topic LDAP authentication and sync in Alfresco Archive

LDAP authentication and sync

multijob03 — Mon, 24 Feb 2014 20:03:15 GMT

Hi,I configured the ldap authentication following this guide (http://www.ochounos.com/#blog/6). It imported in Alfresco all users from ldap, but I can't login in Alfresco with user/password stored in Ldap. There is no error in alfresco.log or catalina.out so I don't have any idea of why it doesn't w

Re: LDAP authentication and sync

mrogers — Mon, 24 Feb 2014 23:28:00 GMT

The bits of the blog I looked at look o.k.

Re: LDAP authentication and sync

multijob03 — Tue, 25 Feb 2014 13:33:22 GMT

I compared the blog with the official docs and it seems fine. As I wrote, the sync worked (at least the first time), but I can't log in Alfresco with ldap users, just with users created directly in Alfresco: is there a setting to switch from "internal" authentication to ldap authentication?

Re: LDAP authentication and sync

crosati — Thu, 27 Feb 2014 19:45:20 GMT

I've the same problem. Fresh install of alfresco 4.2e on a centos 64. Then configured LDAP directly into the alfresco-global.properties



authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=true

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#
ldap.authentication.allowGuestLogin=true

# How to map the user id entered by the user to that passed through to LDAP
ldap.authentication.userNameFormat=uid=%s,ou=users,dc=armundia,dc=com

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://ldap…..com:389

# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync

# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=….

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The authentication mechanism to use for synchronization
ldap.synchronization.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.synchronization.java.naming.security.principal=cn\=ldap,dc\=armundia,dc\=com

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=…..

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=0

# If positive, this property indicates that range retrieval should be used to fetch
# multi-valued attributes (such as member) in batches of the specified size.
# Overcomes any size limits imposed by Active Directory.        
ldap.synchronization.attributeBatchSize=0

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=dc\=roles,dc\=alfresco,dc\=armundia,dc\=com

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=dc\=users,dc\=armundia,dc\=com

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

# The attribute on LDAP group objects to map to the authority name property in Alfresco
ldap.synchronization.groupIdAttributeName=cn

# The attribute on LDAP group objects to map to the authority display name property in Alfresco
ldap.synchronization.groupDisplayNameAttributeName=description


# The group type in LDAP
ldap.synchronization.groupType=groupOfNames

# The person type in LDAP
ldap.synchronization.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member

# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
ldap.synchronization.enableProgressEstimation=true

# Requests timeout, in miliseconds, use 0 for none (default)
ldap.authentication.java.naming.read.timeout=0
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I had no problem on the synchronization. After an alfresco restart i found all the users imported but it's impossible to login with them and there are no logs about it.

Anyone has resolved this issue ??

Thanks

Re: LDAP authentication and sync

mrogers — Fri, 28 Feb 2014 08:44:14 GMT

Looks o.k. But the username format is suspicious. Could you give examples of the userId in alfresco and the properties in ldap.

Re: LDAP authentication and sync

eswbitto — Fri, 28 Feb 2014 22:25:06 GMT

I ran into this same issue, but the cause for me was the SSL certificate/connection. I use centos 6.4 with Alfresco CE 4.2.d. I had to setup apache as the front end SSL connection to be able to actually log in with LDAP users. The tomcat certificate installation that is in the Alfresco documentation didn't help at all. So we opted to go the other route based on a fair amount of other Alfresco admin's have used this option as well.

Re: LDAP authentication and sync

crosati — Mon, 03 Mar 2014 10:49:34 GMT

In alfresco userid have the format first name letter "." lastname, foe exzmple mine is "c.rosati". I attach a screen shot of the relative ldap configuration which is not a really standart one (for what I'v understood).

Thanks for the help.

Re: LDAP authentication and sync

mrogers — Mon, 03 Mar 2014 11:17:16 GMT

crosati

So if your user id in alfresco is c.rostati then I'd expect it to work. But leave ldap.authentication.userNameFormat blank

If your user id in alfresco is your email address then you need to change ldap.synchronization.userIdAttributeName=mail

Re: LDAP authentication and sync

crosati — Mon, 03 Mar 2014 12:20:57 GMT

The problem was the ldap.authentication.userNameFormat, setting it to blank resolved the login issue.

Thanks.

Re: LDAP authentication and sync

multijob03 — Tue, 11 Mar 2014 17:59:04 GMT

Putting the ldap.authentication.userNameFormat as blank worked for me too.

thanks a lot!

Re: LDAP authentication and sync

muhamedhe — Wed, 12 Mar 2014 15:26:47 GMT

Hi everyone,
I'm having troubles with my LDAP-AD. The users can login, but your personal information not being loaded like email, name, last name… etc.
How can i fix this?

