topic Re: LDAP on 3.2? in Alfresco Archive

LDAP on 3.2?

jriker1 — Mon, 11 May 2009 13:47:22 GMT

I am trying out Alfresco 3.2 preview 2 and noticed somethings have moved around but regardless can't get LDAP working. Does anyone know if it's working in 3.2 yet or if this is futile? If so, does anyone have any examples how they configured it? I know this is not production as the sample chainin

Re: LDAP on 3.2?

blackened — Tue, 26 May 2009 20:54:36 GMT

Does anyone have any info on this? I am also trying to get LDAP figured out on 3.2 preview 2 and see no documentation on it nor does there seem to be any ldap config files in the sample extensions archive. If 3.2 doesn't have a working LDAP setup, does anyone know at what point it might be added in again? Thanks.

Re: LDAP on 3.2?

dward — Wed, 27 May 2009 09:15:55 GMT

Dear jriker

First you need to set up your authentication chain by declaring it in custom-repository.properties. E.g.

authentication.chain=myldap:ldap

Now take a copy of

root\projects\repository\config\alfresco\subsystems\Authentication\ldap\ldap-authentication.properties

and place it in your extension classpath under

alfresco/extension/subsystems/Authentication/ldap/myldap/ldap-synchronisation.properties

(note that your instance name is the last directory in the path)

.. and edit so that the parameters match your environment.

We certainly had this working in one of our test environments so let me know (via the forums) if you have any further problems.

Re: LDAP on 3.2?

iantopanto — Wed, 27 May 2009 15:08:07 GMT

What would one do if they wanted to use sync the groups and users from ldap (possibly a one off, or it could be permenant) and use NTLM passthru to a samba machine.

I had this working on a previous version of alfresco where it was doing the sync (at intervals) and auth through our samba server (setup to do pam_ldap). We need this to get CIFS server working properly.

Thanks,
Ian

Re: LDAP on 3.2?

blackened — Wed, 27 May 2009 16:53:56 GMT

dward -

I followed the instructions but I must have an improper filename or path for the properties file. I have definitely modified it with my own server name, but the error in the log upon starting Alfresco shows the default server:

10:50:29,893 ERROR [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] Unable to connect to LDAP Server; check LDAP configuration
javax.naming.CommunicationException: openldap.domain.com:389 [Root exception is java.net.UnknownHostException: openldap.domain.com]

Can you verify the filename you mentioned as well as the path? I did make sure to name the last directory in my path with the instance name I specified in custom-repository.properties.

Thanks,
Scott

Re: LDAP on 3.2?

blackened — Wed, 27 May 2009 21:23:29 GMT

OK so I got to a next step by modifying the ldap-authentication.properties that resides under <TOMCATDIR>/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap. I no longer get the ldap related errors about openldap.domain.com. However, attempting to login either with an LDAP test user or with the local Alfresco admin user is unsuccessful. The alfresco logs shows:

13:36:34,530 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 04270003 Login failed
org.alfresco.web.scripts.WebScriptException: 04270003 Login failed

13:36:43,239 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 04270006 Login failed
org.alfresco.web.scripts.WebScriptException: 04270006 Login failed

Do I need to add alfresco to the chain to get the regular admin login to work? Can I have local alfresco users authenticate before it is authenticated against LDAP? Do I need to manually add all of the LDAP users to Alfresco before hand?

Just a little background - I am running the latest nightly build of Alfresco 3.2 Preview 2 (war files manually loaded onto Tomcat 6) on Centos 5.2, and I am authenticating against a Zimbra installation of LDAP.

Thanks,
Scott

Re: LDAP on 3.2?

airbag888 — Fri, 29 May 2009 07:02:41 GMT

I just found out about Alfresco and watching the videos was really impressed at the amount of control you had on document management.

Trying it out, after seeing the polished interface all around I was expecting an easy time setting up however after looking around I am unable to find a proper configuration screen and all I see around the forums are people tweaking the code directly.

Is there something I'm missing or is that the only way? Reason why I posted in here is one of my 1st objectives is to authenticate my users against my AD server.
Please enlighten me.

Thanks!

Re: LDAP on 3.2?

iantopanto — Fri, 29 May 2009 08:49:53 GMT

I think its the only way to configure the Labs edition anyway.

To get it working for openldap and indeed active directory what I did was to install the full installer which includes the tomcat installations.
To get the auth working to AD you then need to cd into the "tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap" folder in the tomcat install and edit a file called "ldap-authentication.properties" with AD specific stuff.

I have no idea how to do sync for AD groups, but with openldap what i did was to copy the 2 files in "../Synchronization/ldap/" to the ldap auth folder we are in now and edit them accordingly.

