{"id":3814,"date":"2014-05-28T09:57:00","date_gmt":"2014-05-28T07:57:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/"},"modified":"2014-05-28T09:57:00","modified_gmt":"2014-05-28T07:57:00","slug":"configure-a-kerberos-client-and-alfresco-as-a-kerberized-application","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/","title":{"rendered":"Configure a Kerberos Client and Alfresco as a Kerberized application"},"content":{"rendered":"<p><img decoding=\"async\" class=\"blog-image aligncenter\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg\" alt=\"\" \/><\/p>\n<p>In the previous blog, I described <a href=\"\/how-to-install-and-manage-a-kerberos-server\">How to install and manage a Kerberos Server<\/a> but that&#8217;s useless if there are no clients and if no application have been kerberized! That&#8217;s why in this blog I will explain in the first part how to install a kerberos client in linux. The second part will be dedicated to the configuration of a browser to use Kerberos tickets and the last part will explain how to configure a popular application to use the newly created Kerberos MIT KDC. This application is Alfresco (leader in Open Source solutions for Electronic Content Management).<\/p>\n<p>For this blog, let&#8217;s define the following properties\/variables:<\/p>\n<ul>\n<li>example.com = the DNS Domain<\/li>\n<li>EXAMPLE.COM = the KDC REALM<\/li>\n<li>kdc01oel.example.com = the FQDN of the KDC<\/li>\n<li>mpatou@EXAMPLE.COM = the principal of a test user<\/li>\n<li>alf01.example.com = the FQDN of the Alfresco host server<\/li>\n<\/ul>\n<p>All configurations below have been tested on our infrastructure.<\/p>\n<h3>1. Install MIT Kerberos Client<\/h3>\n<p>On this part, I will only present how to install a Linux Client. I think the Mac release is available as part of the Mac OS X since version 10.3 (the current release is Mavericks: 10.9) and so there is nothing to do to install a Kerberos client but this installation isn&#8217;t configured. The Windows installation is quite easy if you use the installer but this isn&#8217;t a perfect solution. I think the best solution for windows would be to use the Windows implementation of Kerberos to configure the connection to a Linux KDC but this is a little bit more complex and I personally have troubles to configure that&#8230;<\/p>\n<p>So, all steps to install a Linux client are quite the same as those to install a Kerberos Server. Indeed, there is no specific source code for the client and so the basic installation is the same but it&#8217;s not the case for the configuration.<\/p>\n<p>Obviously, the first thing to do is to download the current release of the MIT Kerberos distribution for the target operating system. This could be done at the following URL: <a href=\"http:\/\/web.mit.edu\/kerberos\/dist\/index.html.\">http:\/\/web.mit.edu\/kerberos\/dist\/index.html.<\/a> The current Linux release is krb5-1.12.1-signed.tar:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># wget\u00a0 http:\/\/web.mit.edu\/kerberos\/dist\/krb5\/1.12\/krb5-1.12.1-signed.tar\n\u00a0\u00a0\u00a0 --2014-04-01 14:00:28--\u00a0 http:\/\/web.mit.edu\/kerberos\/dist\/krb5\/1.12\/krb5-1.12.1-signed.tar\n\u00a0\u00a0\u00a0 Resolving web.mit.edu... 23.58.214.151\n\u00a0\u00a0\u00a0 Connecting to web.mit.edu|23.58.214.151|:80... connected.\n\u00a0\u00a0\u00a0 HTTP request sent, awaiting response... 200 OK\n\u00a0\u00a0\u00a0 Length: 11950080 (11M) [application\/x-tar]\n\u00a0\u00a0\u00a0 Saving to: \u201ckrb5-1.12.1-signed.tar\u201d\n\u00a0\u00a0\u00a0 100%[===============================================&gt;] 11,950,080\u00a0 1.52M\/s\u00a0\u00a0 in 7.3s\n\u00a0\u00a0\u00a0 2014-04-01 14:00:38 (1.56 MB\/s) - \u201ckrb5-1.12.1-signed.tar\u201d saved [11950080\/11950080]\n# tar\u00a0 -xvf krb5-1.12.1-signed.tar \n\u00a0\u00a0\u00a0 krb5-1.12.1.tar.gz\n\u00a0\u00a0\u00a0 krb5-1.12.1.tar.gz.asc<\/pre>\n<p>As you can see, this file is signed and you could (should) verify the integrity and identity of the software. This can be done, for example, using GNU Privacy Guard:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># gpg\u00a0 --verify\u00a0 krb5-1.12.1.tar.gz.asc<\/pre>\n<p>After that, just extract the MIT Kerberos source code:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># tar\u00a0 -zxf\u00a0 krb5-1.12.1.tar.gz\n# cd\u00a0 krb5-1.12.1\/src\/\n# .