nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfreco session broken while using HTTPS

oscar_2016

Hello

Are environment is as follows

Windows 2008 R2

Apache Tomcat/7.0.53

Alfresco 4.2.4 enterprise edition

The issue we are experience in alfresco share is as follows

1. Authentication NTLM SSO on active directory

2. We only are authenticating share and explorer

3 Using http and https.

what’s happening is that for some users they are randomly y being prompted to enter their user credentials through the Windows security pop up windows, the user enter their active directory credentials but the pop up will continuosly appear thus not letting the user use Alfresco. The page usually freezes and users have to close their browsers if they can as the page is “Not Responding” or reboot their computer. Once they go back into Alfresco it will work for a while then the pop will appear again.

The above issue only occurs while they are using https, his makes me think that the problem is not caused by the authentication but by the configuration of the connector in TOMCAT, below is my configuration, could you help me to understand why the session is broken and the user are prompted to enter credential if we set up NTLM-SSO. Thanks so much for your help

Find more posts tagged with

Comments

openpj

This issue could depends on some networking issue between Alfresco and the specific user machine.

Have you tried to understand if these users have the same subnet or similar constraints compared to the other users?

It could be a problem related to a proxy setting but I'm not sure.

If you are using Alfresco Enterprise Edition you should have a dedicated account for creating a ticket to the Alfresco Support:

http://support.alfresco.com/

In this way the Alfresco Engineers will help you on this specific issue.

oscar_2016

First of all, Thanks very much for your response; was already starting to disappoint to see that nobody showed interest in this.

The https connector configuration is ignoring the parameter maxHttpHeaderSize, see what tomcat documentation says about this parameter:

The maximum size of the request and response HTTP header, specified in bytes. If not specified, this attribute is set to 8192 (8 KB).

We are using NTLM SSO again Active directory, the NTLM authentication uses http headers WWWAuthenticate and Authorization (this header could be big), in addition there are other headers on each http request and response messages like session header, cookies etc

In http or https A request with too long headers is rejected by the webserver before it reaches a web application (alfresco share or alfresco)

The above means that randomly the end user might get and error or be prompted to enter credentials, I have play with

maxHttpHeaderSize, setting small values and what I got is either and error Web page cannot be display (Tomcat is rejecting the request and sending HTTP status bad request) or I am being prompted to enter credential through the alfresco login page (this means that the header size is not big enough and the NTLM SSO failed).

What the end user are getting is the Windows security POP up Windows, this Windows is displays when Basic authentication has been configured for a web application, this kind of authentication is Done my TOMCAT and is enable through security constrains in the web application deployment descriptor, I have checked

The deployment descriptor of Share, alfresco and SOLR and there are security constrains in Alfresco and SOLR but they do not use Basic authentication).

Since Anonymous authentication is disable in Tomcat, Alfresco, SOLR and Share, it could be happening

That when a request with too long headers arrives TOMCAT is rejecting it before it reaches share and silently drop connection and from this point tomcat is switching to basic authentication (the NTLM SSO is performed by Alfresco) and reply any request containing the header WWWAuthenticate = basic, that makes IE display the Windows security pop ups, then the user enter their credential but Tomcat does not find this credential in the xml find that is used for Basic authentication and the authentication fail and keep asking for credentials.