<img alt="Liferay" height="36" src="http://cdn.www.liferay.com/osb-www-theme/images/custom/heading.png" width="146" />

Hello all,

I've just updated Liferay to version 6.0.5 to get correct import from Active Directory.
To make the full story short, NTLM authentication worked on my PC with Liferay 5, but not anymore with LR 6.
When I try to authenticate with NTLM, I have a blank screen in my webbrowser and nothing appears.

Here is the Tomcat console:

1
215:24:39,775 ERROR [NtlmFilter:136] java.lang.StringIndexOutOfBoundsException: String index out of range: -1
3java.lang.StringIndexOutOfBoundsException: String index out of range: -1
4       at java.lang.String.substring(String.java:1937)
5       at com.liferay.portal.security.ntlm.NtlmServiceAccount.setAccount(NtlmServiceAccount.java:48)
6       at com.liferay.portal.security.ntlm.NtlmServiceAccount.<init>(NtlmServiceAccount.java:25)
7       at com.liferay.portal.security.ntlm.NtlmManager.setConfiguration(NtlmManager.java:123)
8       at com.liferay.portal.security.ntlm.NtlmManager.<init>(NtlmManager.java:43)
9       at com.liferay.portal.servlet.filters.sso.ntlm.NtlmFilter.getNtlmManager(NtlmFilter.java:115)
10       at com.liferay.portal.servlet.filters.sso.ntlm.NtlmFilter.processFilter(NtlmFilter.java:162)
11       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:123)
12       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
13       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
14       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
15       at com.liferay.portal.servlet.filters.sso.cas.CASFilter.processFilter(CASFilter.java:176)
16       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:123)
17       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
18       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
19       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
20       at com.liferay.portal.sharepoint.SharepointFilter.processFilter(SharepointFilter.java:179)
21       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:123)
22       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
23       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
24       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
25       at com.liferay.portal.servlet.filters.virtualhost.VirtualHostFilter.processFilter(VirtualHostFilter.java:184)
26       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:123)
27       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
28       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
29       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
30       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:126)
31       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
32       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
33       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
34       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:126)
35       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
36       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
37       at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:738)
38       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
39       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
40       at com.liferay.portal.kernel.servlet.BaseFilter.processFilter(BaseFilter.java:196)
41       at com.liferay.portal.servlet.filters.threadlocal.ThreadLocalFilter.processFilter(ThreadLocalFilter.java:35)
42       at com.liferay.portal.kernel.servlet.BaseFilter.doFilter(BaseFilter.java:123)
43       at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
44       at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
45       at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
46       at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
47       at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:465)
48       at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
49       at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
50       at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
51       at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
52       at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:852)
53       at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:588)
54       at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
55       at java.lang.Thread.run(Thread.java:619)

Do you have any idea of what cause the problem?
Is that a bug? Is it a configuration which has to change?

Thanks for your help.

Philippe

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 18, 2010 9:43 AM

Answer

Samuel Liu

LIFERAY STAFF

Rank: Expert

Posts: 301

Join Date: May 27, 2010

Hi Philippe,

These configurations work for our test servers. Change as needed emoticon

portal.ext.properties:

1
2company.security.auth.type=screenName
3
4#LDAP
5ldap.auth.enabled=true
6ldap.auth.required=false
7
8ldap.import.enabled=false
9ldap.import.on.startup=false
10
11ldap.export.enabled=false
12
13ldap.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
14ldap.base.provider.url={ldap://xxx.xxx.xx.xx:389}
15ldap.base.dn=cn=Users,dc={windows2003},dc=ntlm
16ldap.security.principal=cn={username},cn=Users,dc={windows2003},dc=ntlm
17ldap.security.credentials={password}
18
19ldap.auth.search.filter=(&(sAMAccountName=@screen_name@)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))
20
21ldap.user.default.object.classes=top,person,inetOrgPerson,organizationalPerson
22
23ldap.user.mappings=screenName=sAMAccountName\npassword=userPassword\nemailAddress=userPrincipalName\nfirstName=givenName\nlastName=sn\njobTitle=title\ngroup=memberOf
24
25ldap.group.mappings=groupName=cn\ndescription=sAMAccountName\nuser=member
26
27ldap.import.user.search.filter=(&(objectClass=inetOrgPerson)(!(useraccountcontrol:1.2.840.113556.1.4.803:=2)))
28ldap.import.group.search.filter=(objectClass=groupOfUniqueNames)
29
30ldap.users.dn=ou=users,dc=example,dc=com
31ldap.groups.dn=ou=groups,dc=example,dc=com
32
33#NTLM
34ntlm.auth.enabled=true
35ntlm.auth.domain.controller={xxx.xxx.xx.xxx}
36ntlm.auth.domain.controller.name={our domain controller name}
37ntlm.auth.domain={domain name, ours was "windows2003"}
38ntlm.auth.service.account={XXXXXXX$@xxxxx.ntlm NOTE this has to be a computer account}
39ntlm.auth.service.password={our password}

If there are further problems, please post reproduce steps so we can try to replicate your issue.

