nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

SSO Kerberos

tkim

I want to make SSO environment with ActiveDirectory but I can't...
I worked in accordance with below;
http://docs.alfresco.com/5.0/tasks/auth-kerberos-ADconfig.html
http://docs.alfresco.com/5.0/tasks/auth-kerberos-shareSSO.html

Please teach me right way to configure SSO.

<Environment>
ActiveDirectory Domain Controller:Win2008R2
AlfrescoServer:Win2008R2
Alfresco:Community 5.1 on tomcat

<Works>
1:create account on AD.
   for HTTP and CIFS
2:execute ktpass and setspn just as http://docs.alfresco.com/5.0/tasks/auth-kerberos-ADconfig.html
3ut keytab files on alfresco server; c:\etc
4:create krb5.ini in c:\windows
5:create C:\alfresco-community\java\lib\security\java.login.config
6:modify java.security
7:modify share-config-custom.xml
- uncomment for <config evaluator="string-compare" condition="Remote">
- set Kerberos settings
     - set password
     - set realm
     - set endpoint-spn
     - set onfig-entry
     - set stripUserNameSuffix:true

8:modify alfresco-global.properties
authentication.chain=kerberos1:kerberos,ldap1:ldap-ad,alfrescoNtlm1:alfrescoNtlm

<Error log>
2016-11-28 15:55:32,028 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, kerberos1]
2016-11-28 15:55:32,262 ERROR [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos web filter error
javax.security.auth.login.LoginException: Pre-authentication information was invalid (24)
   at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Unknown Source)
   at com.sun.security.auth.module.Krb5LoginModule.login(Unknown Source)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
   at java.lang.reflect.Method.invoke(Unknown Source)
   at javax.security.auth.login.LoginContext.invoke(Unknown Source)
   at javax.security.auth.login.LoginContext.access$000(Unknown Source)
   at javax.security.auth.login.LoginContext$4.run(Unknown Source)
   at javax.security.auth.login.LoginContext$4.run(Unknown Source)
   at java.security.AccessController.doPrivileged(Native Method)
   at javax.security.auth.login.LoginContext.invokePriv(Unknown Source)
   at javax.security.auth.login.LoginContext.login(Unknown Source)
   at org.alfresco.repo.webdav.auth.BaseKerberosAuthenticationFilter.init(BaseKerberosAuthenticationFilter.java:182)
   at org.alfresco.web.app.servlet.KerberosAuthenticationFilter.init(KerberosAuthenticationFilter.java:56)
   at org.alfresco.repo.webdav.auth.BaseSSOAuthenticationFilter.afterPropertiesSet(BaseSSOAuthenticationFilter.java:146)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1573)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1511)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:521)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:458)
   at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:293)
   at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:223)
   at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:290)
   at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:191)
   at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:636)
   at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:934)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:479)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:814)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:1086)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:308)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory.getApplicationContext(ChildApplicationContextFactory.java:440)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.getApplicationContext(DefaultChildApplicationContextManager.java:360)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.start(DefaultChildApplicationContextManager.java:306)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:1086)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:308)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager.getInstanceIds(DefaultChildApplicationContextManager.java:180)
   at org.alfresco.repo.security.authentication.subsystems.SubsystemChainingAuthenticationService.refreshBeans(SubsystemChainingAuthenticationService.java:89)
   at org.alfresco.repo.security.authentication.subsystems.SubsystemChainingAuthenticationService.getUsableAuthenticationServices(SubsystemChainingAuthenticationService.java:185)
   at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.getDefaultAdministratorUserNames(AbstractChainingAuthenticationService.java:566)
   at org.alfresco.repo.security.authority.AuthorityServiceImpl.getRoleAuthorities(AuthorityServiceImpl.java:260)
   at org.alfresco.repo.security.authority.AuthorityServiceImpl.access$0(AuthorityServiceImpl.java:255)
   at org.alfresco.repo.security.authority.AuthorityServiceImpl$UserAuthoritySet.<init>(AuthorityServiceImpl.java:746)
   at org.alfresco.repo.security.authority.AuthorityServiceImpl.getAuthoritiesForUser(AuthorityServiceImpl.java:251)
   at org.alfresco.repo.security.authority.AuthorityServiceImpl.isAdminAuthority(AuthorityServiceImpl.java:169)
   at org.alfresco.service.cmr.workflow.WorkflowPermissionInterceptor.invoke(WorkflowPermissionInterceptor.java:55)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:46)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:159)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:96)
   at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:260)
   at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:94)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
   at com.sun.proxy.$Proxy71.isDefinitionDeployed(Unknown Source)
   at org.alfresco.repo.workflow.WorkflowDeployer.init(WorkflowDeployer.java:299)
   at org.alfresco.repo.workflow.WorkflowDeployer$1$1.doWork(WorkflowDeployer.java:512)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.workflow.WorkflowDeployer$1.execute(WorkflowDeployer.java:508)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:457)
   at org.alfresco.repo.workflow.WorkflowDeployer.onBootstrap(WorkflowDeployer.java:503)
   at org.springframework.extensions.surf.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:56)
   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEventInternal(SafeApplicationEventMulticaster.java:207)
   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEvent(SafeApplicationEventMulticaster.java:178)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:334)
   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:950)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:482)
   at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:410)
   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:306)
   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:112)
   at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:63)
   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:5016)
   at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5524)
   at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:901)
   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:877)
   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:649)
   at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:672)
   at org.apache.catalina.startup.HostConfig$DeployDescriptor.run(HostConfig.java:1859)
   at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
   at java.util.concurrent.FutureTask.run(Unknown Source)
   at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
   at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
   at java.lang.Thread.run(Unknown Source)
Caused by: KrbException: Pre-authentication information was invalid (24)
   at sun.security.krb5.KrbAsRep.<init>(Unknown Source)
   at sun.security.krb5.KrbAsReqBuilder.send(Unknown Source)
   at sun.security.krb5.KrbAsReqBuilder.action(Unknown Source)
   ... 85 more
Caused by: KrbException: Identifier doesn't match expected value (906)
   at sun.security.krb5.internal.KDCRep.init(Unknown Source)
   at sun.security.krb5.internal.ASRep.init(Unknown Source)
   at sun.security.krb5.internal.ASRep.<init>(Unknown Source)
   ... 88 more

