topic Synchronizing user account status with Kerberos SSO in Alfresco Forum https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97934#M28604 <HTML><HEAD></HEAD><BODY><P>Hi!</P><P>I have a problem synchronizing user account status. It worked fine&nbsp;with ldap authentication before I&nbsp;add kerberos to&nbsp;authentication chain.</P><P></P><P>Configurations:</P><P><EM>alfresco-global.properties</EM></P><P style="padding-left: 30px;">&nbsp;### The authentication chain</P><P style="padding-left: 30px;">authentication.chain=kerberos1:kerberos,ldap1:ldap-ad,alfinst:alfrescoNtlm<BR />ntlm.authentication.sso.enabled=false<BR />ntlm.authentication.mapUnknownUserToGuest=false<BR />alfresco.authentication.authenticateCIFS=false<BR />alfresco.authentication.allowGuestLogin=false</P><P style="padding-left: 30px;">### Kerberos<BR />kerberos.authentication.realm=<EM>AD.DOMAIN.UA</EM><BR />kerberos.authentication.sso.enabled=true<BR />kerberos.authentication.browser.ticketLogons=true<BR />kerberos.authentication.sso.fallback.enabled=true<BR />kerberos.authentication.authenticateCIFS=false<BR />kerberos.authentication.user.configEntryName=Alfresco<BR />kerberos.authentication.defaultAdministratorUserNames=admin<BR />kerberos.authentication.cifs.configEntryName=AlfrescoCIFS<BR />kerberos.authentication.cifs.password=<EM>password</EM><BR />kerberos.authentication.http.configEntryName=AlfrescoHTTP<BR />kerberos.authentication.http.password=<EM>password</EM><BR />kerberos.authentication.stripUsernameSuffix=true</P><P style="padding-left: 30px;">### LDAP Synchronization settings. Active Directory (LDAP-AD).<BR /><STRONG>synchronization.externalUserControl=true</STRONG><BR /><STRONG>synchronization.externalUserControlSubsystemName=ldap1</STRONG><BR />synchronization.syncOnStartup=true<BR />synchronization.autoCreatePeopleOnLogin=false<BR />synchronization.syncWhenMissingPeopleLogIn=true<BR />synchronization.allowDeletions=true<BR />synchronization.import.cron=0 0/20 8-20 * * ?</P><P></P><P><EM>ldap-ad-authentication-context.xml</EM></P><P style="padding-left: 30px;">...</P><P style="padding-left: 30px;">&lt;import resource="../../common-ldap-context.xml" /&gt;</P><P style="padding-left: 30px;">&lt;bean id="<STRONG>ldapadUserAccountStatusInterpreter</STRONG>" class="org.alfresco.repo.security.sync.ldap_ad.LDAPADUserAccountStatusInterpreter"&gt;<BR /> &lt;/bean&gt;</P><P style="padding-left: 30px;">...</P><P><EM>ldap-ad-authentication.properties</EM></P><P style="padding-left: 30px;">ldap.authentication.active=false<BR />ldap.authentication.allowGuestLogin=false<BR />ldap.authentication.userNameFormat=%s@<EM>ad.domain.ua</EM><BR />ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory<BR />ldap.authentication.java.naming.provider.url=ldap://<EM>ad.domain.ua</EM>:389<BR />ldap.authentication.java.naming.security.authentication=simple<BR />ldap.authentication.escapeCommasInBind=false<BR />ldap.authentication.escapeCommasInUid=false<BR />ldap.authentication.defaultAdministratorUserNames=Administrator,admin<BR />ldap.authentication.authenticateFTP=false<BR />ldap.synchronization.active=true<BR />ldap.synchronization.java.naming.security.authentication=simple<BR />ldap.synchronization.java.naming.security.principal=<EM>syncuser@ad.domain.ua</EM><BR />ldap.synchronization.java.naming.security.credentials=<EM>password</EM><BR />ldap.synchronization.queryBatchSize=1000<BR />ldap.synchronization.attributeBatchSize=1000<BR />ldap.synchronization.groupQuery=(&amp;(objectclass\=group)(!(cn\=prn*)))<BR />ldap.synchronization.groupDifferentialQuery=(&amp;(&amp;(objectclass\=group)(!(cn\=prn*)))(!