THIS IS MY ALFRESCO-GLOBAL:

ldap.authentication.java.naming.security.authentification=simple
ldap.authentication.java.naming.provider.url=ldap://fserver.mydomain.com.br:389
ldap.authentication.userNameFormat=%s@mydomain.com.br

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad

ntlm.authentication.sso.enabled=false

alfresco.authentication.authenticateCIFS=true
alfresco.authentication.allowGuestLogin=false

ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.authentication.active=true
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=Administrator@mydomain.com.br
ldap.synchronization.java.naming.security.credentials=**********
ldap.synchronization.groupQuery=(&(objectclass\=group)(memberOf\=CN\=Diretoria,DC\=mydomain,DC\=com,DC\=br))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(\(memberOf\=CN\=Diretoria,DC\=mydomain,DC\=com,DC\=br))(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(\(memberOf\=CN=Diretoria,DC\=mydomain,DC\=com,DC\=br)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(\(memberOf\=CN=Diretoria,DC\=mydomain,DC\=com,DC\=br))(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupSearchBase=dc\=mydomain,dc\=com,dc\=br
ldap.synchronization.userSearchBase=dc\=mydomain,dc\=com,dc\=br

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
synchronization.synchronizeChangesOnly=false

AND MY ALFRESCO.LOG FILE:

INFO [org.alfresco.repo.admin] Using database URL 'jdbcostgresql://localhost:5432/alfresco' with user 'alfresco'.
INFO [org.alfresco.repo.admin] Connected to database PostgreSQL version 9.2.4
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'sysAdmin' subsystem, ID: [sysAdmin, default]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'sysAdmin' subsystem, ID: [sysAdmin, default] complete
INFO [org.springframework.extensions.webscripts.TemplateProcessorRegistry] Registered template processor Repository Template Processor for extension ftl
INFO [org.springframework.extensions.webscripts.ScriptProcessorRegistry] Registered script processor Repository Script Processor for extension js
INFO [org.alfresco.repo.domain.schema.SchemaBootstrap] Connecting to database: jdbcostgresql://localhost:5432/alfresco, UserName=alfresco, PostgreSQL Native Driver
INFO [org.alfresco.repo.domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.PostgreSQLDialect.
INFO [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, alfinst]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, alfinst] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, ldap1]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, ldap1] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Search' subsystem, ID: [Search, managed, solr]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Search' subsystem, ID: [Search, managed, solr] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'thirdparty' subsystem, ID: [thirdparty, default]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'thirdparty' subsystem, ID: [thirdparty, default] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'OOoDirect' subsystem, ID: [OOoDirect, default]
WARN [org.alfresco.util.OpenOfficeConnectionTester] An initial OpenOffice connection could not be established.
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'OOoDirect' subsystem, ID: [OOoDirect, default] complete
INFO [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: C:\Alfresco\alf_data
INFO [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
INFO [org.alfresco.repo.admin.patch.PatchExecuter] No patches were required.
INFO [org.alfresco.repo.module.ModuleServiceImpl] Found 2 module(s).
INFO [org.alfresco.repo.module.ModuleServiceImpl] Starting module 'org.alfresco.module.vti' version 1.3.
[org.alfresco.repo.module.ModuleServiceImpl] Starting module 'org.alfresco.integrations.google.docs' version 2.0.4.
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'fileServers' subsystem, ID: [fileServers, default]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'fileServers' subsystem, ID: [fileServers, default] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'imap' subsystem, ID: [imap, default]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'imap' subsystem, ID: [imap, default] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'email' subsystem, ID: [email, outbound]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'email' subsystem, ID: [email, outbound] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'email' subsystem, ID: [email, inbound]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'email' subsystem, ID: [email, inbound] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Subscriptions' subsystem, ID: [Subscriptions, default]
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Subscriptions' subsystem, ID: [Subscriptions, default] complete
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Synchronization' subsystem, ID: [Synchronization, default]
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldap1'
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronization,Category=directory,id1=ldap1,id2=1 Group Analysis: Commencing batch of 0 entries
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronization,Category=directory,id1=ldap1,id2=1 Group Analysis: Completed batch of 0 entries
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldap1'
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronization,Category=directory,id1=ldap1,id2=6 User Creation and Association: Commencing batch of 0 entries
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronization,Category=directory,id1=ldap1,id2=6 User Creation and Association: Completed batch of 0 entries
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 usuário(s) e 0 grupo(s) processado(s)
INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.7.0_25-b16; maximum heap size 682,688MB
INFO [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community). Current version: 4.2.0 (r56674-b4848) schema 6.033. Originally installed version: 4.2.0 (r56674-b4848) schema 6.033.

Thanks.

Re: LDAP authentication and sync

eswbitto — Wed, 12 Mar 2014 22:08:00 GMT

Have you removed "On-Demand Users"?

There is a possibility that you aren't actually authenticating with your AD containers. If you haven't removed it before setting up LDAP then Alfresco will create users.

Go to /alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/authentication-services-context.xml

Locate


<property name="createMissingPeople">
change the value to <value>false</value>
‍‍‍‍

Also…

Change this


ldap.authentication.userNameFormat=%s@mydomain.com.br
‍‍‍

to this


ldap.authentication.userNameFormat=domainname\\%s
‍‍‍

Re: LDAP authentication and sync

xiaoqunhua — Fri, 25 Apr 2014 00:18:23 GMT

It is Just what I need.Thank you!

Re: LDAP authentication and sync

elliotness — Mon, 21 Sep 2015 14:55:50 GMT

In Alfresco 5.X

add in ~/tomcat/shared/classes/alfresco-global.properties

create.missing.people=false

Regards