Active Directory authentication: allow just group of users

[brgsousa]

I have searched the web two days and found nothing that worked AND this forum.
How can I allow only a group (not an organizational unit) to login and use the alfresco system?
The main issue is that users are not just in one organizational unit. They are not just in the "Users" OU. I don't know how to include several OUs to synchronize.

Current configuration :

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad

ntlm.authentication.sso.enabled=false

ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@intranet.domain.com
ldap.authentication.java.naming.provider.url=ldap://intranet.domain.com:389
ldap.authentication.defaultAdministratorUserNames=administrator

ldap.synchronization.java.naming.security.principal=administrator@intranet.domain.com
ldap.synchronization.java.naming.security.credentials=password
ldap.synchronization.groupSearchBase=ou=groups,dc=intranet,dc=domain,dc=com
ldap.synchronization.userSearchBase=OU=Users,dc=intranet,dc=domain,dc=com
ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf\=CN\=Developers,OU\=Users,DC\=intranet,DC\=domain,DC\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[brgsousa]

I could try something different.
How can I allow synchronization of more than one ORGANIZATION UNIT (OU) ?

[brgsousa]

Got it to work using this configuration:

ldap.synchronization.personType=user

ldap.synchronization.personQuery=(&(|(memberof=CN=GRTecnologia,OU=Grupos,DC=intranet,DC=domain,DC=com)(memberof=CN=GRUDS,OU=Grupos,DC=intranet,DC=domain,DC=com))(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

ldap.synchronization.personDifferentialQuery=(&(|(memberof=CN=GRTecnologia,OU=Grupos,DC=intranet,DC=domain,DC=com)(memberof=CN=GRUDS,OU=Grupos,DC=intranet,DC=domain,DC=com))(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupQuery=(objectclass\=group)

ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupSearchBase=DC=intranet,DC=domain,DC=com
‍‍‍‍‍‍‍‍‍‍‍‍‍

[mrksjs]

i was looking for this as well, thanks for finding a solution!

[nelsonoles]

What file does this string reside in?
C:\Alfresco\tomcat\shared\classes\alfresc-global.properties
or
C:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ad1\ldap-ad-authtications.properties?

Any other hints you could toss my way. Trying to figure out AD Authentication, but it's about as easy as SAP was.

[jgionet76]

hi, pretty new to all of this.. so any help is very appreciated!
how would I specify/filter which company and department to only be synced?

thanks

[102020]

I have a howto I've created for alot of the essentials, may help:
https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/installation-upgra...

[therev]

I've been banging my head against this for a couple of days and can't seem to get it running. I'm trying to only allow access to Alfresco to users in a specific group (Alfredo Access) in the following OU: DOMAIN > Service Accounts > Groups
Here's my current config (based on the above examples):
ldap.synchronization.personQuery=(&(|(memberof=CN=Alfresco Access,OU=Groups,OU=Service Accounts,DC=*****,DC=net)(memberof=CN=Alfresco Access,OU=Groups,OU=Service Accounts,DC=*****,DC=net))(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))


ldap.synchronization.personDifferentialQuery=(&(|(memberof=CN=Alfresco Access,OU=Groups,OU=Service Accounts,DC=*****,DC=net)(memberof=CN=Alfresco Access,OU=Groups,OU=Service Accounts,DC=*****,DC=net))(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

ldap.synchronization.groupSearchBase=dc\=*****,dc\=net

ldap.synchronization.userSearchBase=dc\=*****,dc\=net

[therev]

I finally managed to caffeinate myself to a level where I could combat my own stupidity and got this working.  Derp.

[gojko]

Hi, I have the same problem. I need to allow login only for users in a certain group, and in "People" list only these can be shown. I did the same as above, and in /alfresco.log  it indeed says it synched 7 users (which is correct), but all users from before can still login, and all users are listed. If I comment out ldap.authentication.userNameFormat=%s@doman.local as I've seen in docs, nobody can login except admin. Also, I don't see why (objectclass\=user) is used instead of (objectclass=user). I don't see anything else wrong with TheRev's code.

Any ideas?

Here is my globalproperties:

# AD integration
authentication.chain=myldap:ldap-ad,alfinst:alfrescoNtlm
ntlm.authentication.sso.enabled=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@[name].local
ldap.authentication.java.naming.provider.url=ldap://[IP]:389
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.java.naming.security.principal=administrator@.local
ldap.synchronization.java.naming.security.credentials=[Password]
ldap.synchronization.groupSearchBase=[correct path]
ldap.synchronization.userSearchBase=[correct path]

#Selective AD Query
synchronization.autoCreatePeopleOnLogin=false
synchronization.syncWhenMissingPeopleLogIn=false
ldap.synchronization.personType=user
ldap.synchronization.personQuery=(&(objectCategory\=user)(objectClass\=user)(memberOf\=CN\=[correct path]))
ldap.synchronization.personDifferentialQuery=(&(&(objectCategory\=user)(objectClass\=user)(memberOf\=CN\=[correct path]))(!(modifyTimestamp<\={0})))

#CUSTOM LDAP MAPPINGS
ldap.synchronization.userJobTitleAttributeName=title
ldap.synchronization.userOrganizationAttributeName=department
ldap.synchronization.userLocationAttributeName=physicalDeliveryOfficeName
ldap.synchronization.userMobileAttributeName=mobile
ldap.synchronization.userCompanyPostCodeAttributeName=postalCode
ldap.synchronization.userCompanyFaxAttributeName=facsimileTelephoneNumber
ldap.synchronization.userCompanyTelephoneAttributeName=telephoneNumber
ldap.synchronization.userCompanyEmailAttributeName=mail
ldap.synchronization.userPersonDescriptionAttributeName=info
ldap.synchronization.userTelephoneAttributeName=homePhone
ldap.synchronization.userCompanyAddress1AttributeName=streetAddress
ldap.synchronization.userCompanyAddress2AttributeName=l
ldap.synchronization.userCompanyAddress3AttributeName=st

# Sync
synchronization.synchronizeChangesOnly=false
synchronization.allowDeletions=true
synchronization.import.cron=0 0/3 * * * ?