nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

NTLM works great... except with webclient

adrian

Hi,

I have configured Alfresco to use NTLM authentication. It works fine with CIFS or WebDAV : I can browse my files without being asked for a login/password.
But I got an error when trying to use web-browser.

When I type http://localhost:8080/alfresco/ I'm not asked anymore for a login/password (as expected) but I get this page :

net.sf.acegisecurity.AuthenticationServiceException: Failed to open passthru auth session 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticatePassthru(NTLMAuthenticationComponentImpl.java:793) 
at org.alfresco.repo.security.authentication.ntlm.NTLMAuthenticationComponentImpl.authenticate(NTLMAuthenticationComponentImpl.java:550) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
at java.lang.reflect.Method.invoke(Method.java:585) 
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:281) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:187) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:154) 
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107) 
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176) 
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210) 
at $Proxy18.authenticate(Unknown Source) 
at org.alfresco.web.app.servlet.NTLMAuthenticationFilter.processType1(NTLMAuthenticationFilter.java:523) 
at org.alfresco.web.app.servlet.NTLMAuthenticationFilter.doFilter(NTLMAuthenticationFilter.java:395) 
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:215) 
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188) 
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:210) 
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:174) 
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) 
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117) 
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108) 
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:151) 
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:870) 
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665) 
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528) 
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81) 
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:685) 
at java.lang.Thread.run(Thread.java:595) 
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I'm using Alfresco 2.1 on WinXP.
I tried with IE6 and Firefox : it's always the same error (I also put Alfresco as a trusted website in the options).
I don't think there is a problem with my config files since CIFS and WebDAV access work, but I can post them if you wish.
Is there an option I may have forgotten ?

Find more posts tagged with

Comments

jpfi

Hi,

I 've the same problem. But I figured out, that if I configure the alfresco URL only to be in the internet zone of IE, I get an the browser authentication window (not the alfresco login page). Entering there the domain login data works fine.
I don've any explanation why the direct hidden authentication via browser causes th passthru exception and a manual input via browser authentication window works.
Any idea?
Thanks, jpfi

adrian

Hi jpfi

So I'm not the only one.

I don't know why it's happening. From CIFS, if I use the drag'n'drop on one of the 3 Alfresco icons, Firefox asks for a login/password with its own authentication window (not with Alfresco login page, like you).
I looked into the source code of NTLMAuthenticationComponentImpl.java , the error happens in the bold line :

[ … ]
if ( authSess == null)
{
            // Check if the token has a challenge, if it does then the associated session has been
            // timed out

            if ( ntlmToken.getChallenge() != null)
                throw new CredentialsExpiredException("Authentication session expired");

            // Open an authentication session for the new token and add to the active session list

            authSess = m_passthruServers.openSession( false, ntlmToken.getClientDomain());

            // Check if the session was opened to the passthru server

            if ( authSess == null)
               throw new AuthenticationServiceException("Failed to open passthru auth session");

            ntlmToken.setAuthenticationExpireTime(System.currentTimeMillis() + getSessionTimeout());

            // Get the challenge from the initial session negotiate stage

            ntlmToken.setChallenge(new NTLMChallenge(authSess.getEncryptionKey()));
[ … ]

I found this : http://issues.alfresco.com/browse/AR-1555
The problem is similar, but I don't know if it's the same.
Anyway I didn't get NTLM passthru working with web-client, so I put back
the default filter (org.alfresco.web.app.servlet.AuthenticationFilter) for web-client in web.xml. Users have to log manually, but at least there's not an error message.

andy

Hi

In your config file, prefix your entry with the domain for the server.

        <property name="servers">
           <value>DOMAIN\192.168.1.1</value>
        </property>

‍‍‍‍‍‍

Andy

andy

Hi

… this is for the NTLM authentication component config.

Andy

adrian

Hi

Thank you for answering

I already tried this, but it didn't work.
I did a new install but this time with the 2.1 final on a Red Hat server, and the problem is still there. (and CIFS, webDAV work well with SSO)

Anyway it's not really a problem for us : we want to use the classic web-client filter so external people can log in from the Internet.

andy

Hi

There is something going on related to network connections and urls. I have various nets connections - using different urls to access alfresco some work and some not.

If localhost fails - try the hostname or ip address.

I have raise the issue.

Cheers

Andy