Find more posts tagged with

Comments

angelborroy

Can you include your krb5.ini content?

tkim

This is my krb5.ini.

---

[logging]
default = FILE:C:\work\krb5libs.log
kdc = FILE:C:\work\krb5kdc.log
admin_server = FILE:C:\work\kadmind.log

[libdefaults]
default_realm = OURDOMAIN.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac

[realms]
OURDOMAIN.LOCAL = {
kdc = dcsvr.ourdomain.local
admin_server = dcsvr.ourdomain.local
}

[domain_realm]
dcsvr.ourdomain.local = OURDOMAIN.LOCAL
.dcsvr.ourdomain.local = OURDOMAIN.LOCAL

---

angelborroy

Try removing encryption lines:

default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac

tkim

thx for reply!

I modified java.login.config; adding "@OURDOMAIN.LOCAL", and also removed encryption lines from krb5.ini.
Now, when I started Alfresco service, no error was happened and the logs appeared like below;

2016-11-29 13:54:25,483 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, kerberos1]
2016-11-29 13:54:25,593 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
2016-11-29 13:54:25,593 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal HTTP/xxxx
2016-11-29 13:54:25,624 DEBUG [org.alfresco.repo.webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
2016-11-29 13:54:25,624 DEBUG [org.alfresco.repo.webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal HTTP/xxxx
2016-11-29 13:54:25,686 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, kerberos1] complete

But I can not do SSO.
When I access alfresco from IE, the basic authentication dialog appears; maybe come from Alfrescontlm.
IE settings is OK like http://docs.alfresco.com/4.0/tasks/auth-kerberos-clientconfig.html.

