topic Re: LDAP sync doesn't work in 3.4d in Alfresco Archive

LDAP sync doesn't work in 3.4d

durrell — Sat, 12 Mar 2011 04:06:49 GMT

I've been using the same LDAP config since 3.1 and it has always worked. All of a sudden in 3.4d it errors out at startup and gives the following error:22:59:34,168 Userystem INFO [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap-ad1'22:59:34

Re: LDAP sync doesn't work in 3.4d

gnyce — Sat, 12 Mar 2011 21:28:31 GMT

Don't use AD, so not sure I can help, but this seems to be the culprit, no?

Caused by: javax.naming.AuthenticationNotSupportedException: ${ldap.synchronization.java.naming.security.authentication}
at com.sun.jndi.ldap.sasl.LdapSasl.saslBind(LdapSasl.java:100)

That suggests to me that your Alfresco was unable to get (negotiate?) an authentication (or encryption) scheme with your AD server, thus not able to authenticate, thus could not sync accounts….

But then again, I could be quite wrong

EDIT: should add that we are syncing against OpenLDAP with 3.4.c no problem, but have not tried it in 3.4.d yet. Will have to now that you've thrown up the caution flag.

Re: LDAP sync doesn't work in 3.4d

durrell — Sat, 12 Mar 2011 22:01:50 GMT

Thanks for the reply.

Yeah, I saw that in the log and figured it was the issue. My question is: what changed in 3.4 that would cause that error?

Re: LDAP sync doesn't work in 3.4d

gnyce — Mon, 14 Mar 2011 12:35:57 GMT

Not sure - maybe for a sanity check, try ldapsearch against your AD with SASL encryption on, make sure all is well there? For me, in ldap-authentication.properties:

# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple

http://download.oracle.com/javase/jndi/tutorial/ldap/security/ldap.html and http://download.oracle.com/javase/jndi/tutorial/ldap/security/auth.html seem to indicate that you could try another auth scheme besides simple (e.g. password in the clear). Also see http://download.oracle.com/javase/jndi/tutorial/ldap/security/sasl.html

At http://forums.alfresco.com/en/viewtopic.php?t=11312 they used Digest-MD5.

Good luck, post what you find out.

Re: LDAP sync doesn't work in 3.4d

excitedbynoise — Mon, 14 Mar 2011 14:08:54 GMT

I just moved to 3.4d recently and I think I am having the same issue. Which log file are you looking at for those errors? My alfresco.log has almost nothing in it. It's really odd. All my users disappeared suddenly, so I am trying to figure out the cause.

Re: LDAP sync doesn't work in 3.4d

durrell — Mon, 14 Mar 2011 14:37:23 GMT

I always use the Tomcat log.

alfresco_dir/tomcat/logs/catalina.out assuming you used a standard install with Tomcat included.

Re: LDAP sync doesn't work in 3.4d

gnyce — Mon, 14 Mar 2011 17:31:17 GMT

FWIW, just tested, the ldap sync seems to work fine in 3.4.d against OpenLDAP.

Re: LDAP sync doesn't work in 3.4d

durrell — Mon, 14 Mar 2011 17:34:49 GMT

Interesting. Hoping one of the Alfresco engineers can look into it for me. My 3.3g install is still working fine.

Thanks for the suggestions.

Re: LDAP sync doesn't work in 3.4d

durrell — Wed, 16 Mar 2011 03:41:45 GMT

Well it's looking like I'm going to have to go down in version until I can find a version that works. I can't believe this isn't a bigger issue than it is. I can't find anything wrong with my configuration. I'm stumped.

Re: LDAP sync doesn't work in 3.4d

gnyce — Thu, 17 Mar 2011 00:41:33 GMT

Sorry, no help here with AD. I assume you tried this http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#How_do_I_find_out_what_Simple_Authentication_and_Security_Layer_.28SASL.29_authentication_mechanisms_my_LDAP_server_supports.3F? (although I dont' know if this is specific to openldap or not.

