topic Re: LDAP Authentication For Sites in Alfresco Archive

LDAP Authentication For Sites

lchildress — Tue, 23 Jun 2015 15:14:13 GMT

I am a complete novice to Alfresco so bare with me! I have authentication working through Active Directory. I want to create individual sites for our various departments (I am with a government entity) and allow them access to the site based on their group membership in Active Directory. This questi

Re: LDAP Authentication For Sites

borisstankov — Wed, 24 Jun 2015 12:01:00 GMT

Hello there,

First thing you need is the synchronization subsystem enabled and working properly in order Alfresco to take all groups and other important properties from your users' profiles.
For synchronization you need something like:


synchronization.syncOnStartup=true
synchronization.allowDeletions=true
synchronization.sinchronyzeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.import.cron=0 0 * * * ?

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=AlfrescoService@doamin.com
ldap.synchronization.java.naming.security.credentials=YourPasswordForAlfrescoAccountInAD
#ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))
#ldap.synchronization.personDifferentialQuery=(objectclass\=*)
ldap.synchronization.groupSearchBase=ou=4,ou=3,dc=domain,dc=com
ldap.synchronization.userSearchBase=ou=1,ou=2,dc=domain,dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user
ldap.synchronization.enableProgressEstimation=true


ldap.authentication.defaultAdministratorUserNames=admin
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

After that you need to build you folder structure and Manage the Permissions for each folder –> disable the Inherite Permission button (so that no permission will be inherited from the mother folder), then add some groups to the have access to this folder - the button is right next to the Inherite one. Keep in mind that all subfolder will have this "inharite permission" enabled by default, so if you want to have more deeper folder structure then you need to go through them too.

Let me know how this sounds to you and you have any further questions.

Cheers!

Re: LDAP Authentication For Sites

lchildress — Wed, 24 Jun 2015 19:03:34 GMT

Your settings were very similar to mine, but I erased mine and used yours, keeping my active directory authentication settings. I am able to authenticate through Active Directory but cannot get synchronization to work at all. Additionally, my configuration will fail and the website will not load if I have ldap.synchronization.active=true in the configuration. If I comment out that line, the site will load and I can authenticate, but no synchronization. My config is as follows:

### LDAP Authentication ###
synchronization.syncOnStartup=true

synchronization.allowDeletions=true

synchronization.sinchronyzeChangesOnly=true

synchronization.syncWhenMissingPeopleLogIn=true

synchronization.import.cron=0 0 * * * ?

ldap.authentication.active=true

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad

ntlm.authentication.sso.enabled=true

ldap.authentication.allowGuestLogin=false

ldap.authentication.userNameFormat=%s@some-very-not-so-famous-organization.com

ldap.authentication.java.naming.provider.url=ldap://some-very-not-so-famous-organization.com:389

#ldap.synchronization.active=true

ldap.synchronization.java.naming.security.authentication=simple

ldap.synchronization.java.naming.security.principal=ldap@some-very-not-so-famous-organization.com

ldap.synchronization.java.naming.security.credentials=insert-incredible-password-here

ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))

ldap.synchronization.personDifferentialQuery=(objectclass\=*)

ldap.synchronization.groupSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.userSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName

ldap.synchronization.userFirstNameAttributeName=givenName

ldap.synchronization.userLastNameAttributeName=sn

ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user

ldap.synchronization.enableProgressEstimation=true

ldap.authentication.defaultAdministratorUserNames=admin

Re: LDAP Authentication For Sites

borisstankov — Thu, 25 Jun 2015 06:43:00 GMT

Hello there,

OK, that looks good, but in order to load your ldap-ad authentication you need to put this line first just after the "synchronization.import.cron":


authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
‍‍‍

Second, you need to follow after that with:


ntlm.authentication.sso.enabled=false
‍‍‍

NOTE: it needs to be equals to "false". You can check this if you go through those potics in here: http://docs.alfresco.com/community/concepts/auth-ldap-intro.html

Also you need to put after those two parameters the parameter where you tells your alfresco that the ldap-ad authenticate is enabled:

ldap.authentication.active=true‍

Along with it put all params that include the ldap.authentication.

