Step 4: Configure Alfresco Content Service properties - Step 4: Configure Alfresco Content Service properties - Alfresco - Identity Service - Alfresco/Identity-Service/1.7/Identity-Service/Identity-Service/Tutorials/Single-Sign-On-SSO-Guide/LDAP/Step-4-Configure-Alfresco-Content-Service-properties

The properties listed that need to be set for Alfresco Content Services (ACS) are only those that are required for setting up SSO. They include the synchronization with an LDAP directory and the location of a SAML keystore. The Alfresco Share configuration file also requires updating to enable SSO.

Use the following configuration parameters either in an alfresco-global.properties file, via the repository config map in Kubernetes or as environment variables in a docker-compose file:

Property	Description
authentication.chain	The authentication chain needs to be set for the Identity Service and LDAP synchronization, for example `identity-service-1:identity-service,alfrescoNtlm-1:alfrescoNtlm,ldap-1:ldap`
identity-service.auth-server-url	The base URL of the Identity Service, for example `https://ids.example.com/auth`
identity-service.enable-basic-auth	Sets whether basic authentication is also supported by the Identity Service, for example `true`
identity-service.realm	The realm name configured in the Identity Service for the Alfresco applications, for example `alfresco`
identity-service.resource	The Client ID set up in the Identity Service for Alfresco Content Services. The client needs to exist underneath the realm set for `identity-service.realm`, for example `alfresco`
saml.keystore.location	The location of the SAML keystore self-signed certificate. This file needs to be accessible to the repository and has the file type `.keystore`. This file is generated as part of configuring the SAML Module AMP, for example `/path/to/saml.keystore`
saml.keystore.keyMetaData.location	The location of the SAML keystore metadata. This file needs to be accessible to the repository and has the file type `.properties`. This file is generated as part of configuring the SAML Module AMP, for example `/path/to/saml-keystore-passwords.properties`
ldap.authentication.active	Sets whether LDAP authentication is enabled or not. This needs to be set to `false` to use SAML authentication via the Identity Service, for example `false`
ldap.synchronization.active	Sets whether LDAP synchronization is enabled or not. This needs to be set to `true` to sync users with the repository, for example `true`
ldap.synchronization.java.naming. security.authentication	The mechanism to use to authenticate with the LDAP server, for example `simple`
ldap.synchronization.java.naming. security.principal	The user principal name (UPN) of the account used to retrieve account details for all users and groups, for example `alfresco@domain.com`
ldap.synchronization.java.naming.security.credentials	The password for the account set in `ldap.synchronization.java.naming.security.principal`, for example `secret`
ldap.*	There are several optional configuration and synchronization properties
csrf.filter.referer	The referer value of ACS to prevent Cross Site Request Forgery (CSRF), for example `https://repo.example.com`
csrf.filter.origin	The origin value of ACS to prevent Cross Site Request Forgery (CSRF), for example `https://repo.example.com/*`

Update the share-config-custom.xml file located by default in $ALFRESCO_HOME/tomcat/shared/classes/alfresco/web-extension/:
- Set the CSRFPolicy to true as in the following example:
```
<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
```
- Add the following two rules to allow for signing out via SAML:
```
<rule>
  <request>
    <method>GET</method>
    <path>/res/.*</path>
  </request>
</rule>
```
```
<rule>
  <request>
    <method>POST</method>
    <path>/page/saml-authnresponse|/page/saml-logoutresponse|/page/saml-logoutrequest</path>
  </request>
</rule>
```
  Note
  
  Incoming public GET requests will be caught avoiding them being evaluated by other rules. Incoming POST requests from identity providers do not need a token.
Sign in to the administrator console of ACS as an administrator. The URL of the administrator console is https://repo.example.com:443/alfresco/service/enterprise/admin.
Navigate to Directories > Directory Management and click Run Synchronize to perform a manual LDAP sync.
Sign into Share as an administrator. The URL for Share is https://share.example.com/share.
Navigate to Admin Tools > Users to verify that all user accounts have been synchronized correctly.