CORS configuration in ACS 7.0

[waqar1]

Hi,

        i have confiqured my active directory with acs 7.0 via yml docker.it was working fine but when i added cors configuration settings its not running any more.can any one help

YML FILE

alfresco:
image: alfresco/alfresco-content-repository-community:7.0.0
mem_limit: 1500m

environment:
JAVA_TOOL_OPTIONS: "
-Dencryption.keystore.type=JCEKS
-Dencryption.cipherAlgorithm=DESede/CBC/PKCS5Padding
-Dencryption.keyAlgorithm=DESede
-Dencryption.keystore.location=/usr/local/tomcat/shared/classes/alfresco/extension/keystore/keystore
-Dmetadata-keystore.password=mp6yc0UD9e
-Dmetadata-keystore.aliases=metadata
-Dmetadata-keystore.metadata.password=oKIWzVdEdA
-Dmetadata-keystore.metadata.algorithm=DESede
"
JAVA_OPTS: "
-Ddb.driver=org.postgresql.Driver
-Ddb.username=alfresco
-Ddb.password=alfresco
-Ddb.url=jdbcostgresql://postgres:5432/alfresco

-Dcors.enabled=true
-Dcors.allowed.origins=*

-Dsolr.host=solr6
-Dsolr.port=8983
-Dsolr.http.connection.timeout=1000
-Dsolr.secureComms=none
-Dsolr.base.url=/solr
-Dindex.subsystem.name=solr6
-Dshare.host=127.0.0.1
-Dshare.port=8080
-Dalfresco.host=localhost
-Dalfresco.port=8080
-Daos.baseUrlOverwrite=http://localhost:8080/alfresco/aos
-Dmessaging.broker.url=\"failovernio://activemq:61616)?timeout=3000&jms.useCompression=true\"
-Ddeployment.method=DOCKER_COMPOSE
-DlocalTransform.core-aio.url=http://transform-core-aio:8090/
-Dcsrf.filter.enabled=false
-XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80
-Dauthentication.chain=alfinst:alfrescoNtlm,ldap-ad1:ldap-ad
-Dldap.authentication.active=true
-Dldap.authentication.java.naming.security.authentication=simple
-Dldap.authentication.userNameFormat=%s@nust.edu.pk
-Dldap.authentication.java.naming.provider.url=ldap://nust.edu.pk:389
-Dldap.authentication.defaultAdministratorUserNames=Administrator,alfresco
-Dldap.synchronization.active=true
-Dldap.synchronization.java.naming.security.authentication=simple
-Dldap.synchronization.java.naming.security.principal=XYZ@nust.edu.pk
-Dldap.synchronization.java.naming.security.credentials=1234
-Dldap.synchronization.groupSearchBase=OU=NUST,DC=nust,DC=edu,DC=pk
-Dldap.synchronization.userSearchBase=OU=NUST,DC=nust,DC=edu,DC=pk
-Dldap.synchronization.userFirstNameAttributeName=givenName
-Dldap.synchronization.userLastNameAttributeName=sn
"

transform-core-aio:
image: alfresco/alfresco-transform-core-aio:2.3.10
mem_limit: 1536m
environment:
JAVA_OPTS: " -XX:MinRAMPercentage=50 -XX:MaxRAMPercentage=80"
ports:
- 8090:8090

share:
image: alfresco/alfresco-share:7.0.0
mem_limit: 1g
environment:
REPO_HOST: "alfresco"
REPO_PORT: "8080"
JAVA_OPTS: "
-XX:MinRAMPercentage=50
-XX:MaxRAMPercentage=80
-Dalfresco.host=localhost
-Dalfresco.port=8080
-Dalfresco.context=alfresco
-Dalfresco.protocol=http
"

postgres:
image: postgres:13.1
mem_limit: 512m
environment:
- POSTGRES_PASSWORD=alfresco
- POSTGRES_USER=alfresco
- POSTGRES_DB=alfresco
command: postgres -c max_connections=300 -c log_min_messages=LOG
ports:
- 5432:5432

solr6:
image: alfresco/alfresco-search-services:2.0.1
mem_limit: 2g
environment:
#Solr needs to know how to register itself with Alfresco
- SOLR_ALFRESCO_HOST=alfresco
- SOLR_ALFRESCO_PORT=8080
#Alfresco needs to know how to call solr
- SOLR_SOLR_HOST=solr6
- SOLR_SOLR_PORT=8983
#Create the default alfresco and archive cores
- SOLR_CREATE_ALFRESCO_DEFAULTS=alfresco,archive
#HTTP by default
- ALFRESCO_SECURE_COMMS=none
ports:
- 8083:8983 #Browser port
activemq:
image: alfresco/alfresco-activemq:5.16.1
mem_limit: 1g
ports:
- 8161:8161 # Web Console
- 5672:5672 # AMQP
- 61616:61616 # OpenWire
- 61613:61613 # STOMP

proxy:
image: alfresco/alfresco-acs-nginx:3.1.1
mem_limit: 128m
environment:
DISABLE_PROMETHEUS: "true"
DISABLE_SYNCSERVICE: "true"
DISABLE_ADW: "true"
depends_on:
- alfresco
ports:
- 8080:8080
links:
- alfresco
- share

