topic Alfresco & 389DS in Alfresco Archive https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289849#M242979 <HTML><HEAD></HEAD><BODY><SPAN>Hello everyone!</SPAN><BR /><SPAN>I use alfresco 4.2.f</SPAN><BR /><SPAN>Use script ldap sync from this site:</SPAN><BR /><BR /><SPAN>############################</SPAN><BR /><SPAN>####LDAP AUTHENTICATION ####</SPAN><BR /><SPAN>authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># This flag enables use of this LDAP subsystem for authentication. It may be</SPAN><BR /><SPAN># that this subsytem should only be used for synchronization, in which case</SPAN><BR /><SPAN># this flag should be set to false.</SPAN><BR /><SPAN>ldap.authentication.active=true</SPAN><BR /><SPAN> </SPAN><BR /><SPAN>#</SPAN><BR /><SPAN># This properties file brings together the common options for LDAP authentication rather than editing the bean </SPAN><BR /><SPAN>#</SPAN><BR /><SPAN>ldap.authentication.allowGuestLogin=false</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># How to map the user id entered by the user to that passed through to LDAP</SPAN><BR /><SPAN>ldap.authentication.userNameFormat=</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The LDAP context factory to use</SPAN><BR /><SPAN>ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory</SPAN><BR /><SPAN>ldap.authentication.java.naming.read.timeout=30000</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The URL to connect to the LDAP server </SPAN><BR /><SPAN>ldap.authentication.java.naming.provider.url=ldaps://ldap-00.test.local:636</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The authentication mechanism to use for password validation</SPAN><BR /><SPAN>ldap.authentication.java.naming.security.authentication=simple</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># Escape commas entered by the user at bind time</SPAN><BR /><SPAN># Useful when using simple authentication and the CN is part of the DN and contains commas</SPAN><BR /><SPAN>ldap.authentication.escapeCommasInBind=false</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># Escape commas entered by the user when setting the authenticated user</SPAN><BR /><SPAN># Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is </SPAN><BR /><SPAN># pulled in as part of an LDAP sync</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># If this option is set to true it will break the default home folder provider as space names can not contain \</SPAN><BR /><SPAN>ldap.authentication.escapeCommasInUid=false</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># Comma separated list of user names who should be considered administrators by default</SPAN><BR /><SPAN>ldap.authentication.defaultAdministratorUserNames=admin,Administrator,alfresco</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># This flag enables use of this LDAP subsystem for user and group</SPAN><BR /><SPAN># synchronization. It may be that this subsytem should only be used for </SPAN><BR /><SPAN># authentication, in which case this flag should be set to false.</SPAN><BR /><SPAN>ldap.synchronization.active=true</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The authentication mechanism to use for synchronization</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.authentication=simple</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The default principal to use (only used for LDAP sync)</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.principal=uid\=replica,cn\=config</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The password for the default principal (only used for LDAP sync)</SPAN><BR /><SPAN>ldap.synchronization.java.naming.security.credentials=Test2014</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># If positive, this property indicates that RFC 2696 paged results should be</SPAN><BR /><SPAN># used to split query results into batches of the specified size. This</SPAN><BR /><SPAN># overcomes any size limits imposed by the LDAP server.</SPAN><BR /><SPAN>ldap.synchronization.queryBatchSize=0</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># If positive, this property indicates that range retrieval should be used to fetch</SPAN><BR /><SPAN># multi-valued attributes (such as member) in batches of the specified size.</SPAN><BR /><SPAN># Overcomes any size limits imposed by Active Directory.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </SPAN><BR /><SPAN>ldap.synchronization.attributeBatchSize=1000</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The query to select all objects that represent the groups to import.</SPAN><BR /><SPAN>ldap.synchronization.groupQuery=(objectclass\=groupOfUniqueNames)</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The query to select objects that represent the groups to import that have changed since a certain time.</SPAN><BR /><SPAN>ldap.synchronization.groupDifferentialQuery=(&amp;(objectclass\=groupOfUniqueNames)(!