topic Re: LDAP can connect but not sync in Alfresco Archive

LDAP can connect but not sync

oddo — Mon, 05 Jul 2010 10:07:33 GMT

Hi all,I've configured my alfresco 3.3 for connecting with LDAP system.This is my configuration in alfresco-global-properties:authentication.chain=passthruassthru,ldap-ad:ldap-adpassthru.authentication.useLocalServer=falsepassthru.authentication.domain=DOMpassthru.authentication.servers=DOM\\DC-SE

Re: LDAP can connect but not sync

nguser1 — Mon, 05 Jul 2010 10:41:00 GMT

I'm no expert but from the error message I think you might want to be looking at these lines:

ldap.synchronization.active=false
ldap.authentication.java.naming.security.principal=DOM\\sys.name.surname
ldap.authentication.java.naming.security.credentials=password

The error message you have is similar to the error messages I had when someone changed the password for the user I was logging on to AD as.

HTH

Re: LDAP can connect but not sync

oddo — Mon, 05 Jul 2010 12:20:02 GMT

Thank you, but I'm sure about user and password because it's the same thai I use accessing our servers and Active Directory!!!
I try also to connect LDAP with "Softerra LDAP Browser 2.6" and the same Bases and Queries used in configuration file, with the same user and password, work perfectly!!!
I have no further idea, I'm trying to solve this problem for about 2 weeks…

Oddo.

Re: LDAP can connect but not sync

altroz — Tue, 06 Jul 2010 04:37:06 GMT

I think this page can help you:
http://www.anotherstrangerme.com/alfresco-integration-with-active-directory/

I used LDAP-AD authentication and synchronization like below, and it worked fine for me.
Global Properties:


synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
‍‍‍‍‍‍

ldap-properties


ldap.authentication.active=true
ldap.synchronization.active=true
ldap.authentication.allowGuestLogin=false

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false

ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.provider.url=ldap://localhost:389
ldap.authentication.defaultAdministratorUserNames=Administrator

ldap.synchronization.java.naming.security.principal=Administrator@prosia.local
ldap.synchronization.java.naming.security.credentials=ProsiaPassword
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000

ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(objectclass\=group)

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

ldap.synchronization.groupSearchBase=dc\=prosia,dc\=local
ldap.synchronization.userSearchBase=dc\=prosia,dc\=local

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=userPrincipalName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I hope it helps you…

Re: LDAP can connect but not sync

oddo — Tue, 06 Jul 2010 08:38:42 GMT

Thanks a lot for your help, I have already found the website you told me, I copyed some of your configuration but the result (ERROR) is the same! :cry:

Now this is my LDAP configuration:

authentication.chain=passthru:passthru,ldap-ad:ldap-ad

passthru.authentication.useLocalServer=false
passthru.authentication.domain=DOM
passthru.authentication.servers=DOM\\DC-SERVER,DC-SERVER
ntlm.authentication.sso.enabled=true
alfresco.authentication.allowGuestLogin=false
ntlm.authentication.mapUnknownUserToGuest=false
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=sys.name.surname

ldap.authentication.active=true
ldap.authentication.userNameFormat=%s@dom.com
ldap.authentication.java.naming.provider.url=ldap://DC-SERVER.dom.com:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false

#ldap.synchronization.active=false
synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.referral=follow 
ldap.authentication.java.naming.security.principal=sys.name.surname@dom.com
ldap.authentication.java.naming.security.credentials=syspassword
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronisation.personQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512))
ldap.synchronisation.personDifferentialQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512))
ldap.synchronization.userSearchBase=OU=Users,DC=dom,DC=com
ldap.synchronization.personType=user
ldap.synchronisation.groupQuery=(&(objectclass=group)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronisation.groupDifferentialQuery=(&(objectclass=group)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.groupSearchBase=OU=Groups,DC=dom,DC=com

ldap.synchronization.userIdAttributeName=userPrincipalName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Yesterday I also read that Alfresco doesn't sync correctly if Company Home was renamed, so I delete completely the alfresco folder and re-install the .war file from the beginning, but nothing different happened! :cry: :cry:

I'm thinking to plan a trip to Lourdes… :roll:

Re: LDAP can connect but not sync

altroz — Wed, 07 Jul 2010 16:43:34 GMT

well, I'm not sure with your error.. what about adding backslash("\") mark to your personquery, differentialquery, userSearchBase and groupSearchBase. for example:
ldap.synchronization.userSearchBase=OU=Users,DC=dom,DC=com
to
ldap.synchronization.userSearchBase=OU\=Users,DC\=dom,DC\=com

does it make any difference? btw, are you sure that "Users" is a Organizational Unit (OU), if I'm not wrong, usually "Users" is a CN. Please check it from your LDAP Browser…

PS: I had been stuck also with this AD stuff for more than a week.. but now it's working fine..

Re: LDAP can connect but not sync

oddo — Thu, 08 Jul 2010 15:46:22 GMT

Thank you for the answer…
I'm sure that the SearchBase queries are correct because I use them in my LDAP browser and I can view all Users and Groups correctly…
I also tried to add escape character "\" a few days ago, both in queries and in security.principal user, but the result is always the same!!!

Now, I'm watching on another project because I was going mad, but I'm always hoping in a post that can help me!!!
:roll:

Re: LDAP can connect but not sync

ivan_plestina — Sat, 17 Jul 2010 12:39:10 GMT

Try this:


ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.security.principal=sys.name.surname@dom.com
ldap.authentication.java.naming.security.credentials=syspassword
‍‍‍‍‍

Ivan