Finally to enable auth (and sync) you will need to edit your custom-repository.properties file in "tomcat/shared/classes/alfresco/extension/" adding the line "Authentication.chain=myldap:ldap. This is supposed to read your ldap config from shared/classes/alfresco/extension/subsystem/Authentication/ldap/myldap/ but i never got it working like this.

Hope it helps.

Re: LDAP on 3.2?

iantopanto — Fri, 29 May 2009 08:59:15 GMT

Why can't someone use ldap groups of posixGroup objectclass with memberUid, and not forced to use "groupOfUniqueNames" objectclass.
I know that this is so that the members are validated, but I have all my groups set up with memberUid and a gidNumber - its easier to use.

I have to build the alfresco.war file with some modification to the source to construct the full dn myself (uid=%s,out=People,dc=domain,dc=com) to allow me to use memberUid and my already setup posixGroups.

Is it possible to have some configuration options in the ldap files so that the admin can choose which type of groups they have.
There could be 2 parameters:
1) choose which type of group we use
2) enter the base dn for the groups if we are using posixGroups, so that we can construct the dn for the user from just the uid, like above.

Can i submit this as a request? i don't think its a difficult task?

Re: LDAP on 3.2?

airbag888 — Fri, 29 May 2009 14:47:13 GMT

I think its the only way to configure the Labs edition anyway.

To get it working for openldap and indeed active directory what I did was to install the full installer which includes the tomcat installations.
To get the auth working to AD you then need to cd into the "tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap" folder in the tomcat install and edit a file called "ldap-authentication.properties" with AD specific stuff.

I have no idea how to do sync for AD groups, but with openldap what i did was to copy the 2 files in "../Synchronization/ldap/" to the ldap auth folder we are in now and edit them accordingly.

Finally to enable auth (and sync) you will need to edit your custom-repository.properties file in "tomcat/shared/classes/alfresco/extension/" adding the line "Authentication.chain=myldap:ldap. This is supposed to read your ldap config from shared/classes/alfresco/extension/subsystem/Authentication/ldap/myldap/ but i never got it working like this.

Hope it helps.

Thanks for that thorough response. I'm just out of a seminar and my head's too full of ideas to think about how that'd work in my environment. That said it seems rather tedious to setup. I was looking forward to presenting alfresco running in house with some of our data migrated but i absolutely don't want to be tinkering with the code at such an early stage. If I have to do that now, there's no telling how much more awaits.
A clean administrative console with all settings/options really would make this product showcase-able. However unless that is possible I probably will not even bother and look elsewhere.

Re: LDAP on 3.2?

mikeh — Fri, 29 May 2009 17:00:42 GMT

Thanks for that thorough response. I'm just out of a seminar and my head's too full of ideas to think about how that'd work in my environment. That said it seems rather tedious to setup. I was looking forward to presenting alfresco running in house with some of our data migrated but i absolutely don't want to be tinkering with the code at such an early stage. If I have to do that now, there's no telling how much more awaits.

It's only configuration you're editing, not code.

A clean administrative console with all settings/options really would make this product showcase-able. However unless that is possible I probably will not even bother and look elsewhere.

http://wiki.alfresco.com/wiki/JMX
Although not every configuration value is exposed through this yet.

Mike

Re: LDAP on 3.2?

blackened — Fri, 29 May 2009 21:58:05 GMT

I have tried getting this working through editing the two ldap*.properties files. I can now login properly with the local admin account in both explorer and share. However, a known working user (I can login with the same user to both Zimbra and SugarCRM) does not login (unknown username/password). The alfresco.log spits this error:

15:49:27,768 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 04290004 Login failed
org.alfresco.web.scripts.WebScriptException: 04290004 Login failed
<java error stack>
15:49:34,527 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 04290008 Login failed
org.alfresco.web.scripts.WebScriptException: 04290008 Login failed
<java error stack>

Does this provide any clues to what the problem is to anyone? This is a Zimbra installation of OpenLDAP that resides on another server.

Re: LDAP on 3.2?

blackened — Mon, 01 Jun 2009 21:54:44 GMT

It appears the problem was my ldap UserNameFormat. In other posts, it shows that the config should be
"ldap.authentication.userNameFormat=CN=%s,OU=People,DC=example,DC=com"

However, I have found that it really needs to be:

"ldap.authentication.userNameFormat=uid=%s,ou=People,dc=example,dc=com"

I am now able to create a user in Zimbra, and have them automatically setup in both Alfresco and SugarCRM! Now to tie them all into one portal website…

Re: LDAP on 3.2?

jriker1 — Wed, 10 Jun 2009 17:27:39 GMT

Dear jriker

First you need to set up your authentication chain by declaring it in custom-repository.properties. E.g.

authentication.chain=myldap:ldap

Now take a copy of

root\projects\repository\config\alfresco\subsystems\Authentication\ldap\ldap-authentication.properties

and place it in your extension classpath under

alfresco/extension/subsystems/Authentication/ldap/myldap/ldap-synchronisation.properties

(note that your instance name is the last directory in the path)

.. and edit so that the parameters match your environment.

