topic LDAP authentication to Lion Server Open Directory in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267678#M220808 <HTML><HEAD></HEAD><BODY><SPAN>Environment: Alfresco 4.0d using the mac installer on a Lion Server (10.7.3), using the built-in Postgresql server to host the database.</SPAN><BR /><BR /><SPAN>The ldap setup is a little different for Apple's version of OpenLDAP. I'm posting my config file here in case it saves anyone time.</SPAN><BR /><BR /><SPAN>1. you need to setup chaining in /Applications/alfresco-4.0.d/tomcat/shared/classes/alfresco-global.properties</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>### Authentication Chain ###<BR />authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>I also turned on debugging to see how ldap was working</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE>### Debug lines ###<BR />log4.logger.org.alfresco.repo.security.authentication.ldap=debug <SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>2. Modify /Applications/alfresco-4.0.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap/ldap-authentication.properties so it looks like:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE># This flag enables use of this LDAP subsystem for authentication. It may be<BR /># that this subsytem should only be used for synchronization, in which case<BR /># this flag should be set to false.<BR />ldap.authentication.active=true<BR /><BR />#<BR /># This properties file brings together the common options for LDAP authentication rather than editing the bean definitions<BR />#<BR />ldap.authentication.allowGuestLogin=true<BR /># How to map the user id entered by the user to that passed through to LDAP<BR /># - simple <BR />#&nbsp;&nbsp;&nbsp; - this must be a DN and would be something like<BR />#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; uid=%s,ou=People,dc=company,dc=com<BR /># - digest<BR />#&nbsp;&nbsp;&nbsp; - usually pass through what is entered<BR />#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s<BR /># If not set, an LDAP query involving ldap.synchronization.personQuery and ldap.synchronization.userIdAttributeName will <BR /># be performed to resolve the DN dynamically. This allows directories to be structured and doesn't require the user ID to<BR /># appear in the DN.<BR />ldap.authentication.userNameFormat=uid=%s,cn=users,dc=domain,dc=com<BR />#ldap.authentication.userNameFormat=%s<BR /><BR /># The LDAP context factory to use<BR />ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory<BR /><BR /># The URL to connect to the LDAP server <BR />ldap.authentication.java.naming.provider.url=ldap://&lt;myldapserver&gt;:389<BR /><BR /># The authentication mechanism to use for password validation<BR />ldap.authentication.java.naming.security.authentication=simple<BR /><BR /># Escape commas entered by the user at bind time<BR /># Useful when using simple authentication and the CN is part of the DN and contains commas<BR />ldap.authentication.escapeCommasInBind=false<BR /><BR /># Escape commas entered by the user when setting the authenticated user<BR /># Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is <BR /># pulled in as part of an LDAP sync<BR /># If this option is set to true it will break the default home folder provider as space names can not contain \<BR />ldap.authentication.escapeCommasInUid=false<BR /><BR /># Comma separated list of user names who should be considered administrators by default<BR />ldap.authentication.defaultAdministratorUserNames=localadmin,admin<BR /><BR /># This flag enables use of this LDAP subsystem for user and group<BR /># synchronization. It may be that this subsytem should only be used for <BR /># authentication, in which case this flag should be set to false.<BR />ldap.synchronization.active=false<BR /><BR /># The authentication mechanism to use for synchronization<BR />ldap.synchronization.java.naming.security.authentication=none<BR /><BR /># The default principal to use (only used for LDAP sync)<BR />ldap.synchronization.java.naming.security.principal=<BR /><BR /># The password for the default principal (only used for LDAP sync)<BR />ldap.synchronization.java.naming.security.credentials=<BR /><BR /># If positive, this property indicates that RFC 2696 paged results should be<BR /># used to split query results into batches of the specified size. This<BR /># overcomes any size limits imposed by the LDAP server.<BR />ldap.synchronization.queryBatchSize=0<BR /><BR /># If positive, this property indicates that range retrieval should be used to fetch<BR /># multi-valued attributes (such as member) in batches of the specified size.<BR /># Overcomes any size limits imposed by Active Directory.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR />ldap.synchronization.attributeBatchSize=0<BR /><BR /># The query to select all objects that represent the groups to import.<BR />ldap.synchronization.groupQuery=(objectclass\=groupOfNames)<BR /><BR /># The query to select objects that represent the groups to import that have changed since a certain time.<BR />ldap.synchronization.groupDifferentialQuery=(&amp;(objectclass\=groupOfNames)(!(modifyTimestamp&lt;\={0})))<BR /><BR /># The query to select all objects that represent the users to import.<BR />ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)<BR /><BR /># The query to select objects that represent the users to import that have changed since a certain time.<BR />ldap.synchronization.personDifferentialQuery=(&amp;(objectclass\=inetOrgPerson)(!(modifyTimestamp&lt;\={0})))<BR /><BR /># The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.