(whenChanged&lt;\={0})))<BR />ldap.synchronization.personQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))<BR />ldap.synchronization.personDifferentialQuery=(&amp;(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged&lt;\={0})))<BR />ldap.synchronization.groupSearchBase=ou\=<EM>OrganisationName</EM>,dc\=ad,dc\=domain,dc\=ua<BR />ldap.synchronization.userSearchBase=ou\=<EM>OrganisationName</EM>,dc\=ad,dc\=domain,dc\=ua<BR />ldap.synchronization.modifyTimestampAttributeName=whenChanged<BR />ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'<BR />ldap.synchronization.userIdAttributeName=sAMAccountName<BR />ldap.synchronization.userFirstNameAttributeName=sn<BR />ldap.synchronization.userLastNameAttributeName=givenName<BR />ldap.synchronization.userEmailAttributeName=mail<BR />ldap.synchronization.userOrganizationalIdAttributeName=departmentNumber<BR />ldap.synchronization.userJobTitleAttributeName=title<BR />ldap.synchronization.userSizeQuota=10000<BR />ldap.synchronization.userAvatarAttributeName=thumbnailPhoto<BR />ldap.synchronization.userAvatarDefaultMimetype=image/jpeg<BR />ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider<BR />ldap.synchronization.groupIdAttributeName=extensionName<BR />ldap.synchronization.groupDisplayNameAttributeName=description<BR />ldap.synchronization.groupType=group<BR />ldap.synchronization.personType=user<BR />ldap.synchronization.groupMemberAttributeName=member<BR />ldap.synchronization.enableProgressEstimation=true<BR />ldap.authentication.java.naming.read.timeout=0<BR />ldap.authentication.java.naming.referral=follow<BR />ldap.synchronization.com.sun.jndi.ldap.connect.pool=true<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.authentication=none simple<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.debug=fine<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.initsize=1<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.maxsize=<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.prefsize=<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.protocol=plain<BR />ldap.pooling.com.sun.jndi.ldap.connect.pool.timeout=<BR />ldap.pooling.com.sun.jndi.ldap.connect.timeout=<BR /><STRONG>ldap.synchronization.userAccountStatusProperty=userAccountControl</STRONG><BR /><STRONG>ldap.synchronization.userAccountStatusInterpreter=ldapadUserAccountStatusInterpreter</STRONG></P><P></P><P>Plus&nbsp;<SPAN><EM>common-ldap-context.xml</EM> contain&nbsp;correspondence of AD and Alfresco fields.<BR /></SPAN></P><P></P><P>All users are synchronized. But all users are enabled.</P><P>With another AD server and ldap authorization I can change enable/disable in AD and sync it on Alfresco.</P><P>The similar configuration with kerberos sso don't react on&nbsp;userAccountControl parameter.</P></BODY></HTML> Thu, 16 May 2019 13:57:06 GMT fedorow 2019-05-16T13:57:06Z Synchronizing user account status with Kerberos SSO https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97934#M28604 Hi!I have a problem synchronizing user account status. It worked fine&nbsp;with ldap authentication before I&nbsp;add kerberos to&nbsp;authentication chain.Configurations:alfresco-global.properties&nbsp;### The authentication chainauthentication.chain=kerberos1:kerberos,ldap1:ldap-ad,alfinst:alfrescoNtlmntlm.authentica Thu, 16 May 2019 13:57:06 GMT https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97934#M28604 fedorow 2019-05-16T13:57:06Z Re: Synchronizing user account status with Kerberos SSO https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97935#M28605 <HTML><HEAD></HEAD><BODY><P>I think the problem isn't in synchronization subsystem. Some process block Account status (Disable Account check box) and I cant check it manually even with&nbsp;synchronization.externalUserControl=false. Without kerberos sso all works fine.</P><P></P><P>to be continue...</P></BODY></HTML> Tue, 21 May 2019 10:01:39 GMT https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97935#M28605 fedorow 2019-05-21T10:01:39Z Re: Synchronizing user account status with Kerberos SSO https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97936#M28606 <HTML><HEAD></HEAD><BODY><P>It's a bug of share. User account have disabled status in database and can't login (usr:enabled = false). But admin see him&nbsp;with green button.</P></BODY></HTML> Tue, 28 May 2019 06:07:37 GMT https://connect.hyland.com/t5/alfresco-forum/synchronizing-user-account-status-with-kerberos-sso/m-p/97936#M28606 fedorow 2019-05-28T06:07:37Z