Thanks
Sam

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 19, 2010 12:07 AM

Answer

Philippe GABERT

Rank: New Member

Posts: 17

Join Date: May 13, 2010

Sam,

thank you for your help, I did everything you did, and I can login by going to /login page.
But NTLM still does not work.

The only difference that I have in my own configuration is that for the moment, I don't have a service account and I use mine. (With the full qualified name.)

I still have the StringIndexOutOfBoundsException error, and I don't know why. I guess it's a Java code problem, not a configuration problem in that case.
I don't find the NTLMFilter java source code for LR 6.0.5, I can't have a look at what it wants.

Could you please do something for me?

Thanks !

Philippe

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 20, 2010 10:34 AM

Answer

Samuel Liu

LIFERAY STAFF

Rank: Expert

Posts: 301

Join Date: May 27, 2010

Hi Philippe,

I don't know much about NTLM at all, but I can help you in terms of source code. Liferay community portal's source is publicly available in trunk emoticon

Liferay Wiki - Trunk

You can use subversion to get the code you need to see how it works, if that's at all helpful emoticon

Additionally, if you think this is a bug you should report it at Liferay JIRA so that it gets looked at by the experts.

Warm regards,
Sam

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 20, 2010 12:42 PM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Hi Philippe,

In Liferay 6 NTLM has been changed to handle NTLM v2 authentication. In implementing this, the service.account and service.password were added to have liferay be able to allow for our ntlm authenticator to validate NTLM credentials with the NETLOGON service running on the windows domain controller

So, the configuration of this two properties are needed from now on. Also note that the service.account needs to be a computer account in your AD.

For example:

ntlm.auth.service.account=LIFERAY$@EXAMPLE.COM
ntlm.auth.service.password=test

In this case we hava a computer account LIFERAY properly configured with the test password in AD (the $ character is also needed).

Please refer to this wiki for more details of how to setup this account.

Cheers

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 23, 2010 11:45 AM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Philippe,

I am having the same problem you have. At first, I tried to use same configuration as 5.2.3 and it kept asking user name and password. After I added, ntlm.auth.service.account and ntlm.auth.service.password, I have same problem, String index out of range problem. I did not enter ntlm.auth.domain.controller.name though.

Have you find any solution? Thank you.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 24, 2010 12:43 AM

Answer

Jorge Diniz

Rank: New Member

Posts: 9

Join Date: July 26, 2010

Hi

U can follow this screenshots to get NTLM to work

http://www.liferay.com/community/wiki?p_p_id=36&p_p_lifecycle=0&p_p_state=normal&p_p_mode=view&p_p_col_id=column-2&p_p_col_count=1&_36_struts_action=%2Fwiki%2Fview_page_attachments&p_r_p_185834411_nodeId=1071674&p_r_p_185834411_title=NTLMv2+SSO+Configuration

and this link to understand better what u need to do

http://www.liferay.com/community/wiki/-/wiki/Main/NTLMv2+SSO+Configuration/pop_up
Just read step 1 and step 2.

Hope it helps

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 30, 2010 4:33 PM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Hi Jorge,

I followed your instruction wihtout success. Now I am trying to trace the code to find if there is anything wrong in my configuration. Now I have a question. The wiki says I need to use NTLMv2Filter class after I change web.xml. However, I cannot locate the file from nightly build.

Where is the file? If I cannot find it, can I still trace the logic with NtlmFilter?

Thank you in advance.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 31, 2010 6:56 AM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Hi Brian,

You don't have to change the web.xml. The NtlmFilter from the latest Liferay 6 version should make the job.

Cheers

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

August 31, 2010 9:08 AM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

I found what is causing the StringIndexOutOfBoundsException. Liferay assumes the account name is following the convention of LIFERAY$@EXAMPLE.COM. That means I need $ and @ in the account name. Now I get a prompt for username and password.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 3, 2010 2:02 PM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

I made it work. The problem was computer account not created properly. After I pass the explanation how to create it to our Active Directory Administrator, he was able to create a working account.
Another key point was ntlm.auth.service.account=LIFERAY$@Test_Masco_Coatings.com where
LIFERAY is the account name, "$@" is required, and Test_Masco_Coatings.com is the domain name.

I appreciate your help.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 3, 2010 2:13 PM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Great news Brian! emoticon

Let us know if you have any other problems.

Cheers

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 7, 2010 10:23 AM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

Thank you for the reply. I have more questions though.

1. With Liferay 5.2.3, Ntlm worked with chrome, fixrefox and internet explorer 6 and internet explore 8.

With Liferay 6.0.5, Ntlm worked with chrome, fixrefox. But doe not work with internet explorer 6 and internet explore 8.

Is there any special set up on the browser to make it work?

2. Another interesting thing I found was that Liferay still import the user when you login when
both ldap.import.enabled and ldap.import.on.startup flag are false. That is a good feature. The only issue is that you cannot see the user imported in that manner. You cannot see that user from user screen even after reindex. However, you can see that user from group. Any operation on that user is failing, though.
When I imported the user with ldap.import.enabled flag on, I was able to see all the users.

