topic Re: Ldap query on single subOU in Alfresco Archive

Ldap query on single subOU

ermantis — Mon, 12 Aug 2013 09:07:29 GMT

Hello everyone,So this is what my ldap looks like :-red.lan—Groups(OU)——Computers(SubOU)——Printers(SubOU)——<strong>Users</strong>(SubOU)—Some(OU)—<strong>Users</strong>(OU)——SomeOther(SubOU)So, i'm trying to make a query that would select all the groups in Users(SubOU), but n

Re: Ldap query on single subOU

iblanco — Wed, 14 Aug 2013 07:43:08 GMT

Sorry Ermantis but I don't get what your problem is, why can't you just use this?

ldap.synchronization.groupSearchBase=ou\=Users,ou\=Groups,dc\=red,dc\=lan

The search base is specified with a fully qualified Distinguised Name so there is not duplicity or confusion possible with the other Users OU.

Re: Ldap query on single subOU

ermantis — Wed, 14 Aug 2013 07:58:00 GMT

Well, I've tryed and put this query :

ldap.synchronization.groupSearchBase=ou\=Users,ou\=Groups,dc\=red,dc\=lan‌‍

But it wont work ! It still imports all groups from the Groups OU, not only those under Users…
I add : there are some other OUs under Users\Groups, and I must import all the groups inside them. Don't know if it changes anything though (don't think so).
Thanks for your reply.

Re: Ldap query on single subOU

iblanco — Wed, 14 Aug 2013 11:43:00 GMT

Are you sure that it is importing those other groups ? Have you deleted them after changing the configuration and restarting Alfresco ?

By default Alfresco synchornization is done in a differential way or differential with deletions. The groups might not be deleted because although it is not taking them back to Alfresco again they do still exist. Not 100% sure about that though.

Just in case I would configure Alfresco to make a FULL synchronization instead of differential and program the CRON to trigger it now:

http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem

Re: Ldap query on single subOU

ermantis — Wed, 14 Aug 2013 12:26:48 GMT

I haven't tryed deleting those groups.
I've set synchronization.synchronizeChangesOnly to false already and it is not deleting groups already created… But suppressing groups manually seems to do the trick : they are not re-imported.
It does not automatically suppress the groups though… How could I change that ? Also I can't find out how to pass the synchronization in Partial With Deletion mode ?
Or is there a way to delete all existing groups so it syncs from scrap ?

Re: Ldap query on single subOU

iblanco — Wed, 14 Aug 2013 13:43:05 GMT

Ermantis, have you read the provide link about synchronization ?

On startup and authentication a "differential" sync is done, not a "differential with removals" or a "full" one. If you run a "full" or probably even a "differential with removals" sync old groups should dissapear.

You should change in alfresco-global.properties the cron expression to fire a "differential with removals" or "full" synchronization:


# The cron expression defining when imports should take place
synchronization.import.cron=0 0 0 * * ?
‍‍‍‍

As you can see by default it fires every midnight, change it to something like "0 0/5 * * * ?" so that it fires every 5 minutes and restart Alfresco. Once you have ended don't forget to reestablish the cron expression to something more reasonable than firingi sync every 5 minutes and restart again.

Re: Ldap query on single subOU

ermantis — Tue, 20 Aug 2013 13:34:27 GMT

Changing the cron expression doesnt' trigger a full sync.
I've set
synchronization.import.cron=0 0/5 * * * ?
synchronization.synchronizeChangesOnly=false
synchronization.allowDeletions=true
in Alfresco-global.properties.
Then restarted alfresco.
Still doesn't work : groups aren't deleted.
Am I doing something wrong ?

Re: Ldap query on single subOU

ermantis — Tue, 27 Aug 2013 08:21:40 GMT

Any update ? 😕

Re: Ldap query on single subOU

iblanco — Mon, 02 Sep 2013 08:04:33 GMT

Enable <a href="http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem#Debugging">logging for the synchronization as stated in the wiki</a> and report what it says when synchronization fires.

Authorities in Alfresco are related to zones, so if a full synchronization fires and some groups "dissapear" they should dissapear also in Alfresco. I think zones are named after the instance name you use for you ldap source subsytem, typically "ldap1". Have you changed that name ? If you change that name I guess there is a chance for Alfresco not to correctly relate the old groups with the LDAP.

Re: Ldap query on single subOU

ermantis — Tue, 12 Nov 2013 15:38:11 GMT

Well, I totaly deleted the configuration and made it from the beginning and it seems to work. Thanks.