topic Re: forcer la syncro des users AD (membres) in Alfresco Archive

forcer la syncro des users AD (membres)

sergio1024 — Tue, 19 Jan 2010 16:12:49 GMT

Bonjour,J'ai configuré authentification LDAP de la manière suivante eul les membres du groupe GR-ALFRESCO sont importé.Seulement voilà, la 1er démarrage m'a bien importé les users, mais maintenant si j'ajoute des users dans le groupe AD "GR-ALFRESCO" ilsne s'ajoute dans alfresco malgré un redémarr

Re: forcer la syncro des users AD (membres)

sergio1024 — Wed, 20 Jan 2010 10:32:42 GMT

Bonjour,

au niveau de la config j'ai activé la chaine authentification :

authentication.chain=ldap-ad1:ldap-ad,alfrescoNtlm1:alfrescoNtlm
‍‍

Ci-dessous le fichier "ldap-ad-authentication.properties" avec en gras les lignes que j'ai modifiées :

# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
[b]ldap.authentication.active=true[/b]

# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
[b]ldap.authentication.allowGuestLogin=true[/b]

# How to map the user id entered by the user to taht passed through to LDAP
# In Active Directory, this can either be the user principal name (UPN) or DN.
# UPNs are in the form <sAMAccountName>@domain and are held in the userPrincipalName attribute of a user
[b]ldap.authentication.userNameFormat=%s@mondom.local[/b]

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
[b]ldap.authentication.java.naming.provider.url=ldap://@ipsrv:389[/b]

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=simple

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=Administrateur

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
[b]ldap.synchronization.java.naming.security.principal=user@mondom.local[/b]

# The password for the default principal (only used for LDAP sync)
[b]ldap.synchronization.java.naming.security.credentials=pwd[/b]

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# The query to select all objects that represent the groups to import.
[b]ldap.synchronization.groupQuery=(&(objectclass\=group)(memberOf\=cn\=GRP_ALFRESCO,ou\=Groups,ou\=site1,dc\=mondom,dc\=local))[/b]

# The query to select objects that represent the groups to import that have changed since a certain time.
[b]ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(memberOf\=cn\=GRP_ALFRESCO,ou\=Groups,ou\=site1,dc\=mondom,dc\=local)(!(modifyTimestamp<\={0})))[/b]

# The query to select all objects that represent the users to import.
[b]ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf\=cn\=GRP_ALFRESCO,ou\=Groups,ou\=site1,dc\=mondom,dc\=local)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))[/b]

# The query to select objects that represent the users to import that have changed since a certain time.
[b]ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(memberOf\=cn\=GRP_ALFRESCO,ou\=Groups,ou\=site1,dc\=mondom,dc\=local)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))[/b]

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
[b]ldap.synchronization.groupSearchBase=dc\=mondom,dc\=local[/b]

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
[b]ldap.synchronization.userSearchBase=dc\=mondom,dc\=local[/b]

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=sAMAccountName

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=company

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronization.groupType=group

# The person type in LDAP
ldap.synchronization.personType=user

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Au 1er démarrage d'alfresco mes users membres du GRP_ALFRESCO ont bien été importés. Mais si j'en rajoute, ils ne sont pas pris en compte…(enfin ça dépend, 1 fois pendant un redémarrage il a pris 2 de pus en compte…).
Si je me connecte dans alfreso avec un compte AD non créé, je me connecte, le user est créé mais aucune infos n'est remontée (nom complet, courriel…)

si vous avec des infos je suis preneur !!

merci.

Re: forcer la syncro des users AD (membres)

sergio1024 — Wed, 20 Jan 2010 14:11:42 GMT

Bonjour,

En fait mon but est que :

1 - seul les utilisateurs AD membres du groupe AD GR_ALFRESCO puissent se logguer sous ALFRESCO.

2 - Les infos des ces users (nom complet, mail…) soit importés dans ALFRESCO.

3 - Si j'enlève ou j'ajoute un membre du GR_ALFRESCO dans l'AD cela se répercute dans ALFRESCO.

Pouvez-vous m'orienter sur les fichiers à configurer..?? ldapad, passthru ? authentification ou synchronisation ?…

Merci.

Re: forcer la syncro des users AD (membres)

sergio1024 — Thu, 21 Jan 2010 11:01:48 GMT

personne pour m'orienter ??

ci-dessous mes logs de démarrage…à la fin on voit :

[b]14:50:38,953 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed[/b]‍

mais je ne sais pas pourquoi ?

