topic Re: LDAP User Group Synchronisation with AD : Empty Groups in Alfresco Archive

LDAP User Group Synchronisation with AD : Empty Groups

dushyanth_h — Mon, 05 Jun 2006 19:35:25 GMT

Hey all,I posted about this problem in the forums a few days back and did not find any response . So, iam trying my luck again.I have Alfresco setup with NTLM pass-thru authentication with Active Directory for both CIFS and alfresco and also have LDAP user/Group Sync setup.However, when I check ou

Re: LDAP User Group Synchronisation with AD : Empty Groups

simon — Tue, 06 Jun 2006 12:25:19 GMT

Don't know if this can help you but hey, who knows…

1. We had some empty group import issues with Alfresco as well but this bug seems to be solved in the 1.2.1 release. You are using 1.2.1 so I don't see why Alfresco is complaining. We had the Enterprise version and you're using the Community one, could this be the problem?

2. One other problem could be the request limit in AD. AD only returns the first 1000 records and then stops, this is an AD setting and can be adjusted if needed.

3. Debug your Alfresco LDAP settings with Log4J. Add this line to the log4j.properties and restart Alfresco, look in the alfresco.out log for debug messages.

log4j.logger.org.alfresco.repo.security.authentication.ldap=debug‍

Good luck!

Re: LDAP User Group Synchronisation with AD : Empty Groups

dushyanth_h — Tue, 06 Jun 2006 18:06:16 GMT

Hey,

Thanks for the advice.

2. One other problem could be the request limit in AD. AD only returns the first 1000 records and then stops, this is an AD setting and can be adjusted if needed.

Our AD is not that populated yet. However I have increased the MaxPageSize to 99999 using ntdsutil.exe.

3. Debug your Alfresco LDAP settings with Log4J. Add this line to the log4j.properties and restart Alfresco, look in the alfresco.out log for debug messages.

Enabled debug. Logs look all clean. No errors. Below are last few lines..


4:49:36,853 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Account Operators
04:49:36,853 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=User1,OU=Users,OU=DeptAccounts,OU=departments,DC=abc,DC=com
04:49:36,857 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=User2,OU=Users,OU=DeptAccounts,OU=departments,DC=abc,DC=com
04:49:36,861 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=User3,OU=Users,OU=DeptAccounts,OU=departments,DC=abc,DC=com
04:49:36,865 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=User4,OU=Users,OU=DeptAccounts,OU=departments,DC=abc,DC=com
04:49:36,870 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=User5,OU=Users,OU=DeptAccounts,OU=departments,DC=abc,DC=com
04:49:36,890 DEBUG [authentication.ldap.LDAPGroupExportSource] Top 75
04:49:36,891 DEBUG [authentication.ldap.LDAPGroupExportSource] Secondary 0
‍‍‍‍‍‍‍‍‍‍

But when i browse through this group using the alfresco admin console, I cant find any users. Since its linking the users to the group correctly I dont see why it cannot show it in the interface.

Maybe a interface bug ?

Dushyanth

Re: LDAP User Group Synchronisation with AD : Empty Groups

rivetlogic — Thu, 08 Jun 2006 12:10:49 GMT

Hi,

Just a hunch. Are you also synch'ing the users or just the groups? And if you are synch'ing the users do they show in the Admin Console?

–Aladdin

Re: LDAP User Group Synchronisation with AD : Empty Groups

skselby — Fri, 09 Jun 2006 18:07:43 GMT

The problem is with the userIDAttributeName. You are using UID and should be using samAccountName.

Your code:

<property name="userIdAttributeName">
<value>uid</value>
</property>

Should be:

<property name="userIdAttributeName">
<value>samAccountName</value>
</property>

Let me know if this works.

Re: LDAP User Group Synchronisation with AD : Empty Groups

bhavin_t — Sun, 11 Jun 2006 08:41:16 GMT

As per your instructions i changed uid to "samaccountname". however i still have the same issue.

