topic Re: [SOLVED]Alfresco + Active Directory in Alfresco Archive

[SOLVED]Alfresco + Active Directory

luisg — Tue, 28 Apr 2009 14:59:07 GMT

Hi there.I have been trying to configure Alfresco with Active Directory. Now, all the users in Active Directory can login in Alfresco.The thing is, I just want that some specific users, inside a specific group, can login.My AD tree is something likeC=company, DC=pt OU=AlfrescoOU CN=Alfresco

Re: [SOLVED]Alfresco + Active Directory

luisg — Thu, 07 May 2009 08:55:38 GMT

So…

Any of you can answer my question?

I can only login with AD users if I use %s@company.com in ldap.authentication.userNameFormat.

If I use something like: ldap.authentication.userNameFormat=CN=%s@company.pt, CN=AlfrescoUsers, OU=Alfresco, DC=company, DC=com, the users and the groups are imported, but I cant login…

Any of you had this problem?

Thanks

Re: [SOLVED]Alfresco + Active Directory

luisg — Tue, 19 May 2009 13:56:18 GMT

Hi there…

Just passed to say that I solved the thing….

The ldap.authentication.userNameFormat= is just %s@company.pt.

And if I want only the users in some OU, lets say, OU=Users,OU=Alfresco,dc=company,dc=com, I should do that in ldap-synchronization.properties.

This is frustrating… I spend so many time in this stupid thing.
Why didnt you help me?!

bye

Re: [SOLVED]Alfresco + Active Directory

itbeb — Wed, 20 May 2009 13:23:40 GMT

Luis

Found this thread very interesting, however we have e-directory and ldap, but I suppose the query from the Alfresco side to ldap would look the the same ….

The %s@nwu doesn't work ….

If I have a user ABC, sitting in my ldap in ou=ACTIVE, ou=USERS,o=nwu and I want only the authorized users in cn=ALFRESCO, ou=GROUPS,o=nwu to be authenticated, how would my query from Alfresco look like??

Please help!

Re: [SOLVED]Alfresco + Active Directory

luisg — Thu, 25 Jun 2009 18:01:51 GMT

hi itbeb

one question… is 'o=nwu' correct? or should be 'ou=nwu'? I dont have a deep knowledge in AD, so I dont know if this is correct!

ATM i did some configurations of Alfresco and AD, and all are workin.Except for the CIFS+AD thing!

See this ldap-authentication.properties file I have (workin):

ldap.authentication.userNameFormat=%s@company.com
Giving this the user just need to give is username to login in Alfresco. If a user is registed as jack@company.com, he just need to give jack in alfresco login form.

Other thing, check if your ldap.authentication.java.naming.provider.url as the right name. This is very important!

ldap.authentication.java.naming.security.authentication = simple

ldap.authentication.java.naming.security.principal=alfresco -> 'alfresco' is a user created in AD
ldap.authentication.java.naming.security.credentials=(pass) -> pass for user 'alfresco'
ldap.authentication.escapeCommasInBind=true
ldap.authentication.escapeCommasInUid=true

In ldap.synchronization.properties i have:
ldap.synchronisation.personQuery=(objectclass=user) -> If you see, this was changed from his original value: (objectclass=inetOrgPerson)

ldap.synchronisation.personSearchBase=ou=Users,ou=abc,dc=company,dc=com
in you case, you will have:
ldap.synchronisation.personSearchBase=cn=ALFRESCO,ou=GROUPS,o=nwu,dc=company,dc=com

ldap.synchronisation.userIdAttributeName=sAMAccountName - I changed uid to sAMAccountName

ldap.synchronisation.userFirstNameAttributeName=givenName - not changed

ldap.synchronisation.userLastNameAttributeName=sn- not changed

ldap.synchronisation.userEmailAttributeName=mail- not changed

ldap.synchronisation.userOrganizationalIdAttributeName=o- not changed

ldap.synchronisation.defaultHomeFolderProvider=userHomesHomeFolderProvider - changed frompersonalHomeFolderProvider to userHomesHomeFolderProvider to get users home folders in Users Home space

ldap.synchronisation.groupQuery=(objectclass=group) - changed from (objectclass=groupOfNames) to (objectclass=group)

the rest still the default values.

Remember… If you want to access only the user in a specific path (OU=Users, OU=…) you do that in the ldap.synchronization.properties file.

Hope this helps

see ya