14:48:45,263 INFO  [org.alfresco.config.JndiPropertiesFactoryBean] Loading properties file from class path resource [alfresco/repository.properties]
14:48:45,267 INFO  [org.alfresco.config.JndiPropertiesFactoryBean] Loading properties file from class path resource [alfresco/domain/transaction.properties]
14:48:45,268 INFO  [org.alfresco.config.JndiPropertiesFactoryBean] Loading properties file from URL [file:/usr/share/tomcat6/shared/classes/alfresco-global.properties]
14:48:45,416 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:48:57,873 INFO  [org.alfresco.config.JndiPropertiesFactoryBean] Loading properties file from file [/usr/share/tomcat6/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap-ad1/ldap-ad-authentication.properties]
14:49:22,556 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.MySQLInnoDBDialect.
14:49:24,418 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
14:49:25,265 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'sysAdmin' subsystem, ID: [sysAdmin, default]
14:49:25,288 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:49:25,297 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'sysAdmin' subsystem, ID: [sysAdmin, default] complete
14:49:29,556 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] Index recovery started: 749 transactions.
14:49:29,918 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 10 % complete.
14:49:29,920 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 20 % complete.
14:49:29,921 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 30 % complete.
14:49:29,923 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 40 % complete.
14:49:29,923 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 50 % complete.
14:49:29,924 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 60 % complete.
14:49:29,926 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 70 % complete.
14:49:29,926 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 80 % complete.
14:49:29,927 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 90 % complete.
14:49:29,928 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] 100 % complete.
14:49:35,037 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'thirdparty' subsystem, ID: [thirdparty, default]
14:49:35,145 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:49:37,959 WARN  [org.alfresco.util.OpenOfficeConnectionTester] An initial OpenOffice connection could not be established.
14:49:37,961 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'thirdparty' subsystem, ID: [thirdparty, default] complete
14:50:30,419 INFO  [org.alfresco.repo.node.index.FullIndexRecoveryComponent] Index recovery completed.
14:50:30,468 INFO  [org.alfresco.repo.node.index.AVMFullIndexRecoveryComponent] Rebuilding indexes for 1 AVM Stores
14:50:30,468 INFO  [org.alfresco.repo.node.index.AVMFullIndexRecoveryComponent]     Rebuilding index for sitestore
14:50:30,580 INFO  [org.alfresco.repo.node.index.AVMFullIndexRecoveryComponent]   Reindex   100% complete
14:50:30,581 INFO  [org.alfresco.repo.node.index.AVMFullIndexRecoveryComponent] Finished rebuilding indexes for AVM Stores
14:50:31,253 INFO  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: /var/lib/alfresco
14:50:31,282 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
14:50:31,873 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] No patches were required.
14:50:31,880 INFO  [org.alfresco.repo.module.ModuleServiceImpl] Found 0 module(s).
14:50:31,904 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'fileServers' subsystem, ID: [fileServers, default]
14:50:31,930 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:50:32,387 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1]
14:50:32,426 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:50:32,562 WARN  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://xx.xx.xx.xx:389
14:50:32,633 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://xx.xx.xx.xx:389
14:50:32,636 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://xx.xx.xx.xx:389
14:50:32,792 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://xx.xx.xx.xx:389
14:50:32,817 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1] complete
14:50:32,818 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1]
14:50:32,846 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:50:33,031 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1] complete
14:50:38,069 ERROR [org.alfresco.fileserver] Failed to get local domain/workgroup name, using default of WORKGROUP
14:50:38,069 ERROR [org.alfresco.fileserver] (This may be due to firewall settings or incorrect <broadcast> setting)
14:50:38,144 ERROR [org.alfresco.fileserver] [SMB] Server error : org.alfresco.jlan.server.config.InvalidConfigurationException: Error initializing TCP-IP SMB session handler, Permission denied
14:50:38,148 ERROR [org.alfresco.fileserver] org.alfresco.jlan.server.config.InvalidConfigurationException: Error initializing TCP-IP SMB session handler, Permission denied
14:50:38,149 ERROR [org.alfresco.fileserver]    at org.alfresco.jlan.smb.server.nio.NIOCifsConnectionsHandler.initializeHandler(NIOCifsConnectionsHandler.java:265)
14:50:38,149 ERROR [org.alfresco.fileserver]    at org.alfresco.jlan.smb.server.SMBServer.run(SMBServer.java:478)
14:50:38,149 ERROR [org.alfresco.fileserver]    at java.lang.Thread.run(Thread.java:619)
14:50:38,149 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'fileServers' subsystem, ID: [fileServers, default] complete
14:50:38,149 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'imap' subsystem, ID: [imap, default]
14:50:38,157 ERROR [org.alfresco.fileserver] [FTP] FTP Socket error : java.net.BindException: Permission denied
14:50:38,158 ERROR [org.alfresco.fileserver] java.net.BindException: Permission denied
14:50:38,159 ERROR [org.alfresco.fileserver]    at java.net.PlainSocketImpl.socketBind(Native Method)
14:50:38,159 ERROR [org.alfresco.fileserver]    at java.net.PlainSocketImpl.bind(PlainSocketImpl.java:365)
14:50:38,159 ERROR [org.alfresco.fileserver]    at java.net.ServerSocket.bind(ServerSocket.java:319)
14:50:38,159 ERROR [org.alfresco.fileserver]    at java.net.ServerSocket.<init>(ServerSocket.java:185)
14:50:38,159 ERROR [org.alfresco.fileserver]    at java.net.ServerSocket.<init>(ServerSocket.java:141)
14:50:38,159 ERROR [org.alfresco.fileserver]    at org.alfresco.jlan.ftp.FTPServer.run(FTPServer.java:561)
14:50:38,160 ERROR [org.alfresco.fileserver]    at java.lang.Thread.run(Thread.java:619)
14:50:38,174 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:50:38,278 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'imap' subsystem, ID: [imap, default] complete
14:50:38,279 INFO  [org.alfresco.repo.usage.UserUsageTrackingComponent] Enabled - calculate missing user usages …
14:50:38,381 INFO  [org.alfresco.repo.usage.UserUsageTrackingComponent] Found 0 users to recalculate
14:50:38,382 INFO  [org.alfresco.repo.usage.UserUsageTrackingComponent] … calculated missing usages for 0 users
14:50:38,382 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'Synchronization' subsystem, ID: [Synchronization, default]
14:50:38,442 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:50:38,775 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap-ad1'
14:50:38,800 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving groups changed since 21 janv. 2010 11:00:57 from user registry 'ldap-ad1'
14:50:38,882 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap-ad1 Group Analysis: Commencing batch of 0 entries
14:50:38,885 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap-ad1 Group Analysis: Completed batch of 0 entries
14:50:38,895 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving users changed since 21 janv. 2010 10:10:11 from user registry 'ldap-ad1'
14:50:38,903 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap-ad1 User Creation and Association: Commencing batch of 0 entries
14:50:38,909 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] ldap-ad1 User Creation and Association: Completed batch of 0 entries
14:50:38,952 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap-ad1'
14:50:38,953 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
14:50:38,980 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
14:50:38,998 INFO  [org.alfresco.util.OpenOfficeConnectionTester] The OpenOffice connection was re-established.
14:50:40,394 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_15-b03; maximum heap size 1016,125MB
14:50:40,395 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community): Current version 3.2.0 (r2 2440) schema 3300 - Originally installed version 3.2.0 (@build-number@) schema 2019
14:51:13,637 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Starting 'wcm_deployment_receiver' subsystem, ID: [wcm_deployment_receiver, default]
14:51:13,684 INFO  [org.alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
14:51:13,816 INFO  [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] Startup of 'wcm_deployment_receiver' subsystem, ID: [wcm_deployment_receiver, default] complete‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: forcer la syncro des users AD (membres)

