topic Re: alfresco authenthication with openldap in Alfresco Archive

alfresco authenthication with openldap

bkarthick4u — Sat, 05 Sep 2009 15:41:09 GMT

HI everybodyI'm having problem with alfresco authentication with openldap in alfresco community 3.2i'm not facing any problem in alfresco enterprise edition for authenthication .can any1 tell me how to do authentication in alfresco community 3.2.i tried a lot..eventhough its not authenticating…i tri

Re: alfresco authenthication with openldap

mrogers — Sat, 05 Sep 2009 15:50:00 GMT

Look again at these forums and the wiki. The way alfresco authentication is configured changes in Alfresco 3.2

Re: alfresco authenthication with openldap

bkarthick4u — Sun, 06 Sep 2009 11:03:27 GMT

HI thanks for your reply…
i tried with wikki..but eventhough its doesnot help me….

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
caused by:
javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
caused by:
org.alfresco.error.AlfrescoRuntimeException: 08060004 Not implemented

Show Details
javax.faces.FacesException: Error calling action method of component with id loginForm:submit
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:72)
at javax.faces.component.UICommand.broadcast(UICommand.java:109)
at javax.faces.component.UIViewRoot._broadcastForPhase(UIViewRoot.java:97)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:171)
at org.apache.myfaces.lifecycle.InvokeApplicationExecutor.execute(InvokeApplicationExecutor.java:32)
at org.apache.myfaces.lifecycle.LifecycleImpl.executePhase(LifecycleImpl.java:95)
at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:70)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:139)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:124)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:122)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at $Proxy185.doFilter(Unknown Source)
at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:88)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.alfresco.repo.web.filter.beans.NullFilter.doFilter(NullFilter.java:74)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.alfresco.repo.management.subsystems.ChainingSubsystemProxyFactory$1.invoke(ChainingSubsystemProxyFactory.java:122)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at $Proxy185.doFilter(Unknown Source)
at org.alfresco.repo.web.filter.beans.BeanProxyFilter.doFilter(BeanProxyFilter.java:88)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:619)
Caused by: javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:156)
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:61)
… 43 more
Caused by: org.alfresco.error.AlfrescoRuntimeException: 08060004 Not implemented
at org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao.loadUserByUsername(DefaultMutableAuthenticationDao.java:410)
at net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider.getUserFromBackend(DaoAuthenticationProvider.java:390)
at net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider.authenticate(DaoAuthenticationProvider.java:225)
at net.sf.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:159)
at net.sf.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:49)
at org.alfresco.repo.security.authentication.AuthenticationComponentImpl.authenticateImpl(AuthenticationComponentImpl.java:81)
at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.authenticate(AbstractAuthenticationComponent.java:144)
at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.authenticate(AuthenticationServiceImpl.java:129)
at org.alfresco.repo.security.authentication.AbstractChainingAuthenticationService.authenticate(AbstractChainingAuthenticationService.java:166)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:304)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:80)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:275)
at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at $Proxy25.authenticate(Unknown Source)
at org.alfresco.web.bean.LoginBean.login(LoginBean.java:282)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:132)
… 44 more
Return to application
My Content

Re: alfresco authenthication with openldap

dward — Mon, 07 Sep 2009 08:24:48 GMT

It looks like you are seeing ETHREEOH-2328, fixed on 16th July.

Please try taking a v3.3 nightly build or building the latest code from HEAD.

Re: alfresco authenthication with openldap

dinny_r — Mon, 07 Sep 2009 12:01:21 GMT

Hi,

I also got the same error when trying to authenticate LDAP with alfresco3.2.As per the solution given i tried to download v3.3 but couldn't find a valid url to download.If you are already done with it then can you please help me with the url.

I was able to integrate LDAP with 2.9 and for that I configured 2 files
1)ldap-authentication-context.xml
2) ldap-authentication.properties

So for 3.3 is it going to be the same above 2 files that needs to be configured or is it different

Thanks
Dinny

Re: alfresco authenthication with openldap

dward — Mon, 07 Sep 2009 12:22:33 GMT

OK, they seem to be keeping us guessing with the version number. It looks like the version number on HEAD has been switched back to 3.2.