\/configure\n\u00a0\u00a0\u00a0 ......\n# yum\u00a0 install\u00a0 *yacc*\n\u00a0\u00a0\u00a0 ......\n# make\n\u00a0\u00a0\u00a0 ......\n# make\u00a0 install<\/pre>\n<p>&nbsp;<\/p>\n<p>At this step, Kerberos should be installed properly and the binaries, libraries and the documentation should be under \/usr\/local. The default location is sufficient for a client installation:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># krb5-config\u00a0 --all\n\u00a0\u00a0\u00a0 Version:\u00a0\u00a0\u00a0\u00a0 Kerberos 5 release 1.12.1\n\u00a0\u00a0\u00a0 Vendor:\u00a0\u00a0\u00a0\u00a0\u00a0 Massachusetts Institute of Technology\n\u00a0\u00a0\u00a0 Prefix:\u00a0\u00a0\u00a0\u00a0\u00a0 \/usr\/local\n\u00a0\u00a0\u00a0 Exec_prefix: \/usr\/local<\/pre>\n<p>To set up a linux client, there is only one step remaining: tell Kerberos where to find a KDC. This is done through a configuration file named krb5.conf. In the following configuration, I&#8217;ve included two lines (forwardable and proxiable) that are important for Alfresco SSO using Kerberos to work properly. These two lines aren&#8217;t mandatory for other kerberized applications:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># vi\u00a0 \/etc\/krb5.conf\n\u00a0\u00a0\u00a0 [libdefaults]\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 default_realm = EXAMPLE.COM\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 forwardable = true\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 {Line only important for Alfresco}\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 proxiable = true\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0 {Line only important for Alfresco}\n\u00a0\u00a0\u00a0 [realms]\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 EXAMPLE.COM = {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 kdc = kdc01oel.example.com:88\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 admin_server = kdc01oel.example.com:749\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 default_domain = example.com\n\u00a0\u00a0\u00a0 \u00a0 }\n\u00a0\u00a0\u00a0 [domain_realm]\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 .example.com = EXAMPLE.COM\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 example.com = EXAMPLE.COM<\/pre>\n<p>That should be enough to obtain a ticket for the test user (&#8220;kinit mpatou&#8221; OR &#8220;kinit mpatou@EXAMPLE.COM&#8221;) and delete this ticket:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># klist\n\u00a0\u00a0\u00a0 klist: Credentials cache file '\/tmp\/krb5cc_0' not found\n# kinit\u00a0 mpatou\n\u00a0\u00a0\u00a0 Password for mpatou@EXAMPLE.COM:\n# klist\n\u00a0\u00a0\u00a0 Ticket cache: FILE:\/tmp\/krb5cc_0\n\u00a0\u00a0\u00a0 Default principal: mpatou@EXAMPLE.COM\n\u00a0\u00a0\u00a0 Valid starting\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0\u00a0 Expires\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u00a0 Service principal\n\u00a0\u00a0\u00a0 05\/20\/2014 10:54:48 \u00a0 \u00a0 05\/20\/2014 20:54:48 \u00a0 \u00a0 krbtgt\/mpatou@EXAMPLE.COM\n\u00a0\u00a0\u00a0 renew until 05\/21\/2014 10:54:47\n# kdestroy\n# klist\n\u00a0\u00a0\u00a0 klist: Credentials cache file '\/tmp\/krb5cc_0' not found<\/pre>\n<h3>2. Configure the Browser<\/h3>\n<p>Now the client should be able to acquire the first ticket (TGT) but that&#8217;s not enough! The next step is to configure the Browser to use tickets. Indeed, if the client tries to access to a kerberized application, the browser has to present a ticket for that application to be logged in automatically.<\/p>\n<h4>a. Mozilla Firefox (Window\/Linux\/Mac)<\/h4>\n<p>Open a new window\/tab in Mozilla Firefox:<\/p>\n<ul>\n<li>Enter in the URL field &#8220;about:config&#8221;<\/li>\n<li>All properties of Firefox should be displayed<\/li>\n<li>Search for &#8220;network.negotiate&#8221; and set: network.negotiate-auth.delegation-uris = .EXAMPLE.COM<\/li>\n<li>Set: network.negotiate-auth.trusted-uris = .EXAMPLE.COM<\/li>\n<\/ul>\n<h4>b. Google Chrome<\/h4>\n<p><strong>i. Mac<\/strong><\/p>\n<p>Modify the Google Chrome application with:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">open 'Google Chrome.app' --args --auth-schemes=\"basic,digest,ntlm,negotiate\" --auth-server-whitelist=\"*EXAMPLE.COM\" --auth-negotiate-delegate-whitelist=\"*EXAMPLE.COM\"<\/pre>\n<p>&nbsp;<\/p>\n<p><strong>ii. Linux<\/strong><\/p>\n<p>Modify