1. #SummitNow Alfresco Authentication and Synchronization Nov 2013 Mark Rogers

2. #SummitNow

3. Introduction Configuration of Alfresco Authentication Synchronization Questions and Examples

4. #SummitNow Configuration of Alfresco JMX / Admin Console Extension Subsystem Over-rides alfresco-global.properties module/*/alfresco-global.properties Default settings Precedence

5. #SummitNow Authentication Who are you?

6. #SummitNow Authentication Who are you? Alfresco Share Alfresco Repository Other Applications

7. #SummitNow Alfresco Interfaces Alfresco Share Alfresco (Web App) Other Applications Alfresco Mobile Alfresco Cloud JAAS O.S. CMIS Web Scripts (HTTP) FTP WebDav CIFS NFS JCR RMI SOAP SPP

8. #SummitNow Alfresco Internal Authentication Who are you? Alfresco Share Alfresco Repository Alfresco User Store user://alfresco/userStore/system/people

9. #SummitNow Alfresco Authentication Type Internal (alfresco NTLM) ldap passthru external kerberos

10. #SummitNow Authentication Chain Who are you? Alfresco Repository internal:Internal ldap1:ldap ldap2:ldap 1 3 2

11. #SummitNow Who are you? LDAP Authentication Alfresco Share Alfresco Repository LDAP Directory (optional) lookup user id authenticate

12. #SummitNow Who are you? Passthru Authentication Alfresco Share Alfresco Repository Windows Domain 1 – Authenticate NTLM V1, NetBios, SMB

13. #SummitNow Who are you? LDAP Authentication Alfresco Share Alfresco Repository LDAP Directory (optional) lookup user id authenticate

14. #SummitNow External Authentication Who are you? Alfresco Share Alfresco Repository Other Applications Authentication System Authentication Token {X-Alfresco-Remote-User} F i r e w a ll

15. #SummitNow Kerberos Authentication Who are you? Alfresco Share Alfresco Repository Other Applications 3 - Service ticket {kerberos ticket} F i r e w a ll Kerberos TGS Kerberos KDC users & services : key 1 - Authenticate (user, pass) 2 - TGT

16. #SummitNow Synchronization What are this person’s details?

17. #SummitNow What are my/your details? LDAP Synchronization LDAP Directory Alfresco TYPE cm:person

18. #SummitNow LDAP Synchronization ldap/common-ldap-context.xml AlfrescoLDAP cm:userName${ldap.synchronization.userIdAttributeName} cm:firstName${ldap.synchronization.userFirstNameAttributeName} cm:lastName${ldap.synchronization.userLastNameAttributeName} cm:email${ldap.synchronization.userEmailAttributeName} cm:organization${ldap.synchronization.userOrganizationalIdAttributeName} cm:organizationId${ldap.synchronization.userOrganizationalIdAttributeName} cm:homeFolderProvidernull

19. #SummitNow Server Client NTLM v1 Who are you? (DOMAIN NAME, USERNAME, PASSWORD) DOMAIN NAME, USERNAME CHALLENGE (8 byte random) RESPONSE Windows Key Store Validate Hash GRANTED

20. #SummitNow Server Client NTLM v2 Who are you? (DOMAIN NAME, USERNAME, PASSWORD) DOMAIN NAME, USERNAME SERVER CHALLENGE ( 8 byte random) RESPONSE (HMAC-MD5, 8 byte CLIENT CHALLENGE) Windows Key Store Validate Hash 1 GRANTED Hash 2 Time Stamp, Server Name, Optional Values

21. #SummitNow Resources Alfresco Wiki http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems Alfresco Admin console http://localhost:8080/alfresco/service/enterprise/admin/admin- directorymanagement http://localhost:8080/alfresco/service/enterprise/admin/admin- directorymanagement Apache Directory Studio http://directory.apache.org/studio/ Microsoft NTLM documentation http://msdn.microsoft.com/en-us/library/cc236700.aspx

22. #SummitNow Questions and Answers

23. #SummitNow