ldap-ad sync problem

jjscampos — Fri, 17 Jun 2011 13:51:37 GMT

I'm trying for a week now to configure alfresco authentication e sync to AD. I only can authenticate users by now. I can't figure out way sync does not work… allways tells me "Synchronization aborted due to error 05170000 Unable to connect to LDAP Server; check LDAP configuration"ldap-ad-authenticat

Re: ldap-ad sync problem

valter_85 — Fri, 20 Jul 2012 15:19:11 GMT

hi,

I'm having the same problem and I also can't sync the users, when I try to login into alfresco, it shows that the user is Unable to login - unknown username/password.
I've changed the properties according to the documentation, but it just don't work.
Does anyone know what could be wrong??

Thanks in advance.

valter

Re: ldap-ad sync problem

dgcupit — Wed, 23 Dec 2015 18:49:52 GMT

Hopefully someone will see this and offer some help, since it tells me I cannot start my own thread.

Basically, using the 5.0 build, I can't seem to get LDAP Sync or Passthru to work.

It seems to be authenticating users from AD, but no info syncs, and the error in the log is not very helpful.

I've done a lot of searches thru the forms, and the biggest issue I'm finding is that there's seems to be no one single 'How-To' for AD. I find suggestions that offer suggestions in direct conflict with other's directions, or are done in what seems to be a completely different manner, and the bulk of the results of my searches are for older versions, and not 5.x

Here's my global config, covering the entire Auth configuration. I've substituted the domain HELPME for my actual domain. I realize this looks very bloated, but this is putting together everyone's suggestion for why it's not working, as found in other's posts asking for help:

#Authentication settings
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,passthru1assthru
ntlm.authentication.sso.enabled=false

### CIFS/SMB Server Configuration ###
cifs.enabled=true
cifs.domain=ld.local
cifs.serverName=${localname}A
cifs.hostannounce=true

#CIFS with LDAP We have to use passthru for CIFS due to limitations in how cifs has to authenticate
ntlm.authentication.authenticateCIFS=false
#Must be disabled to allow chained password-based login
ntlm.authentication.sso.enabled=false

alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false

passthru.authentication.authenticateCIFS=true
passthru.authentication.useLocalServer=false
passthru.authentication.domain=HELPME.org
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=admin,administrator
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP,NETBIOS
passthru.authentication.servers=HELPME.org\\SVR-001-DC01,HELPME.org\\SVR-002-DC01,SVR-003-DC01
passthru.authentication.offlineCheckInterval=300

#LDAP authentication
ldap.authentication.userNameFormat=cn=%s,ou=facilities,ou=users,dc=HELPME,dc=org
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.security.authentication=SIMPLE
ldap.authentication.java.naming.security.principal=cn=alfresco,dc=HELPME,dc=org
ldap.authentication.java.naming.security.credentials=APassword
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@HELPME.org
ldap.authentication.java.naming.provider.url=ldap://SVR-001-DC01.HELPME.org:389
ldap.authentication.defaultAdministratorUserNames=admin,administrator
ldap.authentication.active=false
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=alfresco@HELPME.Org
ldap.synchronization.java.naming.security.credentials=APassword
ldap.synchronization.groupSearchBase=OU=Security_Groups,OU=HELPME,DC=Org
ldap.synchronization.userSearchBase=OU=Facilities,OU=Users,DC=HELPME,DC=Org

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member

synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false

I have verified that the AD/LDAP account 'alfresco' can read/view any user in AD using the tool Softerra LDAP Browser 4.5, and the account can fully roam the AD. It is a member of 'Domain Users' only.

When the app is started, I'm presented with the login prompt, so Passthru isn't working.

I can enter my AD ID/PW and it does log me in, but all profile info is blank, and of course it shows my login ID and not my common name.

This is the error / reason in the log when AD Sync tries to kick in:

2015-12-24 00:23:52,504 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reasonrg:389

Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]

Caused by: java.net.UnknownHostException: org

2015-12-24 00:23:52,692 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reasonrg:389

Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]

Caused by: java.net.UnknownHostException: org

2015-12-24 00:23:52,692 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Failed initial synchronize with user registries
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reasonrg:389

Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]

Caused by: java.net.UnknownHostException: org

2015-12-24 00:23:52,692 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete

Re: ldap-ad sync problem

xarope — Thu, 24 Dec 2015 07:31:25 GMT

Seems like your first error is:


2015-12-24 00:23:52,504 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason:org:389

Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
‍‍‍‍‍‍

In case it's a hostname/DNS lookup issue, have you tried using an IP address rather than the FQDN here?


ldap.authentication.java.naming.provider.url=ldap://SVR-001-DC01.HELPME.org:389
‍‍‍

Re: ldap-ad sync problem

xarope — Thu, 24 Dec 2015 07:43:28 GMT

jjscampos, your filter looks like it's missing a closing ")", as well as the "\" to escape the "="


ldap.synchronization.personQuery=(&(objectclass=user)
‍‍‍

And assuming you intentionally want to leave out the clause which excludes AD users who are not active, then you can/should remove the remaining "&". So it should just look like this:


ldap.synchronization.personQuery=(objectclass\=user)
‍‍‍

Re: ldap-ad sync problem

xarope — Thu, 24 Dec 2015 07:46:08 GMT

dgcupit, your error seems to be "UnknownHostException":


2015-12-24 00:23:52,504 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason:org:389

Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]

Caused by: java.net.UnknownHostException: org
‍‍‍‍‍‍‍‍

Have you tried using an IP address here, in case it's a hostname/DNS lookup issue? e.g. if the IP for your LDAP server is 10.10.10.1:


ldap.authentication.java.naming.provider.url=ldap://10.10.10.1:389
‍‍‍

topic Re: ldap-ad sync problem in Alfresco Archive

ldap-ad sync problem

Re: ldap-ad sync problem

Re: ldap-ad sync problem

Re: ldap-ad sync problem

Re: ldap-ad sync problem

Re: ldap-ad sync problem