So you should be able to take the latest 3.2 Community build from here

http://dev.alfresco.com/downloads/nightly/dist/

Yes, LDAP configuration has changed in v3.2. Hopefully for the better. You can control all the settings in alfresco-global.properties.

A simple set up

authentication.chain=ldap1:ldap
ldap.authentication.userNameFormat=uid\=%s,ou\=People,dc\=company,dc\=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://openldap.domain.com:389
ldap.synchronization.java.naming.security.principal=cn\=Manager,dc\=company,dc\=com
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou\=Groups,dc\=company,dc\=com
ldap.synchronization.userSearchBase=ou\=People,dc\=company,dc\=com

See http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP for full details

Note that the word synchronization is now spelled with a 'z' in the property names.

Re: alfresco authenthication with openldap

bkarthick4u — Tue, 08 Sep 2009 06:59:14 GMT

HI Guys thanks for your reply,

I tried with your sugestion ,eventhough i can't log in with the ldap users.

when i login with the ldap user i get a error like this

"javax.faces.FacesException:Error calling action method of component with id loginForm:submit
caused by
javax.faces.el.EvaluationException:Exception while invoking expression #(LoginBean.login)
caused by
org.alfresco.error.AlfrescoRuntimeException:08070004 Not Implemented

I just wanted to ask you guys,
1) Wheather ldap authentication is possible with alfresco comunity 3.2 ????
2)Should i go for the latest version of alfresco community for ldap authentication ????

Re: alfresco authenthication with openldap

dward — Tue, 08 Sep 2009 10:46:08 GMT

Yes, please try the latest nightly build as I think these issues have now been ironed out.

Re: alfresco authenthication with openldap

dward — Tue, 08 Sep 2009 10:47:00 GMT

FYI a workaround might be to include alfrescoNtlm1 in your chain

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

Re: alfresco authenthication with openldap

bkarthick4u — Tue, 08 Sep 2009 13:28:37 GMT

HI thanks for your reply…
here
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

IN this line ldap1:ldap points to what ?

Re: alfresco authenthication with openldap

dward — Tue, 08 Sep 2009 13:33:18 GMT

Go read the Wiki

Re: alfresco authenthication with openldap

dinny_r — Tue, 08 Sep 2009 13:58:04 GMT

Hi,

Thanking you for the quick response.Now I am able to authenticate to LDAP and login with the users in ldap.To make the alfresco admin login work and to synchronize I need to implement chaining and synchronization.Correct me if I am wrong.For this I made changes in alfresco-global.properties and now able to login as alfresco admin as well but synchronization is not happening .This is how my alfresco-global.properties looks like

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true

ldap.authentication.userNameFormat=<usernameformat>
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=<url>
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
#ldap.synchronization.java.naming.security.principal=
#ldap.synchronization.java.naming.security.credentials=
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=Nogroup)
#ldap.synchronization.groupDifferentialQuery=(&(objectclass=group)(!(modifyTimestamp<\={0})))
#ldap.synchronization.personQuery=(&(objectclass=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
#ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
#ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=Alfresco,dc=domain
#ldap.synchronization.userSearchBase=ou\=User Accounts,ou=\Alfresco,dc=domain
#ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
#ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=samaccountname
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
#ldap.synchronization.userEmailAttributeName=mail
#ldap.synchronization.userOrganizationalIdAttributeName=msExchALObjectVersion
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
# userHomesHomeFolderProvider personalHomeFolderProvider companyHomeFolderProvider guestHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=Nogroup
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member

ldap.synchronization.synchronizeChangesOnly=true
ldap.synchronization.import.cron
ldap.synchronization.syncOnStartup=true
ldap.synchronization.syncWhenMissingPeopleLogIn=true
ldap.synchronization.autoCreatePeopleOnLogin=false

I referred the information given in the wiki but still not very clear about what value has to be given for personQuery,personDifferentialQuery etc…also not very sure whether the values and entries that I have given in the property files are correct.Also the folder "tomcat\shared\classes\alfresco\extension" contains a file "chaining-authentication-context.xml.sample".So do I need to configure this as well.

