topic Re: Nightmare of a time getting 3.2 to sync LDAP with AD in Alfresco Archive

Nightmare of a time getting 3.2 to sync LDAP with AD

jdalby — Sat, 25 Jul 2009 00:52:29 GMT

I've got passthru auth to work fine, but am having a real problem getting LDAP sync to work with AD (or Novell's eDirectory for that matter). Currently I'm using the alfresco-globel.properties per the documentation, using configuration examples I've found on this site. What is happening now is w

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

dward — Mon, 27 Jul 2009 09:42:16 GMT

I'm sorry Zorkon wasn't able to help.

There appears to be an issue when your LDAP query returns a user called Guest. In this case, Alfresco attempts to delete its own internal Guest user and create a new one. But something is going wrong due to some ACLs referencing this user (shouldn't be a problem). This needs investigating. I have logged a JIRA issue.

https://issues.alfresco.com/jira/browse/ETHREEOH-2574

I noticed you have changed personQuery so that it no longer includes the userAccountControl bitmask that only includes 'real' users. Does it work with the default setting?

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

I also noticed you have mangled personDifferentialQuery so that it doesn't contain enough matching brackets. Again, I would recommend the default query

ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

If this doesn't work, then you could add on a condition that excludes the Guest user. E.g.:

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0}))(!(sAMAccountName=Guest)))

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

lchoonch — Mon, 27 Jul 2009 17:12:44 GMT

Had the same problem except mine has no error messages. it syncs with "creating XYZ users" and restarts again but I don't have any error messages. After a ridiculouly long time (6 hours), it stops with no sync complete message. Checked the users database and no users were imported. Any one else have this problem ? A workaround ?

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

pbkoob — Mon, 27 Jul 2009 21:18:37 GMT

Had the same problem except mine has no error messages. it syncs with "creating XYZ users" and restarts again but I don't have any error messages. After a ridiculouly long time (6 hours), it stops with no sync complete message. Checked the users database and no users were imported. Any one else have this problem ? A workaround ?

Follow the instructions here referring to syncing users but not syncing groups.
http://forums.alfresco.com/en/viewtopic.php?f=9&t=20389&p=67191&hilit=ldap#p67191

I am a little fuzzy on how to get the groups syncing, but this will get you your users.

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

jdalby — Tue, 28 Jul 2009 02:34:41 GMT

Thank you all for the help! By using the query that excludes guest, and following the instructions that disable the group sync I now have my users syncing, much appreciated.

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

lchoonch — Tue, 28 Jul 2009 02:35:49 GMT

Great ! everything works now. Looks like it is the Guest user thats causing the problem. Excluding it will fix the sync. However, my groups are still not syncing properly. Getting a warn message that says it cannot resolve the distinguished name. I think its my ldap properties / filter for my group query. Not syncing the groups allowed my sync to complete at least.

Thanks guys !

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

dward — Tue, 28 Jul 2009 10:24:37 GMT

Due to popular demand, I have committed our latest LDAP performance and diagnostics improvements into HEAD. You can pick these up by checking out the latest code and using the "ant incremental-tomcat" command to build Alfresco as documented here.

http://wiki.alfresco.com/wiki/Development_Environment

Or you could wait for a new community nightly build…

Here's the change comment for revision 15439:


Merged V3.2 to HEAD
   15388: ETHREEOH-1872: Better debug logging in authentication components
      - Now each authentication component logs every step of the authentication process (including reason for failure) if you switch on debug logging for that component or the entire org.alfresco.repo.security.authentication package. E.g.
      log4j.logger.org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl=debug
      log4j.logger.org.alfresco.repo.security.authentication.AuthenticationComponentImpl=debug
      log4j.logger.org.alfresco.repo.security.authentication=debug
   15196: Further LDAP sync performance improvements
      - Bunch user and group creations into small transactions (except for differential sync on login)
      - Run a differential sync on startup (so that bulk of users are not brought over on first login)
      - Can be disabled by synchronization.syncOnStartup property
   15135: Node creation / ACL performance improvements
      - When an ACL was set on a leaf node such as a person, redundant 'shared' ACLs were created for child nodes with getInheritedAccessControlList(), even though no child nodes existed.
      - Now setInheritanceForChildren() makes a 'lazy' call to getInheritedAccessControlList(), only when it realises there are child nodes
   15133: Changes to datasource definition for improved performance
      - Enable caching and reuse of prepared statements (by default 40 for each connection)
      - Removed custom-connection-pool-context.xml.sample and instead introduced complete property set into repository.properties
      - Updated v3.2 Wiki docs http://wiki.alfresco.com/wiki/Database_Configuration#Overriding_the_Database_Connection_Properties
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

pbkoob — Tue, 28 Jul 2009 13:49:05 GMT

Where is the Nightly Community Build?

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

mikeh — Tue, 28 Jul 2009 14:17:43 GMT

http://dev.alfresco.com/downloads/nightly/dist/

Thanks,
Mike

Re: Nightmare of a time getting 3.2 to sync LDAP with AD

dward — Wed, 29 Jul 2009 16:25:58 GMT

FYI the problem with deleting and recreating "Guest" turned out to be one of case sensitivity. A fix for this is now available in HEAD.