(modifyTimestamp&lt;\={0})))</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The query to select all objects that represent the users to import.</SPAN><BR /><SPAN>ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The query to select objects that represent the users to import that have changed since a certain time.</SPAN><BR /><SPAN>ldap.synchronization.personDifferentialQuery=(&amp;(objectclass\=inetOrgPerson)(!(modifyTimestamp&lt;\={0})))</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.</SPAN><BR /><SPAN>ldap.synchronization.groupSearchBase=ou\=Staff,dc\=test,dc\=local</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.</SPAN><BR /><SPAN>ldap.synchronization.userSearchBase=ou\=Staff,dc\=test,dc\=local</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The name of the operational attribute recording the last update time for a group or user.</SPAN><BR /><SPAN>ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The timestamp format. Unfortunately, this varies between directory servers.</SPAN><BR /><SPAN>ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute name on people objects found in LDAP to use as the uid in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userIdAttributeName=uid</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on person objects in LDAP to map to the first name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userFirstNameAttributeName=givenName</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on person objects in LDAP to map to the last name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userLastNameAttributeName=sn</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on person objects in LDAP to map to the email property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userEmailAttributeName=mail</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on person objects in LDAP to map to the organizational id&nbsp; property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.userOrganizationalIdAttributeName=o</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The default home folder provider to use for people created via LDAP import</SPAN><BR /><SPAN>ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on LDAP group objects to map to the authority name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.groupIdAttributeName=cn</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute on LDAP group objects to map to the authority display name property in Alfresco</SPAN><BR /><SPAN>ldap.synchronization.groupDisplayNameAttributeName=description</SPAN><BR /><SPAN> </SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The group type in LDAP</SPAN><BR /><SPAN>ldap.synchronization.groupType=groupOfUniqueNames</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The person type in LDAP</SPAN><BR /><SPAN>ldap.synchronization.personType=inetOrgPerson</SPAN><BR /><SPAN> </SPAN><BR /><SPAN># The attribute in LDAP on group objects that defines the DN for its members</SPAN><BR /><SPAN>ldap.synchronization.groupMemberAttributeName=uniqueMember</SPAN><BR /><BR /><BR /><SPAN>synchronization.synchronizeChangesOnly=true</SPAN><BR /><BR /><SPAN>All user and group sync without any problem, but group without members. Try change ldap.synchronization.groupMemberAttributeName=uniqueMember (member) but doesnt help it.</SPAN><BR /><BR /></BODY></HTML> Mon, 28 Jul 2014 12:33:10 GMT johnny_k 2014-07-28T12:33:10Z Alfresco & 389DS https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289849#M242979 Hello everyone!I use alfresco 4.2.fUse script ldap sync from this site:################################LDAP AUTHENTICATION ####authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap # This flag enables use of this LDAP subsystem for authentication. It may be# that this subsytem should only be us Mon, 28 Jul 2014 12:33:10 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289849#M242979 johnny_k 2014-07-28T12:33:10Z Re: Alfresco & 389DS https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289850#M242980 <HTML><HEAD></HEAD><BODY><SPAN>How are your groups modeled in LDAP?&nbsp;&nbsp; </SPAN></BODY></HTML> Mon, 28 Jul 2014 12:51:07 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289850#M242980 mrogers 2014-07-28T12:51:07Z Re: Alfresco & 389DS https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289851#M242981 <HTML><HEAD></HEAD><BODY><SPAN>My ldap</SPAN></BODY></HTML> Wed, 30 Jul 2014 07:16:05 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289851#M242981 johnny_k 2014-07-30T07:16:05Z Re: Alfresco & 389DS https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289852#M242982 <HTML><HEAD></HEAD><BODY><SPAN>Any idea? <span class="lia-unicode-emoji" title=":grinning_face_with_big_eyes:">😃</span></SPAN></BODY></HTML> Thu, 31 Jul 2014 18:54:07 GMT https://connect.hyland.com/t5/alfresco-archive/alfresco-389ds/m-p/289852#M242982 johnny_k 2014-07-31T18:54:07Z