topic Re: Need query to search users in active directory in Alfresco Archive

Need query to search users in active directory

johnraju — Thu, 08 Aug 2013 08:32:00 GMT

Hi,I am trying to integrate Activiti BPM 5.13 with Active directory.and I am looking for search filter to query active directory for users.I tried varies combination for search filter but nothing worked.Attached is my activiti-standalone-context file in txt formatKindly help to provide the exact sea

Re: Need query to search users in active directory

jbarrez — Thu, 08 Aug 2013 09:06:01 GMT

No clue how Active Directory stores users and groups … or how it was configured by your admin …

Probably you'll need to google on Java + Activiti Directory in general to find out how it works, cause Activiti is under the hood just using regular java.naming stuff.

Re: Need query to search users in active directory

johnraju — Mon, 12 Aug 2013 14:54:01 GMT

hi jbarrez,

We have found the correct search query in ADS i.e. (&(objectCategory=person)(objectClass=user)(CN={0}))

but we are still unable to authenticate against ADS in Activiti BPM.

We are receiving the following error,

"org.activiti.ldap.LDAPUserManager - Could not authenticate user amit : Unprocessed Continuation Reference(s)
javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'DC=FILENET,DC=TEST,DC=COM'"

The work around as per online forum seems to setting a particular java property, "-Djava.naming.REFERRAL=follow" in the startup of the application server i.e. Apache Tomcat 7.0. But even after setting this java property we are receiving the above error.

Our LDAP configuration looks like below,

<bean class="org.activiti.ldap.LDAPConfigurator">
                <!– Server connection params –>
                <property name="server" value="ldap://xxx.xxx.xxx.xxx"/>
                <property name="port" value="389"/>
<property name="user" value="CN=amit,CN=Users,DC=FILENET,DC=TEST,DC=COM" />
                <property name="password" value="password" />

                <!– Query params –>
                <property name="baseDn" value="DC=FILENET,DC=TEST,DC=COM"/>
<property name="queryUserByUserId" value="(&(objectCategory=person)(objectClass=user)(CN={0}))"/>
<property name="queryGroupsForUser" value="(&(objectCategory=group)(objectClass=group)(CN={0}))"/>

                <!– Attribute config –>
                <property name="userIdAttribute" value="cn" />
                <property name="userFirstNameAttribute" value="cn" />
                <property name="userLastNameAttribute" value="sn" />
                <property name="groupIdAttribute" value="cn" />
                <property name="groupNameAttribute" value="cn" />
             </bean>
          </list>
        </property>
</bean>

Kindly advise if we are missing any configuration here or any specific setting.

Thanks,
John

Re: Need query to search users in active directory

jamesgoodwin — Tue, 13 Aug 2013 19:39:19 GMT

Thanks jbarrez!! spin palace

Re: Need query to search users in active directory

jbarrez — Wed, 14 Aug 2013 10:04:08 GMT

I found this: http://stackoverflow.com/questions/12222869/need-elaboration-on-unprocessed-continuation-reference

Did you try the suggestion in the last post: "I got around it by setting your InitialDirContext environment to have the Context.REFERRAL key set to "follow".

According to the Javadocs, that key can be "follow", "ignore", or "throw". The default is determined by the provider you use, which is probably "throw"."

You should be able to set those properties through the customConnectionParameters setting: see the docs for more info.

If it does work, please report back, so we can update the userguide accordingly.

Re: Need query to search users in active directory

aggiepilot04 — Fri, 04 Oct 2013 05:04:39 GMT

I can confirm that setting Context.REFERRAL to "follow" in InitialDirContext resolved this problem for us.

Re: Need query to search users in active directory

jbarrez — Fri, 04 Oct 2013 08:35:10 GMT

Awesome! Thanks!

Re: Need query to search users in active directory

ismail1 — Fri, 20 Dec 2013 14:42:59 GMT

Hi joram, i would like to apply that parameter to ldap config, is that correct:

<code>

….
<property name="groupIdAttribute" value="cn" />
<property name="groupNameAttribute" value="cn" />
<property name="customConnectionParameters">
<Map>
<property name="InitialDirContext" value="Context.REFERRAL"/>
</Map>
</property>
….
</code>

If not how to set a property with <code> Map<String, String> </code> as stated in user guide?

Re: Need query to search users in active directory

trademak — Fri, 20 Dec 2013 15:28:20 GMT

No, please lookup in the Spring documentation how to fill a map through a Spring configuration or search google and find a link like this one:

http://www.mkyong.com/spring/spring-collections-list-set-map-and-properties-example/

Re: Need query to search users in active directory

b_schnarr — Thu, 06 Mar 2014 09:33:43 GMT

Please could someone post the correct string? I have the same problems and a spring beginner. A little help would be great.

