topic Re: Groups over Groups synchronization in Alfresco Archive

Groups over Groups synchronization

borisstankov — Mon, 03 Aug 2015 08:22:45 GMT

Hello guys,I have very interesting problem.Here is the situation:Alfresco Community 5.0.c with Active Derectory authentication located in Windows Server 2012 R2 Domain Functionality level.All my users are synchronized from the AD to the Alfresco. They are located in this OU - ou=USERS,ou=Office,dc=d

Re: Groups over Groups synchronization

afaust — Mon, 03 Aug 2015 15:56:58 GMT

Hello,

unfortunately, the synchronization logic that Alfresco supports out of the box does not support transitive group memberships when the intermediary groups are not synched. Alfresco will only process one layer of memberships at a time, i.e. from a valid group to a group in the other OU, and if the target of the membership relation (the group from the other OU) is not synched at all, Alfresco won't process it and thus not process its members.
The only thing to be done here is either synchronize all groups or implement a custom directory synchronisation logic.

Regards
Axel

Re: Groups over Groups synchronization

borisstankov — Tue, 04 Aug 2015 11:33:00 GMT

Thanks for the reply. Now it makes more sense why I can't configure it like I wanted to.

I also did try to put two entries for the Alfresco and for the Generic groups, so that both can be in alfresco and hopefully I have the results I wanted, but now I do not see any groups, which could mean that Alfresco do not support such configurations in the properties file:


ldap.synchronization.groupSearchBase=ou=Alfresco,ou=GROUPS,ou=Inter,dc=domain,dc=com
ldap.synchronization.groupSearchBase=ou=Originals,ou=GROUPS,ou=Inter,dc=domain,dc=com
‍‍‍‍

Am I right or I have different problem over here?

Re: Groups over Groups synchronization

afaust — Wed, 05 Aug 2015 07:57:00 GMT

Hello,

the properties files are simply key-value configuration files which do not support multiple values for the same key. The last one is the one that should win and the first one is moot. Typically in such a case you'd generalize the search base to ou=Groups (at the risk of getting more groups than you bargained for). Alternatively, you could set up two distinct LDAP synchronization configurations (Authentication subsystem allows multiple LDAP connections - may also be to the same LDAP) which use your distinct search bases. But the latter can't be done via the alfresco-global.properties file which is just a convenient way to perform simple configuration - see <a href="http://docs.alfresco.com/5.0/concepts/auth-config-examples.html">Authentication subsystem configuration</a> for more…

Regards
Axel

Re: Groups over Groups synchronization

borisstankov — Tue, 18 Aug 2015 13:08:23 GMT

Hello,

Thanks for the reply. Now it's more clear about the situation.
I'll keep in mind your workaround.

Regards!