topic User changes domains help in Alfresco Archive

User changes domains help

jriker1 — Tue, 13 Sep 2011 16:56:14 GMT

I have a bunch of users that are in Active Directory groups and being added automatically to Alfresco. The way it worksomainA group with username jriker DISABLEDDomainB group with username jriker ACTIVE Both DomainA and DomainB has the same named AD groups and they all are stored in another meta

Re: User changes domains help

jriker1 — Fri, 14 Oct 2011 13:31:33 GMT

Thought I would revive this as I can't imagine an enterprise application would not be able to accommodate someone switching domains in an organization. Even if it was manually editing the database and updating some UUID or something. Anyone?

Thanks.

JR

Re: User changes domains help

afaust — Fri, 14 Oct 2011 14:12:04 GMT

Hello,

it all depends on how your authentication subsystem is set up with regards to the synchronization, and how you manage the identities in your LDAP/AD. We have a customer whose LDAP simply contains all trees of their domains and we have set up one authentication subsystem against this aggregated LDAP - when users change domains and their active flag is updated, the currently active account is considered for synchronisation with Alfresco. As long as the identifying property has the same value, the user is unaltered in Alfresco.

But when you have two or more subsystems configured (one for each domain) you actually cause Alfresco to delete and recreate users when they move, as two users from different subsystems are not considered to be the same individual as long as both subsystems are active.

So:
- ensure users move only between the domains covered by a single subsystem
- ensure user moves are atomic operations (if one account is deactivated and the new one will only be available two days later, you run the risk of the user being deleted in the meantime depending on your synchronisation interval / triggers)
- ensure the identifying property remains exactly the same (although case is probably irrelevant at least for 3.4 and lower)

Regards
Axel