topic Re: Mixing authentication (LDAP and native) in Alfresco Archive

Mixing authentication (LDAP and native)

theorbix — Fri, 08 Feb 2008 01:01:40 GMT

Hello,I know the question may sound stupid, but is it possible to define one or more Alfresco user accounts that are authenticated against a corporate directory service, and (in the same installation) other user accounts that are authenticated using the internal password?My corporate IT department h

Re: Mixing authentication (LDAP and native)

jos_snellings — Fri, 08 Feb 2008 14:13:24 GMT

Please, refer to

http://wiki.alfresco.com/wiki/Security_and_Authentication

under section "chaining", the document sounds promising: "
See projects\repository\config\alfresco\extension\chaining-authentication-context.xml.sample for an example of JAAS and Alfresco authentication services combined.

In the configuration, take care to give unique bean names where required in the definitions of each authentication service stack. "

Hope that helps.

Re: Mixing authentication (LDAP and native)

theorbix — Tue, 01 Apr 2008 11:19:31 GMT

Well, it does not seem so easy….

My Alfresco administrator has configured the server to synchronize all users from the corporate Active Directory server, via LDAP.

This means that users now can login to Alfresco using their "corporate" username and password…. good.

But then I tried to create a new user manually, using the Alfresco web admin UI, and at the end of the Create User wizard I got the following error:

Failed to create Person due to error: Create User is not supported

So it seems that once Alfresco is "hooked" to a corporate directory server, it's a "take all or nothing" situation, and one needs to have ALL the Alfresco users cataloged in the directory server.

This is an annoying limitation, since sometimes (external consultants, temporary workers, etc) it would be useful to be able to create accounts in the Alfresco user directory only (with a "local" Alfresco password) without having to create these accounts in the central directory server.

Alfresco folks… can you confirm this limitation? Any way to get around it?

Re: Mixing authentication (LDAP and native)

xerox — Tue, 01 Apr 2008 11:55:29 GMT

I didn't test it myself, but I think it is possible in alfresco.

see:
http://wiki.alfresco.com/wiki/Security_and_Authentication#Chaining

Friendly regards,

Nick

Re: Mixing authentication (LDAP and native)

theorbix — Tue, 01 Apr 2008 12:42:34 GMT

Thanks Xerox for the hint… it points to the same wiki page that I was referred before by Jos.

So it seems that a proper configuration of the the chaining-authentication-context.xml should allow a mix of "LDAP users" and "internal Alfresco users"… interesting.

Has anyone ever tried this type of configuration?

Is it enough to remove the ".sample" suffix from the chaining-authentication-context.xml.sample file and then restart Alfresco, or something else must be done to enable this configuration (pardon me for the stupid question, but I'm a newbie to Alfresco security and authentication configuration…)