AD Authentication by Email

[alchemist]

Hello,

I wanted the users to be logged by their Email.Here is my ldap-ad parameters. After synchronisation, I verified that the uid in the database was the mail and not the samaccountname, (ok). But the authentication failed.

Thx for your help!

ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://172.16.2.44:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator,alfresco
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=Administrateur@adtest.atolcd.priv
ldap.synchronization.java.naming.security.credentials=/*SECRET*/
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=totototoototo)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(whenChanged<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged<\={0})))
ldap.synchronization.groupSearchBase=ou\=alfresco,dc\=adtest,dc\=atolcd,dc\=priv
ldap.synchronization.userSearchBase=ou\=alfresco,dc\=adtest,dc\=atolcd,dc\=priv
ldap.synchronization.modifyTimestampAttributeName=whenChanged
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=mail
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true
ldap.authentication.java.naming.read.timeout=0

[eswbitto]

When posting your config to this community it would probably be a good idea NOT to include your password. Now everyone knows it and now you have to change that. (That's if you provided your true password by accident).

Your config looks ok…

ldap.authentication.userNameFormat=%s‍

I would put =domain\\%s

See if that fixes it.

[mrogers]

I suspect you don't want to have the userNameFormat=%s.   Instead you want to lookup the user in ldap by the email id.

Edit - yes you need to set your ldap.synchronization.personQuery to find people by email id.

Edit2 - I removed your password for you.

[alchemist]

I tried this but it didn't work. My idea is that AD consider that the mail is not a valid (unique) identifier to get password. The only parameters that AD can accept to give a corresponding password are UPN and DN. That's why alfresco accept the modification (samaccountname to mail) in database but the user still can't log in. Thanks for the password