Google Chrome with:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">google-chrome --enable-plugins --args --auth-server-whitelist=\"*EXAMPLE.COM\" --auth-negotiate-delegate-whitelist=\"*EXAMPLE.COM\" --auth-schemes=\"basic,digest,ntlm,negotiate\"<\/pre>\n<p><strong>iii. Windows<\/strong><\/p>\n<p>Modify the Google Chrome shortcut with:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">chrome.exe --auth-schemes=\"basic,digest,ntlm,negotiate\" --auth-server-whitelist=\"*EXAMPLE.COM\" --auth-negotiate-delegate-whitelist=\"*EXAMPLE.COM\"<\/pre>\n<h4>c. Internet Explorer<\/h4>\n<p>Open a new window\/tab in Internet Explorer and:<\/p>\n<ul>\n<li>Open the &#8220;tools&#8221; (ALT+X)<\/li>\n<li>Click on &#8220;internet options&#8221; (o)<\/li>\n<li>Choose the &#8220;Advanced&#8221; tab<\/li>\n<li>In the security section, select the &#8220;Enable Integrated Windows Authentication*&#8221;<\/li>\n<li>Choose the &#8220;Security&#8221; tab<\/li>\n<li>Select &#8220;Local intranet&#8221;<\/li>\n<li>Click on &#8220;Sites&#8221;<\/li>\n<li>Click on &#8220;Advanced&#8221;<\/li>\n<li>Add &#8220;http:\/\/*.example.com&#8221; or\/and &#8220;https:\/\/*.example.com&#8221;<\/li>\n<li>Click on &#8220;Close&#8221;<\/li>\n<li>Click on &#8220;OK&#8221;<\/li>\n<li>Click on &#8220;OK&#8221;<\/li>\n<li>Restart the computer<\/li>\n<\/ul>\n<p>If everything works fine, then the client should be able to access to kerberized applications. If it&#8217;s not the case, a good start to debug the kerberos installation is to use a network analyzer like WireShark.<\/p>\n<h3>3. Configure Alfresco to use Kerberos SSO<\/h3>\n<p>Actual test configuration:<\/p>\n<ul>\n<li>OS: Oracle Enterprise Linux 6<\/li>\n<li>Alfresco: Alfresco Community Enterprise 4.2.c installed on \/opt\/alfresco<\/li>\n<li>Application Server: Tomcat 7<\/li>\n<\/ul>\n<p>So let&#8217;s begin the configuration of a Kerberized application with Alfresco. The first thing to know about Alfresco is that Alfresco uses two main Web Clients: Alfresco Explorer and Alfresco Share. The first one is the core of Alfresco and the second one is the new interface (mainly oriented on collaboration) that uses a proxy to ask Explorer to do the job. The configuration of Alfresco Explorer is quite easy but to get Alfresco Share working it&#8217;s not the same as Share add a new layer above Explorer.<\/p>\n<p>If nothing is specified, all modifications below should be done on alf01.example.com, the Alfresco host server.<\/p>\n<p>For Kerberos to work properly, the maxHttpHeaderSize must be increased:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># vi\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/tomcat\/conf\/server.xml\n\u00a0\u00a0\u00a0Connector port=\"8080\" URIEncoding=\"UTF-8\" protocol=\"HTTP\/1.1\" connectionTimeout=\"20000\" redirectPort=\"8443\" maxHttpHeaderSize=\"32768\"<\/pre>\n<p>Then the authentication chain must allow Kerberos tickets to be used to authenticate a user:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># vi\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/tomcat\/shared\/classes\/alfresco-global.properties:\n\u00a0\u00a0\u00a0 authentication.chain=kerberos1:kerberos,alfrescoNtlm1:alfrescoNtlm<\/pre>\n<p>After that, the Kerberos subsystem must be configured:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># cd\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/tomcat\/shared\/classes\/alfresco\/extension\/subsystems\n# vi\u00a0 Authentication\/kerberos\/kerberos1\/kerberos-authentication.properties\n\u00a0\u00a0\u00a0 kerberos.authentication.realm=EXAMPLE.COM\n\u00a0\u00a0\u00a0 kerberos.authentication.sso.enabled=true\n\u00a0\u00a0\u00a0 kerberos.authentication.authenticateCIFS=false\n\u00a0\u00a0\u00a0 kerberos.authentication.user.configEntryName=Alfresco\n\u00a0\u00a0\u00a0 kerberos.authentication.cifs.password=ChangeMe\n\u00a0\u00a0\u00a0 kerberos.authentication.cifs.configEntryName=AlfrescoCIFS\n\u00a0\u00a0\u00a0 kerberos.authentication.stripUsernameSuffix=true\n\u00a0\u00a0\u00a0 kerberos.authentication.http.password=ChangeMe\n\u00a0\u00a0\u00a0 kerberos.authentication.http.configEntryName=AlfrescoHTTP\n\u00a0\u00a0\u00a0 kerberos.authentication.defaultAdministratorUserNames=admin,xxx,yyy\n\u00a0\u00a0\u00a0 kerberos.authentication.browser.ticketLogons=true<\/pre>\n<p>&nbsp;<\/p>\n<p>Once this is done, the KDC must be configured to recognize Alfresco as a Kerberized application. For that purpose, enter in the KDC kadmin interface. Caution, this requires the installation of a Kerberos Server on kdc01oel.example.com as described in the previous blog (the important part is that kadmin must be available from a remote computer) and the installation of a Kerberos Client on alf01.example.com. If your kadmin doesn&#8217;t work from a remote location, you will have to use the kadmin.local interface on the KDC host server.