topic Re: Ldap confguration issues in Alfresco Archive

Ldap confguration issues

dasjlm — Mon, 26 Mar 2007 18:58:26 GMT

Sorry to be a pest but I have reviewed the doc/various hits etc, but still can't get ldap authentication to work. (I'm ignoring the user/group sync aspect at this point.)I'm testing the lastest Enterpise release and can't either our Sun Directory or Active Directory to work for web authentication.

Re: Ldap confguration issues

dasjlm — Tue, 27 Mar 2007 18:45:17 GMT

After a lot of mucking about and searching the forum I think I finally got the combination that allows ldap authenticaiton with passthru for CIFS.

I'm able to logon via the web and authenticate using Active Directory.

I'm able to use passthru for CIFS.

The tricks seem to be
-use simple authentication for ActiveDirectory to let anonymous work
-provide two ldap beans (one for web authentication and one for CIFS)

Not sure why but it works.

    <bean id="ldapAuthenticationComponentImpl" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–

            This maps between what the user types in and what is passed through to the underlying LDAP authentication.

            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".

            "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authentricate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
            Usually for simple authentication.

            –>
            <value>uwo\%s</value>
        </property>
    </bean>

<!– LDAP authentication configuration –>

    <!–

    You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
    web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
    authentication routes, like Active Directory.

    –>

    <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–

            This maps between what the user types in and what is passed through to the underlying LDAP authentication.

            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".

            "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authentricate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
            Usually for simple authentication.

            –>
            <value>uwo\%s</value>
        </property>
    </bean>

Re: Ldap confguration issues

finner — Wed, 29 Aug 2007 11:30:11 GMT

Hi dasjlm,
Would you have some more info on your configuration for CIFS / LDAP.
I've tried your solution but with the same results. (See my post : Passthru on CIFS ).

I've removed my NTLM configuration. I can login on the Web client and WebDAV against LDAP but not from CIFS.

My config is as follows:

file-servers-custom.xml


. . . 
<config evaluator="string-compare" condition="Filesystem Security" replace="true">
    <authenticator type="passthru">
        <Server>my.ldap.ip</Server>  <!–   LDAP server –>
    </authenticator>
</config>
. . .
‍‍‍‍‍‍‍‍‍

ldap-authentication-context.xml


. . .
<bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
     <property name="allowDeleteUser">
            <value>true</value>
      </property>
</bean>    


<bean id="authenticationComponent" class="es.retevision.ecompany.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentWrapper">
      <property name="LDAPInitialDirContextFactory">
         <ref bean="ldapInitialDirContextFactory"/>
      </property>
      <property name="userNameFormat">
         <value>uid=%s,ou=Users,dc=mydc1,dc=mydc2</value>         
      </property>
</bean>

<bean id="ldapAauthenticationComponentImpl" class="es.retevision.ecompany.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentWrapper">
      <property name="LDAPInitialDirContextFactory">
         <ref bean="ldapInitialDirContextFactory"/>
      </property>
      <property name="userNameFormat">
         <value>uid=%s,ou=Users,dc=mydc1,dc=mydc2</value>         
      </property>
</bean>

<bean id="ldapInitialDirContextFactory" class="es.retevision.ecompany.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryWrapper">
        <property name="initialDirContextEnvironment">
             <map>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry> 
                <entry key="java.naming.provider.url">
                    <value>ldap://my.ldap.server:port</value>
                </entry>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>     <!–  DIGEST-MD5 –>
                </entry>
             </map>
        </property>
</bean>

. . .
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

As you can see, I have 2 beans as suggested by your mail and I'm not using LDAP synchronization.
Sorry to drag this up again, any ideas would be appreciated.
Thanks
Finner

Re: Ldap confguration issues

daliakamal2005 — Sun, 16 Sep 2007 13:37:54 GMT

Hi all

I have the same problem and i spent more that 3 days to try all the suggestion but still I can not login to CIFS.

So i ask if u solve this problem.

Thanks a lot.