nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Error on LoginBean with custom authentication

jbaton

Hi all,

I plugged in an authentication against a LDAP server as described in the wiki.

When the credentials are not OK, an exception is thrown.
When authentication matches the LDAP content nothing is done.

Problem comes up after treatment , in managed bean Loginbean.

Here is the exception :

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:74)
at javax.faces.component.UICommand.broadcast(UICommand.java:106)
at javax.faces.component.UIViewRoot._broadcastForPhase(UIViewRoot.java:90)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:164)
at org.apache.myfaces.lifecycle.LifecycleImpl.invokeApplication(LifecycleImpl.java:271)
at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:86)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:94)
at org.alfresco.web.app.servlet.AlfrescoFacesServlet.service(AlfrescoFacesServlet.java:49)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:252)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.alfresco.web.app.servlet.ModeDetectionFilter.doFilter(ModeDetectionFilter.java:59)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:81)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:81)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:202)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:173)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:178)
at org.jboss.web.tomcat.security.CustomPrincipalValve.invoke(CustomPrincipalValve.java:39)
at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:153)
at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:59)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:126)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:105)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:107)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:148)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:856)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:744)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:527)
at org.apache.tomcat.util.net.MasterSlaveWorkerThread.run(MasterSlaveWorkerThread.java:112)
at java.lang.Thread.run(Thread.java:595)
Caused by: javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:153)
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:63)
… 32 more
Caused by: net.sf.acegisecurity.AuthenticationCredentialsNotFoundException: A valid SecureContext was not provided in the RequestContext
at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:477)
at net.sf.acegisecurity.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:355)
at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:77)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:144)
at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:37)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:144)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:57)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:144)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:174)
at $Proxy73.getProperty(Unknown Source)
at org.alfresco.web.bean.LoginBean.login(LoginBean.java:271)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:129)
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Is there something to configure ?
Or do I need another version than OS ?

How do I provide a SecureContext ?

Thanks

Jerome

Find more posts tagged with

Comments

jbaton

Tried to update class

web-client/source/java/org/alfresco/web/app/portlet/AlfrescoFacesPortlet.java

as advised in another post about a "SecureContext" problem.

It does not work.

jbaton

As a routine verification, I tried to change my user's password in Alfresco to the same value in the LDAP.

Impossible to do it.
Impossible to delete that user.

In both case, a 'user does not exist' error message is shown in the UI.
It might come from an import of an 1.0 repo into version 1.1.

Having restarted the process with a blank repo., and users recreated, it still fails with the exception given in the first post.

Any idea someone ?

andy

Hi

I have had a quick look at the example …. and it works for me.

There are a couple of things….

1) The example eats some errors where it should throw an authentication exception….

2) The Distinguished name of the user is a bit of a pain.
I may have the username "andy" but have to log on as "Andy Hind" using the LDAP API exposed via active directory. I am starting out on LDAP ….so I may find a better way …but you most probably need read access to LDAP to resolve usernames. I will be investigating further.

3) Similarly the location of users in your LDAP repository may not be so simple. The form below works for me. Your users may be stored under some other distinguished name.

"cn="+userName+",ou=Maidenhead,dc=alfresco,dc=com"

Try using an LDAP browser and see if you can connect/bind that way. This will confirm that the connection/bind works. I used the softerra LDAP browser 2.6 to do this. If you can log on with admin rights …you may be able to find the directory structure … You will need something like

cn=administrator,cn=users,dc=company,dc=com

Hope this helps

Cheers

Andy

jbaton

Andy,

Thanks for your help.
I am not sure I mentionned that I use the OS 1.1 version, while waiting for the enterprise (sources) to be available to me (purchase in progress).

As LDAP sso is part of the enterprise network version, can it work with the OS version ?

I tried to connect on the LDAP with the software you wrote of.
I succeeded in connecting anonymously and fetch my information.

But I think the problem is after authentication is verified.

If I understand well the wiki example, method

public void authenticate(String userName, char[] password) throws AuthenticationException
‍‍‍

should verify the login+pwd couple against, for instance, the ldap server so, if I implement it in that way :

public void authenticate(String userName, char[] password) throws AuthenticationException 
{
 ;
}
‍‍‍‍‍‍

it should work. Unfortunately, it does not.

I set both the userid and the company id to the same value at user creation to avoid mistakes of that kind.

The exception looks like something is not set.
Is there something to set in LoginBean so that the user is recognized by the system ?

Jerome

andy

Hi

If you want to accept or reject all users you could do something like

public void authenticate(String userName, char[] password) throws AuthenticationException
    {
        if(accept)
        {
            setCurrentUser(userName);
        }
        else
        {
            throw new AuthenticationException("Access Denied");
        }

    }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The

setCurrentUser(userName);
‍‍‍

Is the key to setting the security context information if you are happy with authentication.

Cheers

Andy

jbaton

Andy,

I knew there was something to do !!!!