<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># \/usr\/local\/bin\/kadmin\n\u00a0\u00a0\u00a0 addprinc\u00a0 cifs\/alf01.example.com@EXAMPLE.COM\n\u00a0\u00a0\u00a0 addprinc\u00a0 HTTP\/alf01.example.com@EXAMPLE.COM\n\u00a0\u00a0\u00a0 ktadd\u00a0 -k\u00a0 \/etc\/krb5cifs.keytab\u00a0 cifs\/alf01.example.com@EXAMPLE.COM\n\u00a0\u00a0\u00a0 ktadd\u00a0 -k\u00a0 \/etc\/krb5http.keytab\u00a0 HTTP\/alf01.example.com@EXAMPLE.COM<code class=\"mceVisualAid mceVisualGuides\"><\/code><\/pre>\n<p>This will create 2 files named &#8216;krb5cifs.keytab&#8217; and &#8216;krb5http.keytab&#8217; on the host where the kadmin was run. That means that if you used the kadmin from alf01.example.com, then there is nothing more to do but if you used the kadmin or kadmin.local from kdc01oel.example.com, then those 2 files must be moved to alf01.example.com:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># cd\u00a0 \/etc\n# scp\u00a0 krb5cifs.keytab\u00a0 root@alf01.example.com:\/etc\nenter password:\n# scp\u00a0 krb5http.keytab\u00a0 root@alf01.example.com:\/etc\nenter password:<\/pre>\n<p>Create or update the config file for the Java Security. Be careful that this is the Java used by Alfresco:<\/p>\n<pre># vi\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/java\/jre\/lib\/security\/java.login.config:\n\u00a0\u00a0\u00a0 Alfresco {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule sufficient;\n\u00a0\u00a0\u00a0 };<\/pre>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\">\u00a0\u00a0\u00a0 AlfrescoCIFS {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule required\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 storeKey=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 useKeyTab=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 keyTab=\"\/etc\/krb5cifs.keytab\"\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 principal=\"cifs\/alf01.example.com\";\n\u00a0\u00a0\u00a0 };\n\u00a0\u00a0\u00a0 AlfrescoHTTP {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule required\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 storeKey=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 useKeyTab=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 keyTab=\"\/etc\/krb5http.keytab\"\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 principal=\"HTTP\/alf01.example.com\";\n\u00a0\u00a0\u00a0 };\n\u00a0\u00a0\u00a0 ShareHTTP {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule required\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 storeKey=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 useKeyTab=true\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 keyTab=\"\/etc\/krb5http.keytab\"\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 principal=\"HTTP\/alf01.example.com\";\n\u00a0\u00a0\u00a0 };\n\u00a0\u00a0\u00a0 com.sun.net.ssl.client {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule sufficient;\n\u00a0\u00a0\u00a0 };\n\u00a0\u00a0\u00a0 other {\n\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0 com.sun.security.auth.module.Krb5LoginModule sufficient;\n\u00a0\u00a0\u00a0 };<\/pre>\n<p>Configure the default Java Security to use our custom configuration by adding a line at the end of the file:<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># vi\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/java\/jre\/lib\/security\/java.security:\n\u00a0\u00a0\u00a0 login.config.url.1=file:${java.home}\/lib\/security\/java.login.config<\/pre>\n<p>Finally, update the share-config-custom.xml file to contain the Kerberos configuration (the three images are in a unique file attached in this blog -&gt; <a title=\"title\" href=\"http:\/\/dbi-services.com\/blog\/images\/easyblog_images\/132\/share-config-custom.zip\" target=\"_self\">share-config-custom.zip<\/a>):<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># vi \/opt\/alfresco\/alfresco-4.2.c\/tomcat\/shared\/classes\/alfresco\/web-extension\/share-config-custom.xml<\/pre>\n<p><a class=\"easyblog-thumb-preview\" title=\"ShareCustom1.