My Issue:
=======
* Users sync fine
* Groups sync fine
* but when i login to alfresco admin console and click on a group - it shows NO Users in it. All the groups are empty
* I am pulling my hair trying to figure this one out

below is my ldap-authentication-context.xml and an excerpt from my log files

Log Excerpt:
========


User dhwani.g
19:21:03,925 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for ravi.g
User ravi.g
19:21:04,063 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for sheldon.g
User sheldon.g
19:21:04,138 DEBUG [authentication.ldap.LDAPGroupExportSource] Found 93
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_web-promo
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Domain Computers
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Programmers_WHI
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=nikunj.s,OU=Users,OU=DeptProductEngg,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,156 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for shailesh.g
User shailesh.g
19:21:04,159 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_MSCRM Role (Salesperson)
19:21:04,159 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_HR
19:21:04,160 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Margaret Rodrigues,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,163 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Kinnari Gandhi,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,167 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Sumita Das,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,171 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=savita.s,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,174 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=nandini S,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,178 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Mavis Fernandes,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,182 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Aljo Joseph,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,185 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=shivkumari,OU=Users,OU=DeptBilling,OU=departments,DC=internal,DC=directi,DC=com
19:21:07,373 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Guests
19:21:07,374 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=TsInternetUser,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,376 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_CVS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,927 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_ACCOUNTS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,930 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_ACCOUNTS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,933 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_DIRECTI-2K,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,937 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Domain Guests,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,939 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_CRM,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,942 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_CRM,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,945 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Guest,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,948 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_CVSSERVER,CN=Users,DC=internal,DC=directi,DC=com

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

My Conf File:
========


<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

    <!– DAO that rejects changes - LDAP is read only at the moment –>

    <bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
        <property name="proxyInterfaces">
            <value>org.alfresco.repo.security.authentication.MutableAuthenticationDao</value>
        </property>
        <property name="transactionManager">
            <ref bean="transactionManager"/>
        </property>
        <property name="target">
            <bean class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao">
                <property name="nodeService">
                    <ref bean="nodeService"/>
                </property>
            </bean>
        </property>
        <property name="transactionAttributes">
            <props>
                <prop key="*">${server.transaction.mode.default}</prop>
            </props>
        </property>
    </bean>

    <!– LDAP authentication configuration –>

    <!–

    You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
    web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
    authentication routes, like Active Directory.

    –>

    <bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–

            This maps between what the user types in and what is passed through to the underlying LDAP authentication.

            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".

            "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authentricate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
            Usually for simple authentication.

            –>
            <value>samaccountname=%s</value>
        </property>
    </bean>

    <!–

    This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
    to pull them out of the LDAP reopsitory

    –>

    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <!– The LDAP provider –>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry>

                <!– The url to the LDAP server –>
                <entry key="java.naming.provider.url">
                    <value>ldap://192.168.0.35:389</value>
                </entry>

                <!– The authentication mechanism to use      –>
                <!– Some sasl authentication mechanisms may require a realm to be set –>
                <!–                java.naming.security.sasl.realm –>
                <!– The available options will depend on your LDAP provider –>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>
                </entry>

                <!– The id of a user who can read group and user information –>
                <!– This does not go through the pattern substitution defined above and is used "as is" –>
                <entry key="java.naming.security.principal">
                    <value>CN=installer,CN=Users,DC=internal,DC=directi,DC=com</value>
                </entry>

                <!– The password for the user defined above –>
                <entry key="java.naming.security.credentials">
                    <value>d0ntask</value>
                </entry>
            </map>
        </property>
    </bean>

    <!– Ldap Syncronisation support –>

    <!–

    There can be more than one stack of beans that import users or groups. For example, it may be easier
    to have a version of ldapPeopleExportSource, and associated beans, for each sub-tree of your ldap directory
    from which you want to import users. You could then limit users to be imported from two or more sub tress and ignore
    users found else where. The same applies to the import of groups.

