topic LDAP Sync working but no Authentication in Alfresco Archive

LDAP Sync working but no Authentication

m4lewis — Thu, 11 Jul 2013 15:15:53 GMT

Hello,I'm currently working with Alfresco 4.2.c Community and I am trying to obtain authentication within Alfresco through our LDAP AD. After many searches on the net I was able to throw together a configuration and all of my AD users have appeared within alfresco (stack trace below) and there are n

Re: LDAP Sync working but no Authentication

m4lewis — Thu, 11 Jul 2013 15:21:08 GMT

I should also say that I'm using bitnami alfresco stack and here is yesterday's log when my users were actually pulled into alfresco.

16:58:08,767 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Commencing batch of 30 entries
16:58:08,846 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Processed 30 entries out of 30. 100% complete. Rate: 379 per second. 0 failures detected.
16:58:08,846 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Completed batch of 30 entries
16:58:08,867 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Creation and Association Deletion: Commencing batch of 30 entries
16:58:10,518 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Creation and Association Deletion: Processed 30 entries out of 30. 100% complete. Rate: 18 per second. 0 failures detected.
16:58:10,518 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Creation and Association Deletion: Completed batch of 30 entries
16:58:10,521 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldap1'
16:58:10,557 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Commencing batch of 114 entries
16:58:11,972 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Updating user 'Guest'. This user will in future be assumed to originate from user registry 'ldap1'.
16:58:28,635 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Processed 100 entries out of 114. 88% complete. Rate: 5 per second. 0 failures detected.
16:58:30,835 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Processed 114 entries out of 114. 100% complete. Rate: 5 per second. 0 failures detected.
16:58:30,835 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Completed batch of 114 entries
16:58:30,938 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
16:58:30,938 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 114 user(s) and 30 group(s) processed
16:58:30,980 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
16:58:31,002 INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.7.0_25-b15; maximum heap size 494.938MB
16:58:31,002 WARN [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - WARNING - maximum heap size 494.938MB is less than recommended 512MB
16:58:31,003 INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community). Current version: 4.2.0 (4576) schema 6,022. Originally installed version: 4.2.0 (4576) schema 6,022.

Re: LDAP Sync working but no Authentication

m4lewis — Thu, 11 Jul 2013 15:51:15 GMT

Okay I ended up getting it working.

I did not have passthru enabled or configured so it was only trying to authenticate my ldap users from Alfresco and not my AD server. Added the following config settings…

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad,passthru1assthru (appended passthru)
passthru.authentication.servers=DOMAIN\\batman.robin.com,batman.com
passthru.authentication.domain=#leave blank
passthru.authentication.guestAccess=false

Restarted Tomcat and was able to login as myself using my AD credentials… woohoo

Re: LDAP Sync working but no Authentication

scouil — Fri, 12 Jul 2013 15:35:12 GMT

Hi m4lewis,

Congratz for getting it to work.
And thanks for posting the answer for everyone to see.

However, I'm sorry to be the bearer of bad news but it looks like you have a security hole there.
With simple authentication and ldap without SSL, your password will transit on your network in the clear:
(cf:http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2)

So the next step before going to production might be to either put your ldap behind SSL or use DIGEST-MD5 and configure your LDAP with reversible encryption.

Good luck!