Help

Kerberos: impossible a faire fonctionner

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
christian1980
Member II
‎9 Dec 2011 2:46 PM

Kerberos: impossible a faire fonctionner

Bonjour,

J'ai suivi pas à pas l'aide de al doc pour configurer le SSO Kerberos sur un active directory (Win 2008 R2).

Dès que je tente de l'activer dans la chaine d'authentification je me retrouve obstinément avec l'erreur suivante:
2011-12-09 15:12:01,779  ERROR [org.alfresco.fileserver] [Thread-1] CIFS server configuration error, Error creating bean with name 'cifsAuthenticator' defined in file [C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\kerberos\kerberos-authentication-context.xml]: Invocation of init method failed; nested exception is java.lang.SecurityException: Erreur de configuration :
   Ligne 5 : attendu [controlFlag]
 org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'cifsAuthenticator' defined in file [C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\kerberos\kerberos-authentication-context.xml]: Invocation of init method failed; nested exception is java.lang.SecurityException: Erreur de configuration :
   Ligne 5 : attendu [controlFlag]
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1420)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:519)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:456)
   at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:291)
   at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
   at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:288)
   at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:190)
   at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:580)
   at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:895)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:425)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:684)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:665)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:234)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory.getApplicationContext(ChildApplicationContextFactory.java:368)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.getApplicationContext(DefaultChildApplicationContextManager.java:337)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager$ApplicationContextManagerState.start(DefaultChildApplicationContextManager.java:296)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:665)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.getState(AbstractPropertyBackedBean.java:234)
   at org.alfresco.repo.management.subsystems.DefaultChildApplicationContextManager.getInstanceIds(DefaultChildApplicationContextManager.java:180)
   at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:64)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
   at $Proxy217.isActive(Unknown Source)
   at org.alfresco.filesys.config.ServerConfigurationBean.processCIFSServerConfig(ServerConfigurationBean.java:190)
   at org.alfresco.filesys.AbstractServerConfigurationBean.init(AbstractServerConfigurationBean.java:473)
   at org.alfresco.filesys.AbstractServerConfigurationBean.onApplicationEvent(AbstractServerConfigurationBean.java:824)
   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:97)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ChildApplicationContext.publishEvent(ChildApplicationContextFactory.java:484)
   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)
   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:684)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:665)
   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:473)
   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEventInternal(SafeApplicationEventMulticaster.java:209)
   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEvent(SafeApplicationEventMulticaster.java:180)
   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:303)
   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)
   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)
   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:276)
   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:197)
   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)
   at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:63)
   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3972)
   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4467)
   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:546)
   at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:637)
   at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:563)
   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:498)
   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1277)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:321)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
   at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)
   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
   at org.apache.catalina.core.StandardService.start(StandardService.java:519)
   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
   at org.apache.catalina.startup.Catalina.start(Catalina.java:581)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
   at java.lang.reflect.Method.invoke(Method.java:601)
   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
Caused by: java.lang.SecurityException: Erreur de configuration :
   Ligne 5 : attendu [controlFlag]
   at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:110)
   at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
   at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
   at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
   at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
   at java.lang.Class.newInstance0(Class.java:372)
   at java.lang.Class.newInstance(Class.java:325)
   at javax.security.auth.login.Configuration$3.run(Configuration.java:264)
   at javax.security.auth.login.Configuration$3.run(Configuration.java:260)
   at java.security.AccessController.doPrivileged(Native Method)
   at javax.security.auth.login.Configuration.getConfiguration(Configuration.java:259)
   at javax.security.auth.login.LoginContext$1.run(LoginContext.java:254)
   at javax.security.auth.login.LoginContext$1.run(LoginContext.java:252)
   at java.security.AccessController.doPrivileged(Native Method)
   at javax.security.auth.login.LoginContext.init(LoginContext.java:251)
   at javax.security.auth.login.LoginContext.<init>(LoginContext.java:418)
   at org.alfresco.filesys.auth.cifs.EnterpriseCifsAuthenticator.initialize(EnterpriseCifsAuthenticator.java:311)
   at org.alfresco.filesys.auth.cifs.CifsAuthenticatorBase.afterPropertiesSet(CifsAuthenticatorBase.java:279)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1477)
   at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1417)
   … 65 more
Caused by: java.io.IOException: Erreur de configuration :
   Ligne 5 : attendu [controlFlag]
   at com.sun.security.auth.login.ConfigFile.match(ConfigFile.java:563)
   at com.sun.security.auth.login.ConfigFile.parseLoginEntry(ConfigFile.java:413)
   at com.sun.security.auth.login.ConfigFile.readConfig(ConfigFile.java:383)
   at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:283)
   at com.sun.security.auth.login.ConfigFile.init(ConfigFile.java:241)
   at com.sun.security.auth.login.ConfigFile.<init>(ConfigFile.java:108)
   … 84 more‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

