topic Is it possible with LDAP? in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216975#M170105 <HTML><HEAD></HEAD><BODY><SPAN>I've got this LDAP stucture:</SPAN><BR /><PRE class="language-none line-numbers"><CODE><BR />dc=century,dc=local<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__ou=group<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__cn=alfresco<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__ou=people<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__uid=user1<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__uid=user2<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__uid=user3<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN>cn=alfresco is:</SPAN><BR /><SPAN>dn: cn=alfresco,ou=group,dc=century,dc=local</SPAN><BR /><SPAN>objectClass: posixGroup</SPAN><BR /><SPAN>objectClass: top</SPAN><BR /><SPAN>cn: alfresco</SPAN><BR /><SPAN>gidNumber: 1</SPAN><BR /><SPAN>memberUid: user1</SPAN><BR /><SPAN>memberUid: user2</SPAN><BR /><BR /><SPAN>As you can see from this description user1 and user2 are both members of the alfresco group.</SPAN><BR /><SPAN>I want users from the alfresco group can access the system and I don't want to synchronize groups in alfresco and groups in LDAP but only users.</SPAN><BR /><SPAN>What are config options for my case?</SPAN><BR /><SPAN>Thanks a lot!</SPAN></BODY></HTML> Thu, 25 Feb 2010 07:15:58 GMT quasar 2010-02-25T07:15:58Z Is it possible with LDAP? https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216975#M170105 I've got this LDAP stucture:dc=century,dc=local&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__ou=group&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__cn=alfresco&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__ou=people&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__uid=user1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; |__uid=user2&nbsp; Thu, 25 Feb 2010 07:15:58 GMT https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216975#M170105 quasar 2010-02-25T07:15:58Z Re: Is it possible with LDAP? https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216976#M170106 <HTML><HEAD></HEAD><BODY><SPAN>It's possible.</SPAN><BR /><BR /><SPAN>You need to set your search base to search all users in the AD. Example: OU=people,dc=century,dc=local</SPAN><BR /><BR /><SPAN>Then, you need to set your personQuery to query only those who are members of that group based on CN=Alfresco. Example: (memberOf=CN=alfresco,OU=Group,DC=century,DC=local)</SPAN><BR /><BR /><SPAN>That should work. I tested it on my AD and it returned all members of the group I tested. Let me know if it does. <img id="smileyhappy" class="emoticon emoticon-smileyhappy" src="https://connect.hyland.com/i/smilies/16x16_smiley-happy.png" alt="Smiley Happy" title="Smiley Happy" /></SPAN></BODY></HTML> Fri, 26 Feb 2010 18:39:56 GMT https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216976#M170106 durrell 2010-02-26T18:39:56Z Re: Is it possible with LDAP? https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216977#M170107 <HTML><HEAD></HEAD><BODY><SPAN>Thanks for reply, durrell!</SPAN><BR /><SPAN>I think my problem is the search query actually.</SPAN><BR /><SPAN>I'm unable to construct the query to find all users from OU=people,dc=century,dc=local witn memberUid: user1</SPAN><BR /><SPAN>memberUid: user2 from cn=alfresco,ou=group,dc=century,dc=local.</SPAN><BR /><SPAN>I'm using OpenLDAP not AD.</SPAN><BR /><SPAN>Could you help me with it?</SPAN></BODY></HTML> Sat, 27 Feb 2010 07:47:20 GMT https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216977#M170107 quasar 2010-02-27T07:47:20Z Re: Is it possible with LDAP? https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216978#M170108 <HTML><HEAD></HEAD><BODY><SPAN>I'm not quite sure what you're asking. How many users are you trying to pull into Alfresco? I am not very familiar with OpenLDAP, actually.</SPAN></BODY></HTML> Mon, 01 Mar 2010 13:49:38 GMT https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216978#M170108 durrell 2010-03-01T13:49:38Z Re: Is it possible with LDAP? https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216979#M170109 <HTML><HEAD></HEAD><BODY><SPAN>In OpenLDAP you need something called Reverse Group Membership Maintenance to be able to query a user's group memberships. See </SPAN><A href="http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Membership%20Maintenance" rel="nofollow noopener noreferrer">http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Membership%20Maintenance</A><SPAN>. Rather than requiring all users to be in a certain group, it's more common for them to just be in a certain sub-tree of the LDAP server, in which case you could just configure userSearchBase to use the correct DN prefix.</SPAN></BODY></HTML> Mon, 01 Mar 2010 18:05:20 GMT https://connect.hyland.com/t5/alfresco-archive/is-it-possible-with-ldap/m-p/216979#M170109 dward 2010-03-01T18:05:20Z