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom1.png\"><img decoding=\"async\" title=\"ShareCustom1.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom1.png\" alt=\"ShareCustom1.png\" \/><\/a><a class=\"easyblog-thumb-preview\" title=\"ShareCustom2.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom2.png\"><img decoding=\"async\" title=\"ShareCustom2.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom2.png\" alt=\"ShareCustom2.png\" \/><\/a><a class=\"easyblog-thumb-preview\" title=\"ShareCustom3.png\" href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom3.png\"><img decoding=\"async\" title=\"ShareCustom3.png\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ShareCustom3.png\" alt=\"ShareCustom3.png\" \/><\/a><\/p>\n<p>That could be enough to get the Kerberos SSO working for Alfresco Explorer and Alfresco Share. I think there are some additional steps to get the Alfresco CIFS working too but I&#8217;m not sure. Moreover, it&#8217;s possible that you get some strange exceptions that prevent Alfresco to authenticate your Kerberos Ticket. That probably comes from the Java Cryptography Extension that is missing on your Alfresco server. For that purpose, download the JCE corresponding to the Java version used by Alfresco (JCE6 or JCE7) and deploy it (I assume below that the JCE7 is under \/opt):<\/p>\n<pre class=\"brush: actionscript3; gutter: true; first-line: 1\"># unzip\u00a0 \/opt\/UnlimitedJCEPolicyJDK7.zip\n# cd\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/java\/jre\/lib\/security\n# cp\u00a0 local_policy.jar\u00a0 local_policy.jar.orig\n# cp\u00a0 US_export_policy.jar\u00a0 US_export_policy.jar.orig\n# cd\u00a0 \/opt\/UnlimitedJCEPolicy\n# cp\u00a0 local_policy.jar\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/java\/jre\/lib\/security\/\n# cp\u00a0 US_export_policy.jar\u00a0 \/opt\/alfresco\/alfresco-4.2.c\/java\/jre\/lib\/security\/<\/pre>\n<p>I hope I was clear enough in my explanations and I hope I was able to share (a little bit?) my passion for open source solutions!<br \/>\nGood luck with Kerberos and Alfresco!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the previous blog, I described How to install and manage a Kerberos Server but that&#8217;s useless if there are no clients and if no application have been kerberized! That&#8217;s why in this blog I will explain in the first part how to install a kerberos client in linux. The second part will be dedicated [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":2166,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[197],"tags":[3169,101,444,370,445],"type_dbi":[],"class_list":["post-3814","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-application-integration-middleware","tag-alfresco","tag-installation","tag-kerberos","tag-open-source","tag-sso"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.5) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Configure a Kerberos Client and Alfresco as a Kerberized application - dbi Blog<\/title>\n<meta name=\"description\" content=\"How to install a Kerberos Client in Linux\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configure a Kerberos Client and Alfresco as a Kerberized application\" \/>\n<meta property=\"og:description\" content=\"How to install a Kerberos Client in Linux\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2014-05-28T07:57:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"170\" \/>\n\t<meta property=\"og:image:height\" content=\"178\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Morgan Patou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MorganPatou\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Morgan Patou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/\"},\"author\":{\"name\":\"Morgan Patou\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"headline\":\"Configure a Kerberos Client and Alfresco as a Kerberized application\",\"datePublished\":\"2014-05-28T07:57:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/\"},\"wordCount\":1282,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"keywords\":[\"Alfresco\",\"Installation\",\"Kerberos\",\"Open