ERROR Details

fresco_1 | 09-Aug-2021 09:32:42.403 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/usr/local/tomcat/webapps/alfresco] has finished in [94,806] ms
alfresco_1 | 09-Aug-2021 09:32:42.433 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
alfresco_1 | 09-Aug-2021 09:32:42.484 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [103639] milliseconds
solr6_1 | 2021-08-09 09:32:42.670 ERROR (searcherExecutor-8-thread-1-processing-x:alfresco) [ x:alfresco] o.a.s.t.ModelTracker Model tracking failed for core: alfresco
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090000 api/solr/modelsdiff return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getModelsDiff(SOLRAPIClient.java:1103)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModelsImpl(ModelTracker.java:313)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModels(ModelTracker.java:275)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.ensureFirstModelSync(ModelTracker.java:297)
solr6_1 | at org.alfresco.solr.lifecycle.SolrCoreLoadListener.createModelTracker(SolrCoreLoadListener.java:341)
solr6_1 | at org.alfresco.solr.lifecycle.SolrCoreLoadListener.newSearcher(SolrCoreLoadListener.java:135)
solr6_1 | at org.apache.solr.core.SolrCore.lambda$getSearcher$15(SolrCore.java:2249)
solr6_1 | at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
solr6_1 | at org.apache.solr.common.util.ExecutorUtil$MDCAwareThreadPoolExecutor.lambda$execute$0(ExecutorUtil.java:229)
solr6_1 | at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
solr6_1 | at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
solr6_1 | at java.base/java.lang.Thread.run(Thread.java:834)
solr6_1 | 2021-08-09 09:32:42.749 WARN (searcherExecutor-7-thread-1-processing-x:archive) [ x:archive] o.a.s.t.MetadataTracker nextTxCommitTimeService is not available. Upgrade your ACS Repository version in order to use this feature: archive - GetNextTxCommitTime return status is 404 when invoking api/solr/nextTransaction?fromCommitTime=0
solr6_1 | 2021-08-09 09:32:42.751 WARN (searcherExecutor-8-thread-1-processing-x:alfresco) [ x:alfresco] o.a.s.t.MetadataTracker nextTxCommitTimeService is not available. Upgrade your ACS Repository version in order to use this feature: alfresco - GetNextTxCommitTime return status is 404 when invoking api/solr/nextTransaction?fromCommitTime=0
solr6_1 | 2021-08-09 09:32:50.156 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-1) [ ] o.a.s.t.AbstractTracker [alfresco / MODEL@1197316477 / IT #1628501570024] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090001 api/solr/modelsdiff return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getModelsDiff(SOLRAPIClient.java:1103)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModelsImpl(ModelTracker.java:313)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.trackModels(ModelTracker.java:275)
solr6_1 | at org.alfresco.solr.tracker.ModelTracker.doTrack(ModelTracker.java:235)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.191 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-2) [ ] o.a.s.t.AbstractTracker [alfresco / ACL@221768688 / IT #1628501570027] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090003 api/solr/aclchangesets return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getAclChangeSets(SOLRAPIClient.java:185)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.checkRepoAndIndexConsistency(AclTracker.java:417)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.trackRepository(AclTracker.java:398)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.doTrack(AclTracker.java:161)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.ActivatableTracker.track(ActivatableTracker.java:97)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.178 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-13) [ ] o.a.s.t.AbstractTracker [archive / NODE_STATE_PUBLISHER@249059573 / IT #1628501570054] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090002 GetTransactions return status is 404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getTransactions(SOLRAPIClient.java:441)
solr6_1 | at org.alfresco.solr.tracker.ShardStatePublisher.doTrack(ShardStatePublisher.java:91)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.200 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-3) [ ] o.a.s.t.AbstractTracker [archive / ACL@1231985689 / IT #1628501570030] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090004 api/solr/aclchangesets return status:404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.callRepository(SOLRAPIClient.java:1596)
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getAclChangeSets(SOLRAPIClient.java:185)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.checkRepoAndIndexConsistency(AclTracker.java:417)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.trackRepository(AclTracker.java:398)
solr6_1 | at org.alfresco.solr.tracker.AclTracker.doTrack(AclTracker.java:161)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.ActivatableTracker.track(ActivatableTracker.java:97)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
solr6_1 | 2021-08-09 09:32:50.233 ERROR (org.alfresco.solr.AlfrescoCoreAdminHandler@41e1455d_Worker-12) [ ] o.a.s.t.AbstractTracker [alfresco / NODE_STATE_PUBLISHER@466006752 / IT #1628501570052] Tracking failure. See the stacktrace below for further details.
solr6_1 | org.alfresco.error.AlfrescoRuntimeException: 07090005 GetTransactions return status is 404
solr6_1 | at org.alfresco.solr.client.SOLRAPIClient.getTransactions(SOLRAPIClient.java:441)
solr6_1 | at org.alfresco.solr.tracker.ShardStatePublisher.doTrack(ShardStatePublisher.java:91)
solr6_1 | at org.alfresco.solr.tracker.AbstractTracker.track(AbstractTracker.java:242)
solr6_1 | at org.alfresco.solr.tracker.TrackerJob.execute(TrackerJob.java:60)
solr6_1 | at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
solr6_1 | at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
alfresco_1 | 09-Aug-2021 09:32:54.027 INFO [JobLockService1] org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading Illegal access: this web application instance has been stopped already. Could not load [org.alfresco.repo.lock.JobLockServiceImpl$4]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
alfresco_1 | java.lang.IllegalStateException: Illegal access: this web application instance has been stopped already. Could not load [org.alfresco.repo.lock.JobLockServiceImpl$4]. The following stack trace is thrown for debugging purposes as well as to attempt to terminate the thread which caused the illegal access.
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForResourceLoading(WebappClassLoaderBase.java:1385)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.checkStateForClassLoading(WebappClassLoaderBase.java:1373)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1226)
alfresco_1 | at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1188)

