topic Re: Switch from AD LDAP authentication to local authentication keeping current users and history in Alfresco Forum

Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Mon, 30 Mar 2020 22:06:17 GMT

I'm going to migrate my Alfresco to the cloud and I have the task of removing authentication via AD LDAP for authentication.

I was looking for a way to do this in the database, but the Alfresco tables are quite complex. I still haven't been able to identify a way to perform this operation in the database. I saw that users and groups are in the database.

Is there a way to convert these users as if they were local users?

Is there any documentation on the tables and fields in the Alfresco database?

Thank you very much in advance!

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

afaust — Tue, 31 Mar 2020 15:56:37 GMT

You should rarely have to delve into the Alfresco database tables directly to do things like this. As such, there is no (public) documentation on the tables to not encourage people to try and modify these internals, and break their systems by doing so.

This this particular case, the users you have in Alfresco are already pretty much ready to go as regular users when LDAP-AD is disabled. The only thing you absolutely would have to do is assign each user a password. Theoretically, you should be able to deactivate/remove the LDAP-AD configuration (simplest way: remove it from authentication.chain property in alfresco-global.properties) and after a restart should be allowed to set new passwords for these users in the Share UI. If that does not work or you have a lot of users, you can use tools like the JavaScript Console to script the password allocation by using JavaScript-Java interoperability to access the call the createAuthentication operation on the MutableAuthenticationService interface.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Wed, 01 Apr 2020 23:21:13 GMT

I tried to use your tips, unfortunately I couldn't. Explaining everything I've done.

In this new installation I did I disabled LDAP-AD authentication. When I checked the users, all accounts were disabled.
In the Share UI the password fields and the checkbox to activate the account are disabled even using the admin user.

I have no knowledge to use the JavaScript Console or Alfresco API. I tried to research more but I didn't see any practical example of how to use it.

Could you help me with some study material? Or without abusing too much what you should do.

Thanks in advance

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

EddieMay — Thu, 02 Apr 2020 11:19:56 GMT

Hi @adautofernandes,

Was your Share instance customised as part of LDAP integration? Look in <web-extension>\share-config-custom.xml to see if there are any modifications in this file. Also check the documentation on Form Customisation.

HTH,

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Thu, 02 Apr 2020 15:15:48 GMT

The only thing I customized in that file:

<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
  <properties>
    <token>Alfresco-CSRFToken</token>
    <!-- Use the pipe | in the regex as OR operator: URL1|URL2|... -->
    <referer>https://alfresco.mydomain.com.br/.*</referer>
    <origin>https://alfresco.mydomain.com.br</origin>
  </properties>
</config>

I believe that it is not that.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Thu, 02 Apr 2020 15:50:14 GMT

I forgot to inform the version I am using. It's the Alfresco Community 201707 (v5.2).

Today I tried to "steal" on the user's edit form. Enabling the password fields and the user account activation checkbox by editing the generated HTML using the browser inspect element.

Just remove the Disabled="True" to enable, but Alfresco's security is good. I underestimate Alfresco's security

When I try to save I get the following error message:

There had to be an easier way to activate these users.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Sun, 05 Apr 2020 23:51:43 GMT

Hi @afaust,

I left some extra information. Do you have any light to help me?

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

pauldavidmena — Fri, 02 Jul 2021 15:16:19 GMT

Hello, @adautofernandes - did you ever get this to work for you? I'm migrating an ACS 4.6.2 instance over to a new data center and would like to do so without the current LDAP authentication.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

adautofernandes — Wed, 07 Jul 2021 21:19:19 GMT

Hi @pauldavidmena,

So I couldn't migrate to the other server by disabling authentication with my Microsoft Active Directory/LDAP.
The solution I found was to install OpenLDAP + LAM (LDAP Account Manager) on Alfresco's server to manage users.

What's annoying about Alfresco is that it's difficult to maintain.
In the coming months I will have to plan the update. Hope to have a little headache.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

cristinamr — Thu, 08 Jul 2021 06:53:35 GMT

@adautofernandesyou have your answer on @afaust' post:

Theoretically, you should be able to deactivate/remove the LDAP-AD configuration 
(simplest way: remove it from authentication.chain property in alfresco-global.properties) 
and after a restart should be allowed to set new passwords for these users in the Share UI.

Don't go directly into the database. Go though alfresco-global.properties and keep only ntlm authenticator on that line.

Cheers,

Cristina.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

pauldavidmena — Thu, 08 Jul 2021 11:56:14 GMT

Greetings from Cape Cod!

I have edited the authentication.chain variable in alfresco-global.properties to eliminate references to LDAP:

authentication.chain=alfrescoNtlm1:alfrescoNtlm

I am running Alfresco Content Services v4.2.6. After restarting alfresco, I was able to log in as "admin" and create a new user. Now the big task is to convert all of the LDAP users to local users while keeping the existing data and history. Is there a doc or a tutorial describing how this is done? When I search for a user under the "Manage System Users" section of the Administration Console, I can see their "Person Properties" and "User Properties", but I'm unable to change their password.

Thank you in advance!

@cristinamr wrote:
@adautofernandesyou have your answer on @afaust' post:
Theoretically, you should be able to deactivate/remove the LDAP-AD configuration 
(simplest way: remove it from authentication.chain property in alfresco-global.properties) 
and after a restart should be allowed to set new passwords for these users in the Share UI.
Don't go directly into the database. Go though alfresco-global.properties and keep only ntlm authenticator on that line.
Cheers,
Cristina.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

ryanmorgan — Wed, 12 Apr 2023 09:46:26 GMT

Did you find a way to do this? I am on Alfresco 7.2 and having the same issue.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

pauldavidmena — Wed, 12 Apr 2023 14:59:43 GMT

We never did make the switch, so we're continuing to authenticate to LDAP. Ultimately we will probably migrate to the Cloud version of Alfresco, but there's no timeframe as far as I know.

Re: Switch from AD LDAP authentication to local authentication keeping current users and history

odtorres — Mon, 06 Nov 2023 19:41:33 GMT

//ContextLoader = Packages.org.springframework.web.context.ContextLoader,
//ContextLoader.getCurrentWebApplicationContext().getBean(beanName, classType)
var authService = C.getBean('authenticationService', org.alfresco.service.cmr.security.MutableAuthenticationService);

var password = new String("pass");
var user = "user";

var ch = []
for (var i = 0; i < password.length; i++) {
     ch[i] = password.charAt(i);
}

if(authService.isAuthenticationMutable(user)){
	authService.setAuthentication(user,ch);
}else{
	authService.createAuthentication(user,ch);
}