Re: Need query to search users in active directory

b_schnarr — Thu, 06 Mar 2014 10:04:30 GMT

I tried this without success:

<code>
    <property name="customConnectionParameters">
     <map>
    <entry key="InitialDirContext" value="Context.REFERRAL" />
    </map>
    </property>
</code>

When I enter incorrect credentials, I get the message that I could not logged in (that is correct). When I enter correct credentials, simply nothing happens. I get no error message, I still see the Activiti Explorer login screen.

Here is the full configuration:

<code>
<bean id="processEngineConfiguration" class="org.activiti.spring.SpringProcessEngineConfiguration">
   <property name="dataSource" ref="dataSource" />
   <property name="transactionManager" ref="transactionManager" />
   <property name="databaseSchemaUpdate" value="true" />
   <property name="jobExecutorActivate" value="true" />
    <property name="customFormTypes">
      <list>
        <bean class="org.activiti.explorer.form.UserFormType"/>
        <bean class="org.activiti.explorer.form.ProcessDefinitionFormType"/>
        <bean class="org.activiti.explorer.form.MonthFormType"/>
      </list>
    </property>
<property name="configurators">
          <list>
              <bean class="org.activiti.ldap.LDAPConfigurator">

                <!– Server connection params –>
                <property name="server" value="ldap://10.120.201.12" />
                <property name="port" value="389" />
                <property name="user" value="cn=Administrator,cn=Users,dc=ebusiness,dc=local" />
                <property name="password" value="****" />

    <!– Query params –>
                <property name="baseDn" value="ou=ebusiness,dc=ebusiness,dc=local" />
                <property name="queryUserByUserId" value="(&(objectClass=person)(cn={0}))" />
                <property name="queryUserByFullNameLike" value="(&(objectClass=person)(|({0}=*{1}*)({2}=*{3}*)))" />
                <property name="queryGroupsForUser" value="(&(objectClass=group)(cn={0}))" />

    <property name="customConnectionParameters">
    <map>
    <entry key="InitialDirContext" value="Context.REFERRAL" />
    </map>
    </property>

                <!– Attribute config –>
                <property name="userIdAttribute" value="cn" />
                <property name="userFirstNameAttribute" value="givenName" />
                <property name="userLastNameAttribute" value="sn" />

                <property name="groupIdAttribute" value="cn" />
                <property name="groupNameAttribute" value="cn" />

              </bean>
          </list>
        </property>
</code>

Please, could anyone help?

Thank you very much
Ben

Re: Need query to search users in active directory

b_schnarr — Thu, 06 Mar 2014 11:11:33 GMT

Problem solved. My users in LDAP just had a lastname, not a forename. Then, nothing happend, the Activiti Login screen did not disappear. After adding a forename, the login was successful.

This looks for me like a bug. Steps for reproduce:
Create an LDAP User without a forename. Try to login with cn in the activiti explorer.
Expected behavior: Login is successful
Actual behaviour: Nothing happens. There is no error message and the login screen does not disappear.

Should I open a jira ticket?

Re: Need query to search users in active directory

frederikherema1 — Mon, 10 Mar 2014 09:53:57 GMT

Seems like something wee need to look at, so yes please

Re: Need query to search users in active directory

b_schnarr — Mon, 10 Mar 2014 11:42:10 GMT

Jira says: "Not a member? To request an account, please contact your JIRA administrators."

Re: Need query to search users in active directory

aggiepilot04 — Thu, 03 Apr 2014 20:08:23 GMT

The missing first name/last name issue bit us with our test users in the past, but it is unrelated to the referral issue. If you're hitting the referral issue, the error in the logs will look something like this (as mentioned in a previous post):

<code>
INFO org.activiti.ldap.LDAPUserManager - Could not authenticate user [USERID]: Unprocessed Continuation Reference(s)
javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'DC=blah,DC=local'
</code>

In 5.14, we had this fixed in the activiti-ldap source code. We just upgraded to 5.15.1, and I'm able to avoid using the customized code with the following configuration:

<code>
<property name="customConnectionParameters">
    <map>
        <entry key="java.naming.referral" value="follow" />
    </map>
</property>
</code>

Re: Need query to search users in active directory

jbarrez — Tue, 22 Apr 2014 08:30:12 GMT

@aggiepilot04: Thanks for posting this. Useful information for many!