[abhinavmishra14]

It seems the cors config with "*" seems to break. Although documentation has mention of * to allow all origins :https://docs.alfresco.com/content-services/community/config/repository/#cors-configuration

but as per : https://alfresco.atlassian.net/browse/REPO-4219 it seems * is not even allowed, and should be left empty. 

Here are some workarounds though: 

https://stackoverflow.com/questions/67162359/dockerized-alfresco-cors-filter

https://alfresco.atlassian.net/browse/REPO-4217

https://docs.alfresco.com/content-services/6.1/config/repository/#cross-origin-resource-sharing-cors...

[waqar1]

i followed the workarounds defined on these links. usr/local/tomcat not exist in my ubuntu directory i can only navigate up to usr/local while tomcat directory not exist.similary WEB-INF/lib is also not exist.as i have used containerized docker installation for alfresco.please help me to resolve this issue

[abhinavmishra14]

---

@waqar1 wrote:

i followed the workarounds defined on these links. usr/local/tomcat not exist in my ubuntu directory i can only navigate up to usr/local while tomcat directory not exist.similary WEB-INF/lib is also not exist.as i have used containerized docker installation for alfresco.please help me to resolve this issue

---

@waqar1  it is not necessary that alfresco is installed under /usr/local/tomcat directory only. When following the links relate the instructions as per your installation. 

As you are docker compose the path mentioned in link is correct that is: /usr/local/tomcat. I think you are looking for it on your host machine which is not correct. You have to check the container. 

If you are not aware on how to connect to a docker container, here are the steps:

1- Open command promot/power shell or terminal (whatever you are using) and type following command:

docker exec -it <nameOrIdOfContainer> /bin/bash

example:

docker exec -it alfresco_1 /bin/bash

or

docker exec -it 028 /bin/bash 

Where name of the container is: alfresco
and container id: 0282bf706a57

If you are not sure how to get the container name of container id, then first execute the following commands before step 1 above, the below commad will display containers and their ids:

docker ps 

Output example: 
https://hub.alfresco.com/t5/image/serverpage/image-id/1037i5D397466386337DB/image-size/large?v=v2&px=999

Based on output look for the container name or id (usually first 3 letters are enough to use).

3- Post connecting to container shell, follow the instructions you tried earlier. If it works then try to convert those steps into DockerFile and use it with docker-compose in combination because if you terminate the container the changes you made would be lost.

[waqar1]

I have followed all the instructions on given links but get no success.implemented Instructions given on this mentioned link    https://stackoverflow.com/questions/67162359/dockerized-alfresco-cors-filter.

i have copied the jars file with exact version in there respective directores.i dont know exactly where is exact location of pom.xml.i have searched almost all directories.still getting the same error.i have attached screenshot of an error.

