<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic AD authentication &amp; user properties reset in Alfresco Archive</title>
    <link>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225551#M178681</link>
    <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;SPAN&gt;Hello all,&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;We’re running Alfresco CE 3.2. This installation has been configured to use our Microsoft AD as userbackend. This “kind of” works.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;Our problem is that the ldap synchronization resets user properties. For example, once a LDAP user is known in Alfresco, we may change the user’s home directory in Alfresco. This works until the next synchronization, which defaults the home directory.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;We’re wondering what is going on here. I’ve found some clues suggesting that all AD users are automatically recreated every sync run, which of course should not be. Also, upon updating a user I would not suspect non-AD values to be defaulted.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;The relevant configuration:&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;PRE class="language-none line-numbers"&gt;&lt;CODE&gt;&lt;BR /&gt;ldap.authentication.active=true&lt;BR /&gt;ldap.authentication.allowGuestLogin=false&lt;BR /&gt;ldap.authentication.userNameFormat=%s@domain.Local&lt;BR /&gt;ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory&lt;BR /&gt;ldap.authentication.java.naming.provider.url=ldap://adserver:389&lt;BR /&gt;ldap.authentication.java.naming.security.authentication=simple&lt;BR /&gt;ldap.authentication.escapeCommasInBind=false&lt;BR /&gt;ldap.authentication.defaultAdministratorUserNames=Administrator&lt;BR /&gt;ldap.synchronization.active=true&lt;BR /&gt;ldap.synchronization.java.naming.security.principal=cn\=alfrescoadm,ou\=_Users,ou\=ourcompany,dc\=domain,dc\=Local&lt;BR /&gt;ldap.synchronization.queryBatchSize=10000&lt;BR /&gt;ldap.synchronization.groupQuery=(objectclass\=Nogroup)&lt;BR /&gt;ldap.synchronization.groupDifferentialQuery=(&amp;amp;(objectclass\=group)(!(modifyTimestamp&amp;lt;\={0})))&lt;BR /&gt;ldap.synchronization.personQuery=(&amp;amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(memberOf\=CN\=Alfresco,CN\=Users,DC\=domain,DC\=Local))&lt;BR /&gt;ldap.synchronization.personDifferentialQuery=(&amp;amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp&amp;lt;\={0}))(memberOf\=CN\=Alfresco,CN\=Users,DC\=domain,DC\=Local))&lt;BR /&gt;ldap.synchronization.groupSearchBase=OU\=ourcomapny,DC\=domain,DC\=Local&lt;BR /&gt;ldap.synchronization.userSearchBase=OU\=ourcompany,DC\=domain,DC\=Local&lt;BR /&gt;ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp&lt;BR /&gt;ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'&lt;BR /&gt;ldap.synchronization.userFirstNameAttributeName=givenName&lt;BR /&gt;ldap.synchronization.userLastNameAttributeName=sn&lt;BR /&gt;ldap.synchronization.userEmailAttributeName=mail&lt;BR /&gt;ldap.synchronization.userOrganizationalIdAttributeName=company&lt;BR /&gt;ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider&lt;BR /&gt;ldap.synchronization.groupType=NoGroup&lt;BR /&gt;ldap.synchronization.personType=user&lt;BR /&gt;ldap.synchronization.groupMemberAttributeName=member&lt;BR /&gt;&lt;SPAN class="line-numbers-rows"&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/CODE&gt;&lt;/PRE&gt;&lt;BR /&gt;&lt;SPAN&gt;From the Logs:&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;PRE class="language-none line-numbers"&gt;&lt;CODE&gt;&lt;BR /&gt;10:08:03,346 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '748'&lt;BR /&gt;10:08:03,376 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 112&lt;BR /&gt;10:08:03,376 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '747'&lt;BR /&gt;10:08:03,395 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 401&lt;BR /&gt;10:08:03,395 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '112'&lt;BR /&gt;10:08:03,431 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '401'&lt;BR /&gt;10:08:03,481 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'AUTH.EXT.ldap1'&lt;BR /&gt;10:08:03,542 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Found 0&lt;BR /&gt;10:08:03,578 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'AUTH.EXT.ldap1'&lt;BR /&gt;10:08:03,578 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 144 user(s) and 0 group(s) processed&lt;BR /&gt;10:12:00,056 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'&lt;BR /&gt;10:12:00,056 WARN&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Forced synchronization with user registry 'ldap1'; some users and groups previously created by synchronization with this user registry may be removed.