OpenLDAP authentication, if username already existed, both authentications are valid after sync

skushnerenko — Wed, 13 Feb 2019 09:05:25 GMT

We have to provide authentication with OpenLDAP so, that after synchronization with OpenLDAP usernames from OpenLDAP, which already existed for alfrescoNtlm authentication, would keep all the access to owned documents.That is, we had user John with alfrescoNtlm authentication, which had long workin

Re: OpenLDAP authentication, if username already existed, both authentications are valid after sync

skushnerenko — Thu, 21 Feb 2019 10:23:59 GMT

Using SQL queries I have found the difference between user created with NATIVE Alfresco authentication and user with same username imported from LDAP.

So, NATIVE user is stored in database table alf_node with types user and person.

Mixed user also has both types.

LDAP user has only type person.

Besides, with db objects alf_child_assoc it was found, that NATIVE person object is owned by AUTH.ALF object, while LDAP person object is owned by AUTH.EXT.ldap1 object.

Mixed person object is owned by both AUTH.ALF and AUTH.EXT.ldap1 objects.

ACL is made by db object alf_authority where username is stored as String.

So I hope that ACL made by native user will be effective for both LDAP and mixed user with same name.

The same may be true for access to documents owned by NATIVE user - I suppose access to these documents will be effective for LDAP and mixed user with same username.

The only problem is that field authority in alf_authority is case sensitive while username is case insensitive.

So in case if LDAP username and NATIVE username have different case, there may be problem with access of LDAP user to documetns of NATIVE user.

topic OpenLDAP authentication, if username already existed, both authentications are valid after sync in Alfresco Forum

OpenLDAP authentication, if username already existed, both authentications are valid after sync

Re: OpenLDAP authentication, if username already existed, both authentications are valid after sync