<BR />ldap.synchronization.groupSearchBase=cn\=groups,dc\=domain,dc\=com<BR /><BR /># The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.<BR />ldap.synchronization.userSearchBase=cn\=users,dc\=domain,dc\=com<BR /><BR /># The name of the operational attribute recording the last update time for a group or user.<BR />ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp<BR /><BR /># The timestamp format. Unfortunately, this varies between directory servers.<BR />ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'<BR /><BR /># The attribute name on people objects found in LDAP to use as the uid in Alfresco<BR />ldap.synchronization.userIdAttributeName=uid<BR /><BR /># The attribute on person objects in LDAP to map to the first name property in Alfresco<BR />ldap.synchronization.userFirstNameAttributeName=givenName<BR /><BR /># The attribute on person objects in LDAP to map to the last name property in Alfresco<BR />ldap.synchronization.userLastNameAttributeName=sn<BR /><BR /># The attribute on person objects in LDAP to map to the email property in Alfresco<BR />ldap.synchronization.userEmailAttributeName=mail<BR /><BR /># The attribute on person objects in LDAP to map to the organizational id&nbsp; property in Alfresco<BR />ldap.synchronization.userOrganizationalIdAttributeName=o<BR /><BR /># The default home folder provider to use for people created via LDAP import<BR />ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider<BR /><BR /># The attribute on LDAP group objects to map to the authority name property in Alfresco<BR />ldap.synchronization.groupIdAttributeName=cn<BR /><BR /># The attribute on LDAP group objects to map to the authority display name property in Alfresco<BR />ldap.synchronization.groupDisplayNameAttributeName=apple-group-realname<BR /><BR /># The group type in LDAP<BR />ldap.synchronization.groupType=groupOfNames<BR /><BR /># The person type in LDAP<BR />ldap.synchronization.personType=users<BR /><BR /># The attribute in LDAP on group objects that defines the DN for its members<BR />ldap.synchronization.groupMemberAttributeName=memberUid<BR /><BR /># If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.<BR />ldap.synchronization.enableProgressEstimation=true<SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><SPAN>Note: I'm not currently synchronising, that's for later.</SPAN><BR /><BR /><SPAN>Hope this helps.</SPAN></BODY></HTML> Fri, 04 May 2012 17:28:12 GMT peterglock 2012-05-04T17:28:12Z LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267678#M220808 Environment: Alfresco 4.0d using the mac installer on a Lion Server (10.7.3), using the built-in Postgresql server to host the database.The ldap setup is a little different for Apple's version of OpenLDAP. I'm posting my config file here in case it saves anyone time.1. you need to setup chaining in Fri, 04 May 2012 17:28:12 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267678#M220808 peterglock 2012-05-04T17:28:12Z Re: LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267679#M220809 <HTML><HEAD></HEAD><BODY><SPAN>i've been beating my head against my keyboard trying to get my Alfresco to LDAP authenticate against my OSX server.&nbsp; its running mountain lion server, but shouldn't be too much different from your Lion server… but yet, i cannot get it to use the local OSX server for authentication…</SPAN><BR /><BR /><SPAN>i suspect i'm doing something wrong, as i'm not even getting any sort of debug logging for the authentication attempt.&nbsp; everything you posted i did, other than changing the domain info to the appropriate settings for my server…</SPAN><BR /><BR /><SPAN>any ideas?</SPAN><BR /><BR /><SPAN>-spike</SPAN></BODY></HTML> Sat, 18 Aug 2012 06:46:06 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267679#M220809 spike 2012-08-18T06:46:06Z Re: LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267680#M220810 <HTML><HEAD></HEAD><BODY><SPAN>I have the same problem. I'm using the latest alfresco community 4.2b, tried it on 4.2a also. Probably I'm doing it all wrong.</SPAN></BODY></HTML> Sun, 28 Oct 2012 19:34:10 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267680#M220810 dagrafica 2012-10-28T19:34:10Z Re: LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267681#M220811 <HTML><HEAD></HEAD><BODY><SPAN>I have just set up a dev environment for mountain lion server so will test over the next week.</SPAN></BODY></HTML> Fri, 02 Nov 2012 18:07:03 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267681#M220811 peterglock 2012-11-02T18:07:03Z Re: LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267682#M220812 <HTML><HEAD></HEAD><BODY><SPAN>OK, I tried copying my configuration from Alfresco 4.0d over to 4.2 but can't get it to authenticate. Will continue to work on this and report back.</SPAN></BODY></HTML> Sun, 11 Nov 2012 12:03:29 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267682#M220812 peterglock 2012-11-11T12:03:29Z Re: LDAP authentication to Lion Server Open Directory https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267683#M220813 <HTML><HEAD></HEAD><BODY><SPAN>For those following this thread, take a look at </SPAN><A href="https://forums.alfresco.com/en/viewtopic.php?f=57&amp;t=47076#p139654" rel="nofollow noopener noreferrer">https://forums.alfresco.com/en/viewtopic.php?f=57&amp;t=47076#p139654</A></BODY></HTML> Mon, 12 Nov 2012 20:32:47 GMT https://connect.hyland.com/t5/alfresco-archive/ldap-authentication-to-lion-server-open-directory/m-p/267683#M220813 peterglock 2012-11-12T20:32:47Z