    The defaults shown below are for OpenLDAP.

    –>


    <!– Extract user information from LDAP and transform this to XML –>

    <bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
        <!–
        The query to select objects that represent the users to import.

        For Open LDAP, using a basic schema, the following is probably what you want:
        (objectclass=inetOrgPerson)

        For Active Directory:
        (objectclass=user)
        –>
        <!–
        <property name="personQuery">
            <value>(objectclass=user)</value>
        </property>
        –>
         <property name="personQuery">
                <value><![CDATA[(&(objectclass=user)(cn=*)(sn=*)(mail=*)(company=*))]]></value>
         </property>

        <!–
        The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
        –>
        <property name="searchBase">
            <value>dc=internal,dc=directi,dc=com</value>
        </property>

        <!–
        The unique identifier for the user.

        THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT

        For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"

        In OpenLDAP, using other authentication mechanisms "uid", but this depends on how you map
        from the id in the LDAP authentication request to search for the inetOrgPerson against which
        to authenticate.

        In Active Directory this is most likely to be "sAMAccountName"

        This property is mandatory and must appear on all users found by the query defined above.

            <value>sAMAccountName</value>
        –>
        <property name="userIdAttributeName">
            <value>samaccountname</value>
        </property>

        <!– Services –>
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="personService">
            <ref bean="personService"></ref>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property>

        <!–
        The path to the location of a space to use as the default home folder.
        This folder should be readable by all users, or a group to which all imported users belong.
        –>
        <property name="defaultHomeFolder">
            <value>/app:company_home</value>
        </property>

        <!–
        This property defines a mapping between attributes held on LDAP user objects and
        the properties of user objects held in the repository. The key is the QName of an attribute in
        the repository, the value is the attribute name from the user/inetOrgPerson/.. object in the
        LDAP repository.
        –>
        <property name="attributeMapping">
            <map>
                <entry key="cm:userName">
                    <!– Must match the same attribute as userIdAttributeName –>
                    <value>samaccountname</value>
                </entry>
                <entry key="cm:firstName">
                    <!– OpenLDAP: "givenName" –>
                    <!– Active Directory: "givenName" –>
                    <value>givenName</value>
                </entry>
                <entry key="cm:lastName">
                    <!– OpenLDAP: "sn" –>
                    <!– Active Directory: "sn" –>
                    <value>sn</value>
                </entry>
                <entry key="cm:email">
                    <!– OpenLDAP: "mail" –>
                    <!– Active Directory: "???" –>
                    <value>mail</value>
                </entry>
                <entry key="cm:organizationId">
                    <!– OpenLDAP: "o" –>
                    <!– Active Directory: "???" –>
                    <value>company</value>
                </entry>
            </map>
        </property>
    </bean>

    <!– Extract group information from LDAP and transform this to XML –>

    <bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
        <!–
        The query to select objects that represent the groups to import.

        For Open LDAP, using a basic schema, the following is probably what you want:
        (objectclass=groupOfNames)

        For Active Directory:
        (objectclass=group)
        –>
        <property name="groupQuery">
            <value>(objectclass=group)</value>
            <!–<value><![CDATA[(&(objectclass=group) (member=*))]]></value>–>
        </property>

        <!–
        The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
        –>
        <property name="searchBase">
            <value>dc=internal,dc=directi,dc=com</value>
        </property>

        <!–
        The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above.
        –>
        <property name="userIdAttributeName">
            <value>samaccountname</value>
        </property>

        <!–
        An attribute that is a unique identifier for each group found.
        This is also the name of the group with the current group implementation.
        This is mandatory for any groups found.

