CIFS Kerberos issue

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

gmccullough

I'm getting the following error in the logs when trying to connect to the cifs server from windows:

2014-04-22 12:55:49,696  ERROR [auth.cifs.EnterpriseCifsAuthenticator] [AlfJLANWorker10] No authentication mechanism for SPNEGO found

Kerberos login from Share interface works fine.

Have the following config:

### CIFS Server Configuration ###
cifs.enabled=true
cifs.serverName=${localname}A
cifs.domain=internal.domain.gov
cifs.broadcast=255.255.255.255
# An empty value indicates bind to all available network adapters
cifs.bindto=
cifs.ipv6.enabled=false
cifs.hostannounce=true
# Enable the use of asynchronous sockets/NIO code
cifs.disableNIO=false
# Disable the use of JNI code. Only currently affects Windows
cifs.disableNativeCode=false
# Session timeout, in seconds. Defaults to 15 minutes, to match the default Windows client setting.
# If no I/O is received within that time the session is closed by the server
cifs.sessionTimeout=900
# Maximum virtual circuits per session
# Should only be changed when using Terminal Server clients
cifs.maximumVirtualCircuitsPerSession=16

# Can be mapped to non-privileged ports, then use firewall rules to forward requests from the standard ports
cifs.tcpipSMB.port=445
cifs.netBIOSSMB.sessionPort=139
cifs.netBIOSSMB.namePort=137
cifs.netBIOSSMB.datagramPort=138

# Optional WINS server primary and secondary IP addresses. Ignored if autoDetectEnabled=true
cifs.WINS.autoDetectEnabled=true
cifs.WINS.primary=172.16.100.200
cifs.WINS.secondary=172.16.101.200

# CIFS session debug flags (also enable org.alfresco.fileserver=debug logging level)
# Comma delimeted list of levels :-
#    NETBIOS, STATE, RXDATA, TXDATA, DUMPDATA, NEGOTIATE, TREE, SEARCH, INFO, FILE, FILEIO, TRANSACT
#    ECHO, ERROR, IPC, LOCK, PKTTYPE, DCERPC, STATECACHE, TIMING, NOTIFY, STREAMS, SOCKET, PKTPOOL
#    PKTSTATS, THREADPOOL, BENCHMARK
cifs.sessionDebug=

# Big Switch, are the Desktop Actions and URL shortcuts shown for CIFS ?
cifs.pseudoFiles.enabled=true

# CIFS URL for alfresco explorer
cifs.pseudoFiles.explorerURL.enabled=true
cifs.pseudoFiles.explorerURL.fileName=__Alfresco.url

# Cifs URL for alfresco share
cifs.pseudoFiles.shareURL.enabled=false
cifs.pseudoFiles.shareURL.fileName=__Share.url


ntlm.authentication.sso.enabled=false
ntlm.authentication.authenticateCIFS=false
##alfresco.authentication.allowGuestLogin=true
##alfresco.authentication.authenticateCIFS=true

authentication.chain=alfrescoNtlm1:alfrescoNtlm,kerberos1:kerberos,ldap1:ldap-ad

kerberos.authentication.realm=AD.DOMAIN.GOV
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=true
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.cifs.password=changed
kerberos.authentication.http.password=changed
kerberos.authentication.defaultAdministratorUserNames=gmccullough
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

gmccullough

Like I said, logging in from Share app with my AD creds works fine.  I noticed in the logs that it successfully logs into the HTTP principal twice, don't know if that is normal or not…

2014-04-23 09:23:08,055  DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Processing the JAAS callback list of 1 items.
 2014-04-23 09:23:08,056  DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Request for password.
 2014-04-23 09:23:08,065  DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
 2014-04-23 09:23:08,065  DEBUG [app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal HTTP/yeti.ad.clintonok.gov@AD.CLINTONOK.GOV
 2014-04-23 09:23:08,133  INFO  [management.subsystems.ChildApplicationContextFactory] [asynchronouslyRefreshedCacheThreadPool1] Starting 'Search' subsystem, ID: [Search, managed, solr]
 2014-04-23 09:23:08,532  INFO  [management.subsystems.ChildApplicationContextFactory] [asynchronouslyRefreshedCacheThreadPool1] Startup of 'Search' subsystem, ID: [Search, managed, solr] complete
 2014-04-23 09:23:09,091  DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Processing the JAAS callback list of 1 items.
 2014-04-23 09:23:09,091  DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Request for password.
 2014-04-23 09:23:09,097  DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
 2014-04-23 09:23:09,098  DEBUG [webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal HTTP/yeti.ad.clintonok.gov@AD.CLINTONOK.GOV
 2014-04-23 09:23:09,114  INFO  [management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, kerberos1] complete
‍‍‍‍‍‍‍‍‍‍‍‍‍

Also tried installing samba and joining the machine to the AD, but still have same results.