topic Re: Alfresco + LDAP +eDirectory in Alfresco Archive

Alfresco + LDAP +eDirectory

linuxos77 — Mon, 23 Oct 2006 20:02:56 GMT

I'm trying to configure Alfresco to authenticate via our eDirectory server. I copied the ldap-authentication-context.xml.sample to /WEB-INF/classes/alfresco/extension and made the changes shown below:<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'ht

Re: Alfresco + LDAP +eDirectory

andy — Mon, 23 Oct 2006 21:13:58 GMT

Hi

Can you log in as one of the users in your ldap store via the UI?

To sync users and groups you need to remove the comments around


       <!– Commented out to disable
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
        –> 
‍‍‍‍‍‍‍

To schedule th sync up.

Regards

Andy

Re: Alfresco + LDAP +eDirectory

linuxos77 — Tue, 24 Oct 2006 16:31:38 GMT

I think we're getting closer… I removed the comments around the scheduler. Now when the service comes up it looks at out LDAP tree (I'm running a network scan to watch the traffic). However, my logins are still failing. The catalina.out log shows the following error:

12:42:31,507 ERROR [quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:206)
        at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:36)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:191)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:516)
Caused by: org.alfresco.repo.importer.ExportSourceImporterException: User returned by user search does not have mandatory user id attribute

Is there a way to know what attribute it's tripping on?

Re: Alfresco + LDAP +eDirectory

andy — Wed, 25 Oct 2006 14:20:53 GMT

Hi

One of your users in LDAP does not have a uid attribute (as specified in the import) - this is mandatory. (1.4 can be confugured to skip such entries)
You can fix your ldap query to exclude these users or fix them up in your LDAP repository.

Regards

Andy

Re: Alfresco + LDAP +eDirectory

linuxos77 — Thu, 26 Oct 2006 14:55:21 GMT

I'll have to check with our eDir admin and see what's going on with that. Do I use the same LDAP.xml file to configure LDAP in 1.4? If so I'll try that. We're still about 6-12 months from considering deployment (if this demo works we would probably purchase Ent edition).

Re: Alfresco + LDAP +eDirectory

andy — Fri, 27 Oct 2006 11:33:29 GMT

Hi

1.3 and 1.4 config are similar. There have been a few bug fixes so I would start again with the 1.4 example file.

The query is easy to fix up ….


(objectclass=inetOrgPerson)
‍‍‍

becomes


(& (objectclass=inetOrgPerson)(uid=*))
‍‍‍

This means only inetOrgPersons that have a vald uid are found (or whatever attribute you use for this).

Regards

Andy

Re: Alfresco + LDAP +eDirectory

linuxos77 — Fri, 27 Oct 2006 15:18:46 GMT

THANK YOU!! I can now authenticate via eDirectory!! Now for the final question, it appears looking at the ldap properties file that some attributes should automatically get pulled in (first name, last name and email address are the ones I want). Using the example ldap file I put in out Edirectory information and it works for authentication. However, when I log in and go to my user properties my first name entry is the only one filled in (and it's filled in with my userid, not first name). Our Edir server is using the correct attribute names in the information is stored in LDAP, but not getting pulled into Alfresco. This is the final step I need before I can demo this. I really appreciate all the help thus far.

Re: Alfresco + LDAP +eDirectory

dmrnj — Thu, 02 Nov 2006 16:21:00 GMT

Hi

1.3 and 1.4 config are similar. There have been a few bug fixes so I would start again with the 1.4 example file.

The query is easy to fix up ….
(objectclass=inetOrgPerson)
‍‍‍
becomes
(& (objectclass=inetOrgPerson)(uid=*))
‍‍‍
This means only inetOrgPersons that have a vald uid are found (or whatever attribute you use for this).

Regards

Andy

I'd be careful with this. You're inputting a value into XML with an ampersand, which means you'll need to pass it as character data, or:
<![CDATA[(& (objectclass=inetOrgPerson)(uid=*))]]>

Here's my problem, though. We're using userPrincipalName to log in, so I obviously edited that attribute above, and our objectclass is user. I went ahead and modified the ldap xml file, and when i ran, this is what was returned:

ERROR [org.quartz.core.ErrorLogger] Job (DEFAULT.ldapGroupJobDetail threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: org.alfresco.repo.importer.ExportSourceImporterException: Failed to import]
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:516)
* Nested Exception (Underlying Cause) —————
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:206)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:36)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:191)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:516)
Caused by: org.alfresco.repo.importer.ExportSourceImporterException: User missing user id attribute DN =CN=Adminguy,CN=Users,DC=our,DC=domain,DC=edu att = userPrincipalName
   at org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource.buildGroupsAndRoots(LDAPGroupExportSource.java:508)
   at org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource.generateExport(LDAPGroupExportSource.java:161)
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:166)
   … 3 more

Nobody else's account returns this, because everyone else has userPrincipalName defined. And, unlike before, when I didn't have this filter in place, Alfresco is still running and I can still log in. Still, why is this a problem? Shouldn't the filter just NOT be pulling adminguy up?

Re: Alfresco + LDAP +eDirectory

andy — Mon, 20 Nov 2006 15:16:11 GMT

THANK YOU!! I can now authenticate via eDirectory!! Now for the final question, it appears looking at the ldap properties file that some attributes should automatically get pulled in (first name, last name and email address are the ones I want). Using the example ldap file I put in out Edirectory information and it works for authentication. However, when I log in and go to my user properties my first name entry is the only one filled in (and it's filled in with my userid, not first name). Our Edir server is using the correct attribute names in the information is stored in LDAP, but not getting pulled into Alfresco. This is the final step I need before I can demo this. I really appreciate all the help thus far.

It sounds like your users are not getting pulled from LDAP.
It is also possible the person information is created blank at login time - it will be updated sometime later when the update from ldap runs.

Make sure that the import jobs are scheduled, by default they are not.
Turn on debug for org.alfresco.repo.security.authentication.ldap.

Regards

Andy

Re: Alfresco + LDAP +eDirectory

andy — Mon, 20 Nov 2006 15:21:18 GMT

Hi

1.4 allows better configuration of what to do whe there are errors importing people. You can carry on and just log these issues..

You will still have your old person entries from when import worked. (If you were not auto creating people, this may have stopped you loggin in before.)

If you have a presence filter for the uid attribute all I can think of is that it matched in the search but you are not allowed to see the actual value??

Regards

Andy

Re: Alfresco + LDAP +eDirectory

rubi — Fri, 11 Jan 2008 12:41:34 GMT

Hello linuxos77

Find any solution of mapping attributes to Alfresco from AD? I'am also struggling with exporting email address over til alfresco repository…

Re: Alfresco + LDAP +eDirectory

rubi — Tue, 12 Feb 2008 07:16:09 GMT

Ok. solved this one.
I removed my restrict personQuery. then the mapping of email worked.

Re: Alfresco + LDAP +eDirectory

mcando — Mon, 25 Feb 2008 13:54:31 GMT

Hi linuxos77, I've tried to configure my Alfresco to use our eDir accounts too, but I can't find the file ldap-authentication-context.xml.sample to begin with.
I'm using Alfresco Community 2.1, is this version support?
Is that file the only thing needed to authenticate to Alfresco using eDir?
Thank you!