3. If I activate the NTLM, I lose the ability to login as built in user test, which means I lose the admin user. After the user import, I need to go back and disable the NTML by changing the portal-ext.properties, restart the server, login as test, and give the admin role to my account imported. Then, I need to reactivate the NTLM. The installation process becomes a little bit clumsy when you do the configuration through portal-ext.properties only.

Thank you.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 13, 2010 11:42 AM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

I found what I was doing wrong with IE 8 as decribed in http://issues.liferay.com/browse/LPS-12596?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel. It is working with IE8.

Now I am working on how we can have at least one user who has the admin role after activating NTLM.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 13, 2010 11:58 AM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Hi Brian,

Thanks for your feedback regarding the NTLM stuff. I was out of time last week to go through your findings so I couldn't make any comments.

I'll try to reproduce the issues you had and let you know my results.

Thanks

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 13, 2010 4:22 PM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

No problem. I solved following one, too. I noticed that it only happens with solr indexing and I was using older version 6.0.1.1. Whne I found 6.0.5.1 and deploy again. It worked fine. I just did not know there was a update for solr-web, too. I will work on the omniadmin(user test) issue with NTLM. (I am glad it is not a show stpper.)

Brian

2. Another interesting thing I found was that Liferay still import the user when you login when
both ldap.import.enabled and ldap.import.on.startup flag are false. That is a good feature. The only issue is that you cannot see the user imported in that manner. You cannot see that user from user screen even after reindex. However, you can see that user from group. Any operation on that user is failing, though.
When I imported the user with ldap.import.enabled flag on, I was able to see all the users.

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 13, 2010 4:56 PM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marcellus,

The last one. The default omniadmin, test does not work at all when you activate ntlm. Here is my work around using omniadmin.

1. Configure and Run Liferay to create brand new DB.
2. Login as someone who is going to be omniAdmin, for example "bko".
3. GO to datstabase table user_ and find the useId of the "bko".
4. Add following line to portal-ext.properties. (10426 is the userId of the "bko")
omniadmin.users=10426
5. Restart the server.
6. If you login as bko, you can do everything like user test (without NTLM).

Please let me know if there is better way. Now I am ready for production.
Thank you.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 16, 2010 9:14 AM

Answer

Rank: Junior Member

Posts: 70

Join Date: February 11, 2010

Marsellus,

One more thing about the OmniAdmin. In 5.2.3. Omniadmin did not have the permission as the adminstarator. OmniAdmin had the permission to do server operation only. However, in 6.0.5, omniAdmin has all the permission including the ones of the administrator. It make a lot of sense, as the default admin "test" is not usable any more once you activate the NTLM.

Brian

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 17, 2010 3:07 PM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Hi Brian,

I tested the issue #2 today, however I couldn't replicate. Here's my steps:

1. I set both ldap.import.enabled and ldap.import.on.startup flag to false
2. I logged in with an AD user
3. I logged as admin and searched for the user Control Panel User section. I could find the imported user.

Could you check on your end again?

Thanks man

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

September 17, 2010 3:15 PM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Ops, I haven't read your last comment. So we are good with #2.

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter

December 3, 2010 1:48 PM

Answer

Vladimir Filipovic

Rank: New Member

Posts: 11

Join Date: September 21, 2010

For me NTLM works on Windows XP in all browsers. On Windows 7 and Windows 2008 it does not. I get prompted for a username and password and even if I enter them correctly it still does not log me in. It keeps reprompting me.

I found a workaround here, http://technet.microsoft.com/en-us/library/cc960646.aspx, which worked but this seems to fall back on using NTLM v1. This "fix" would have to get pushed to everyones PC which I'm sure our client technologies team would not like.

Has anyone gotten NTML authentication to work on Windows 7 and Windows 2008?

Thank you,

Vlado

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter

January 26, 2011 3:59 AM

Answer

Alfredo del Castillo

Rank: Junior Member

Posts: 41

Join Date: January 18, 2011

Hi, I reopen this thread because I have a problem. The thing is that my client was using Liferay 5.2.3, with a v1 ntlm server. Now we have to work with Liferay 6.0.5, but after reading this post we have realized that we need that this ntlm can work with v2...

But, knowing that the IT people who should do that job isn't going to do it soon, we are in problems.

So, the question is, can we force Liferay 6 to use the old ntlm v1?

Thanks!

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter

April 13, 2011 4:41 AM

Answer

Ana Tavares

Rank: New Member

Posts: 1

Join Date: January 24, 2011

Vladimir Filipovic:

Hi there!

Have figured out to solve your problem? I'm having the same problem.

Thank you

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter

April 13, 2011 7:13 AM

Answer

LIFERAY STAFF

Rank: Regular Member

Posts: 131

Join Date: October 26, 2009

Hi All,

We have recently discovered an issue with NTLMv2 and Windows 2008. See LPS-15380.

It's fixed and it's included in the next CE release.

Cheers

Mark as an Answer

RE: [LR 6.0.5] NTLM Filter -> StringIndexOutOfBoundsException

April 19, 2011 2:19 PM

Answer

Rowell Belen

Rank: New Member

Posts: 7

Join Date: April 14, 2011

Hello,

According to the wiki, I have to execute the script on the domain controller? Is this correct? Thanks.