topic 3.4.d Community / Centos 5.5 x64 LDAP Sync in Alfresco Archive

3.4.d Community / Centos 5.5 x64 LDAP Sync

bensewell — Fri, 06 May 2011 16:15:53 GMT

Hi,Been trawling through various blogs, forum entries and the Alfresco wiki for the past few days and think I understand how the Alfresco LDAP sync works. I have the system working fine logging users on through AD rather than using the local ntml accounts. So this will stop using AD as a ondemand

Re: 3.4.d Community / Centos 5.5 x64 LDAP Sync

bensewell — Mon, 09 May 2011 15:05:41 GMT

Had a look at this again with fresh eyes and think the LDAP query might have been wrong. I used a freebie tool to run a few scripts off against our AD and found a group that i can use to test called "IT Admins". The LDAP data is below i've starred any private information:

>> Dn: CN=IT Admins,OU=Information Technology,OU=Information Management & Technology Directorate,DC=***,DC=***,DC=***
   2> objectClass: top; group;
   1> cn: IT Admins;
   1> description: IT Department Administrators;
   1> distinguishedName: CN=IT Admins,OU=Information Technology,OU=Information Management & Technology Directorate,dc\=***,dc\=***,dc\=uk;
   1> name: IT Admins;
   1> canonicalName: ***.***.**/Information Management & Technology Directorate/Information Technology/IT Admins;

So I revisited config file and made ammendments. Itt looks something like this now I stripped all the comments out so the settings ar e easier t osee.

    ldap.authentication.active=false
    ldap.authentication.java.naming.security.authentication=simple
    ldap.synchronization.active=true
    ldap.authentication.userNameFormat=%s******
    ldap.authentication.allowGuestLogin=false
    ldap.authentication.java.naming.provider.url=ldap://ad1.*****.uk:389
    ldap.synchronization.java.naming.security.principal=sewellb@****.uk
    ldap.synchronization.java.naming.security.credentials=*****
    ldap.synchronization.queryBatchSize=500

   ldap.synchronization.groupQuery=(&(objectclass\=group)(memberOf\=cn\=IT Admins,ou\=Information Technology,ou\=Information Management & Technology Directorate,dc\=***,dc\=***,dc\=uk))

    ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(memberOf\=cn\=IT Admins,ou\=Information Technology,ou\=Information Management & Technology Directorate,dc\=***,dc\=***,dc\=uk)(!(modifyTimestamp<\={0})))

    ldap.synchronization.personQuery=(&(objectclass\=user)(|(memberOf\=CN\=IT Admins,OU\=Information Technology,ou\=Information Management & Technology Directorate,
dc\=***,dc\=***,dc\=uk)(memberOf\=CN\=IT Admins,OU\=Information Technology,ou\=Information Management & Technology Directorate, dc\=***,dc\=***,dc\=uk))(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

    ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(|(memberOf\=CN\=IT Admins,ou\=Information Technology,ou\=Information Management & Technology Directorate,dc\=***,dc\=***,dc\=uk(memberOf\=CN\=IT Admins,ou\=Information Technology,ou\=Information Management & Technology Directorate,dc\=****,dc\=***,dc\=***,dc\=uk))(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

    ldap.synchronization.groupSearchBase= dc\=***,dc\=***,dc\=uk
    ldap.synchronization.userSearchBase=dc\=***,dc\=***,dc\=uk
    ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
    ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
    ldap.synchronization.userIdAttributeName=sAMAccountName
    ldap.synchronization.userFirstNameAttributeName=givenName
    ldap.synchronization.userLastNameAttributeName=sn
    ldap.synchronization.userEmailAttributeName=mail
    ldap.synchronization.userOrganizationalIdAttributeName=company
    ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
    ldap.synchronization.groupIdAttributeName=cn
    ldap.synchronization.groupType=group
    ldap.synchronization.personType=user
    ldap.synchronization.groupMemberAttributeName=member
    synchronization.synchronizeChangesOnly=false

Is this looking closer?

Re: 3.4.d Community / Centos 5.5 x64 LDAP Sync

bensewell — Tue, 10 May 2011 09:17:04 GMT

Just checked a few of the logs:

Have these errors in the catalina.out file:

08:51:24,773 ERROR [authentication.ldap.LDAPInitialDirContextFactoryImpl] Unable to connect to LDAP Server; check LDAP configuration

javax.naming.CommunicationException: openldap.domain.com:389 [Root exception is java.net.UnknownHostException: openldap.domain.com]

08:52:00,778 ERROR [web.context.ContextLoader] Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'syncTrigger' defined in file [/opt/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Synchronization/default/default-synchronization-context.xml]: Invocation of init method failed; nested exception is java.text.ParseException: Unexpected character: $

WARN : org.alfresco.wcm.client.util.impl.GuestSessionFactoryImpl - WQS unable to connect to repository: Not Found

Re: 3.4.d Community / Centos 5.5 x64 LDAP Sync

bensewell — Tue, 10 May 2011 09:35:55 GMT

My default-synchronization-context.xml file is:

I'm trying my best to crack this by the end of today

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
    <!–
        Job definition to import people and groups from one or more external user registries in the authentication chain
        (e.g. LDAP directory)
    –>

    <bean id="syncTrigger" class="org.alfresco.util.CronTriggerBean">
        <property name="jobDetail">
            <bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.security.sync.UserRegistrySynchronizerJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="userRegistrySynchronizer">
                            <ref bean="userRegistrySynchronizer" />
                        </entry>
                        <entry key="synchronizeChangesOnly">
                            <value>${synchronization.synchronizeChangesOnly}</value>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <property name="cronExpression">
            <value>${synchronization.import.cron}</value>
        </property>
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
    </bean>

    <!– The chaining user registry synchronizer –>
    <bean id="userRegistrySynchronizer" class="org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer">
        <property name="syncWhenMissingPeopleLogIn">
            <value>${synchronization.syncWhenMissingPeopleLogIn}</value>
        </property>
        <property name="syncOnStartup">
            <value>${synchronization.syncOnStartup}</value>
        </property>
        <property name="autoCreatePeopleOnLogin">
            <value>${synchronization.autoCreatePeopleOnLogin}</value>
        </property>
        <property name="authorityService">
            <ref bean="authorityService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="attributeService">
            <ref bean="attributeService" />
        </property>
        <property name="applicationContextManager">
            <ref bean="Authentication" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
        <property name="ruleService">
            <ref bean="ruleService" />
        </property>
        <property name="jobLockService">
            <ref bean="jobLockService" />
        </property>
        <property name="sourceBeanName">
            <value>userRegistry</value>
        </property>
        <property name="loggingInterval">
            <value>${synchronization.loggingInterval}</value>
        </property>
        <property name="workerThreads">
            <value>${synchronization.workerThreads}</value>
        </property>
    </bean>


</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: 3.4.d Community / Centos 5.5 x64 LDAP Sync

mouradef — Fri, 13 May 2011 14:25:50 GMT

Hello,
Perhaps you already find solution, but my experience is that synchronization.*.* attributes (like synchronization.synchronizeChangesOnly) are taken into account only if located in alfresco-global.properties.

At first i have put this in ldap-ad-authetification.properties but no sychronization at all
putting this in alfresco-global.properties with cron attribute resolved my problem

hope this will help