topic Re: Sync problem (?) with Active Directory in Alfresco Archive

Sync problem (?) with Active Directory

lchoonch — Thu, 23 Jul 2009 09:32:28 GMT

I'm new to Alfresco and just spent the last week configuring Alfresco 3.2. I use AD and I am experiencing a problem with the synchronization with AD. Every time my AD user logs in, Alfresco creates all the users. Is the normal behaviour ? My configuration is ldap.authentication.active=falseldap.

Re: Sync problem (?) with Active Directory

jbaldo — Fri, 31 Jul 2009 19:41:12 GMT

Maybe you've resolved this by now, but when an unknown user attempts to login and is authenticated, it triggers a sync. Your config is attempting to do a sync at this location:

ldap.synchronization.userSearchBase=cn\=Users,dc\=myhome,dc\=net

I think by default it attempts to add the first 1000 users.

You can narrow the scope by adding a query string which only selects users with certain attributes:

ldap.synchronization.personDifferentialQuery
The query to select objects that represent the users to export that have changed since a certain time. Should use the placeholder {0} in place of a timestamp in the format specified by ldap.synchronization.timestampFormat. The timestamp substituted will be the maximum value of the attribute named by ldap.synchronization.modifyTimestampAttributeName the last time users were queried. This query is used in 'differential sync mode', which by default is triggered whenever a user is successfully authenticated that does not yet exist in Alfresco. See The Synchronization Subsystem.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

Re: Sync problem (?) with Active Directory

lchoonch — Sun, 02 Aug 2009 07:18:46 GMT

thank you I manage to resolve this. It is as you said the ldap syncs on login if the user has not been created. This was not the only problem. Narrowing the sync query AND also excluding the Guest user ( I am using AD ) fixed the problem for me.

Re: Sync problem (?) with Active Directory

dward — Mon, 03 Aug 2009 09:43:43 GMT

FYI it queries in batches of 1000 users at a time but is not restricted to 1000 users. It just uses multiple round-trips to the LDAP server to retrieve the users. This is controlled by:

ldap.synchronization.queryBatchSize