AD attribute synchronization

[alexw]

<ul>
<li><strong>Alfresco version:</strong> 5.0.c</li>
<li><strong>OS:</strong> Windows 2008 R2</li>
</ul>

Hi,

I've been using the AD synchronization for quite some time now without any issue. Recently, I tried to map new AD attributes to user profiles visible in Alfresco but I didn't manage to make it work despite my best efforts.

Here is what I did so far:

- Copy

common-ldap-context.xml‍

to

Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication‍

and add some entries to the

personAttributeMapping‍

property in the

UserRegistry‍

bean:

…
<entry key="cm:jobtitle">
    <!– OpenLDAP: "title" –>
    <!– Active Directory: "title" –>
    <value>${ldap.synchronization.userJobTitleAttributeName}</value>
</entry>
…
‍‍‍‍‍‍‍‍‍

- Modifiy my

ldap-ad-authentication.properties‍

located in

Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap-ad1‍

and map the attribute mentioned above:

# The attribute on person objects in LDAP to map to the title property in Alfresco
ldap.synchronization.userJobTitleAttributeName=title
‍‍‍‍

- Check that my Alfresco user in the Active Directory has the "Read all inetOrgPerson information" permission

- Look at my domain controller logs for potential authentication errors (I didn't find any)


I must have forgotten to do something along the way but I can't figure out what it is!


Here is my full

ldap-ad-authentication.properties‍

if need be:

# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=false

# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
ldap.authentication.allowGuestLogin=false

# How to map the user id entered by the user to that passed through to LDAP
# In Active Directory, this can either be the user principal name (UPN) or DN.
# UPNs are in the form <sAMAccountName>@domain and are held in the userPrincipalName attribute of a user
ldap.authentication.userNameFormat=%s@FOO.LOCAL

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://pdc.foo.local:389

# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=Administrator

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The authentication mechanism to use for synchronization
ldap.synchronization.java.naming.security.authentication=simple

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=cn\=Alfresco HTTP,dc\=FOO,dc\=LOCAL

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=password

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# If positive, this property indicates that range retrieval should be used to fetch
# multi-valued attributes (such as member) in batches of the specified size.
# Overcomes any size limits imposed by Active Directory.        
ldap.synchronization.attributeBatchSize=1000

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=group)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(whenChanged<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged<\={0})))

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=FOO,dc\=FOO,dc\=LOCAL

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=FOO,dc\=FOO,dc\=LOCAL

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=whenChanged

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=sAMAccountName

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the title property in Alfresco
ldap.synchronization.userJobTitleAttributeName=title

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=company

# The attribute on person objects in LDAP to map to the telephone property in Alfresco
ldap.synchronization.userCompanyTelephoneAttributeName=telephoneNumber

# The attribute on person objects in LDAP to map to the postcode property in Alfresco
ldap.synchronization.userCompanyPostCodeAttributeName=postalCode

# The attribute on person objects in LDAP to map to the company address property in Alfresco
ldap.synchronization.userCompanyAddress1AttributeName=streetAddress

# The attribute on person objects in LDAP to map to the company address property in Alfresco
ldap.synchronization.userCompanyAddress2AttributeName=l

# The attribute on person objects in LDAP to map to the company address property in Alfresco
ldap.synchronization.userCompanyAddress3AttributeName=st

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

# The attribute on LDAP group objects to map to the authority name property in Alfresco
ldap.synchronization.groupIdAttributeName=cn

# The attribute on LDAP group objects to map to the authority display name property in Alfresco
ldap.synchronization.groupDisplayNameAttributeName=displayName

# The group type in LDAP
ldap.synchronization.groupType=group

# The person type in LDAP
ldap.synchronization.personType=user

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member

# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
ldap.synchronization.enableProgressEstimation=true

# Requests timeout, in miliseconds, use 0 for none (default)
ldap.authentication.java.naming.read.timeout=0
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Thanks in advance to anyone willing to help me out!

[sujaypillai]

Have you run full sync after making the change? Set ldap.synchronization.synchronizeChangesOnly=false in alfresco-global.properties and give a restart to the system.