topic Re: LDAP (AD) Account inheritance question in Alfresco Archive

LDAP (AD) Account inheritance question

sjordi — Mon, 25 Jun 2012 08:30:22 GMT

HI,We're currently integrating our Alfresco with LDAP through an active directory.The problem we face is that once synchronized, it actually creates the 4,000+ account at once.Then everybody can connect.Is there a way to avoid this?We'd like to allow only specific persons, defined in groups, to conn

Re: LDAP (AD) Account inheritance question

afaust — Fri, 10 Aug 2012 20:36:00 GMT

Hello,

depending on your layout within the LDAP (AD) and your ability to express the conditions in an LDAP query, you can select the people that are being synchronized by configuring the ldap.synchronization.personQuery and ldap.synchronization.personDifferentialQuery (http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2).

Regards
Axel

Re: LDAP (AD) Account inheritance question

sjordi — Mon, 13 Aug 2012 12:27:08 GMT

Ok we found a way to avoid creating everything, but we still struggle with the queries in order to try to get info from groups.

The idea is to have a group called Applications->Alfresco->DNP
In this one we have three groups: DNP-Admin, DNP-Manager, DNP-Read
We have set persons in each group.
When Alfresco syncs, it sees the three groups but says that the users don't have the right distinguished names.
It has the correct name, so this means that it correctly sees who is in which group, but still it doesn't use it.
Here is the error
Failed to resolve member of group 'GG-DNP-Admin' with distinguished name: CN=Jordi,OU=DSIC,OU=VILLE-GE,DC=activedir,DC=ville-geneve,DC=ch

Our queries are as follows:
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimeStamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimeStamp<\={0})))
ldap.synchronization.groupSearchBase=ou\=Alfresco,ou\=Applications,dc\=activedir,dc\=ville-geneve,dc\=ch
ldap.synchronization.userSearchBase=ou\=Alfresco,ou\=Applications,dc\=activedir,dc\=ville-geneve,dc\=ch
ldap.synchronization.modifyTimestampAttributeName=modifyTimeStamp

Any idea?
Thanks for your help.
Steve