Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want Alfresco to authenticate users using SSO with MIT Kerberos.

What authentication.chain should I use?

I tried authentication.chain=kerberos1:kerberos without success.

Based on this answer I have also set up an LDAP server containing the same users as MIT Kerberos, and tried with authentication.chain=kerberos1:kerberos;ldap1:ldap, but that does not work either.

Important lines of ldap1/

I always get CIFS server configuration error, Error creating bean with name 'globalAuthenticationFilter', even though I don't care about CIFS, only HTTP. In kerberos1/ I have kerberos.authentication.authenticateCIFS=false.

What am I doing wrong?
Do I maybe need passthru somehow?

share|improve this question
up vote 1 down vote accepted

This chain should work:


but as far as I know MIT kerberos won't work out of the box with Alfresco kerberos authentication backend. You might need some additionnal config on the KDC

you can still use ldap if your KDC uses an LDAP directory as a backend and passthru would only work if you have samb along side with you kerberos.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.