topic Re: How to configure AD authentication users in Alfresco 5.0.a? in Alfresco Archive

How to configure AD authentication users in Alfresco 5.0.a?

psouza — Fri, 22 Aug 2014 14:17:37 GMT

I'm New to Alfresco and follow various scripts to configure authentication and sicnronização of users and groups from AD, but none worked. Can someone send me a step-by-step how to configure AD authentication users in Alfresco 5.0.a? Thank you!

Re: How to configure AD authentication users in Alfresco 5.0.a?

ja79 — Wed, 27 Aug 2014 21:27:38 GMT

To authentication by ldap ad You must add couple lines in alfresco-global.properties

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
#You can login by bulidin alfresco authentication system and ldap

ntlm.authentication.sso.enabled=false

ldap.authentication.allowGuestLogin=false
#do not allow guest logon

ldap.authentication.userNameFormat=%s@your_domain.com
#your login is the same like user name in windows

ldap.authentication.java.naming.provider.url=ldap://your_ldap_server.your_domain.com:389
#adres of ldap server
ldap.authentication.defaultAdministratorUserNames=admin,administrator,bob
#users with admin rights
ldap.synchronization.java.naming.security.principal=ldap_admin@yourdomain.com
#account ldap administrator on your server
ldap.synchronization.java.naming.security.credentials=Au34ao11
#password to ldap_admin@yourdomain.com
ldap.synchronization.groupSearchBase=cn=Security_Groups,ou=Alfresco,dc=your_domain,dc=com
#groups for alfresco, cn=Security_Groups,ou=Alfresco,dc=your_domain,dc=com must exist in Your ldap
ldap.synchronization.userSearchBase=cn=User_Accounts,ou=Alfresco,dc=your_domain,dc=com
#users for alfresco, cn=User_Accounts,ou=Alfresco,dc=your_domain,dc=com must exist in Your ldap

=================
thats all
authentication work for me
synchronisation not, if someone know what to do, please let me know.
sorry for my english
ja79

Re: How to configure AD authentication users in Alfresco 5.0.a?

psouza — Thu, 28 Aug 2014 18:27:46 GMT

Thanks for the help, I managed to authenticate via AD, now missing sync all users, if someone can help me, I'd be grateful.

Note: My English is google translator

Thank you!

Re: How to configure AD authentication users in Alfresco 5.0.a?

kimberlydeborah — Fri, 12 Sep 2014 05:46:30 GMT

For authentication purpose, alfresco can be configured with AD, LDAP, Kerberos, alfrescoNtlm or other external servers. You can configure alfresco to authenticate from a number of systems - this is known as Authentication Chain.

Re: How to configure AD authentication users in Alfresco 5.0.a?

eswbitto — Fri, 12 Sep 2014 16:59:03 GMT

Syncing all users will determine what you have for your user and group. Example:

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
#ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=Alfresco,dc=domain
ldap.synchronization.groupSearchBase=OU\=PEOPLE,DC\=domain name,DC\=domain name

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
#ldap.synchronization.userSearchBase=ou\=User Accounts,ou=\Alfresco,dc=domain

Re: How to configure AD authentication users in Alfresco 5.0.a?

kmanickam — Thu, 01 Jan 2015 15:27:59 GMT

Hi,

Any one help me how to configure zimbra (8.0.5) ldap for alfresco 5.0.c my os cent OS

Pls guide me step-by-step

Re: How to configure AD authentication users in Alfresco 5.0.a?

mtrento — Wed, 16 Sep 2015 13:42:26 GMT

be carefull of the ldap syntax.
the following string will not work :cn=User_Accounts,ou=Alfresco,dc=your_domain,dc=com
you must add backslash before the = example : cn\=User_Accounts,ou\=Alfresco,dc\=your_domain,dc\=com

To be sure to use the right ldap terms, go to your active directory users and computers snappin and click properties on the node you want to target your ldap search. now go on the attribute editor and look at attribue distinguishedName.
if it's an organisation unit the first term start with OU\= but not CN\=

Good luck.

Re: How to configure AD authentication users in Alfresco 5.0.a?

sharifu — Mon, 21 Sep 2015 16:58:19 GMT

I have problem with my ldap synchro. on 5.0.b the groups are all there however all the users within the groups are missing. never had this issue with previous version of alfresco

Re: How to configure AD authentication users in Alfresco 5.0.a?

gnyce — Tue, 22 Sep 2015 12:26:25 GMT

maybe you need to specify what ldap property is used to determine what a "user" object is within your LDAP backend? for example, when I sync'd with Zimbra, I had to identify what a users and groups were with these two lines:
ldap.synchronization.groupQuery=(objectclass\=zimbraDistributionList)
ldap.synchronization.personQuery=(objectclass\=zimbraAccount)

Re: How to configure AD authentication users in Alfresco 5.0.a?