Thanking u in advance
Dinny

Re: alfresco authenthication with openldap

dward — Tue, 08 Sep 2009 14:16:11 GMT

The chaining-authentication-context.xml.sample is out of date and unnecessary and has been removed from HEAD.

You shouldn't have to edit the ldap-ad queries. They have already been optimized for Active Directory.

You do need to set

ldap.synchronization.groupSearchBase and ldap.synchronization.userSearchBase

so that they are appropriate for your directory layout

If you want a mixture of Alfresco and LDAP authentication, all you need is

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

That will give priority to Alfresco over LDAP.

Re: alfresco authenthication with openldap

dinny_r — Wed, 09 Sep 2009 16:02:52 GMT

Hi,
I made the changes in the property file and now able to login with alfresco user as well as ldap user.But now the ldap user details are available in alfresco only after the ldap users login for the 1st time but as per my requirement the ldap user details should be available in the alfresco even if the ldap users doesn't login.Also is it possible to configure in such a way that only certain set of ldap users should be allowed to login to alfresco.

Thanking you in advance
Dinny

Re: alfresco authenthication with openldap

dward — Wed, 09 Sep 2009 16:55:56 GMT

If you have configured synchronization correctly, the users should be available in advance of them logging in. A differential sync is triggered when a missing user logs in, but a full sync (by default) is scheduled every night at midnight.

And if you take a recent nighly build (recommended) a differential sync is also triggered every time the server starts up, using small transactions for maximum performance.

If you aren't seeing any users brought across by the sync, then there is still something wrong with the sync configuration.

Re: alfresco authenthication with openldap

dward — Wed, 09 Sep 2009 16:58:24 GMT

To answer the question about restricting login to a subset of ldap users, what you need to do is tighten your user query so that it only returns that subset.

Then in alfresco-global.properties, set

synchronization.autoCreatePeopleOnLogin=false

That will stop users being auto-created that aren't even brought over by the sync and ultimately they will be rejected by authentication.

See http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem

Re: alfresco authenthication with openldap

dinny_r — Thu, 10 Sep 2009 09:24:56 GMT

Hi,

I am getting the below message while starting the server..

12:47:29,911 INFO [management.subsystems.ChildApplicationContextFactory] Start
ing 'Authentication' subsystem, ID: [managed, ldap1]
12:47:29,927 INFO [alfresco.config.JndiPropertyPlaceholderConfigurer] Loading
properties file from class path resource [alfresco/alfresco-shared.properties]
12:47:30,443 WARN [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server supports anonymous bind ldap://sjc-adc-01.corp.ebay.com:389
12:47:30,896 INFO [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a string uid and password at lda
p://sjc-adc-01.corp.ebay.com:389
12:47:31,333 INFO [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a simple dn and password at ldap
://sjc-adc-01.corp.ebay.com:389
12:47:31,787 INFO [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for known principal and invalid cred
entials at ldap://sjc-adc-01.corp.ebay.com:389
12:47:31,802 INFO [management.subsystems.ChildApplicationContextFactory] Start
up of 'Authentication' subsystem, ID: [managed, ldap1] complete

My alfresco-global.properties settings looks like this …

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=<userformat>
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=<url>
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=<username>
ldap.synchronization.java.naming.security.credentials=<password>
ldap.synchronization.import.cron=0 45 * * * ?
ldap.synchronisation.personQuery=objectClass=user
ldap.synchronisation.userIdAttributeName=sAMAccountName
ldap.synchronisation.userFirstNameAttributeName=givenName
ldap.synchronisation.userLastNameAttributeName=sn
ldap.synchronisation.userEmailAttributeName=mail
ldap.synchronisation.import.group.cron=0 45 * * * ?
ldap.synchronisation.import.group.clearAllChildren=false
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest))(!(modifyTimestamp<\={0})))

synchronization.synchronizeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=true
synchronization.syncOnStartup=true

I am really not able to figure out why synchronization is not happening .With the user details given for "principal & credentials" I am able to login to alfresco.Please correct me if there is something missing or wrongly configured in my alfresco-global.properties

Thanking you in advance
Dinny

Re: alfresco authenthication with openldap

dward — Thu, 10 Sep 2009 10:33:48 GMT

What does it say in the log file after "starting Synchronization subsystem"?

