CIFS Server Authentication

From AlfrescoWiki

Jump to: navigation, search

The Alfresco CIFS server has several different authenticator implementations. The default authenticator provides user authentication against the Alfresco user database using NTLMv1 password hashing. The default authenticator is configured using :- 

<config evaluator="string-compare" condition="Filesystem Security">
  <authenticator type="alfresco">
  </authenticator>
</config>

The default authenticator has configuration options to allow guest access when the client uses the guest user name to connect, <allowGuest/>, and to map client user names that are not in the Alfresco user database to the guest user, <mapUnknownUserToGuest/>.

There are two other CIFS authenticators included with Alfresco that provide passthru authentication and Enterprise authentication support.

[edit] Passthru Authenticator

The CIFS passthru authenticator provides the ability to use existing Windows file servers to authenticate users accessing the Alfresco CIFS server. To configure the passthru authenticator use :- 

<config evaluator="string-compare" condition="Filesystem Security">
  <authenticator type="passthru">
   <Server>192.168.0.1,adsrv.alfresco.org</Server>
  </authenticator>
</config>

The configuration options available for the passthru authenticator are :-

  • <Server>

Specifies a comma delimeted list of servers to use for passthru authentication.

  • <LocalServer/>

Use the local server for passthru authentication.

  • <Domain>

Specifies the Windows domain/workgroup to use for passthru authentication. The CIFS server will locate the domain controllers.

  • <LocalDomain/>

Use the domain/workgroup that the local server belongs to when finding the domain controllers.

  • <protocolOrder>

Specifies the type of protocols and the order of connection for passthru authentication sessions. The default is to use NetBIOS, if that fails then try to connect using native SMB/port 445. Specify either a single protocol type or a comma delimited list with a primary and secondary protocol type. The available protocol types are 'NetBIOS' for NetBIOS over TCP and 'TCPIP' for native SMB.

  • <offlineCheckInterval>

Specifies how often passthru servers that are marked as offline are checked to see if they are now online. The default check interval is 5 minutes. The check interval is specified in seconds.

You should only specify one of the above options.

The passthru authenticator can only be configured when the main authentication component is configured to use the LDAP or JAAS component.

[edit] Enterprise Authenticator

The Enterprise authenticator provides support for many types of logon that a CIFS client may send. It supports the following logon types :-

  • NTLMv1 hashed passwords
  • NTLMv2 hashed passwords/blob
  • NTLMSSP two stage session setup with NTLMv1/NTLMv2
  • SPNEGO session setup with Kerberos or NTLMSSP

To enable the Enterprise authenticator use :- 

<config evaluator="string-compare" condition="Filesystem Security">
  <authenticator type="enterprise">
  </authenticator>
</config>

The default configuration will enable NTLMv1/NTLMv2 and NTLMSSP support using the Alfresco user database.

The weaker NTLMv1 hashed password support can be disabled using <disallowNTLMv1/>.

To enable support for Kerberos against Active Directory you will need to setup an account under Active Directory, follow the instructions Configuring_the_CIFS_server_for_Kerberos/Active_Directory_integration.

Retrieved from "http://wiki.alfresco.com/wiki/CIFS_Server_Authentication"