topic Re: OpenLDAP Sync with Share in Alfresco Archive

OpenLDAP Sync with Share

sthurrott — Thu, 13 Nov 2008 00:38:38 GMT

We have been able to install Share and sync it to our OpenLDAP server. The problem we have run into is that it puts all our users and groups in the Company Home directory. How do I put users in the User Home directory and keep groups in the Company Home directory? Thanks

Re: OpenLDAP Sync with Share

yyovkov — Thu, 13 Nov 2008 10:26:24 GMT

Hi sthurrott,

probably you will find helpful this post:
http://forums.alfresco.com/en/viewtopic.php?t=7133&highlight=nonunique+path

Re: OpenLDAP Sync with Share

ofrxnz — Thu, 13 Nov 2008 13:59:19 GMT

in ldap-synchronization-context.xml

change this

<property name="attributeDefaults">
            <map>
                <entry key="cm:homeFolderProvider">
                    <value>${ldap.synchronisation.defaultHomeFolderProvider}</value>
                </entry>
            </map>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍

to this

 <property name="attributeDefaults">
            <map>
                <entry key="cm:homeFolderProvider">
                    <value>${ldap.synchronisation.userHomesHomeFolderProvider}</value>
                </entry>
            </map>
        </property>
    </bean>

‍‍‍‍‍‍‍‍‍‍

Re: OpenLDAP Sync with Share

sthurrott — Thu, 13 Nov 2008 14:59:36 GMT

Thanks, we got it to work. Now onto the next thing…the groups imported without any users. I remember reading something about that in another forum.

Re: OpenLDAP Sync with Share

ofrxnz — Thu, 13 Nov 2008 22:37:32 GMT

if the groups import without any users you need to change this in ldap-synchronization.properties

ldap.synchronisation.groupMemberAttributeName=member

change that variable so it is = what ever attribute your group members are under. i believe they need to be stored as their full DN

Re: OpenLDAP Sync with Share

sthurrott — Fri, 14 Nov 2008 19:37:46 GMT

Thanks, we set the ldap.synchronisation.groupMemberAttributeName=member to what our group members are under but I'm not sure what you mean by them needing to be stored as their full DN. Could you give an example?

Thanks again…

Re: OpenLDAP Sync with Share

ofrxnz — Fri, 14 Nov 2008 20:12:02 GMT

It should be it by default but
In my ldap server, group members are determined by the attribute 'member' holding a value like 'uid=username,ou=people,dc=company,dc=com' this is just the absolute path to a user.

so, since in your case alfresco is already finding groups and importing, the last step is to tell it what the group members are labeled as.
This label is defined under ldap.synchronisation.groupMemberAttributeName
in my case it is 'member'.

when alfresco scans a group and finds the attribute 'member' it looks at its value and adds it to a group.

so in mine, when ever alfresco finds a group, it looks for 'member' and adds it's value to the group. In my case the users absolute name looks something like 'uid=username,ou=people,dc=company,dc=com' (this will look different for you on both sides of the '=' )

My guess is you got it right, I just found it confusing when i first set it up because i am using Active Directory. In AD your absolute name (uid=username,ou=people,dc=company,dc=com) is not your 'Windows username'.

I was just trying to be clear. Sorry for any confusion.

Are your groups populating?

Adam

Re: OpenLDAP Sync with Share

sthurrott — Mon, 17 Nov 2008 20:28:50 GMT

Not yet, we decided to reinstall Share because we were having several issues so I haven't been able to test out your solution.

Thanks

Re: OpenLDAP Sync with Share

markuskopinits — Thu, 30 Jul 2009 15:04:01 GMT

Hi,

I'm using Alfresco 3.1.1
The LDAP syncronizations is working for users and groups but it's not putting the users inside the groups.

I've tried the ldap.synchronisation.groupMemberAttributeName attribute with "member", "membrUid", "memberOf"
but none off then worked.

Can you help me?

Thanks

Re: OpenLDAP Sync with Share

mricher — Mon, 04 Jan 2010 18:06:17 GMT

Just to clarify the problem.

