topic some LDAP users are able to connect to Alfresco but they should not be in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71320#M23274 <HTML><HEAD></HEAD><BODY><P>Hi,&nbsp;</P><P>I'm begginer in Alfresco and LDAP synchronization.</P><P>I need to configure my Alfresco user only sync from specific AD group member.</P><P>synchronization gets the users of the adequate group.</P><P>When I search all users in the admin console, I find the right users. but I have a test user in the Active Directory that does not belong to the group. and does not appear in the user list in alfresco. but when i try to connect to alfresco with this account it is successful to login. and when I redo the search on the admin console this time it appears.</P><P>someone would have an idea to solve this problem please ?</P><P>I use Alfresco Community v5.2.0&nbsp;</P><P>here is my configuration</P><P></P><PRE class="" style="color: #000000; background: #f5f2f0; border: 0px; margin: 0.5em 0px; padding: 1em 1em 1em 3.8em;"><BR />ldap.authentication.active=true<BR />ldap.authentication.allowGuestLogin=false<BR />ldap.authentication.userNameFormat=%s@domain.com<BR />ldap.authentication.java.naming.provider.url=ldap://server:389<BR />ldap.synchronization.java.naming.security.principal=alfresco@domain.com<BR />ldap.synchronization.java.naming.security.credentials=password<BR />ldap.synchronization.personType=user<BR />ldap.synchronisation.groupIdAttributeName=cn<BR />ldap.synchronisation.userLastNameAttributeName=sn<BR />ldap.synchronisation.userIdAttributeName=sAMAccountName<BR />ldap.synchronisation.userFirstNameAttributeName=givenName<BR />ldap.synchronisation.userEmailAttributeName=mail<BR />ldap.synchronisation.groupType=group<BR />ldap.synchronisation.groupMemberAttributeName=member<BR />synchronization.syncOnStartup=true<BR />synchronization.allowDeletions=true<BR />synchronization.autoCreatePeopleOnLogin=false<BR />synchronization.syncWhenMissingPeopleLogIn=false<BR />ldap.synchronization.userSearchBase=OU="Interne users",DC="domain",DC="com"<BR />ldap.synchronization.personQuery=(&amp;(memberOf=CN="Alfresco",OU="software",<BR />OU="Groupes",DC="domain",DC="com")(objectclass=user))<BR /><BR />ldap.synchronization.personDifferentialQuery=(&amp;(memberOf=CN="Alfresco",OU="software",<BR />OU="Groupes",DC=domain,DC=com)(objectclass=user)(!(modifyTimestamp&lt;\={0})))<BR /><BR />ldap.synchronization.groupSearchBase=OU="software",OU="Groupes",DC=domain,DC=com<BR />ldap.synchronization.groupQuery=(&amp;(CN="Alfresco")(objectCategory=group))<BR /><BR /></PRE><P></P><P><SPAN class="" style="border-width: 0px 1px 0px 0px; border-style: initial solid initial initial; border-color: initial #999999 initial initial; font-weight: inherit;"></SPAN></P></BODY></HTML> Mon, 08 Apr 2019 15:08:52 GMT adelohb 2019-04-08T15:08:52Z some LDAP users are able to connect to Alfresco but they should not be https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71320#M23274 Hi,&nbsp;I'm begginer in Alfresco and LDAP synchronization.I need to configure my Alfresco user only sync from specific AD group member.synchronization gets the users of the adequate group.When I search all users in the admin console, I find the right users. but I have a test user in the Active Directory Mon, 08 Apr 2019 15:08:52 GMT https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71320#M23274 adelohb 2019-04-08T15:08:52Z Re: some LDAP users are able to connect to Alfresco but they should not be https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71321#M23275 <HTML><HEAD></HEAD><BODY><P>Hi:</P><P></P><P>This should work:</P><P></P><P>synchronization.autoCreatePeopleOnLogin=false</P><P></P><P>But it may depend on your chain authentication, for example if have passthru subsystem in the chain besides de ldap-ad.&nbsp;</P><P></P><P><A class="link-titled" href="https://docs.alfresco.com/5.0/concepts/sync-props.html" title="https://docs.alfresco.com/5.0/concepts/sync-props.html" rel="nofollow noopener noreferrer">Synchronization configuration properties | Alfresco Documentation</A>&nbsp;</P><P></P><P>Kind regards.</P><P>--C.</P></BODY></HTML> Tue, 09 Apr 2019 16:43:00 GMT https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71321#M23275 cesarista 2019-04-09T16:43:00Z Re: some LDAP users are able to connect to Alfresco but they should not be https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71322#M23276 <HTML><HEAD></HEAD><BODY><P><SPAN style="color: #242729; background-color: #ffffff;">thank you for your answer,</SPAN></P><P><SPAN style="color: #242729; background-color: #ffffff;"> here is the authentication chain </SPAN></P><P><SPAN style="color: #242729; background-color: #ffffff;">authentication.chain=alfrescoNtlm1:alfrescoNtlm,<SPAN>ldap1</SPAN>-ad:ldap-ad</SPAN></P></BODY></HTML> Wed, 10 Apr 2019 08:49:33 GMT https://connect.hyland.com/t5/alfresco-forum/some-ldap-users-are-able-to-connect-to-alfresco-but-they-should/m-p/71322#M23276 adelohb 2019-04-10T08:49:33Z