topic AD attribute synchronization in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/ad-attribute-synchronization/m-p/289321#M242451 <HTML><HEAD></HEAD><BODY><SPAN>&lt;ul&gt;</SPAN><BR /><SPAN>&lt;li&gt;&lt;strong&gt;Alfresco version:&lt;/strong&gt; 5.0.c&lt;/li&gt;</SPAN><BR /><SPAN>&lt;li&gt;&lt;strong&gt;OS:&lt;/strong&gt; Windows 2008 R2&lt;/li&gt;</SPAN><BR /><SPAN>&lt;/ul&gt;</SPAN><BR /><BR /><SPAN>Hi,</SPAN><BR /><BR /><SPAN>I've been using the AD synchronization for quite some time now without any issue. Recently, I tried to map new AD attributes to user profiles visible in Alfresco but I didn't manage to make it work despite my best efforts.</SPAN><BR /><BR /><SPAN>Here is what I did so far:</SPAN><BR /><BR /><SPAN>- Copy </SPAN><PRE class="language-none line-numbers"><CODE>common-ldap-context.xml<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> to </SPAN><PRE class="language-none line-numbers"><CODE>Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> and add some entries to the </SPAN><PRE class="language-none line-numbers"><CODE>personAttributeMapping<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> property in the </SPAN><PRE class="language-none line-numbers"><CODE>UserRegistry<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> bean:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR />…<BR />&lt;entry key="cm:jobtitle"&gt;<BR />&nbsp;&nbsp;&nbsp; &lt;!– OpenLDAP: "title" –&gt;<BR />&nbsp;&nbsp;&nbsp; &lt;!– Active Directory: "title" –&gt;<BR />&nbsp;&nbsp;&nbsp; &lt;value&gt;${ldap.synchronization.userJobTitleAttributeName}&lt;/value&gt;<BR />&lt;/entry&gt;<BR />…<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>- Modifiy my </SPAN><PRE class="language-none line-numbers"><CODE>ldap-ad-authentication.properties<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> located in </SPAN><PRE class="language-none line-numbers"><CODE>Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap-ad1<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> and map the attribute mentioned above:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR /># The attribute on person objects in LDAP to map to the title property in Alfresco<BR />ldap.synchronization.userJobTitleAttributeName=title<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>- Check that my Alfresco user in the Active Directory has the "Read all inetOrgPerson information" permission</SPAN><BR /><BR /><SPAN>- Look at my domain controller logs for potential authentication errors (I didn't find any)</SPAN><BR /><BR /><BR /><SPAN>I must have forgotten to do something along the way but I can't figure out what it is! <img id="smileyhappy" class="emoticon emoticon-smileyhappy" src="https://connect.hyland.com/i/smilies/16x16_smiley-happy.png" alt="Smiley Happy" title="Smiley Happy" /></SPAN><BR /><BR /><BR /><SPAN>Here is my full </SPAN><PRE class="language-none line-numbers"><CODE>ldap-ad-authentication.properties<SPAN class="line-numbers-rows"><SPAN>‍</SPAN></SPAN></CODE></PRE><SPAN> if need be:</SPAN><BR /><BR /><PRE class="language-none line-numbers"><CODE><BR /># This flag enables use of this LDAP subsystem for authentication. It may be<BR /># that this subsytem should only be used for synchronization, in which case<BR /># this flag should be set to false.<BR />ldap.authentication.active=false<BR /><BR /># This properties file brings together the common options for LDAP authentication rather than editing the bean definitions<BR />ldap.authentication.allowGuestLogin=false<BR /><BR /># How to map the user id entered by the user to that passed through to LDAP<BR /># In Active Directory, this can either be the user principal name (UPN) or DN.