After that enable the ldap.synchronization. Uncomment the "ldap.synchronization.active" param.

Check like that and let me know if it works.

Cheers!

Re: LDAP Authentication For Sites

lchildress — Thu, 25 Jun 2015 14:03:26 GMT

First off, let me say THANK YOU, Boris. I did not expect someone to assist me like you have been willing and I want you to know I truly am appreciative. I made the changes you suggested, and show them below. However, when I enter the url to Alfresco, the site crashes. If I comment out ldap.syncronization.active=true, the site works and I am able to authenticate, but obviously nothing synchronizes.

synchronization.syncOnStartup=true

synchronization.allowDeletions=true

synchronization.sinchronyzeChangesOnly=true

synchronization.syncWhenMissingPeopleLogIn=true

synchronization.import.cron=0 0 * * * ?

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
ntlm.authentication.sso.enabled=false
ldap.authentication.active=true

ldap.authentication.userNameFormat=%s@some-very-not-so-famous-organization.com

ldap.authentication.java.naming.provider.url=ldap://dc-adcen.some-very-not-so-famous-organization.com:389

#ldap.synchronization.active=true

ldap.synchronization.java.naming.security.authentication=simple

ldap.synchronization.java.naming.security.principal=ldap@some-very-not-so-famous-organization.org

ldap.synchronization.java.naming.security.credentials=insert-incredible-password-here

ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))

ldap.synchronization.personDifferentialQuery=(objectclass\=*)

ldap.synchronization.groupSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.userSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName

ldap.synchronization.userFirstNameAttributeName=givenName

ldap.synchronization.userLastNameAttributeName=sn

ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user

ldap.synchronization.enableProgressEstimation=true

ldap.authentication.defaultAdministratorUserNames=admin

Re: LDAP Authentication For Sites

borisstankov — Thu, 25 Jun 2015 14:23:32 GMT

There is no problem about it. I had a long time that I had some similar problems and I spent a lot of time in internet and doing tests before I made my configuration work fine.
Hmm this is interesting problem. Do you have any error messages in catalina.out log file located in /pathto/youralfresco/tomcat/logs/catalina.out during the same time when you try to open the site? Also what happens in the browser?

Re: LDAP Authentication For Sites

lchildress — Thu, 25 Jun 2015 14:59:57 GMT

I could not find a catalina.out file but I posted today's log below which really didn't tell me anything.