Another dumb question - which 3.4.d are you using? They have a newer "3.4.d" in the nightly-builds, from Mar 1. http://dev.alfresco.com/downloads/nightly/dist/ And did you look through JIRA for any tickets?

Re: LDAP sync doesn't work in 3.4d

durrell — Sat, 19 Mar 2011 16:06:05 GMT

I don't know what the difference between 3.4c and 3.4d is, but moving to 3.4c fixed the problem. It's a shame I can't use the most recent release, but oh well.

Re: LDAP sync doesn't work in 3.4d

loftux — Sun, 20 Mar 2011 17:26:44 GMT

For what I can see there are no changes to ldap sync from 3.4.c r24574 to 3.4.d r25020
http://fisheye.alfresco.com/browse/alfresco_open_mirror/alfresco/HEAD/root/projects/repository/config/alfresco/subsystems/Authentication/common-ldap-context.xml#r22725
http://fisheye.alfresco.com/changelog/alfresco_open_mirror/alfresco/HEAD/root/projects/repository/source/java/org/alfresco/repo/security/sync

So 3.4.d should work for you if you can get it to work with 3.4.c, I'm not seeing any problems with ldap sync with a microsoft AD in 3.4.d in the installations I manage.

Re: LDAP sync doesn't work in 3.4d

durrell — Sun, 20 Mar 2011 17:38:20 GMT

I'm wondering if there was a difference in Java versions between the 3.4c and 3.4d installers that could've caused this behavior? I can't think of anything else.

Re: LDAP sync doesn't work in 3.4d

loftux — Sun, 20 Mar 2011 18:02:43 GMT

Just replace alfresco.war and share.war on your 3.4.c install with the 3.4.d version, then you are running the exact same config and java versions.
Download alfresco-community-3.4.d.zip from http://wiki.alfresco.com/wiki/Community_file_list_3.4.d and you can extract them from that zip.

Re: LDAP sync doesn't work in 3.4d

durrell — Sun, 20 Mar 2011 18:10:46 GMT

Well I didn't even think of that. Thanks for the suggestion.

EDIT: Good call. That worked.

Re: LDAP sync doesn't work in 3.4d

pnavinkumar — Mon, 04 Apr 2011 10:32:49 GMT

Hi all

I am new to alfresco and I am trying to setup the LDAP Sync with 3.4d. I have been able to establish the login to my AD which is a win2003 server. But somehow synchronization doesn't seem to work for me.

Here is my configuration:

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap-ad

ldap.authentication.active=true
ldap.authentication.userNameFormat=%s
ldap.authentication.defaultAdministratorUserNames=admin
ldap.authentication.java.naming.provider.url=ldap://domainserver:389
ldap.authentication.java.naming.security.authentication=simple

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=ldapsearch@mydomain.com
ldap.synchronization.java.naming.security.credentials=password

ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou\=Groups,dc\=mydomain,dc\=com
ldap.synchronization.userSearchBase=CN\=Users,dc\=mydomain,dc\=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=o
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=groupOfNames
ldap.synchronization.personType=inetOrgPerson
ldap.synchronization.groupMemberAttributeName=member

but the above configuration fails with the below error:

15:46:40,220 Userystem ERROR [security.sync.ChainingUserRegistrySynchronizer] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 03040000 User and group import failed

Caused by: javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-031001CD, problem 2001 (NO_OBJECT), data 0, best match of:
'DC=mydomain,DC=com'
]; remaining name 'ou=Groups,dc=mydomain,dc=com'

Any help on this will be of great support.

Thanks in advance.

Re: LDAP sync doesn't work in 3.4d

mrogers — Mon, 04 Apr 2011 10:58:08 GMT

Are you really "mydomain.com" ?

Re: LDAP sync doesn't work in 3.4d

pnavinkumar — Mon, 04 Apr 2011 11:08:59 GMT

No. I have just changed my domain name here.