sharifu — Mon, 12 Oct 2015 16:04:00 GMT

Below is my configuration for ldap sso


### AD SSO
authentication.chain=passthru1:passthru,ldap1:ldap-ad
alfresco.authentication.authenticateCIFS=false
ntlm.authentication.sso.enabled=true

ldap.authentication.active=false
ldap.authentication.userNameFormat=%s
ldap.authentication.allowGuestLogin=false
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://echo.uk.domain.com:389

passthru.authentication.authenticateCIFS=true
passthru.authentication.domain=DOMAIN
passthru.authentication.servers=DOMAIN\\echo.uk.domain.com,DOMAIN\\jarvis.usa.domain.com
passthru.authentication.defaultAdministratorUserNames=johnl,markw,administrator,alfresco,sharifu

synchronization.synchronizeChangesOnly=false
synchronization.import.cron=0 0 1 * * ?
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=true

ldap.synchronization.active=true
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.java.naming.security.authenticaton=simple
ldap.synchronization.java.naming.security.principal=administrator@domain.com
ldap.synchronization.java.naming.security.credentials=****

#ldap.synchronization.groupDifferentialQuery=(&(objectclass=nogroup)(!(modifyTimestamp<\={0})))
#ldap.synchronization.personQuery=(&(objectclass=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
#ldap.synchronization.personDifferentialQuery=(& (objectclass=user)(!(modifyTimestamp<\={0})))
#ldap.synchronization.personQuery=(&(objectclass=user))
#ldap.synchronization.groupQuery=(objectclass\=group)
#ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(CN\=allusers)(!(modifyTimestamp<\={0})))

ldap.synchronization.userSearchBase=ou\=Sites,dc\=domain,dc\=com
ldap.synchronization.groupSearchBase=cn\=users,dc\=domain,dc\=com
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

The way i fixed it was by forcing an ldap.

Re: How to configure AD authentication users in Alfresco 5.0.a?

lauvanya — Sat, 16 Jul 2016 11:01:38 GMT

Hi, Did you connect the AD with Alfresco and users were able to login? I am new to Alfresco, Could you guide me with the steps you performed and file you shared?

Re: How to configure AD authentication users in Alfresco 5.0.a?

sandeepreddy1 — Mon, 18 Jul 2016 06:40:00 GMT

Re: How to configure AD authentication users in Alfresco 5.0.a?

sandeepreddy1 — Mon, 18 Jul 2016 06:43:09 GMT

Hai Everyone,
I integrated alfresco with Active Directory, These are AD properties http://pastebin.com/WAsDEFLS , i created a folder 'Alfresco-DATA' in alfresco-dms site. after that in manage permissions i searched user xyz like this
https://i.imgsafe.org/c76c0295a3.png and i added that user it is showing empty like this https://i.imgsafe.org/c76e4daa24.png .
can anyone help me out please. is there any solution

These are my AD properties

###Ldap####

authentication.chain=ldap-ad1:ldap-ad,alfrescoNtlm1:alfrescoNtlm
ntlm.authentication.sso.enabled=false

ldap.authentication.active=true

ldap.authentication.userNameFormat=%s@empover.hyd
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://192.168.3.27:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=testuser
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=testuser@empover.hyd
ldap.synchronization.java.naming.security.credentials=user123
ldap.synchronization.queryBatchSize=10000
ldap.synchronization.attributeBatchSize=10000
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.personQuery=objectClass=user
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou=EMPOU\,dc=empover,dc=hyd
ldap.synchronization.userSearchBase=ou=EMPOU,dc=empover,dc=hyd

cifs.domain=empover.hyd

ldap.synchronization.modifyTimestampAttributeName=whenChanged
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member

synchronization.autoCreatePeopleOnLogin=true
synchronization.synchronizeChangesOnly=true

# to sync on each alfresco startup
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true

### DONT USE UNIX CRON EXPRESSION- USE QUARTZ CRON EXPRESSIONS!!!
### look here http://www.quartz-scheduler.org/docs/tutorials/crontrigger.html
### synchronisation starts every 15 minutes!
synchronization.import.cron=0 0/1 * * * ?
ldap.authentication.allowGuestLogin=true

Re: How to configure AD authentication users in Alfresco 5.0.a?

manikandan — Wed, 17 Aug 2016 15:06:15 GMT

I have created a group in ldap which I want to be able to login in alfresco, in order to restrict the remaing users that are not part of the group to login in alfresco and therefore have access to alfresco.
the problem is that everyone who has an account in ladp can login in alfresco

Please help me at earliest

Re: How to configure AD authentication users in Alfresco 5.0.a?

johni_angriss — Tue, 25 Oct 2016 17:01:03 GMT

Good afternoon I'm having trouble authenticating with AD

I would like to manage users with permission to access a group. it's possible?

GED = Group

Afresco GED = OU

ldap.synchronization.groupSearchBase=cn=ged,ou=Alfresco GED,dc=pg,dc=intra

#groups for alfresco, cn=Security_Groups,ou=Alfresco,dc=pg,dc=com must exist in Your ldap

ldap.synchronization.userSearchBase=cn=ged,ou=Alfresco GED,dc=pg,dc=intra

#users for alfresco, cn=User_Accounts,ou=Alfresco,dc=your_domain,dc=com must exist in Your ldap