Help

Kerberos / LDAP-AD (Samba 4) and File Service SSO

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
gguillotin
Member II
‎19 Jan 2017 11:58 AM

Kerberos / LDAP-AD (Samba 4) and File Service SSO

Hi All !

I'm currently working on the setup of an Alfresco Community server. I am running version 5.2.0 on a freshly installed Ubuntu 16.04 64bits server.

This server will be used in a network containing a domain (Active Directory type, but managed by Samba 4). I have already setup LDAP and Kerberos auth (web user auth is working correctly), but while startup logs show me everything is alright, I cannot get Kerberos to authenticate my domain users for file service.

Here is the error stack I get when trying to login through netbios from a Windows Client :

2017-01-19 09:52:29,760 ERROR [org.alfresco.fileserver] [AlfJLANWorker19] Error from JLAN
GSSException: Failure unspecified at GSS-API level (Mechanism level: Checksum failed)
 at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:856)
 at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:342)
 at sun.security.jgss.GSSContextImpl.acceptSecContext(GSSContextImpl.java:285)
 at org.alfresco.jlan.server.auth.kerberos.SessionSetupPrivilegedAction.run(SessionSetupPrivilegedAction.java:102)
 at java.security.AccessController.doPrivileged(Native Method)
 at javax.security.auth.Subject.doAs(Subject.java:360)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.doKerberosLogon(EnterpriseCifsAuthenticator.java:1543)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.doSpnegoSessionSetup(EnterpriseCifsAuthenticator.java:1427)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.access$2(EnterpriseCifsAuthenticator.java:1311)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator$2.execute(EnterpriseCifsAuthenticator.java:904)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator$2.execute(EnterpriseCifsAuthenticator.java:1)
 at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:464)
 at org.alfresco.filesys.auth.cifs.CifsAuthenticatorBase.doInTransaction(CifsAuthenticatorBase.java:648)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.processAlfrescoSessionSetup(EnterpriseCifsAuthenticator.java:887)
 at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.processSessionSetup(EnterpriseCifsAuthenticator.java:689)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:498)
 at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:119)
 at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
 at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
 at com.sun.proxy.$Proxy209.processSessionSetup(Unknown Source)
 at org.alfresco.jlan.smb.server.NTProtocolHandler.procSessionSetup(NTProtocolHandler.java:417)
 at org.alfresco.jlan.smb.server.NTProtocolHandler.runProtocol(NTProtocolHandler.java:223)
 at org.alfresco.jlan.smb.server.SMBSrvSession.processPacket(SMBSrvSession.java:1481)
 at org.alfresco.jlan.smb.server.nio.NIOCIFSThreadRequest.runRequest(NIOCIFSThreadRequest.java:149)
 at org.alfresco.jlan.server.thread.ThreadRequestPool$ThreadWorker.run(ThreadRequestPool.java:153)
 at java.lang.Thread.run(Thread.java:745)
Caused by: KrbException: Checksum failed
 at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:102)
 at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:94)
 at sun.security.krb5.EncryptedData.decrypt(EncryptedData.java:175)
 at sun.security.krb5.KrbApReq.authenticate(KrbApReq.java:281)
 at sun.security.krb5.KrbApReq.<init>(KrbApReq.java:149)
 at sun.security.jgss.krb5.InitSecContextToken.<init>(InitSecContextToken.java:108)
 at sun.security.jgss.krb5.Krb5Context.acceptSecContext(Krb5Context.java:829)
 ... 28 more
Caused by: java.security.GeneralSecurityException: Checksum failed
 at sun.security.krb5.internal.crypto.dk.ArcFourCrypto.decrypt(ArcFourCrypto.java:408)
 at sun.security.krb5.internal.crypto.ArcFourHmac.decrypt(ArcFourHmac.java:91)
 at sun.security.krb5.internal.crypto.ArcFourHmacEType.decrypt(ArcFourHmacEType.java:100)
 ... 34 more
2017-01-19 09:52:29,762 ERROR [org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator] [AlfJLANWorker19] No SPNEGO response, Kerberos logon failed

Here is what I get when starting Alfresco server :

2017-01-19 09:51:12,316 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
2017-01-19 09:51:12,317 DEBUG [org.alfresco.web.app.servlet.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal http/myserver.mydomain@MYREALM
2017-01-19 09:51:12,394 DEBUG [org.alfresco.repo.webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] HTTP Kerberos login successful
2017-01-19 09:51:12,394 DEBUG [org.alfresco.repo.webdav.auth.KerberosAuthenticationFilter] [localhost-startStop-1] Logged on using principal http/myserver.mydomain@MYREALM

Here is my alfresco-global.properties :

###############################
## Common Alfresco Properties #
###############################

dir.root=/opt/alfresco/alf_data

dir.contentstore=/home/alfresco/contentstore
dir.contentstore.deleted=/home/alfresco/contentstore.deleted

alfresco.context=alfresco
alfresco.host=alfresco.public
alfresco.port=8080
alfresco.protocol=http

share.context=share
share.host=alfresco.public
share.port=8080
share.protocol=http

cifs.enabled=true
cifs.serverName=myserver
cifs.domain=DOMAIN
cifs.hostannounce=true
cifs.tcpipSMB.port=1445
cifs.netBIOSSMB.namePort=1137
cifs.netBIOSSMB.datagramPort=1138
cifs.netBIOSSMB.sessionPort=1139

