Alfresco 'share' SSO issue

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

kaliyugantagoni

Hello,

  I am trying to configure Alfresco Share with CAS (mod_auth_cas). I am able to login to /alfresco
  but connot login to /share.

CAS : version 3.3
Alfresco : 4.0.d
Apache (proxyPass) : 2.2
   
   My Apache Configuration for alfresco and share is :

   

ProxyPass /alfresco http://myIp.com:8080/alfresco
    ProxyPassReverse /alfresco http://myIp.com:8080/alfresco

    <Location /alfresco>
            Options FollowSymLinks
            AuthName "CAS"
            AuthType CAS
            CASCookie APACHE_CAS
         CASScope /
            CASAuthNHeader CAS_FILTER_USER
            Require valid-user
     </Location>

    ProxyPass /share http://myIp.com:8080/share
    ProxyPassReverse /share http://myIp.com:8080/share

    <Location /share>
            Options FollowSymLinks
            AuthName "CAS"
            AuthType CAS
            CASCookie APACHE_CAS
         CASScope /
            CASAuthNHeader CAS_FILTER_USER
            Require valid-user
    </Location>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

share-config-custom.xml file

<!– this one is to enable alfresco–>
 <config evaluator="string-compare" condition="Remote">
      <remote>
         <endpoint>
            <id>alfresco-noauth</id>
            <name>Alfresco - unauthenticated access</name>
            <description>Access to Alfresco Repository WebScripts that do not require authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
            <identity>none</identity>
         </endpoint>

         <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfresco</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
            <identity>user</identity>
         </endpoint>

         <endpoint>
            <id>alfresco-feed</id>
            <name>Alfresco Feed</name>
            <description>Alfresco Feed - supports basic HTTP authentication via the EndPointProxyServlet</description>
            <connector-id>http</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/s</endpoint-url>
            <basic-auth>true</basic-auth>
            <identity>user</identity>
         </endpoint>
      </remote>
   </config>
<!– this one is to enable Share–>
<config evaluator="string-compare" condition="Remote">
      <remote>
         <keystore>
             <path>alfresco/web-extension/alfresco-system.p12</path>
             <type>pkcs12</type>
             <password>alfresco-system</password>
         </keystore>

         <connector>
            <id>alfrescoCookie</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using cookie-based authentication</description>
            <class>org.alfresco.web.site.servlet.SlingshotAlfrescoConnector</class>
            <userHeader>CAS_FILTER_USER</userHeader>
         </connector>

          <connector>
            <id>alfrescoHeader</id>
            <name>Alfresco Connector</name>
            <description>Connects to an Alfresco instance using header and cookie-based authentication</description>
            <class>org.alfresco.web.site.servlet.SlingshotAlfrescoConnector</class>
            <userHeader>CAS_FILTER_USER</userHeader>
         </connector>

        <endpoint>
            <id>alfresco</id>
            <name>Alfresco - user access</name>
            <description>Access to Alfresco Repository WebScripts that require user authentication</description>
            <connector-id>alfrescoHeader</connector-id>
            <endpoint-url>http://localhost:8080/alfresco/wcs</endpoint-url>
            <identity>user</identity>
            <external-auth>true</external-auth>
         </endpoint>
      </remote>
   </config>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

alfresco-global.properties file

authentication.chain=external1:external
external.authentication.proxyUserName=
external.authentication.proxyHeader=CAS_FILTER_USER
external.authentication.enabled=true
external.authentication.userIdPattern=‍‍‍‍‍

CAS is working properly as my other applications integrated with it are running fine.
Even when i access /alfresco it works properly, but when i hit /share its shows alfresco error page.

In the logs it says :

ERROR [org.alfresco.web.site] org.springframework.extensions.surf.exception.PlatformRuntimeException: 05140007 Incorrectly configured endpoint ID: alfresco

Please help !

Thanks !

swapraw

HI
     I am also having this same problem with exactly same configuration.
I thing i have noticed that the class org.alfresco.web.site.servlet.SlingshotAlfrescoConnector which is configured in share-config-custom.xml file for getting Share work with only external authentication, is being missing. So i manually added the source for this class and also changed the org.alfresco.web.site.servlet.SSOAuthenticationFilter for extracting userHeader configured for exterbal authentication SSO (Source code copied for both the class is taken from svn repo : link : http://svn.alfresco.com/repos/alfresco-open-mirror/alfresco/HEAD/root/projects/slingshot/source/java/org/alfresco/web/site/servlet/).

I then packaged this changes in alfresco-share-4.0.d.jar and deployed under /share/WEB-INF/lib.

After i restarted alfresco server i was stil not able to access the share but this time the error i got is

23:28:09,331 ERROR [org.alfresco.web.site] org.springframework.web.util.NestedServletException: Request processing failed; nested exception is org.springframework.extensions.surf.exception.WebFrameworkServiceException: Unable to process response: A JSONObject text must begin with '{' at character 47
org.springframework.extensions.surf.exception.WebFrameworkServiceException: Unable to process response: A JSONObject text must begin with '{' at character 47
   at org.alfresco.web.site.EditionInterceptor.preHandle(EditionInterceptor.java:151)
   at org.springframework.web.servlet.handler.WebRequestHandlerInterceptorAdapter.preHandle(WebRequestHandlerInterceptorAdapter.java:54)
   at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:781)
   at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:719)
   at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:644)
   at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:549)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.alfresco.web.site.servlet.MTAuthenticationFilter.doFilter(MTAuthenticationFilter.java:74)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.alfresco.web.site.servlet.SSOAuthenticationFilter.challengeOrPassThrough(SSOAuthenticationFilter.java:703)
   at org.alfresco.web.site.servlet.SSOAuthenticationFilter.doFilter(SSOAuthenticationFilter.java:430)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:857)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
   at java.lang.Thread.run(Thread.java:662)
Caused by: org.json.JSONException: A JSONObject text must begin with '{' at character 47
   at org.json.JSONTokener.syntaxError(JSONTokener.java:413)
   at org.json.JSONObject.<init>(JSONObject.java:180)
   at org.json.JSONObject.<init>(JSONObject.java:420)
   at org.alfresco.web.site.EditionInterceptor$EditionInfo.<init>(EditionInterceptor.java:205)
   at org.alfresco.web.site.EditionInterceptor.preHandle(EditionInterceptor.java:108)
   … 27 more
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This error is comming from class EditionInterceptor where a EditionInfo object is being created using JSONObject (passing response as a parameter) to extract users,documents and edition.

EditionInfo(String response) throws JSONException
        {
            JSONObject json = new JSONObject(response);
            this.users = json.optLong("users", -1L);
            this.documents = json.optLong("documents", -1L);
            this.edition = json.getString("licenseMode");
        }‍‍‍‍‍‍‍

The main line which might be causing the problem is

Response response = conn.call("/api/admin/restrictions?guest=true", ctx); ‍

from which response is being used to fetch users, documents and edition.

If any one has any idea about this please guide me i as am badly stuck here