I note that you aree using a mixture of spellings for "synchronization". The v3.2 property names all use a z in the work synchronization. And some of the attribute names have changed. Please carefully check all your attribute names against

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

I don't see why you have to include all those synchronization properties in alfresco-global.properties anyway. As the defaults all have sensible values.

The only properties that it is important for you to customize are

ldap.synchronization.groupSearchBase

and

ldap.synchronization.userSearchBase

Re: alfresco authenthication with openldap

dinny_r — Thu, 10 Sep 2009 14:33:56 GMT

Hi ,

My log file is showing ….

sco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Synchronization' subsystem, ID: [default]
19:35:04,491 INFO [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
19:35:04,507 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [default] complete
19:35:04,538 INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - vpwi32devifx-20071213a (ifix 129397: SR4 + IY99287 + IY99356 + IY98136 + IZ09166 ); maximum heap size 512.000MB
19:35:04,538 INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community): Current version 3.2.0 (2039) schema 2019 - Installed version 3.2.0 (2039) schema 2019
19:35:07,272 INFO [org.alfresco.module.vti.VtiServer] Vti server started successfully on port: 7070
19:35:20,194 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'wcm_deployment_receiver' subsystem, ID: [default]
19:35:20,225 INFO [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
19:35:20,319 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'wcm_deployment_receiver' subsystem, ID: [default] complete
19:35:24,022 INFO [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
19:35:24,819 INFO [org.alfresco.config.JBossEnabledWebApplicationContext] Refreshing org.alfresco.config.JBossEnabledWebApplicationContext@44424442: display name [Root WebApplicationContext]; startup date [Thu Sep 10 19:35:24 IST 2009]; root of context hierarchy
19:35:47,912 INFO [org.alfresco.config.JBossEnabledWebApplicationContext] Bean factory for application context [org.alfresco.config.JBossEnabledWebApplicationContext@44424442]: org.springframework.beans.factory.support.DefaultListableBeanFactory@57725772
19:35:48,897 INFO [org.alfresco.web.scripts.DeclarativeRegistry] Registered 24 Web Scripts (+0 failed), 26 URLs
19:35:48,912 INFO [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised Presentation Web Script Container (in 210.2646ms)
19:35:49,037 INFO [org.alfresco.web.scripts.DeclarativeRegistry] Registered 42 Web Scripts (+0 failed), 44 URLs
19:35:49,053 INFO [org.alfresco.web.scripts.AbstractRuntimeContainer] Initialised WebFramework Web Script Container (in 134.30843ms)
19:35:49,100 INFO [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
19:38:52,832 INFO [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
19:38:52,926 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [managed, ldap1]
19:38:52,973 INFO [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
19:38:53,457 WARN [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://sjc-adc-01.corp.ebay.com:389
19:38:53,910 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://sjc-adc-01.corp.ebay.com:389
19:38:54,379 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://sjc-adc-01.corp.ebay.com:389
19:38:54,832 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://sjc-adc-01.corp.ebay.com:389
19:38:54,832 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [managed, ldap1] complete
19:41:53,564 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
19:41:53,564 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'AUTH.EXT.ldap1'

These are the values that i have given for the following properties:

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest))(!(modifyTimestamp<\={0})))
ldap.synchronization.groupType=group.no
ldap.synchronization.groupQuery=(objectclass\=group.no)
ldap.synchronization.userSearchBase=<searchbase>
ldap.synchronization.groupSearchBase=<group search base>

For the properties "principal & credentials" do I need to give the user details who can log into ldap or any user details which is stored in ldap..Also if the users are imported successfully will it be visible for admin under "Manage System Users "

Thanks
Dinny

Re: alfresco authenthication with openldap

dward — Thu, 10 Sep 2009 14:43:54 GMT

For principal and credentials you must give the user principal name and password of a user who has the ability to see all users and groups in the LDAP directory.

You can test out the right value by using an LDAP browser, such as the one from http://www.ldapbrowser.com

Now your log shows that the sync started but did not finish. Are there no more lines in the log after 19:41:53,564 ?