Angular application

alfresco running on same localhost

[abhinavmishra14 · Accepted solution]

@waqar1  Like mentioned earlier, settings as per https://docs.alfresco.com/content-services/latest/config/repository/#cors-configuration or https://docs.alfresco.com/content-services/6.1/config/repository/#cross-origin-resource-sharing-cors... doesn't work and seems broken at repo layer. 

The settings are broken only with "*", valid urls works fine though. You may not be wanted to do this setting for prod as it is not recommended. Allowing only valid trusted remote origins as suggested. 

However, workaround given here does work for me.

This is what i did to test the workaround:

1- downloaded the two jar files:

https://repo1.maven.org/maven2/com/thetransactioncompany/cors-filter/2.5/cors-filter-2.5.jar

https://repo1.maven.org/maven2/com/thetransactioncompany/java-property-utils/1.9.1/java-property-uti...

2- Copied them to $TOMCAT_DIR/webapps/alfresco/WEB-INF/lib/ using DockerFile. 

Note: if you have non containerized setup, then copy the jars in $ALF_HOME/modules/platform directory. Refer this doc to understand simple modules: https://docs.alfresco.com/content-services/latest/develop/extension-packaging/#simplemodule

3- Taken the latest copy of web.xml from here: https://raw.githubusercontent.com/Alfresco/alfresco-community-repo/master/packaging/war/src/main/web...

 4- Updated it with CORS filters as suggested here: https://docs.alfresco.com/content-services/6.1/config/repository/#cross-origin-resource-sharing-cors... and kept the value for cors filter as

<init-param>
  <param-name>cors.allowOrigin</param-name>
   <param-value>*</param-value>
</init-param>

5- Copied the web.xml to $TOMCAT_DIR/webapps/alfresco/WEB-INF/web.xml via DockerFile, you can also use "sed" tool to update the web.xml file within the image without downloading a local copy as well. 

  <filter>
     <filter-name>CORS</filter-name>
     <filter-class>com.thetransactioncompany.cors.CORSFilter</filter-class>
     <init-param>
         <param-name>cors.allowGenericHttpRequests</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
         <param-name>cors.allowOrigin</param-name>
         <param-value>*</param-value>
     </init-param>
     <init-param>
         <param-name>cors.allowSubdomains</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportedMethods</param-name>
         <param-value>GET, HEAD, POST, PUT, DELETE, OPTIONS</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportedHeaders</param-name>
         <param-value>origin, authorization, x-file-size, x-file-name, content-type, accept, x-file-type, range</param-value>
     </init-param>
     <init-param>
         <param-name>cors.exposedHeaders</param-name>
         <param-value>Accept-Ranges, Content-Encoding, Content-Length, Content-Range</param-value>
     </init-param>
     <init-param>
         <param-name>cors.supportsCredentials</param-name>
         <param-value>true</param-value>
     </init-param>
     <init-param>
          <param-name>cors.maxAge</param-name>
          <param-value>3600</param-value>
     </init-param>
   </filter>

   <filter-mapping>
     <filter-name>CORS</filter-name>
     <url-pattern>/api/*</url-pattern>
     <url-pattern>/service/*</url-pattern>
     <url-pattern>/s/*</url-pattern>
     <url-pattern>/cmisbrowser/*</url-pattern>
     <url-pattern>/definitions/*</url-pattern>
 </filter-mapping>

   

FROM alfresco/alfresco-content-repository-community:7.1.0-M1

ARG TOMCAT_DIR=/usr/local/tomcat

# Copy any third party libraries if there are any
COPY Dockerfile libs/*.jar $TOMCAT_DIR/webapps/alfresco/WEB-INF/lib/

#Copy updated web.xml
COPY web.xml $TOMCAT_DIR/webapps/alfresco/WEB-INF/web.xml

6- Built the images and launched the containers. 

docker-compose up --build

To test used this simple code:

index.html

<!DOCTYPE html>
<html>

    <head>
        <meta charset="utf-8"/>
        <title>CORS Test</title>
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
        <script type='text/javascript' src="cors-test.js"></script>
    </head>
    <body onLoad='main();'>
    </body>
</html>

cors-test.js

function main()
{
    console.log("main invoked...");
    console.log("ajax request to the api that require cors enabled");
    $.ajax
    ({
        dataType: "xml",
        url: "http://localhost:7080/alfresco/s/api/login?u=admin&pw=admin",
        success: function(data)
        {
            console.log("log response on success");
            console.log(data);
        }
    });
}

Checkout this demo project in case you want to reference: https://github.com/abhinavmishra14/enable-cors-acs-demo

[akreienbring1]

I'm using ACS 7.2.0.1 and at least Alfresco starts up normally when i configure:

cors.allowed.origins=*

cors.support.credentials=false