topic Re: Timezone issue with LDAP Differential Sync in Alfresco Archive

Timezone issue with LDAP Differential Sync

warren_mcdonald — Thu, 11 Nov 2010 14:14:28 GMT

Hello everyone,we have uncovered an interesting problem with LDAP Sync in Differential mode.In a nutshell, our Alfresco application sees the last Sync datetime in local time but the LDAP server modifyTimestamp value is always in UTC, which is pretty standard.This may not be so much of a problem for

Re: Timezone issue with LDAP Differential Sync

warren_mcdonald — Fri, 12 Nov 2010 01:43:00 GMT

Looks like I was looking in the wrong domain.

The answer should be to add the offset to the LDAP query.

(!(modifyTimestamp<={0}+1000)

I don't know if i need to escape the + for this expression to be valid in a properties file.

I will try and see what happens

Warren

Re: Timezone issue with LDAP Differential Sync

warren_mcdonald — Sat, 13 Nov 2010 09:32:11 GMT

Well the answer to being a valid syntax seems to be no

I tried to include the offset in the config as above but get bad results returned.

I will have to trace the LDAP calls to see what is actually being sent to the LDAP server.

Any other ideas?

Warren

Re: Timezone issue with LDAP Differential Sync

sasquatch58 — Sun, 14 Nov 2010 07:30:59 GMT

Hello Warren,
Perhaps the problem is a client time zone not correctly set. Important to keep time in sync with NTP server and user locale to satisfy the user.
If Alfresco server is also set the same way, all server/ user times are synched to UTC.Ldap shouldn't be as fussy with time as is Kerberos or AD.
Mind you I'm still tying down Ldap on our servers and also separate dev/ test system so might have to change my comments later.
Cheers, Sasquatch

Re: Timezone issue with LDAP Differential Sync

warren_mcdonald — Sun, 14 Nov 2010 11:23:08 GMT

Hi Sasquatch,

there is no user client in involved in these transactions. The LDAP entries are updated by other systems. Then Alfresco sync runs to get the entries modified since last sync.

Alfresco server sends last sync date in LDAP query as local time. The LDAP server (with an expressed offset) expects this to be UTC time. In our situation we are 10 hours ahead of UTC so no entries are ever returned if we sync within 10 hours. If we sync every 24 hours we still lose LDAP modifications for 11 hours of the day. Our members can update personal details online, so changes could occur any time.

My specific issue is how to put the time offset expression in to the alfresco ldap subsystem properties file so they will work. If I include the offset the LDAP sync process complains about invalid results. So I am assuming including the offset is not working as expected. I can use the modifyTimetamp offset in an ldapsearch command line and get results returned as expected.

I am assuming in the expression (!(modifyTimestamp<={0})) that {0} is something like arg0 supplied to the query. So I have used (!(modifyTimestamp<\={0}+1000)) to include the offset. I have also tried (!(modifyTimestamp<\={0}\+1000)).

Cheers,

Warren

Re: Timezone issue with LDAP Differential Sync

bopolissimus — Tue, 12 Mar 2013 03:25:56 GMT

This is an old post so Warren has probably resolved his issue in the meantime. I ran into this recently though (I'm in NZ, even further past UTC than Warren ;-).

Using alfresco 4.2.c community and an LDAP that returns modifyTimestamp in

ldap.synchronization.timestampFormat=yyyyMMddHHmmss.SSSSSS

format.

In my own case, new users (even those created weeks previously) were not being synced.

Setting the following (adding +1300 [or whatever your timezone offset is] now allows differential sync to work (although I'm not clear on what will happen if I forget to change the offset when NZDT changes to NZST and back again).

ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0}+1300)))

I didn't test with old version of alfresco, but the above works with 4.2.c Community.