        OpenLDAP: "cn" as it is mandatory on groupOfNames
        Active Directory: "cn"

        –>
        <property name="groupIdAttributeName">
            <value>cn</value>
        </property>

        <!–
        The objectClass attribute for group members.
        For each member of a group, the distinguished name is given.
        The object is looked up by its DN. If the object is of this class it is treated as a group.
        –>
        <property name="groupType">
            <value>groupOfNames</value>
        </property>

        <!–
        The objectClass attribute for person members.
        For each member of a group, the distinguished name is given.
        The object is looked up by its DN. If the object is of this class it is treated as a person.
        –>
        <property name="personType">
            <value>inetOrgPerson</value>
        </property>
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property>

        <!–
        The repeating attribute on group objects (found by query or as sub groups)
        used to define membership of the group. This is assumed to hold distinguished names of
        other groups or users/people; the above types are used to determine this.

        OpenLDAP: "member" as it is mandatory on groupOfNames
        Active Directory: "member"

        –>
        <property name="memberAttribute">
            <value>member</value>
        </property>
    </bean>

    <!– Job definitions to import LDAP people and groups –>

    <bean id="ldapPeopleTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
        <property name="jobDetail">
            <bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapPeopleImport"/>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <!– Start after 30 seconds of starting the repository –>
        <property name="startDelay">
            <value>30000</value>
        </property>
        <!– Repeat every hour –>
        <property name="repeatInterval">
            <value>3600000</value>
        </property>
    </bean>

    <bean id="ldapGroupTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
        <property name="jobDetail">
            <bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapGroupImport"/>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <!– Start after 30 seconds of starting the repository –>
        <property name="startDelay">
            <value>30000</value>
        </property>
        <!– Repeat every hour –>
        <property name="repeatInterval">
            <value>3600000</value>
        </property>
    </bean>

    <!– The bean that imports xml describing people –>

    <bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
        <property name="importerService">
            <ref bean="importerComponent"/>
        </property>
        <property name="transactionService">
            <ref bean="transactionComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponent"/>
        </property>
        <property name="exportSource">
            <ref bean="ldapPeopleExportSource"/>
        </property>

        <!– The store that contains people - this should not be changed –>
        <property name="storeRef">
            <value>${spaces.store}</value>
        </property>

        <!– The location of people nodes within the store defined above - this should not be changed –>
        <property name="path">
            <value>/${system.system_container.childname}/${system.people_container.childname}</value>
        </property>

        <!– If true, clear all existing people before import, if false update/add people from the xml –>
        <property name="clearAllChildren">
            <value>false</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="searchService">
            <ref bean="searchService"/>
        </property>
        <property name="namespacePrefixResolver">
            <ref bean="namespaceService"/>
        </property>
    </bean>

    <!– The bean that imports xml descibing groups –>

    <bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
        <property name="importerService">
            <ref bean="importerComponent"/>
        </property>
        <property name="transactionService">
            <ref bean="transactionComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponent"/>
        </property>
        <property name="exportSource">
            <ref bean="ldapGroupExportSource"/>
        </property>
        <!– The store that contains group information - this should not be changed –>
        <property name="storeRef">
            <value>${alfresco_user_store.store}</value>
        </property>

        <!– The location of group information in the store above - this should not be changed –>
        <property name="path">
            <value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>
        </property>

        <!– If true, clear all existing groups before import, if false update/add groups from the xml –>
        <property name="clearAllChildren">
            <value>true</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="searchService">
            <ref bean="searchService"/>
        </property>
        <property name="namespacePrefixResolver">
            <ref bean="namespaceService"/>
        </property>
    </bean>

</beans>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Re: LDAP User Group Synchronisation with AD : Empty Groups

robinsonfernand — Tue, 13 Jun 2006 06:57:46 GMT

this was a problem with ldapPeopleImport which was not able to import all the members into the repository, i made some modification after which it started working

From :

       <property name="personType">
           <value>inetOrgPerson</value>
       </property>

To :

       <property name="personType">
           <value>person</value>
       </property>

"person" that's the objectClass attribute for members in Active Directory