pleosoft/tokenproxy repository overview

This application allows to use Alfresco's "edit in ms office" feature without explicitly using identity services, since MS removed basic auth from MS-Office.

The shown setup is using traefik as proxy, and can be just added to the latest alfresco docker compose. For any other proxy engine,it should be straight forward to setup by following the same configuration. The most important is that Alfresco Share has the module below installed and that tokenproxy is accessible on "EXTERNAL_HOST/alfresco/aos/token/" or "EXTERNAL_HOST/alfresco/webdav/token/"

⁠use with the latest alfresco docker compose

⁠docker compose

   tokenproxy:
    image: pleosoft/tokenproxy:latest
    mem_limit: 256m
    environment:
      TOKENPROXY_TARGET_URI: "http://alfresco:8080"      
      TOKENPROXY_TARGET_USE_TICKET: true 
      TOKENPROXY_TARGET_USE_OAUTH2: true
      TOKENPROXY_TARGET_PATH: /alfresco/webdav
      TOKENPROXY_SHARE_URI: "http://share:8080"
      TOKENPROXY_ALFRESCO_URI: "http://alfresco:8080"
      SERVER_PORT: 8080
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.tokenproxy.rule=PathPrefix(`/alfresco/webdav/token/`)"
      - "traefik.http.routers.tokenproxy2.rule=PathPrefix(`/alfresco/aos/token/`)"
      - "traefik.http.routers.tokenproxy3.rule=PathPrefix(`/oauth2/`)"      
      - "traefik.http.routers.tokenproxy4.rule=PathPrefix(`/login/oauth2/code/`)"            
      - "traefik.http.routers.tokenproxy5.rule=PathPrefix(`/share/token/`)"
      - "traefik.http.routers.tokenproxy6.rule=PathPrefix(`/alfresco/token/`)"
      - "traefik.http.services.tokenproxy.loadbalancer.server.port=8080"

the proxy urls in the example cover all standard authentication types, however if you do not use oauth2 you do not need to set

  /oauth2/
  /login/oauth2/code/

so the remaining urls to add to the proxy are:

  /alfresco/webdav/token/
  /alfresco/aos/token/
  /share/token/
  /alfresco/token/

and there it should be ovious that the two first also depend on the baseUrlOverwrite you are actually using

⁠config

• for basic auth set:

TOKENPROXY_TARGET_USE_TICKET: true 

• for oauth2 set:

TOKENPROXY_TARGET_USE_OAUTH2: true

spring_security_oauth2_client_provider_test_issuer_uri: http://YOUR_IDP_REALM
spring_security_oauth2_client_registration_spring_provider: test
spring_security_oauth2_client_registration_spring_client-id: xxx
spring_security_oauth2_client_registration_spring_client-secret: xxx
spring_security_oauth2_client_registration_spring_authorization-grant-type=authorization_code
spring_security_oauth2_client_registration_spring_client-authentication-method=client_secret_basic
spring_security_oauth2_client_registration_spring_redirect-uri={baseUrl}/login/oauth2/code/{registrationId}
spring_security_oauth2_client_registration_spring_scope=openid

• for external auth:

Tokenproxy is by default configured to use the header value: X-Alfresco-Remote-User external-auth works with apisix, traefik, nginx, apache ...

if you want to change it, use the below config and set the same header value in alfresco/share ...

TOKENPROXY_TARGET_EXTERNAL_AUTH_HEADER: YOUR_HEADER_NAME
TOKENPROXY_TARGET_USE_TICKET: false
TOKENPROXY_TARGET_USE_OAUTH2: false

• additional config

configure the token lifetime

server_servlet_session_timeout: 8H

any spring boot servlet option is available too.

in order to only forward specific headers like the

tokenproxy_target_headers: YOUR_HEADER_NAME

it is a list so you could easily configure multiple headers to be passed to target downstream

⁠alfresco repository

-Daos.baseUrlOverwrite=http://host.docker.internal:8080/alfresco/aos

I prefer using simply webdav, which does not offer Sharepoint features implemented by Alfresco

-Daos.baseUrlOverwrite=http://host.docker.internal:8080/alfresco/webdav

• configure different context paths

tokenproxy_share_path: /share
tokenproxy_alfresco_path: /alfresco

remember to match baseUrlOverwrite with the following config

TOKENPROXY_TARGET_PATH: /alfresco/webdav

⁠Share

in order to use with share this jar (https://github.com/PleoSoft/tokenproxy-extensions⁠) has to be added

volumes:                  
      - ./tokenproxy-extension-1.0.0.jar:/usr/local/tomcat/webapps/share/WEB-INF/lib/tokenproxy-extension-1.0.0.jar:ro

⁠ADF

currently there is no "addon/extension" for ADF. You could use the provided extension for "edit in ms office" and adapt the code for the token proxy retrieval, like in the share extension provided. Samples and tests are welcome.

⁠License

This software is provided free of charge for use, but without any warranty. It is built as a native image on top of Spring Framework libraries and Spring Boot. The software includes no third-party software except for Spring Framework libraries, OpenTelemetry/Micrometer, and proprietary code developed by Pleo Soft d.o.o.

The source code for the Docker image (non-native images) and Windows executables is available to customers upon request. The binaries are distributed under an unlockable source code license, allowing free usage with limitations on access to the source code.