Unlocking the Secrets of Alfresco Authentication Mehdi BELMEKKI, Consultancy Team Alfresco

Agenda Introduction Talk objectives Alfresco Authentication Share Authentication External Authentication External SSO Demo Debugging tricks Questions

Introduction Mehdi Belmekki Technical consultant, Professional Service Team 5 years experience : Born and grow-up in Community : Graduated Community Contributor High-school Partners : Graduated RD University of Alfresco: Undergraduate Consultant ACA/ACE Based in Paris, France

Talk objectives Give a global overview of Repository authentication subsystems. Explain how Share get authenticated against the Repository How External Authentication works with Share/Repository Be able to configure SSO Filter for Share, with External Authentication Debugging tricks

Repository Authentication

Repository Authentication : Before subsystems Up to version 3.1 Spring configuration subdivided into themed-context files Authentication-services-context.xml Authority-services-context.xml Rendition-services-context.xml … All loaded into single Spring Application Context Customized by overriding bean’s definition Highly-coupled components :

Repository Authentication : Before subsystems - Limitations Everything global, managed by the same component Hard to separate dependencies Supportability / Upgradeability Configuration / Customization ? Basic admin tasks required Spring understanding Hard to maintain compatibility with old configuration Server restarts for any changes on the configuration Switching between supported authentications mechanisms, involved simultaneous editing of several files Template configuration could not be used without editing due to the uniqueness of namespacing e.g two LDAP directories

Repository Authentication : After subsystems A subsystem is a separate module responsible for a sub-part of Alfresco functionality Can be started, stopped, configured independently Has its own isolated Spring bean container and configuration Can have multiple instances

Repository Authentication : After subsystems – Subsystem’s actions Clearly define its interfaces with the rest of the system Automatically expose its configuration properties for editing via JMX (enterprise only) Change configuration without server restart All edited properties are persisted in the database and synchronized across the cluster.

Repository Authentication : Subsystem components Authentication Component Authentication Data Access Object (DAO) Authentication Service User Registry Export Service (optional) Authentication Filters Provide form or SSO-Based login functions for the following: Web Client WebDav WebScripts Sharepoint Protocol File Server Authentiticators CIFS Protocol (optional) FTP Protocol

Repository Authentication : OOTB Mechanisms – 5 types of subsystems alfrescoNtlm Native Alfresco authentication optional NTLM v2-based single sign-on (SSO) Supports CIFS authentication ldap Authentication via an LDAP server Optional user registry export No CIFS authentication ldap-ad variant exists with preconfigured defaults for Active Directory external Authentication by the application server E.g. CAS, Websphere LTPA User identity asserted to Alfresco via HttpServletRequest.getRemoteUser() or configured HTTP header

Repository Authentication : OOTB Mechanisms – 5 types of subsystems kerberos Authentication with a Kerberos Realm Optional SPNEGO-based single sign-on (SSO) Supports CIFS authentication Starting from v3.4: Sharepoint Protocol, Webscript and Share support passthru Authentication via a Windows domain server Optional NTLM v1-based single sign-on (SSO) Supports CIFS authentication

Repository Authentication : Advantages of Subsystems Each subsystem is a coordinated stack of compatible components No danger of e.g. Using the wrong CIFS authenticator with the wrong authentication component Common parameters are shared No need to paste the same Kerberos parameters multiple times into different configuration files No need to edit web.xml – ever! Web.xml uses generic filters that call into the authentication subsystem You can hot swap from one filter to another Easily chained

Repository Authentication : Chaining Mechanism Some enterprise customers may store user authentication data in multiple systems Local Alfresco Active Directory LDAP Kerberos There may be more than one instance of each type E.g. multiple LDAP directories One system may support different protocols for different purposes E.g. Active Directory with LDAP for User Registry Export and Kerberos for Authentication Rather than tie Alfresco exclusively to one of those systems and protocols, our customers want it all!

Repository Authentication : Chaining Mechanism An authentication component is configured for each system and added to an ordered list or ‘chain’ On a user login, Alfresco tries the credentials against each of the components in the chain If a chain member accepts the credentials the login succeeds If no chain member accepts, the login fails

Repository Authentication : Authentication Mechanism Decision OkLoginPage ChainingSubsystemProxyFactory ldapalfrescoNtlmexternal Users requests (e.g Explorer Web Client) AuthenticationFilter

Share Authentication

Share Authentication : Connectors, Endpoints, Credentials, Authenticators Connectors Responsible of establishing connection/communication with a remote location e.g Alfresco Repository Endpoints URL link to a remote resource Share connectors point to Alfresco Webscript service url Authenticators Plugged into connector to allow handshake with the remote location (e.g Alfresco Repository, using login/password against api/login webscript) Credentials User credentials (username/password) are used to get Endpoint credentials (Alfresco Ticket for example)

External Authentication And Single Sign On

External authentication Integrate Alfresco with any external authentication system. Can be integrated with your application server in such a way that the identity of the logged-in user is passed to servlets via the HttpServletRequest.getRemoteUser() method. Compatible with a number of SSO solutions, including Central Authentication Service (CAS). The subsystem also allows a proxy user to be configured, such that requests made through this proxy user are made in the name of an alternative user, whose name is carried in a configured HTTP request header Activating external authentication makes Alfresco accept external authentication tokens, make sure that no untrusted direct access to Alfresco's HTTP or AJP ports is allowed

External Authentication : Single Sign On prior to Alfresco 4 Custom Alfresco repo filter Changes in web.xml Custom Share filter Changes in web.xml Custom authentication webscript (Repo-side) Custom Connector Custom Authenticator

External Authentication : Single Sign On Alfresco 4 onward Subsystem configuration No need to change web.xml files (either in Repo or Share side) No need to code new authentication webscript. It’s provided now OOTB Easy to maintain Benefit from all subsystem’s features and capabilities Easy to support and maintain No change after version upgrade Modularity

External Authentication : SSO Configuration Share Uncomment remote section in share-config-custom.xml Replace AlfrescoCoockie by HeaderConnector Set the name of the header used by the external SSO in the userHeader element of the alfrescoHeader connector Repository Alfresco-global.properties authentication.chain=external1:external,alfrescoNtlm1:alfrescoNtlm

External Authentication with SSO Demo

Debugging Tricks

Debugging tricks : External Auth/SSO Repository Enable logging for repository authentication : org.alfresco.web.site.servlet.SSOAuthenticationFilter org.alfresco.repo.security.authentication.AuthenticationUtil Enable logging for Chaining : org.alfresco.repo.security.authentication.AbstractChainingAuthentic ationService

Debugging tricks : External Auth/SSO

Share Enable logging for : org.alfresco.web.app.servlet.DefaultRemoteUserMap org.springframework.extensions.webscripts.connector.RemoteClien t org.springframework.extensions.webscripts.connector.AlfrescoAuth enticator Use firebug to trace header properties and Modify-Header plugin to force header re-write

Questions ?