topic Re: Two LDAP server setup in Alfresco Archive

Two LDAP server setup

bensewell — Thu, 07 Jul 2011 13:59:50 GMT

Hi I've read through the alfresco wiki and a few related posts but can't seem to nail this one down.Heres the scenario. My Alfresco is working fine through LDAP and local user accounts. I now want it to chain to LDAP1, LDAP2 and then local. I copied the content from the subsystems authentication

Re: Two LDAP server setup

bensewell — Thu, 07 Jul 2011 15:26:16 GMT

So i've been reading further using this article

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Example_2:_Advanced_LDAP_Chain

And i've made a ldap1 and ldap2 folder with the ldap-authentication.properties files. Just editing these to reflect the files in the global configuration for the two servers. Then will these be loaded by default if i take the current user chaining out of the global config file or do i have to reference the two files somehow? I've managed to get some downtime for tomorrow AM.

Cheers

Re: Two LDAP server setup

bensewell — Mon, 11 Jul 2011 09:56:41 GMT

So heres what a tried. I added the settings from the global configuration file for our current LDAP server and added into

/opt/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldap1/ldap-ad-authentication.properties

The contents are as below:

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.userNameFormat=%s@domain1.co.uk
ldap.authentication.allowGuestLogin=false
ldap.authentication.java.naming.provider.url=ldap://ad1.domain1.co.uk:389
ldap.authentication.defaultAdministratorUserNames=alfresco_user
ldap.synchronization.active=false‍‍‍‍‍‍‍

The new LDAP settings for LDAP chaining 2 is saved into the

/opt/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldap2/ldap-ad-authentication.properties

With the same contents but for the the second AD chain:

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.userNameFormat=%s@domain2.co.uk
ldap.authentication.allowGuestLogin=false
ldap.authentication.java.naming.provider.url=ldap://ad1.domain2.co.uk:389
ldap.authentication.defaultAdministratorUserNames=alfresco_user
ldap.synchronization.active=false‍‍‍‍‍‍‍

Then lastly to pull these together in the global configuration file it has the following for the chaining:

[quote]### Authentication settings ###
authentication.chain=ldap1:ldap,ldap2:ldap,alfrescoNtlm1:alfrescoNtlm
ldap.synchronization.active=false[/quote]‍‍‍

If i enter our LDAP 1 server directly into the global config file it works and i can login using a AD account from domain1. However when i take this out i can't login to the system using an account from domain1. If i revert the settings back into the global config i can. Is there something i'm missing here?

Anyone?

Re: Two LDAP server setup

bensewell — Mon, 11 Jul 2011 13:27:03 GMT

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Example_1:_Advanced_AD_Chain

After double checking the wiki i've put the ldap1 and ldap2 folders into the:

/opt/alfresco-3.4.d/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ *ldap1* *ldap2*

I'm going to revert to the modified global config file and restart the services and see if this works.?

Re: Two LDAP server setup

bensewell — Wed, 13 Jul 2011 09:19:21 GMT

So i've nearly got it working now.

The two configs are in the correct folders:
/opt/alfresco-3.4.d/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldap1
/opt/alfresco-3.4.d/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldap2

The ldap1 is working fine and is like below:

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.userNameFormat=%s@domain1.co.uk
ldap.authentication.allowGuestLogin=false
ldap.authentication.java.naming.provider.url=ldap://ad1.domain1.co.uk:389
ldap.authentication.defaultAdministratorUserNames=alfresco_user
ldap.synchronization.active=false

Ldap2 is not working and looks like this:

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.userNameFormat=%sou=Users,dc=domain2,dc=co,dc=uk
ldap.authentication.allowGuestLogin=false
ldap.authentication.java.naming.provider.url=ldap://dc02.domain2.co.uk:389
ldap.synchronization.active=false

The LDAP is working fine on LDAP server one but not on two. I can succesffully talk to the LDAP server using a LDAP browser so i know there's no connectivity issues. So my next attempt is to simplyfy the ldap.authentication.userNameFormat= and try %s@domain2.co.uk

The IT admins told me i need to seach for attribue uid so maybe the config is wrong.

Anyone any more pointers. I know i'm nearly there! :roll:

Re: Two LDAP server setup

bensewell — Wed, 13 Jul 2011 14:33:27 GMT

Further progress here.

So i changed the ldap2 configuration file to be

uid=%s,ou=External,ou=Users,dc=domain1,dc=co,dc=uk

As my testing account is in a OU called External. However i want to include the higher level group like below:

DOMAIN1
—-USERS
———–EXTERNAL
———–GROUP1
———–GROUP2
———–GROUP3

So it works if i add the EXTERNAL but doesnt include all the sub groups when i add the USERS in?

Anyone?

Re: Two LDAP server setup

bensewell — Thu, 21 Jul 2011 13:27:14 GMT

Anyone?

the other things i've thought about. Adding a -s to the string indicates a sub scope and maybe that would work.

uid=%-s,ou=Users,dc=domain1,dc=co,dc=uk

cn=%s,ou=Users,dc=domain1,dc=co,dc=uk