### database connection properties ###
db.driver=org.postgresql.Driver
db.username=alfresco
db.password=is2t
db.name=alfresco
db.url=jdbc:postgresql://localhost:5432/${db.name}
db.pool.max=275
db.pool.validate.query=SELECT 1

# The server mode. Set value here
# UNKNOWN | TEST | BACKUP | PRODUCTION
system.serverMode=UNKNOWN

### FTP Server Configuration ###
ftp.port=2121

### RMI registry port for JMX ###
alfresco.rmi.services.port=50500

### External executable locations ###
ooo.exe=/opt/alfresco/libreoffice/program/soffice.bin
ooo.enabled=true
ooo.port=8100
img.root=/opt/alfresco/common
img.dyn=${img.root}/lib
img.exe=${img.root}/bin/convert

jodconverter.enabled=false
jodconverter.officeHome=/opt/alfresco/libreoffice
jodconverter.portNumbers=8100

### Initial admin password ###
alfresco_user_store.adminpassword=verysecret

### E-mail site invitation setting ###
notification.email.siteinvite=false

### License location ###
dir.license.external=/opt/alfresco

### Solr indexing ###
index.subsystem.name=solr4
dir.keystore=${dir.root}/keystore
solr.host=localhost
solr.port.ssl=8443

### Allow extended ResultSet processing
security.anyDenyDenies=false

### Smart Folders Config Properties ###
smart.folders.enabled=false

### Remote JMX (Default: disabled) ###
alfresco.jmx.connector.enabled=false

authentication.chain=kerberos1:kerberos,ldap1:ldap-ad,alfrescoNtlm1:alfrescoNtlm

ntlm.authentication.sso.enabled=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@mydomain
ldap.authentication.java.naming.provider.url=ldap://myserver.mydomain:389
ldap.authentication.defaultAdministratorUserNames=someusers
ldap.synchronization.java.naming.security.principal=alfresco@mydomain
ldap.synchronization.java.naming.security.credentials=verysecret
ldap.synchronization.groupSearchBase=ou=Groups,ou=MyOU,dc=my,dc=domain
ldap.synchronization.userSearchBase=ou=Users,ou=MyOU,dc=my,dc=domain
ldap.synchronization.personQuery=memberOf=CN=Employees,OU=Groups,OU=MyOU,DC=my,DC=domain
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

kerberos.authentication.realm=MYREALM
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=true
kerberos.authentication.user.configEntryName=alfresco
kerberos.authentication.cifs.configEntryName=cifsalfresco
kerberos.authentication.http.configEntryName=httpalfresco
kerberos.authentication.cifs.password=verysecret
kerberos.authentication.http.password=verysecret
kerberos.authentication.defaultAdministratorUserNames=someusers
kerberos.authentication.cifs.enableTicketCracking=false
kerberos.authentication.stripUsernameSuffix=true


mail.host=mymta.domain
mail.port=25
mail.encoding=UTF-8
mail.smtp.auth=false

I have generate my two keytab files using samba-tools (the command is /usr/local/samba/bin/samba-tool domain exportkeytab --principal myserver.mydomain@MYREALM /tmp/cifsalfresco.keytab). Here is the result of a klist -ket :

Keytab name: FILE:/etc/keytables/cifsalfresco.keytab
KVNO Timestamp Principal
---- ------------------- ------------------------------------------------------
 2 01/18/2017 09:11:58 cifs/myserver.mydomain@MYREALM (arcfour-hmac)
 2 01/18/2017 09:11:58 cifs/myserver.mydomain@MYREALM (aes256-cts-hmac-sha1-96)
 2 01/18/2017 09:11:58 cifs/myserver.mydomain@MYREALM (aes128-cts-hmac-sha1-96)
 2 01/18/2017 09:11:58 cifs/myserver.mydomain@MYREALM (des-cbc-md5)
 2 01/18/2017 09:11:58 cifs/myserver.mydomain@MYREALM (des-cbc-crc)

Finally, here is my /etc/krb5.conf file :

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = MYREALM
 allow_weak_crypto = yes
 default_tkt_enctypes = rc4-hmac
 default_tgs_enctypes = rc4-hmac

[realms]
 MYREALM = {
 kdc = myadserver.mydomain
 kpasswd_server = myadserver.mydomain
 admin_server = myadserver.mydomain
 }

[domain_realm]
 myadserver.mydomain = MYREALM
 .myadserver.mydomain = MYREALM

I can't figure what I am missing here. Any help would be greatly appreciated. Please let me know if more information could be usefull.

Thanks !

Gilles

Reply
1 Reply
mmuller88
Member II
‎7 Jun 2019 5:49 PM

Re: Kerberos / LDAP-AD (Samba 4) and File Service SSO

Probably it isn't working because Samba wasn't supporting MIT Kerberos. Since a while now they do in a experimental stage. I am currently trying that Smiley Happy: https://wiki.samba.org/index.php/Running_a_Samba_AD_DC_with_MIT_Kerberos_KDC

Will come back to report my results.

0 Kudos
Reply
Alfresco Content Services Forum

Ask for and offer help to other Alfresco Content Services Users and members of the Alfresco team.

Related links:

We use cookies on this site to enhance your user experience

By using this site, you are agreeing to allow us to collect and use cookies as outlined in Alfresco’s Cookie Statement and Terms of Use (and you have a legitimate interest in Alfresco and our products, authorizing us to contact you in such methods).   If you are not ok with these terms, please do not use this website.