topic Re: Contextless LDAP authentication in Alfresco Archive

Contextless LDAP authentication

eron123 — Thu, 29 Jun 2006 16:39:53 GMT

Hi team, We have Alfresco 1.2.1 running and authenticating using simple bind to an LDAP directory (eDirectory, which conforms to OpenLDAP). We would like to configure Alfresco to login without context. As the users are in different containers, we can not use a string like the following:'cn=%s,o=a

Re: Contextless LDAP authentication

andy — Fri, 30 Jun 2006 07:53:19 GMT

Hi

I am not sure exactly what the issue is here….

You could use chainging authentication. This allows an ordered list of authentication services to be specified. You could have multiple LDAP repos or multiple branch locations for users in the same LDAP repo. You can use abstract spring beans for the common configuration.

Digest MD5 should solve the problem. What was the issue here?

Regards

Andy

Re: Contextless LDAP authentication

eron123 — Sat, 01 Jul 2006 03:51:55 GMT

Andy,

We want to have a user log in with just thier uid (in eDirectory, this is the CN attribute). This means the alfresco login module should search the tree for the user with that name to authenticate to. Since users are in various containers in the tree, we can not hard-code a container like in the example.

The users don't know their full DN, and forcing them to enter it is not desirable anyway.

What are the options for solving this? Should the MD5 Digest solution take care of this?

Re: Contextless LDAP authentication

andy — Mon, 03 Jul 2006 10:51:29 GMT

Hi

It sounds like the best thing is to configure chaining authentication to use an LDAP authentication service against the same repo for each path where you have users. They can then use the cn to login.

MD5 authentication would still have to be able to find users - but it would involve a search based on uid attribue to find the user and therefore get the password. The search would not need to be restricted by path and is done on the ldap server. Your users would have to type in the uid. The wiki contains information on how to set up md5 authentication for open ldap.

Regards

Andy