Thanks a lot

JÃƒÂ©rÃƒÂ´me

jbaton

Using 1.1.1 OS

Using LDAP authentication, then setting user,
what happens is that if I successfully log against the ldap with a username that does not exist in the Alfresco system, I get in, with minimal interactions possible.
Well, sort of expected.
The trouble is that the username appears in the users list of the admin console.
Well, why not, after all, it is not a problem with the ENT version. But it is with the PRO version (user count limited)

But the problem is that the user created is sort of ghost user, it is visble but can not be deleted. A "user does not exists" message is issued when trying to delete it with the UI.

I'm coding something that will use the RepositoryAuthenticationDao.getUserOrNull method.
Will post it here when tested.

Basically, code is to be sthg like

public void authenticate(String userName, char[] password) throws AuthenticationException
    {
        if(acceptOnLDAP() && existsInRepository(userName) )
        {
            setCurrentUser(userName);
        }
        else
        {
            throw new AuthenticationException("Access Denied");
        }

    } 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Will check 'ghost-creation' against 1.1.1 ENT when my local mergeMyStuffWithNewSources procedure will be done.

HIH

Jerome

jbaton

Continuing what's in the above posts.

Declare a new private member which will be initialized by Spring

 private RepositoryAuthenticationDao authenticationDao ;
‍‍‍

the useful methods are

public void authenticate(String userName, char[] password) throws AuthenticationException {
   String tmp = ldapAuthenticate(); // this method returns null if eve
   if(tmp!=null || !declaredInRepository(userName) ) throw new AuthenticationException(tmp);
      else
         setCurrentUser(userName);
   }
      
public boolean declaredInRepository(String userName){
      if(authenticationDao.getUserOrNull( userName ) == null) {
         return false ; 
      }
return true;
}
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Modify authentication-services-context.xml , so that the block/paragraph of the bean with id="alfDaoImpl"

becomes

<bean  class="org.alfresco.repo.security.authentication.RepositoryAuthenticationDao"  id="RepoAuthDAO">
              <property name="nodeService">
                  <ref bean="nodeService" />
              </property>
              <property name="dictionaryService">
                  <ref bean="dictionaryService" />
              </property>
              <property name="namespaceService">
                  <ref bean="namespaceService" />
              </property>
              <property name="passwordEncoder">
                  <ref bean="passwordEncoder" />
              </property>
              <property name="searchService">
                  <ref bean="searchService" />
              </property>
              <property name="userNamesAreCaseSensitive">
                 <value>${user.name.caseSensitive}</value>
              </property>
           </bean>

    <bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
        <property name="proxyInterfaces">
            <value>org.alfresco.repo.security.authentication.MutableAuthenticationDao</value>
        </property>
        <property name="transactionManager">
            <ref bean="transactionManager" />
        </property>
        <property name="target">
           <ref bean="RepoAuthDAO" />
        </property>
        <property name="transactionAttributes">
            <props>
                <prop key="*">${server.transaction.mode.default}</prop>
            </props>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

This makes a new bean declared which becomes then available for the class

So add this into authentication-services-context.xml

<bean id="authenticationComponentImpl" class="com.theyfiredme.security.authentication.LDAPAuthentifierImpl">
<property name="host">
            <value>ldap://YOURLDAP:389</value>
</property>
<property name="baseDN">
            <value>dc=YOURCOMPANY,dc=COMorSOMETHING</value>
</property>
<property name="authenticationDao">
            <ref bean="RepoAuthDAO" />
</property>
</bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍

There you are, credentials verified from a LDAP, working only with users that are declared in Alfresco

Merry xmas

Jerome

hsantander

Hello
I solved the problem of authentication trought a query to an Active Directory. I got the same problem of "ghost" users created when somebody is authenticated trought AD and it's not created in alfresco.
I modify my java class implementation of LDAPAuthenticationComponentImpl with the items you write, but I get a lot of errors and the application can't start.

Thanks

jbaton

Hi,

May be should you post your stacktrace or the top of it if its too long.
I can swear it : 'It works on my machine'

(with a LDAP server)

The trick is just to implement the interface, replace default auth. with it in spring config.

But I can't help you access an active directory in java.

Take steps one after another. Verify your custom auth. mecanism with a simple class with a main method. Then plug it into Alfresco.

Hope it helps a little

JBaton

hsantander

Hello again and thanks for your quick response

Well, I'lll start from the begining because I explained not so well and my english it's not the best.

First of all I create an authenticartor based on the example found on alfresco wiki, on the
chapter about authentication. The java accessing Active Directory (AD) works without problem. When a user authenticate, the module query for authentication to AD. If the authentication it's ok then the user logs in alfresco. When the user it's defined in alfresco everithing it's ok. When it's not, alfresco creates the user and you can't delete it.

I read your post and tried to get implemented, but I didn't get working. I read and check several times the configuration but there's nothing wrong.

It seems like if there is a conflict in the definition of something in Spring modules.

Thanks

andy

Hi

The default configuration is to make people to match users.
People are used in alfresco for full name etc.
People can be made if not present. This is configurable on the person service.

If you are using LDAP/Active Directory or any other external authentication system you should not be managing the users via Alfresco.
There should be some other way to do this.

It may be you should be keeping People in synchronisation with your authentication back end. This is currently in the Enterprise version for LDAP support. If the decision is to go open with this code stream you could use this.

Regards

Andy