J'ai créé les fichiers de config pour Kerberos comme ceci:
"C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\kerberos\kerberos1"
et dans ce répertoire j'ai 2 fichiers .properties avec le contenu suivant:


kerberos-authentication.properties
kerberos.authentication.realm=DOMAINE.NOM
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.defaultAdministratorUserNames=
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.cifs.password=<password>
kerberos.authentication.authenticateCIFS=true‍‍‍‍‍‍

kerberos-filter.properties
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.http.password=<password>
kerberos.authentication.sso.enabled=true
kerberos.authentication.browser.ticketLogons=true‍‍‍‍

alfresco-global.properties

### CIFS configuration ###
cifs.enabled=true
cifs.servername=monserveur
cifs.domain=
cifs.hostannounce=true
cifs.ipv6.enabled=false


### authentication config ###
authentication.chain=alfrescoNtlm1:alfrescoNtlm,kerberos1:kerberos
‍‍‍‍‍‍‍‍‍‍‍‍


java.login.config

Alfresco {
   com.sun.security.auth.module.Krb5LoginModule sufficient;
};

AlfrescoHTTP {
   storeKey=true
   useKetTab=true
   keyTab="C:/Alfresco/krb5/alfrescohttp.keytab"
   principal="HTTP/monserveur.domaine.nom";
};

AlfrescoCIFS {
   storeKey=true
   useKetTab=true
   keyTab="C:/Alfresco/krb5/alfrescocifs.keytab"
   principal="cifs/monserveur.domaine.nom";
};

com.sun.net.ssl.client {
   com.sun.security.auth.module.Krb5LoginModule sufficient;
};

other {
   com.sun.security.auth.module.Krb5LoginModule sufficient;
};
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

java.security

login.config.url.1=file:${java.home}/lib/security/java.login.config
‍‍‍

krb5.ini

[libdefaults]
default_realm = DOMAINE.NOM
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac 

[realms]
DOMAINE.NOM = {
kdc=srvdc1.mondomaine.nom
admin_server=srvdc1.mondomaine.nom
}

[domain_realm]
srvdc1.mondomaine.nom = DOMAINE.NOM
.srvdc1.mondomaine.nom = DOMAINE.NOM
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Où pourrait-être mon erreur dans la configuration de Kerberos ?????
Labels
0 Kudos
Reply
1 Reply
sibe
Active Member
‎19 Jun 2012 0:21 PM

Re: Kerberos: impossible a faire fonctionner

Quelle version d'Alfresco utilisez-vous ?

Sinon utilisez les valeurs ci dessous pour votre fichier brb5.ini

[libdefaults]
default_realm = DOMAINE.NOM
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac 
permitted_enctypes   = rc4-hmac
dns_lookup_kdc = false 
dns_lookup_realm = false 
forwardable = true 

[realms]
DOMAINE.NOM = {
kdc=srvdc1.mondomaine.nom
admin_server=srvdc1.mondomaine.nom
}

[domain_realm]
.srvdc1.mondomaine.nom = DOMAINE.NOM
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

J'ai créé les fichiers de config pour Kerberos comme ceci:
"C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\kerberos\kerberos1"
et dans ce répertoire j'ai 2 fichiers .properties avec le contenu suivant:

Ce n'est pas obligatoire de créer ce fichier depuis la version 3, vous pouvez réaliser la configuration via le fichier alfresco-global.properties ce qui doit vous donne quelques choses du genre (à vous d'utiliser les bonnes valeurs correspondantes) : 


authentication.chain=kerberos1:kerberos
kerberos.authentication.realm=ALFRESCO.COM
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=true
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.cifs.password=******
kerberos.authentication.http.password=******
kerberos.authentication.cifs.kerberosDebug=true
kerberos.authentication.cifs.disableNTLM=true
kerberos.authentication.cifs.useSPNEGO=true

cifs.enabled=true
cifs.serverName=CIFS_TEST
cifs.domain=ALFRESCO.COM
cifs.broadcast=255.255.255.255
cifs.bindto=
cifs.hostannounce=true
cifs.disableNIO=false
cifs.disableNativeCode=false
cifs.serverComment=Serveur CIFS Test
cifs.WINS.autoDetectEnabled=true
cifs.sessionDebug=NETBIOS, STATE, TREE, TRAN, ECHO, ERRORS, IPC, SOCKET, NEGOTIATE
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

J'espère que ça répond à votre question.

@++++
0 Kudos
Reply
The Archive

Content from pre 2016 and from language groups that have been closed.

Content is read-only.

We use cookies on this site to enhance your user experience

By using this site, you are agreeing to allow us to collect and use cookies as outlined in Alfresco’s Cookie Statement and Terms of Use (and you have a legitimate interest in Alfresco and our products, authorizing us to contact you in such methods).   If you are not ok with these terms, please do not use this website.