source\",\"SSO\"],\"articleSection\":[\"Application integration &amp; Middleware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/\",\"name\":\"Configure a Kerberos Client and Alfresco as a Kerberized application - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"datePublished\":\"2014-05-28T07:57:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"description\":\"How to install a Kerberos Client in Linux\\\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"contentUrl\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/04\\\/2e1ax_default_entry_MIT-Kerberos.jpg\",\"width\":170,\"height\":178},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Configure a Kerberos Client and Alfresco as a Kerberized application\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\",\"name\":\"Morgan Patou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"caption\":\"Morgan Patou\"},\"description\":\"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\\\/Banking, and the Pharmaceutical industry.\",\"sameAs\":[\"https:\\\/\\\/blog.dbi-services.com\\\/author\\\/morgan-patou\\\/\",\"https:\\\/\\\/x.com\\\/MorganPatou\"],\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Configure a Kerberos Client and Alfresco as a Kerberized application - dbi Blog","description":"How to install a Kerberos Client in Linux\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/","og_locale":"en_US","og_type":"article","og_title":"Configure a Kerberos Client and Alfresco as a Kerberized application","og_description":"How to install a Kerberos Client in Linux\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.","og_url":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/","og_site_name":"dbi Blog","article_published_time":"2014-05-28T07:57:00+00:00","og_image":[{"width":170,"height":178,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","type":"image\/jpeg"}],"author":"Morgan Patou","twitter_card":"summary_large_image","twitter_creator":"@MorganPatou","twitter_misc":{"Written by":"Morgan Patou","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/"},"author":{"name":"Morgan Patou","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"headline":"Configure a Kerberos Client and Alfresco as a Kerberized application","datePublished":"2014-05-28T07:57:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/"},"wordCount":1282,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","keywords":["Alfresco","Installation","Kerberos","Open source","SSO"],"articleSection":["Application integration &amp; Middleware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/","url":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/","name":"Configure a Kerberos Client and Alfresco as a Kerberized application - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","datePublished":"2014-05-28T07:57:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"description":"How to install a Kerberos Client in Linux\/Unix and how to setup SSO using Kerberos in Alfresco Explorer AND Share.","breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/2e1ax_default_entry_MIT-Kerberos.jpg","width":170,"height":178},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/configure-a-kerberos-client-and-alfresco-as-a-kerberized-application\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Configure a Kerberos Client and Alfresco as a Kerberized application"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8","name":"Morgan Patou","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","caption":"Morgan Patou"},"description":"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\/Banking, and the Pharmaceutical industry.","sameAs":["https:\/\/blog.dbi-services.com\/author\/morgan-patou\/","https:\/\/x.com\/MorganPatou"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3814","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=3814"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/3814\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/2166"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=3814"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=3814"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=3814"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=3814"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}