topic Re: LDAP-config for mutiple AD queries in Alfresco Archive

LDAP-config for mutiple AD queries

jdel23 — Wed, 12 Feb 2014 16:53:39 GMT

Folks, I am at my wits end trying to configure LDAP to query AD using multiple user and group search bases. It would appear that there have been many similar posts in the past on this forum but I cannot see any resolution to the problem. If someone can post a working syntax to support multiple AD pa

Re: LDAP-config for mutiple AD queries

afaust — Wed, 12 Feb 2014 20:12:43 GMT

Hello,

having worked on an Alfresco system with thousands of groups and users in the past I can tell you that the advice to separate the configuration into multiple LDAP configurations / components is a valid one. And it is the only solution I know of to your problem. We have had a customer with users in 3 different LDAP servers (not just search bases, but different LDAP systems alltogether) due to acquisition and integrated these systems in Alfresco using about 4 or 5 LDAP configurations (we had to sort out some overlaps).
I do not know what part of the wiki you are referring to (I could not find something in a cursory search for "lockout").

There is also no problem from what I know with the multiple synchronisations. They will be fired from the same thread but will execute sequentially.

Regards
Axel

Re: LDAP-config for mutiple AD queries

jdel23 — Fri, 14 Feb 2014 15:37:13 GMT

Hi Axel,

Thank you very much for your reply. I took your advice and set up two LDAP configurations - they import the same group but have different userSearchBases. Unfortunately this does not solve my problem as the group is imported ok with the users from the LDAP1 configuration but the users from the LDAP2 are not imported ( I have validated the serach string).

Regarding my reference to the wiki - here it is: It's not recommended to include the same LDAP server in the chain more than once as it could cause acount locking, see https://issues.alfresco.com/jira/browse/ALF-5444

Regards

Re: LDAP-config for mutiple AD queries

afaust — Sun, 16 Feb 2014 18:23:43 GMT

Hello,

ok - the recommendation refers to the use of LDAP / LDAP-AD to actually authenticate users.
If you do not authenticate users using LDAP - instead using passthru or kerberos - you can have multiple configurations for the same LDAP. I have never used LDAP / LDAP-AD for authentication in Alfresco - our customers typically use passthru or kerberos, or do not synchronize with any directory at all.

Regards
Axel

Re: LDAP-config for mutiple AD queries

mrogers — Sun, 16 Feb 2014 21:38:28 GMT

And Alf-5444 was fixed years ago, its no longer relevant.