Jun 25, 2015 8:32:02 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 8:32:02 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 8:32:02 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["http-bio-8443"]
Jun 25, 2015 8:32:02 AM org.apache.catalina.core.StandardService stopInternal
INFO: Stopping service Catalina
Jun 25, 2015 8:39:19 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 8:39:19 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 8:39:19 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["http-bio-8443"]
Jun 25, 2015 8:42:04 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: Loaded APR based Apache Tomcat Native library 1.1.32 using APR version 1.5.1.
Jun 25, 2015 8:42:04 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
Jun 25, 2015 8:42:05 AM org.apache.catalina.core.AprLifecycleListener initializeSSL
INFO: OpenSSL successfully initialized (OpenSSL 1.0.1j 15 Oct 2014)
Jun 25, 2015 8:42:06 AM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 8:42:06 AM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 8:42:06 AM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-bio-8443"]
Jun 25, 2015 8:42:07 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 3688 ms
Jun 25, 2015 8:42:07 AM org.apache.catalina.core.StandardService startInternal
INFO: Starting service Catalina
Jun 25, 2015 8:42:07 AM org.apache.catalina.core.StandardEngine startInternal
INFO: Starting Servlet Engine: Apache Tomcat/7.0.59
Jun 25, 2015 8:42:07 AM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor C:\Alfresco\tomcat\conf\Catalina\localhost\solr4.xml
Jun 25, 2015 8:42:07 AM org.apache.catalina.startup.SetContextPropertiesRule begin
WARNING: [SetContextPropertiesRule]{Context} Setting property 'debug' to '0' did not find a matching property.
Jun 25, 2015 8:42:30 AM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deployment of configuration descriptor C:\Alfresco\tomcat\conf\Catalina\localhost\solr4.xml has finished in 23,602 ms
Jun 25, 2015 8:42:31 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive C:\Alfresco\tomcat\webapps\alfresco.war
Jun 25, 2015 8:44:52 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deployment of web application archive C:\Alfresco\tomcat\webapps\alfresco.war has finished in 140,979 ms
Jun 25, 2015 8:44:52 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive C:\Alfresco\tomcat\webapps\share.war
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deployment of web application archive C:\Alfresco\tomcat\webapps\share.war has finished in 48,663 ms
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Alfresco\tomcat\webapps\host-manager
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deployment of web application directory C:\Alfresco\tomcat\webapps\host-manager has finished in 141 ms
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Alfresco\tomcat\webapps\manager
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deployment of web application directory C:\Alfresco\tomcat\webapps\manager has finished in 93 ms
Jun 25, 2015 8:45:41 AM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 8:45:41 AM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 8:45:41 AM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-bio-8443"]
Jun 25, 2015 8:45:41 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 214272 ms
Jun 25, 2015 9:09:18 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 9:09:18 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 9:09:18 AM org.apache.coyote.AbstractProtocol pause
INFO: Pausing ProtocolHandler ["http-bio-8443"]
Jun 25, 2015 9:09:18 AM org.apache.catalina.core.StandardService stopInternal
INFO: Stopping service Catalina
Jun 25, 2015 9:10:18 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["http-apr-8080"]
Jun 25, 2015 9:10:18 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["ajp-apr-8009"]
Jun 25, 2015 9:10:18 AM org.apache.coyote.AbstractProtocol stop
INFO: Stopping ProtocolHandler ["http-bio-8443"]

Re: LDAP Authentication For Sites

lchildress — Thu, 25 Jun 2015 18:30:10 GMT

I fixed a typo: synchronization.sinchronyzeChangesOnly=true => synchronization.synchronizeChangesOnly=true. After making that change, I no longer have to comment out ldap.synchronization.active=true. The site loads now with that line active. HOWEVER, nothing is imported from Active Directory. <sigh>

Re: LDAP Authentication For Sites

borisstankov — Fri, 26 Jun 2015 06:38:47 GMT

Ok, that's good and sorry about the typo…
What are the messages in the catalina log about the synchronization subsystem when you restart/start the alfresco service?

Do you have network connection between Alfresco and the ldap on port 389?
Do you see any entries on the LDAP server from the Alfresco?

Re: LDAP Authentication For Sites

borisstankov — Fri, 26 Jun 2015 06:41:52 GMT

My catalina.out file is located /opt.alfresc-5.0/tomcat/logs/catalina.out

Re: LDAP Authentication For Sites

lchildress — Fri, 26 Jun 2015 12:33:19 GMT

It's nice that you are able to use a linux box. I'm stuck having to use Windows for our environment and it sucks! I did a search on my entire drive and there is no catalina.out. I may have to bite the bullet and just pay for Sharepoint … great … another Microsoft product to deal with! lol

Boris, you have been an awesome help. Thank you so much.

Re: LDAP Authentication For Sites

borisstankov — Fri, 26 Jun 2015 13:44:31 GMT

No problem.
Maybe I got confused, but I did not know that you are using Windows server for this.
Please try to search for alfresco.log somewhere on the HDD. It appears that it called different way on Windows.

Re: LDAP Authentication For Sites

lchildress — Fri, 26 Jun 2015 14:22:36 GMT

I think I'm gonna create a Ubuntu server to test with even though they like everything Windows. I'll keep you posted, and thanks again

Re: LDAP Authentication For Sites

borisstankov — Mon, 06 Jul 2015 16:12:50 GMT

Ok and good luck!