We certainly had this working in one of our test environments so let me know (via the forums) if you have any further problems.

OK, I have a Authentication/ldap/ldap-authentication.properties file. Couple questions on the above.

Not sure which extensions branch we are talking about. I have:

/srv/tomcat6/webapps/alfresco/WEB-INF/classes/alfresco/extension

and

/srv/tomcat/shared/classes/alfresco/extension.

Neither of them have a LDAP subsystem in them. Do I have to manually create these folders?

JR

Re: LDAP on 3.2?

mrogers — Wed, 10 Jun 2009 19:01:51 GMT

You put all your Alfresco configuration into the extension classpath. (Never into the WEB-INF)

If you have installed onto Tomcat 6 then you need to create the shared extensions folder and add it to the classpath.
http://wiki.alfresco.com/wiki/Install_Tomcat6

Re: LDAP on 3.2?

jriker1 — Wed, 10 Jun 2009 19:27:46 GMT

You put all your Alfresco configuration into the extension classpath. (Never into the WEB-INF)

If you have installed onto Tomcat 6 then you need to create the shared extensions folder and add it to the classpath.
http://wiki.alfresco.com/wiki/Install_Tomcat6

Thanks for the reply. Does items in the extension folder have to be at the root of that folder or does it search recursively under it?

Re: LDAP on 3.2?

mrogers — Thu, 11 Jun 2009 10:02:11 GMT

From application-context.xml:

These are the locations for users' configuration files. It is not recursive.
<import resource="classpath*:alfresco/extension/*-context.xml"/>
<import resource="classpath*:alfresco/extension/mt/*-context.xml"/>
<import resource="classpath*:alfresco/extension/bootstrap/*-context.xml" />

Re: LDAP on 3.2?

jriker1 — Thu, 18 Jun 2009 15:42:55 GMT

From application-context.xml:

These are the locations for users' configuration files. It is not recursive.
<import resource="classpath*:alfresco/extension/*-context.xml"/>
<import resource="classpath*:alfresco/extension/mt/*-context.xml"/>
<import resource="classpath*:alfresco/extension/bootstrap/*-context.xml" />

Then what iantopanto suggests on the prior page wouldn't work because it wouldn't look that deep for the files. As an Alfresco engineer, and having to get this working as a POC else my management will look elsewhere, can you walk thru exactly how to configure LDAP and or NTLM to work with preview2? Even when i put a copy of the ldap properties and xml file in the extensions folder I get a bunch of errors, first being that it can't connect to my ldap server which is nuts because I know it's entered right. Unless it's how the credentials are entered. We are using ADAM here if that helps any.

By the way, here is the first part of what I get. I know it finds the ldap server because when I put in a bogus name it shows the name physically in the log as not found.


10:44:52,740 INFO  [org.alfresco.config.JndiPropertiesFactoryBean] Loading properties file from class path resource [alfresco/extension/custom-hibernate-dialect.properties]
10:44:52,776 INFO  [org.alfresco.config.SystemPropertiesFactoryBean] Loading properties file from class path resource [alfresco/domain/hibernate-cfg.properties]
10:44:58,273 ERROR [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] Unable to connect to LDAP Server; check LDAP configuration
javax.naming.NoInitialContextException: Cannot instantiate class: ${ldap.authentication.java.naming.factory.initial} [Root exception is java.lang.ClassNotFoundException: ${ldap.authentication.java.naming.factory.initial}]
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:657)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.afterPropertiesSet(LDAPInitialDirContextFactoryImpl.java:224)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1203)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1172)
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapable
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: LDAP on 3.2?

jriker1 — Fri, 19 Jun 2009 14:02:59 GMT

Got things working kind of. I put in my custom-repository.properties file in the tomcat shared extensions folder:

authentication.chain=myldap:ldap

Alfresco then seemed to start reading in the default ldap-authentication.properties data in the webapp branch of Tomcat. If I created a myldap folder under the ldap folder Alfresco didn't care. If I created a myldap folder in the shared tomcat extensions folder it didn't read it. If I stuck the properties and xml file in the root of the extensions folder still nothing. If I created the alfresco/subsystem/Authentication/ldap structure under extensios still nothing. Only place it seems to read in the config is from the original file location.

Is the beta just not working with these files in the extensions folder? Also how do I get the Synchronization working? Do I need to copy those files to the LDAP folder?

Thanks.

JR

Re: LDAP on 3.2?

dward — Fri, 19 Jun 2009 14:27:10 GMT

The correct place is

alfresco/extension/subsystems/Authentication/ldap/myldap/*.properties

Look at the javadoc for ChildApplicationContextFactory.

I'm currently updating the Wiki on subsystem configuration and will move on to authentication configuration shortly.