topic ldap-ad network configuration - need to specify domain controller ip in Alfresco Forum

ldap-ad network configuration - need to specify domain controller ip

skushnerenko — Thu, 19 Apr 2018 10:46:49 GMT

We have specific installation of Alfresco 5.2.d repository where primary domain controller, identified by domain name is unavailabe by its ip, available is only secondary domain controller host. So, we have domain some.com.ua and the command telnet some.com.ua 389 results intelnet some.com.ua 389Tr

Re: ldap-ad network configuration - need to specify domain controller ip

skushnerenko — Fri, 28 Sep 2018 13:18:36 GMT

We still suffer from problem with AD synchronization

As I have found, Alfresco during synchronization not only connect domain controller "ldap.authentication.java.naming.provider.url=ldap://ldap.some.com.ua:389", but somehow connect also the domain name "some.com.ua"

And in case when we have a few domain controllers and not all of them are accessible from Alfresco host, we have errors in alfresco.log, which are in start message

Re: ldap-ad network configuration - need to specify domain controller ip

cesarista — Sat, 29 Sep 2018 15:53:11 GMT

Hi Sergei:

If you have problems for resolving ldap.some.co.ua server with your config, you can help Alfresco setting IP directly or assigning it /etc/hosts temporally. This should allow to go ahead and to see if the rest of sync configuration is working.

Regards.

--C.

Re: ldap-ad network configuration - need to specify domain controller ip

skushnerenko — Mon, 01 Oct 2018 07:45:25 GMT

Thank you for your reply, my problem is that the real cause of the situation is too complicated and not as obvious as can be supposed at first glance.

You see, setting IP directly does not solve the problem, because AD synchronization connects not only host indicated by parameter host ldap.some.com.ua (ldap.some.com.ua), but somehow it also connects domain by name (some.com.ua), which it should not connect.

AD synchronization should connect ldap.some.com.ua but connects also some.com.ua !!!!

This is proved fact, which I observed twice in different network infrastructures.

Resuming, in case when AD configuration has several AD controllers, and only part of them are accessible by Alfresco host, whatever we indicate in parameter ldap.authentication.java.naming.provider.url , host or ip directly, periodically we observe errors in synchronization log:

Caused by: javax.naming.CommunicationException: some.com.ua:389 [Root exception is java.net.ConnectException: Connection timed out (Connection timed out)]

It can be solved by adding line in etc/hosts for domain name some.com.ua and accessible IP, but the operating system is not ours and system admin prohibits doing this.