The LDAP server is storing the 'short name' eg. username in the field 'member' or 'memberUid' or 'memberOf'.

Alfresco on the other hand is expecting the full DN to be stored. (eg. cn=username,ou=People,dc=example,dc=com ).

It is a pain to have to modify the ldap (and all the other services) to support his.

However, it looks like it was resolved in the Enterprise version of Alfresco (as they added some fallback code to test for the shortname when the full DN fails).
JIRA: https://issues.alfresco.com/jira/browse/ETHREEOH-2508

Any chance of getting the small changes ported over to the Community edition?
Cheers,

R. Michael Richer

Re: OpenLDAP Sync with Share

mrogers — Mon, 04 Jan 2010 18:30:00 GMT

Looks like it was put on HEAD last July.

Re: OpenLDAP Sync with Share

mricher — Mon, 04 Jan 2010 19:10:13 GMT

Hmmm… Looks like I'll be investigating my problem (/sigh)… was hoping for a fast fix hehe.

I'm currently experiencing the identical issue on 3.2r2 … but it could be my configuration (either Alfresco or OpenLDAP)…
I'll bump up some logging, etc. and get back to here. (Tried it really quick with memberUid as the attribute…)

Any chance you have svn revision number of the changes? (just in case)

Thanks for the quick response,

Cheers

Mike

Re: OpenLDAP Sync with Share

mricher — Fri, 15 Jan 2010 13:58:07 GMT

Well it was a configuration issue on my end… so I am able to sync now, and authenticate.
I had to use the DifferentialQuery's, etc. in 3.2r2 with the proper filters, and everything works.

I have ran into another problem, where an 'updated' Query fails to be used (without wiping the database and data directory).
I tried the cron method of performing a full sync, but still the 'new' accounts don't show up.

Initially (this works well):
user.name.caseSensitive=true
ldap.synchronization.synchronizeChangesOnly=false
ldap.synchronization.import.cron=0 0 * * * ?
ldap.synchronization.PersonQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))
ldap.synchronization.PersonDifferentialQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo))(!(modifyTimestamp<\={0})))
ldap.synchronization.GroupQuery=(&(objectClass\=posixGroup)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))

Now I wanted to add an additional OU to the list (cca – (ou\:dn\:\=cca) 😞
ldap.synchronization.PersonQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))
ldap.synchronization.PersonDifferentialQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo))(!(modifyTimestamp<\={0})))
ldap.synchronization.GroupQuery=(&(objectClass\=posixGroup)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))

Restarting and waiting for the cron sync, both still do not permit access to the cca ou. If I wipe the database and the data dir, and restart, the system will reinitialize and make the cca container available as well.

Is there a step I'm missing for changing the Querys? (Although I am not expecting changes to the DIT on the ldap server, I'm just planning ahead…)

Mike

Re: OpenLDAP Sync with Share

dward — Fri, 15 Jan 2010 15:53:52 GMT

That's because the system remembers the newest modification date of the objects it queries and only asks for those modified after that date in future syncs.

You could set

synchronization.synchronizeChangesOnly=false

which will cause the scheduled full sync job (which by default runs every midnight) to sync with everything regardless of modification date.

Re: OpenLDAP Sync with Share

mricher — Mon, 18 Jan 2010 16:08:31 GMT

Typos, typos, typos..

All problems are corrected, and they do work as you say they will. ldapsearch queries with typos in them are just plain bad…

And even creating your own parameters are bad…. (eg. ldap.synchronization vs. synchronization, etc.)

In short, I shuold be taking more time confirming what I'm typing…

Thanks for the help and quick responses though. Works like a charm!

Mike

Re: OpenLDAP Sync with Share

njeudy — Tue, 13 Apr 2010 14:28:00 GMT

Can you post your config file for ldap sync.

I try lots of solution, but i'm not able to sync group in alfresco:

- Login and user users works
- sync group works, but stay empty

I'm using openldap, and group are posixGroup with memberUid = uid (user uid)

Thanks,

Nicolas JEUDY