&lt;BR /&gt;10:12:00,056 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'AUTH.EXT.ldap1'&lt;BR /&gt;10:12:00,260 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 400&lt;BR /&gt;10:12:00,275 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 029&lt;BR /&gt;10:12:00,276 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '400'&lt;BR /&gt;10:12:00,290 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 012&lt;BR /&gt;10:12:00,290 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '029'&lt;BR /&gt;10:12:00,304 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 013&lt;BR /&gt;10:12:00,304 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '012'&lt;BR /&gt;10:12:00,321 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 015&lt;BR /&gt;10:12:00,321 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '013'&lt;BR /&gt;10:12:00,335 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 017&lt;BR /&gt;10:12:00,335 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '015'&lt;BR /&gt;10:12:00,349 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 019&lt;BR /&gt;10:12:00,349 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '017'&lt;BR /&gt;10:12:00,378 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 020&lt;BR /&gt;10:12:00,378 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '019'&lt;BR /&gt;10:12:00,394 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 022&lt;BR /&gt;10:12:00,394 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '020'&lt;BR /&gt;10:12:00,408 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 023&lt;BR /&gt;10:12:00,409 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '022'&lt;BR /&gt;10:12:00,423 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 025&lt;BR /&gt;10:12:00,423 INFO&amp;nbsp; [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user '023'&lt;BR /&gt;10:12:00,438 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Adding user for 028&lt;BR /&gt;&lt;SPAN class="line-numbers-rows"&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;SPAN&gt;‍&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/CODE&gt;&lt;/PRE&gt;&lt;BR /&gt;&lt;SPAN&gt;I’m quite confused about what’s happening here. The log suggests that all AD users are recreated (and consecutively updated) every sync. That shouldn’t be, should it? Is our configuration to authenticate against AD wrong?&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;Best, Raj&lt;/SPAN&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
    <pubDate>Wed, 28 Oct 2009 10:14:35 GMT</pubDate>
    <dc:creator>rajd</dc:creator>
    <dc:date>2009-10-28T10:14:35Z</dc:date>
    <item>
      <title>AD authentication &amp; user properties reset</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225551#M178681</link>
      <description>Hello all,We’re running Alfresco CE 3.2. This installation has been configured to use our Microsoft AD as userbackend. This “kind of” works.Our problem is that the ldap synchronization resets user properties. For example, once a LDAP user is known in Alfresco, we may change the user’s home directory</description>
      <pubDate>Wed, 28 Oct 2009 10:14:35 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225551#M178681</guid>
      <dc:creator>rajd</dc:creator>
      <dc:date>2009-10-28T10:14:35Z</dc:date>
    </item>
    <item>
      <title>Re: AD authentication &amp; user properties reset</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225552#M178682</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;A href="http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem" rel="nofollow noopener noreferrer"&gt;http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem&lt;/A&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Sat, 31 Oct 2009 11:48:00 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225552#M178682</guid>
      <dc:creator>ivan_plestina</dc:creator>
      <dc:date>2009-10-31T11:48:00Z</dc:date>
    </item>
    <item>
      <title>Re: AD authentication &amp; user properties reset</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225553#M178683</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;BLOCKQUOTE class="jive-quote"&gt;&lt;A href="http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem" rel="nofollow noopener noreferrer"&gt;http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem&lt;/A&gt;&lt;/BLOCKQUOTE&gt;&lt;BR /&gt;&lt;SPAN&gt;Hi there Ivan,&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;I'm aware of the online manual. I even read it &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;Is there something in here I should have a look at? For as far as I understand I don't know what should be changed.&lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;Best, Robin&lt;/SPAN&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Mon, 02 Nov 2009 15:31:01 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225553#M178683</guid>
      <dc:creator>rajd</dc:creator>
      <dc:date>2009-11-02T15:31:01Z</dc:date>
    </item>
    <item>
      <title>Re: AD authentication &amp; user properties reset</title>
      <link>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225554#M178684</link>
      <description>&lt;HTML&gt;&lt;HEAD&gt;&lt;/HEAD&gt;&lt;BODY&gt;&lt;SPAN&gt;Well by wiki this:&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;synchronization.synchronizeChangesOnly&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; Should the scheduled sync job run in differential mode? The default is false, which means that the scheduled sync job is run in full mode. Regardless of this setting a differential sync may still be triggered when a user is successfully authenticated who does not yet exist in Alfresco. &lt;/SPAN&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;If the change doesn't work out as expected then it looks like a bug to me…&lt;/SPAN&gt;&lt;/BODY&gt;&lt;/HTML&gt;</description>
      <pubDate>Tue, 03 Nov 2009 14:33:46 GMT</pubDate>
      <guid>https://connect.hyland.com/t5/alfresco-archive/ad-authentication-user-properties-reset/m-p/225554#M178684</guid>
      <dc:creator>ivan_plestina</dc:creator>
      <dc:date>2009-11-03T14:33:46Z</dc:date>
    </item>
  </channel>
</rss>

