Create a user account for the Alfresco CIFS server using the Active Directory Users and Computers application. Use the Action->New->User menu, then enter the full name as 'Alfresco CIFS' and the user logon name as 'alfrescocifs'. Click Next, enter a password, enable 'Password never expires' and disable 'User must change password at next logon'. Click Finish. Right click the new user account name, select Properties, go to the Account tab and enable the Use DES encryption types for this account and Do not require Kerberos preauthentication options in the Account Options section.
Create a user account for the Alfresco web server as in step 1 using the full name 'Alfresco HTTP' and user logon name as 'alfrescohttp'.
Use the ktpass utility to generate key tables for the CIFS and web servers. The ktpass utility is a free download from the Microsoft site, and is also part of the Win2003 Resource Kit. The ktpass command can only be run from the Active Directory server.
The principal should be specified using the server name and domain in lowercase with the realm in uppercase. The service types should match cifs and HTTP. Eg. cifs/server.alfresco.org@ALFRESCO.ORG.
The realm should be the domain upper cased; example if the domain is alfresco.org then the realm should be ALFRESCO.ORG
<domain> is the DNS domain, example alfresco.org <domainnetbios> is the netbios name, example alfresco
Note: Some versions of the ktpass command can generate invalid keytab files, download the latest version of the resource kit tools from the Microsoft site to avoid any problems.
Service Principal Names (SPN)
Create the Service Principal Names (SPN) for the Alfresco CIFS and web server using the setspn utility. The setspn utility is a free download from the Microsoft site, and is also part of the Win2003 Resource Kit.
setspn -a cifs/<cifs-server-name> alfrescocifs setspn -a cifs/<cifs-server-name>.<domain> alfrescocifs
setspn -a HTTP/<web-server-name> alfrescohttp setspn -a HTTP/<web-server-name>.<domain> alfrescohttp
<cifs-server-name> is the NetBIOS name of the Alfresco CIFS server when running on an Active Directory client or the host name for a client that is not an Active Directory client, ie. not logged onto the domain.
<web-server-name> is the host name that is running the Alfresco server.
Some versions of the ktpass command will add the SPN for the principal so you may only need to add the NetBIOS/short name versions of the SPNs. Use the setspn -l <account-name> command to check if the ktpass' command set the SPN.
You can list the SPNs for a server using :-
setspn -l <account-name>
setspn -l alfrescocifs setspn -l alfrescohttp
Note: the servicePrincipalName (SPN) attribute is a multivalued, nonlinked attribute within the Active Directory directory. It can thus also be shown with standard LDAP clients. For instance the commands below show how to use the 'ldapsearch' tool to check the servicePrincipalName and userPrincipalName of the created users. The example below assumes the AD server is at IP 10.69.69.99, the domain is 'example.foo', and the alfresco server name is 'madona'.
<KDC> specifies the IP address or DNS name of the Active Directory server. <Realm> is the Kerberos realm. <Password> is the account password used when creating the alfrescocifs account in step 1. <Principal> is the value used for the ktpass -princ parameter. I.e. if you typed 'ktpass -princ cifs/<web-server-name>.<domain>@<realm>', then you need to enter 'cifs/<web-server-name>.<domain>' The optional <LoginEntry> specifies the login configuration file entry name, this defaults to AlfrescoCIFS.
Note: The Principal setting has been removed from recent versions as we can now get that value automatically after the server side Kerberos logon during startup.
Note: in 3.X versions of alfresco, the kerberos authentication section is now within the 'CIFS Server' section and not in the 'Filesystem Security' section anymore. Please look at the file-servers.xml file to custom your file-servers-custom.xml
When using firefox on Windows as client, you will need to add your alfresco server name to the network.negotiate-auth.trusted-uris variable You can access the variable going to the special URL: about:config
When using firefox under Linux, you will need to add your alfresco server name to network.negotiate-auth.trusted-uris as above but you will need in addition to get a kerberos ticket using the kinit command. Note that the ticket can correspond to a different user than your linux username
where user1 is an active directory user. Note that if the client and the server are on the same machine, you will need to go to the eternl interface. The loopback interface won't be able to authenticate. You can view your tickets using klist.
18:46:27,915 DEBUG [app.servlet.KerberosAuthenticationFilter] New Kerberos auth request from 192.168.4.95 (192.168.4.95:38750) 18:46:28,063 DEBUG [app.servlet.KerberosAuthenticationFilter] User user1 logged on via Kerberos
For cifs you can as described above use:
<kerberosDebug/> in the <authenticator> section
It enables the Sun JGSS/Kerberos debug output. This sets up the Java properties sun.security.jgss.debug=true and sun.security.krb5.debug=true