topic Re: Ldap Active Directory Sync in Alfresco Archive

Ldap Active Directory Sync

micdy — Tue, 26 Jan 2010 19:05:27 GMT

Hello,i'm trying to set up AD authentication and sync, the authentication work fine, but synchronisation dont work…i try to fix my problem for days now, but nothing work and dont find my answer in other postHere is my config in : alfresco-global.properties#Authentication chainauthentication.ch

Re: Ldap Active Directory Sync

micdy — Tue, 26 Jan 2010 21:30:50 GMT

woot it work now, i inspire myself from this post : http://forums.alfresco.com/en/viewtopic.php?f=9&t=24552
and now i have my script working..

i post it here if it can help someone.



authentication.chain=passthru1:passthru,ldap1:ldap

ntlm.authentication.sso.enabled=false

passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=DOMAIN\\999.999.999.999
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=Alfresco_user
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true


ldap.authentication.active=false
ldap.synchronization.active=true

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.provider.url=ldap://999.999.999.999:389
ldap.synchronization.java.naming.security.principal=Alfresco_user
ldap.synchronization.java.naming.security.credentials=Alfresco_user_password



ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupQuery=(&(objectclass\=group))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=dc\=domain,dc\=com
ldap.synchronization.userSearchBase=dc\=domain,dc\=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true
synchronization.synchronizeChangesOnly=true

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

it import all users and all groups of the domain
hope it help

Re: Ldap Active Directory Sync

dward — Tue, 02 Feb 2010 11:57:59 GMT

Why did you feel the need to customize all the queries? The default ones should be fine.

Re: Ldap Active Directory Sync

micdy — Tue, 02 Feb 2010 14:44:01 GMT

Because if i only use the default querry, it only synchronise user of type : "InetOrgPerson" from our Active Directory.
it's not what i wanted because InetOrgPerson are external or web users i think, i only wanted users of type "user"

i think InetOrgPerson is the default user in OpenLdap, but i'm not sure.

i have modify it again


ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl:1.2.840.113556.1.4.803:=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl:1.2.840.113556.1.4.803:=512))(!(modifyTimestamp<\={0}))
‍‍‍‍

the reason for adding : (userAccountControl:1.2.840.113556.1.4.803:=512)
is to filter only valid users. i mean before i put this system return me all system users. with this filter i now have only true users