topic Re: [SOLVED] LDAP authentication failed synchronizing wih AD in Alfresco Archive

[SOLVED] LDAP authentication failed synchronizing wih AD

edic — Thu, 07 May 2009 11:51:00 GMT

Hi,I'm trying to get LDAP group synchronization working with Active Directory and Alfresco Labs3 Stable 1526. The import job fails with a 'LDAP authentication failed' exception.However, I can connect perfectly using the same credentials with ldapsearch (from openldap). This is what I get in catalina

Re: [SOLVED] LDAP authentication failed synchronizing wih AD

edic — Fri, 08 May 2009 07:50:32 GMT

The problem were the settings in ldap-authentication.properties, and the account properties in AD. I changed the authentication type to 'SIMPLE'. I suppose it would work with DIGEST-MD5 if I put the sAMAccountName in the principal property instead of the DN.
Anyway, here is the file


ldap.authentication.userNameFormat=%s

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://ediwin5.edicom.es:389

# The authentication mechanism to use
# ldap.authentication.java.naming.security.authentication=DIGEST-MD5
# ldap.authentication.java.naming.security.principal=alfrescoldap

ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=alfrescoldap,cn=Users,dc=edicom,dc=es

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=Test2009

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

On the other hand, make sure the account used has the 'reversible password encryption' option checked, and reset the password after that.

Re: [SOLVED] LDAP authentication failed synchronizing wih AD

mautidavis — Mon, 10 Aug 2009 13:46:32 GMT

Hi Edic,

I have precisely this very same problem.

I have done all that you have mentioned in this thread but to no avail.

Please have a look at the config files and see if there are some tips you can drop a line to be able to sort this same problem>

catalina.out log file:


16:00:00,019  ERROR [quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:211)
        at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: org.alfresco.repo.security.authentication.AuthenticationException: LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:90)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:79)
        at org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource.generateExport(LDAPPersonExportSource.java:160)
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:178)
        … 3 more
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3005)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2951)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2753)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2667)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:287)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:86)

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ldpa-authentication.properties file:


#      %s
ldap.authentication.userNameFormat=%s@nacc.local

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://192.168.100.2:389

# The authentication mechanism to use 
#and see how it works
ldap.authentication.java.naming.security.authentication=DIGEST-MD5

# The default principal to use (only used for LDAP sync): 
ldap.authentication.java.naming.security.principal=administrator@nacc.local

# The password for the default principal (only used for LDAP sync)- onsakia changed the password to 'mypassword' from the 'secret'
ldap.authentication.java.naming.security.credentials=***************

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
~
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Please Edic, as you can see this is precisely the same problem that you had, how did you sort it out?
Help me. I am lost.

Regards,
Davis M Onsakia

Re: [SOLVED] LDAP authentication failed synchronizing wih AD

dward — Mon, 10 Aug 2009 13:52:48 GMT

Davis

You are really confusing us by posting to 100 different threads with questions about your outdated v3.0 version.

It looks like the key problem is you need to change this parameter to "simple"

ldap.authentication.java.naming.security.authentication=simple

Please see

http://forums.alfresco.com/en/viewtopic.php?f=9&t=17029#p68681

Please post any further questions to a single thread about v3.0.

Re: [SOLVED] LDAP authentication failed synchronizing wih AD

johnrockfellerz — Mon, 06 Jun 2011 11:17:42 GMT

ADAudit Plus is a valuable security tool that will help you be compliant with all the IT regulatory acts. With this tool, you can monitor user activity such as logon, file access, etc. A configurable alert system warns you of potential threats.

http://www.manageengine.com/products/active-directory-audit/