Is there a better way to sync the active directory groups in LDAP queries

hsturner — Fri, 05 Feb 2016 22:51:31 GMT

Hi I am trying to find an easier way to sync active directory groups. We currently have to add the new group name to the LDAP queries and restart the alfresco service to get the new users to synch. Is there a better way to do this so we don't have to add in the group name and restart the service e

Re: Is there a better way to sync the active directory groups in LDAP queries

hsturner — Wed, 13 Jul 2016 19:50:35 GMT

Found using an ldap variable makes this possible.
# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectClass\=user)(memberof:1.2.840.113556.1.4.1941:\=cn\=ERP_Alfresco,ou\=Alfresco Groups,ou\=Security Groups,dc\=pblp,dc\=ca)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personiDifferentialQuery=(&(objectClass\=user)(memberof:1.2.840.113556.1.4.1941:\=cn\=ERP_Alfresco,ou\=Alfresco Groups,ou\=Security Groups,dc\=pblp,dc\=ca)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimeStamp<\={0})))

However I have 1 single user that synchronizes in our development enviroment, but won't in production when using the identical query. Not sure why. Anyone know what logging property needs to be set to debug so I can see each user being synchronized in the alfresco log. Currently getting message below showing no errors:

2016-07-13 14:20:00,215 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronizing users and groups with user registry 'pbl-ldap-ad1'
2016-07-13 14:20:00,215 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Full synchronization with user registry 'pbl-ldap-ad1'
2016-07-13 14:20:00,215 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Some users and groups previously created by synchronization with this user registry may be removed.
2016-07-13 14:20:00,277 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Retrieving groups changed since Jul 8, 2016 9:01:08 AM from user registry 'pbl-ldap-ad1'
2016-07-13 14:20:00,507 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=1 Group Analysis: Commencing batch of 34 entries
2016-07-13 14:20:00,663 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=1 Group Analysis: Processed 34 entries out of 34. 100% complete. Rate: 217 per second. 0 failures detected.
2016-07-13 14:20:00,664 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=1 Group Analysis: Completed batch of 34 entries
2016-07-13 14:20:00,840 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Retrieving users changed since Jul 13, 2016 1:16:36 PM from user registry 'pbl-ldap-ad1'
2016-07-13 14:20:00,909 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=6 User Creation and Association: Commencing batch of 2 entries
2016-07-13 14:20:01,452 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=6 User Creation and Association: Processed 2 entries out of 2. 100% complete. Rate: 3 per second. 0 failures detected.
2016-07-13 14:20:01,452 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=6 User Creation and Association: Completed batch of 2 entries
2016-07-13 14:20:01,454 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=5 User Association: Commencing batch of 1 entries
2016-07-13 14:20:01,456 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=5 User Association: Processed 1 entries out of 1. 100% complete. Rate: 500 per second. 0 failures detected.
2016-07-13 14:20:01,456 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=pbl-ldap-ad1,id2=5 User Association: Completed batch of 1 entries
2016-07-13 14:20:01,476 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Finished synchronizing users and groups with user registry 'pbl-ldap-ad1'
2016-07-13 14:20:01,477 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] 2 user(s) and 34 group(s) processed

topic Re: Is there a better way to sync the active directory groups in LDAP queries in Alfresco Archive

Is there a better way to sync the active directory groups in LDAP queries

Re: Is there a better way to sync the active directory groups in LDAP queries