Synchronization problem between Alfresco and Windows AD

meeko — Mon, 18 Jan 2010 21:27:28 GMT

I having really weird problem with our Alfresco Installation. I am trying to synchronize only a few user from our Windows AD to Alfresco. I don't need any group to be synchronize. Here what I have inside my configuration right now (tomcat/shared/classes/alfresco-global.properties):authentication.

Re: Synchronization problem between Alfresco and Windows AD

meeko — Tue, 19 Jan 2010 21:50:36 GMT

I now been able to synchronize my user/group correctly. I now have a new problem, everything work fine except that Alfresco do not respect my ldap.synchronization.personQuery value. In the first start, and all synchronize, he will add and update user inside Alfresco, but will let every other user that doesn't match the ldap.synchronization.personQuery log in. And once this user is log in, it create the user locally without copying the information from the LDAP directory. Here my update configuration:


authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru,ldap1:ldap-ad

# CIFS
cifs.domain=domain.org

# AlfrescoNtlm
ntlm.authentication.sso.enabled=false
alfresco.authentication.authenticateCIFS=false
alfresco.authentication.allowGuestLogin=false

# LDAP
ldap.authentication.active=false
ldap.synchronization.active=true

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.provider.url=ldap://ldap01.domain.org:389
ldap.synchronization.java.naming.security.principal=alfresco@domain.org
ldap.synchronization.java.naming.security.credentials=secretpassword

ldap.authentication.userNameFormat=%s@domain.org
ldap.authentication.allowGuestLogin=false

ldap.synchronization.userSearchBase=dc=domain,dc=org
ldap.synchronization.personQuery=(&(objectclass=person)(memberOf=cn\=alfresco-user,ou\=Applications,ou\=Security Groups,dc\=domain,dc\=org))
ldap.synchronization.personDifferentialQuery=(&(objectclass=person)(memberOf=cn\=alfresco-user,ou\=Applications,ou\=Security Groups,dc\=domain,dc\=org)(!(modifyTimestamp<\={0})))
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.personType=person

ldap.synchronization.groupQuery=(&(objectclass=group)(cn=alfresco-user))
ldap.synchronization.groupDifferentialQuery=(&(objectclass=group)(cn=alfresco-user)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou=Applications,ou=Security Groups,dc=domain,dc=org
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupMemberAttributeName=memberOf
ldap.synchronization.groupType=group

ldap.synchronization.queryBatchSize=100

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# Passthru
passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=pslgroup.com\\ldap01.domain.org,ldap02.domain.org
passthru.authentication.authenticateCIFS=true

# Syncronisation
synchronization.synchronizeChangesOnly=false
synchronization.import.cron=0 0 * * * ?
synchronization.syncOnStartup=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

That what append in my log when I user that doesn't match the personQuery log in:


16:30:38,433 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
16:30:38,490 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving groups changed since Jan 19, 2010 2:31:19 PM from user registry 'ldap1'
16:30:38,499 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Commencing batch of 0 entries
16:30:38,499 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Completed batch of 0 entries
16:30:38,502 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving users changed since Jan 18, 2010 9:47:56 AM from user registry 'ldap1'
16:30:38,506 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Commencing batch of 0 entries
16:30:38,514 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Completed batch of 0 entries
16:30:38,517 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
16:30:38,517 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
‍‍‍‍‍‍‍‍‍‍‍

And after that, the user is now log in, but all is information have not been copy (email, company, name…). Can someone tell me what is missing or what is wrong in my configuration?

Re: Synchronization problem between Alfresco and Windows AD

sergio1024 — Thu, 21 Jan 2010 12:55:51 GMT

Hi,

I have the same problem.
If I add users in active directory, they are not imported in Alfresco.

I can open a session in Alfresco with a user AD but its properties (ful name, mail) are not sync…

If you find the solution…

Re: Synchronization problem between Alfresco and Windows AD

meeko — Thu, 21 Jan 2010 15:09:46 GMT

Actually, my last configuration synchronize my users and groups, but it giving access to user that doesn't supposed to have access inside the AD (not part of the personQuery). Just a quick note, make sure you put both personQuery and personDifferencialQuery. Otherwise, Alfresco doesn't seem to know what to do between the first import and the update following.

Re: Synchronization problem between Alfresco and Windows AD

sergio1024 — Fri, 22 Jan 2010 09:13:31 GMT

hi,

Can you post your last config…?

regards.

Re: Synchronization problem between Alfresco and Windows AD

dward — Mon, 25 Jan 2010 17:53:59 GMT

You need to set synchronization.autoCreatePeopleOnLogin=false to lock out people who are not returned by the query.

topic Re: Synchronization problem between Alfresco and Windows AD in Alfresco Archive

Synchronization problem between Alfresco and Windows AD

Re: Synchronization problem between Alfresco and Windows AD

Re: Synchronization problem between Alfresco and Windows AD

Re: Synchronization problem between Alfresco and Windows AD

Re: Synchronization problem between Alfresco and Windows AD

Re: Synchronization problem between Alfresco and Windows AD