<BR /># UPNs are in the form &lt;sAMAccountName&gt;@domain and are held in the userPrincipalName attribute of a user<BR />ldap.authentication.userNameFormat=%s@FOO.LOCAL<BR /><BR /># The LDAP context factory to use<BR />ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory<BR /><BR /># The URL to connect to the LDAP server <BR />ldap.authentication.java.naming.provider.url=ldap://pdc.foo.local:389<BR /><BR /># The authentication mechanism to use for password validation<BR />ldap.authentication.java.naming.security.authentication=simple<BR /><BR /># Escape commas entered by the user at bind time<BR /># Useful when using simple authentication and the CN is part of the DN and contains commas<BR />ldap.authentication.escapeCommasInBind=false<BR /><BR /># Escape commas entered by the user when setting the authenticated user<BR /># Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is <BR /># pulled in as part of an LDAP sync<BR /># If this option is set to true it will break the default home folder provider as space names can not contain \<BR />ldap.authentication.escapeCommasInUid=false<BR /><BR /># Comma separated list of user names who should be considered administrators by default<BR />ldap.authentication.defaultAdministratorUserNames=Administrator<BR /><BR /># This flag enables use of this LDAP subsystem for user and group<BR /># synchronization. It may be that this subsytem should only be used for <BR /># authentication, in which case this flag should be set to false.<BR />ldap.synchronization.active=true<BR /><BR /># The authentication mechanism to use for synchronization<BR />ldap.synchronization.java.naming.security.authentication=simple<BR /><BR /># The default principal to bind with (only used for LDAP sync). This should be a UPN or DN<BR />ldap.synchronization.java.naming.security.principal=cn\=Alfresco HTTP,dc\=FOO,dc\=LOCAL<BR /><BR /># The password for the default principal (only used for LDAP sync)<BR />ldap.synchronization.java.naming.security.credentials=password<BR /><BR /># If positive, this property indicates that RFC 2696 paged results should be<BR /># used to split query results into batches of the specified size. This<BR /># overcomes any size limits imposed by the LDAP server.<BR />ldap.synchronization.queryBatchSize=1000<BR /><BR /># If positive, this property indicates that range retrieval should be used to fetch<BR /># multi-valued attributes (such as member) in batches of the specified size.<BR /># Overcomes any size limits imposed by Active Directory.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <BR />ldap.synchronization.attributeBatchSize=1000<BR /><BR /># The query to select all objects that represent the groups to import.<BR />ldap.synchronization.groupQuery=(objectclass\=group)<BR /><BR /># The query to select objects that represent the groups to import that have changed since a certain time.<BR />ldap.synchronization.groupDifferentialQuery=(&amp;(objectclass\=group)(!(whenChanged&lt;\={0})))<BR /><BR /># The query to select all objects that represent the users to import.<BR />ldap.synchronization.personQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))<BR /><BR /># The query to select objects that represent the users to import that have changed since a certain time.<BR />ldap.synchronization.personDifferentialQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged&lt;\={0})))<BR /><BR /># The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.<BR />ldap.synchronization.groupSearchBase=ou\=FOO,dc\=FOO,dc\=LOCAL<BR /><BR /># The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.<BR />ldap.synchronization.userSearchBase=ou\=FOO,dc\=FOO,dc\=LOCAL<BR /><BR /># The name of the operational attribute recording the last update time for a group or user.<BR />ldap.synchronization.modifyTimestampAttributeName=whenChanged<BR /><BR /># The timestamp format. Unfortunately, this varies between directory servers.