sergio1024 — Fri, 22 Jan 2010 10:50:56 GMT

bonjour,

Comment fonctionnne la valeur import.cron=0 0 * * * ?

cdlt.

Re: forcer la syncro des users AD (membres)

michaelh — Fri, 22 Jan 2010 13:10:15 GMT

Pour les tâches planifiées, voir http://wiki.alfresco.com/wiki/Scheduled_Actions#Cron_Explained

Re: forcer la syncro des users AD (membres)

sergio1024 — Fri, 22 Jan 2010 15:18:10 GMT

Merci.

sinon je suis toujours bloqué…la syncro ne se fait pas..c bon au niveau des groupes mais les users c'est aléatoire…

Re: forcer la syncro des users AD (membres)

rguinot — Mon, 25 Jan 2010 15:22:03 GMT

Etant donné que vous êtes en 3.2, il vaudrait mieux configurer le LDAP (synchro + authentification) en utilisant le mécanisme de subsystem. l' "ancienne" méthode est gardée pour compatibilité mais n'est pas forcément futureproof. La doc est ici : http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems

Sauf erreur de ma part, je ne vois pas les propriétés :

ldap.synchronization.import.person.cron=12 40 * * * ?
ldap.synchronization.import.group.cron=12 41 * * * ?‍‍

dans votre configuration, qui vous permettraient de configurer la fréquence comme bon vous semble.
Dans cet exemple, ici la synchro des gens est faite à 12h40 tous les jours, la synchro des groupes à 12h41.