topic Re: Alfresco 3, AD NTLM, LDAP Sync Issue in Alfresco Archive

Alfresco 3, AD NTLM, LDAP Sync Issue

rubicon49bc — Mon, 06 Apr 2009 15:25:53 GMT

I have NTLM Authentication working and I can access the CIFS shares as a user with out a problem. My issue is with LDAP Sync, I can not seem to get it working. When I configure ldap-authentication.properties I can no longer get into Alfresco.[#|2009-04-06T14:22:40.227+0000|INFO|sun-appserver2.1|org.

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

steffen — Mon, 06 Apr 2009 16:15:31 GMT

Hi,

I think you forgot to specify the IP/DNS of the LDAP-Server:

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://<ip address>

Greetings

Steffen

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

rubicon49bc — Mon, 06 Apr 2009 16:56:23 GMT

I took that info, out as well as passwords and the Domain of the application server.

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

rubicon49bc — Mon, 06 Apr 2009 16:57:28 GMT

I also tested against an openldap server with no problem, of course I need CIFS so NTLM it needs to be.

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

rubicon49bc — Mon, 06 Apr 2009 20:22:58 GMT

I have ldap-authenication work and the user accounts sync'd. CIFS will only work in passthru mode, but NTLM users can not log into the CIFS share. So if you use ldap-sync you lose NTLM and so you lose CFIS SSO. Is this correct? If so, how do you manage groups in AD for Alfresco? How do you get all the users in? file-server.xml with Alfresco or enterprise won't work if you are using ldap-auth. So how do you import AD accounts using the ldap-sync?

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

ofrxnz — Fri, 10 Apr 2009 19:14:57 GMT

this suggests to me it is not even binding correctly

[#|2009-04-06T14:22:49.913+0000|INFO|sun-appserver2.1|org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl|_ThreadID=16;_ThreadName=pool-1-thread-8;|LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://<ip address>|#]

It probably worked on OpenLDAP because OpenLDAP will anonymously bind until you explicitly forbid it. AD will not anonymously bind till you make it

what does your NTLM and File-server configuration look like? The file servers are a bit picky with the NTLM syntax.

file-server.xml has nothing to do with LDAP sync. you can set the file servers to use pass through to the LDAP but, that wont do anything about the sync.

When you have both NTLM and LDAP enabled. NTLM should over ride LDAP. Though it sounds like something is a bit funky. Did you change any other authentication files?

NTLM will give you SSO. LDAP will not.

If you only want to use NTLM you will have to manually enter user details (email, phone, etc).

With Both NTLM and LDAP a user account is created as soon as they log into alfresco. you do not need to sync as soon as they correctly authenticate they are allowed in

I would not use SYNC for groups because Share creates its own groups and SYNC will do one of two things. It will either delete these groups when Alfresco sees they are not in AD or, Alfresco will only be able to add users to groups. Depending on your network size you may only want to sync once and handle user details and group changes by hand.

try this…..

auth file

ldap.authentication.userNameFormat=%s‍

better safe than sorry with the port

ldap.authentication.java.naming.provider.url=ldap://<ip address>:389‍

dont know if it counts but mine is caps…i remember caps greif somewhere in here dont know where though

ldap.authentication.java.naming.security.authentication=SIMPLE‍

again verify capitalization….I think it gave me grief before… this is my capitalization pattern

ldap.authentication.java.naming.security.principal=CN=Alfresco Ldap,CN=Users,DC=COMPANY,DC=net‍

yours should be valid but this is mine

ldap.synchronisation.personQuery=(objectclass=user)‍

and the search file

again check caps…i would guess it would be more like this. your path here and above dont match even if you did scrub them?

ldap.synchronisation.personSearchBase=OU=Users,OU=pkmm,DC=PKMM-INC,DC=net‍

this isnt required information in AD have you filled it in. if not 'o' does not exist.

ldap.synchronisation.userOrganizationalIdAttributeName=o‍

shouldn't matter but i used user

ldap.synchronisation.personType=user‍

Re: Alfresco 3, AD NTLM, LDAP Sync Issue

rubicon49bc — Tue, 21 Apr 2009 19:45:38 GMT

I will give that a try. I did use :389 in the server address. I wasn't not paying attention to case in the config for the windows configs. I am also running Glassfish so share doesn't work with that. Maybe in the next release.

Thanks
Matt