<BR />ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'<BR /><BR /># The attribute name on people objects found in LDAP to use as the uid in Alfresco<BR />ldap.synchronization.userIdAttributeName=sAMAccountName<BR /><BR /># The attribute on person objects in LDAP to map to the first name property in Alfresco<BR />ldap.synchronization.userFirstNameAttributeName=givenName<BR /><BR /># The attribute on person objects in LDAP to map to the last name property in Alfresco<BR />ldap.synchronization.userLastNameAttributeName=sn<BR /><BR /># The attribute on person objects in LDAP to map to the email property in Alfresco<BR />ldap.synchronization.userEmailAttributeName=mail<BR /><BR /># The attribute on person objects in LDAP to map to the title property in Alfresco<BR />ldap.synchronization.userJobTitleAttributeName=title<BR /><BR /># The attribute on person objects in LDAP to map to the organizational id&nbsp; property in Alfresco<BR />ldap.synchronization.userOrganizationalIdAttributeName=company<BR /><BR /># The attribute on person objects in LDAP to map to the telephone property in Alfresco<BR />ldap.synchronization.userCompanyTelephoneAttributeName=telephoneNumber<BR /><BR /># The attribute on person objects in LDAP to map to the postcode property in Alfresco<BR />ldap.synchronization.userCompanyPostCodeAttributeName=postalCode<BR /><BR /># The attribute on person objects in LDAP to map to the company address property in Alfresco<BR />ldap.synchronization.userCompanyAddress1AttributeName=streetAddress<BR /><BR /># The attribute on person objects in LDAP to map to the company address property in Alfresco<BR />ldap.synchronization.userCompanyAddress2AttributeName=l<BR /><BR /># The attribute on person objects in LDAP to map to the company address property in Alfresco<BR />ldap.synchronization.userCompanyAddress3AttributeName=st<BR /><BR /># The default home folder provider to use for people created via LDAP import<BR />ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider<BR /><BR /># The attribute on LDAP group objects to map to the authority name property in Alfresco<BR />ldap.synchronization.groupIdAttributeName=cn<BR /><BR /># The attribute on LDAP group objects to map to the authority display name property in Alfresco<BR />ldap.synchronization.groupDisplayNameAttributeName=displayName<BR /><BR /># The group type in LDAP<BR />ldap.synchronization.groupType=group<BR /><BR /># The person type in LDAP<BR />ldap.synchronization.personType=user<BR /><BR /># The attribute in LDAP on group objects that defines the DN for its members<BR />ldap.synchronization.groupMemberAttributeName=member<BR /><BR /># If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.<BR />ldap.synchronization.enableProgressEstimation=true<BR /><BR /># Requests timeout, in miliseconds, use 0 for none (default)<BR />ldap.authentication.java.naming.read.timeout=0<BR /><SPAN class="line-numbers-rows"><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN><SPAN>‍</SPAN></SPAN></CODE></PRE><BR /><BR /><SPAN>Thanks in advance to anyone willing to help me out!</SPAN></BODY></HTML> Wed, 28 Jan 2015 19:10:48 GMT alexw 2015-01-28T19:10:48Z AD attribute synchronization https://connect.hyland.com/t5/alfresco-archive/ad-attribute-synchronization/m-p/289321#M242451 &lt;ul&gt;&lt;li&gt;&lt;strong&gt;Alfresco version:&lt;/strong&gt; 5.0.c&lt;/li&gt;&lt;li&gt;&lt;strong&gt;OS:&lt;/strong&gt; Windows 2008 R2&lt;/li&gt;&lt;/ul&gt;Hi,I've been using the AD synchronization for quite some time now without any issue. Recently, I tried to map new AD attributes to user p Wed, 28 Jan 2015 19:10:48 GMT https://connect.hyland.com/t5/alfresco-archive/ad-attribute-synchronization/m-p/289321#M242451 alexw 2015-01-28T19:10:48Z Re: AD attribute synchronization https://connect.hyland.com/t5/alfresco-archive/ad-attribute-synchronization/m-p/289322#M242452 <HTML><HEAD></HEAD><BODY><SPAN>Have you run full sync after making the change? Set ldap.synchronization.synchronizeChangesOnly=false in alfresco-global.properties and give a restart to the system.</SPAN></BODY></HTML> Fri, 06 Feb 2015 18:57:37 GMT https://connect.hyland.com/t5/alfresco-archive/ad-attribute-synchronization/m-p/289322#M242452 sujaypillai 2015-02-06T18:57:37Z