1:Kerberos SSO means that no authentication dialog appears, right?
2:my configuration is wrong or not enogh?

This is my config.

<krb5.ini>
---
[logging]
default = FILE:C:\work\krb5libs.log
kdc = FILE:C:\work\krb5kdc.log
admin_server = FILE:C:\work\kadmind.log

[libdefaults]
default_realm = OURDOMAIN.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac

[realms]
OURDOMAIN.LOCAL = {
kdc = dcsvr.ourdomain.local
admin_server = dcsvr.ourdomain.local
}

[domain_realm]
dcsvr.ourdomain.local = OURDOMAIN.LOCAL
.dcsvr.ourdomain.local = OURDOMAIN.LOCAL
---

<java.login.config>
---
Alfresco {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};

AlfrescoCIFS {
com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="C:/etc/cifs.keytab"
   principal="cifs/alfrescoserver.ourdomain.local@OURDOMAIN.LOCAL";
};

AlfrescoHTTP {
com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="C:/etc/http7.keytab"
   principal="HTTP/alfrescoserver.ourdomain.local@OURDOMAIN.LOCAL";
};

ShareHTTP
{
   com.sun.security.auth.module.Krb5LoginModule required
   storeKey=true
   useKeyTab=true
   keyTab="C:/etc/http.keytab"
   principal="HTTP/alfrescoserver.ourdomain.local@OURDOMAIN.LOCAL";
};
com.sun.net.ssl.client {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};
other {
com.sun.security.auth.module.Krb5LoginModule sufficient;
};
---

<share-config-custom.xml(a part of)>
---
<config evaluator="string-compare" condition="Kerberos" replace="true">
   <kerberos>
      <password>mypassword</password>
      <realm>OURDOMAIN.LOCAL</realm>
      <endpoint-spn>HTTP/alfrescoserver.ourdomain.local@OURDOMAIN.LOCAL</endpoint-spn>
      <config-entry>AlfrescoHTTP</config-entry>
     <stripUserNameSuffix>true</stripUserNameSuffix>
   </kerberos>
</config>

and uncomment <config evaluator="string-compare" condition="Remote"> sections.
---

<kerberos-filter.properties>
---
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.http.password=mypassword
kerberos.authentication.sso.enabled=true
kerberos.authentication.browser.ticketLogons=true
kerberos.authentication.sso.fallback.enabled=true
---

<alfresco-global.properties>
---

authentication.chain=kerberos1:kerberos,ldap1:ldap-ad,alfrescoNtlm1:alfrescoNtlm

#NTLM
ntlm.authentication.sso.enabled=false

#LDAP

#LADAP Sync
ldap.authentication.userNameFormat=%s@ourdomain.local

ldap.authentication.java.naming.provider.url=ldap://IPAddress for domain controller:389

ldap.synchronization.java.naming.security.principal=username@ourdomain.local
ldap.synchronization.java.naming.security.credentials=mypassword

#user

ldap.synchronization.userSearchBase=DC\=ourdomain,DC\=local
ldap.synchronization.personType=person

ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn

#group
ldap.synchronization.groupSearchBase=DC\=ourdomain,DC\=local
ldap.synchronization.groupType=organizationalUnit

# Sync
synchronization.synchronizeChangesOnly=false
synchronization.allowDeletions=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.syncOnStartup=true

ldap.synchronization.enableProgressEstimation=true

ldap.synchronization.active=true
ldap.authentication.allowGuestLogin=true

synchronization.synchronizeChangesOnly=false

---

tkim

adding information.

When I accessed Alfresco from IE and appears basic authentication dialog, these logs were put out.

2016-11-29 14:50:52,728 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-5] Authentication not required (filter), chaining ...
2016-11-29 14:50:52,806 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-6] Authentication not required (filter), chaining ...
2016-11-29 14:50:52,822 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] New Kerberos auth request from 127.0.0.1 (127.0.0.1:58954)
2016-11-29 14:50:52,822 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [http-apr-8080-exec-7] Issuing login challenge to browser.