <filter>
      <description>Redirects view and service URLs to the dispatcher servlet.</description>
      <filter-name>UrlRewriteFilter</filter-name>
      <filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
   </filter>

   <filter>
      <description>Share SSO authentication support filter.</description>
      <filter-name>Authentication Filter</filter-name>
      <filter-class>org.alfresco.web.site.servlet.SSOAuthenticationFilter</filter-class>
      <init-param>
         <param-name>endpoint</param-name>
         <param-value>alfresco</param-value>
      </init-param>
   </filter>
 <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>


   <filter-mapping>
      <filter-name>UrlRewriteFilter</filter-name>
      <url-pattern>/proxy/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>UrlRewriteFilter</filter-name>
      <url-pattern>/service/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>UrlRewriteFilter</filter-name>
      <url-pattern>/feedservice/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>UrlRewriteFilter</filter-name>
      <url-pattern>/res/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>UrlRewriteFilter</filter-name>
      <url-pattern>/system/*</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.jpg</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.png</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.gif</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.css</url-pattern>
   </filter-mapping>
<filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.gif</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.css</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>CacheExpiresFilter</filter-name>
      <url-pattern>*.js</url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>MTAuthentationFilter</filter-name>
      <url-pattern>/page/*</url-pattern>
   </filter-mapping>
   <filter-mapping>
      <filter-name>MTAuthentationFilter</filter-name>
      <url-pattern>/p/*</url-pattern>
   </filter-mapping>

   <!– Spring Context Loader listener - the name of the default global context is passed to the DispatcherServlet
        in the servlet definition below - this is to allow the NTLM filter etc. to find the single app context –>
   <listener>
      <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
   </listener>

   <servlet>
      <servlet-name>Spring Surf Dispatcher Servlet</servlet-name>
      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
      <init-param>
         <param-name>contextAttribute</param-name>
         <param-value>org.springframework.web.context.WebApplicationContext.ROOT</param-value>
      </init-param>
      <load-on-startup>1</load-on-startup>
   </servlet>

   <servlet-mapping>
      <servlet-name>Spring Surf Dispatcher Servlet</servlet-name>
      <url-pattern>/page/*</url-pattern>
   </servlet-mapping>
   <servlet-mapping>
      <servlet-name>Spring Surf Dispatcher Servlet</servlet-name>
      <url-pattern>/p/*</url-pattern>
   </servlet-mapping>

   <session-config>
      <session-timeout>60</session-timeout>
   </session-config>
  <!– welcome file list precedence order is index.jsp, then index.html –>
   <welcome-file-list>
      <welcome-file>index.jsp</welcome-file>
      <welcome-file>index.html</welcome-file>
   </welcome-file-list>

</web-app>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

My share-config-custion.xml :

<alfresco-config>
<!–
        NTLM authentication config for Share
        NOTE: you will also need to enable the NTLM authentication filter in Share web.xml
              change localhost:8080 below to appropriate alfresco server location if required
   –>
   <config evaluator="string-compare" condition="Remote">
      <remote>
         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.springframework.extensions.webscripts.connector.AlfrescoConnector</class>
         </connector>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoCookie</connector-id>
            <endpoint-url>http://t-alfresco:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>

   <!– Repository Library config section –>
   <config evaluator="string-compare" condition="RepositoryLibrary" replace="true">
      <!–
         Whether the link to the Repository Library appears in the header component or not.
      –>
      <visible>true</visible>
   </config>

   <config evaluator="string-compare" condition="Remote">
      <remote>
         <endpoint>
            <id>alfresco-noauth</id>
            <name>Alfresco - unauthenticated access</name>
            <description>Access to Alfresco Repository WebScripts that do not require authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
            <identity>none</identity>
         </endpoint>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
 <identity>user</identity>
         </endpoint>

         <endpoint>
            <id>alfresco-feed</id>
            <name>Alfresco Feed</name>
            <description>Alfresco Feed - supports basic HTTP authentication via the EndPointProxyServlet</description>
            <connector-id>http</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
            <basic-auth>true</basic-auth>
            <identity>user</identity>
         </endpoint>
      </remote>
   </config>

</alfresco-config>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Any ideas ?
Thanks for your support

Bruno

kevinr

The web.xml is missing this filter-mapping (bug fix - will be present in 3.4.b Community release due next week):

   <filter-mapping>
      <filter-name>Authentication Filter</filter-name>
      <url-pattern>/proxy/*</url-pattern>
   </filter-mapping>‍‍‍‍

However the reason it is not working at all: you need to remove this block from the Remote section lower down in your config:

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
<identity>user</identity>
         </endpoint>‍‍‍‍‍‍‍‍

Otherwise you are effectively overriding the same value twice i.e. the alfresco endpoint is overridden once to enable NTLM, then you override it again later in the config file. I assume you should also update the endpoint-url values remaining in that section to t-alfresco:8080.

Kev

brano_funk

It works perfectly !

Thanks a lot and have a nice day

novetica

Hi guys,
I have a problem… I've setup my environment exactly as explained here but when Alfresco Share is loaded nothing appears, a blank page is flushed.

I've indeed successfully configured Alfresco Explorer (/alfresco) with external authentication and X-Alfresco-Remote-User, now I'd like to enable the same for Share, is there anything I can do? Is correct to sort out the NTLM configuration or I completely misunderstood wiki?

I hope someone can help me,

Thanks,

N.

ashutosh_mishra

Hi,

I have done my SSO for alfresco and Share using 3.4b ver.
Alfresco is working fine but the Share is not working with IE 7.0 and older version.
Pls help.

novetica

News at http://forums.alfresco.com/en/viewtopic.php?f=9&t=21876&p=107102#p107102