AD LDAP user-sync throwing UnknownHostException: domain

[zbaumberger]

Hi everybody,

We have setup Alfresco to synchronize users and groups with AD.

First we hit the

javax.naming.PartialResultException: Unprocessed Continuation Reference‍

bug decribed in ALF-2406 and patched Alfresco accordingly.

Now group sync works without problems, but user sync gives following error:

15:10:32,188 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldap1'                                                                     
15:10:32,207 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronization aborted due to error                                                                                
org.alfresco.error.AlfrescoRuntimeException: 03280000 User and group import failed                                                                                                                        
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1039)                                                                                                 
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.access$2400(LDAPUserRegistry.java:74)                                                                                                    
…
Caused by: javax.naming.CommunicationException: domain:389 [Root exception is java.net.UnknownHostException: domain]                                                                                      
        at com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.java:74)                                                                                                                      
…
Caused by: java.net.UnknownHostException: domain                                                                                                                                                          
        at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:177) 
…                               
        at javax.naming.spi.NamingManager.getObjectInstance(NamingManager.java:316)                                                                                                                       
        at com.sun.jndi.ldap.LdapReferralContext.<init>(LdapReferralContext.java:93)
        … 56 more
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Where does the LDAP subsystem get the hostname domain from?
Is it from AD?
We have a AD Domain Forrest with
kncorp.group.local beeing child of group.local domain.

thanks
Zlatko

[soriaedu79]

Hello Zlatko,

Finally, did you get the solution? I have the same problem than you.

Thank you

[rhoefer]

You configured ldap.synchronization properties but did you also configure the ldap.authentication properties? I thought that the domain was configured with ldap.authentication.java.naming.provider.url.

[zaccret]

Same problem for me. Did you find a solution ?

[ssaravanan]

With all versions above 3.2 ldap-ad is configured in one file
ldap-ad-authentication.properties, I do have the same issue.

[zaccret]

Well… resolved for me. The probem was a 's' instead of a 'z'.

So check your ldap.synchronization.groupSearchBase and ldap.synchronization.userSearchBase properties.

[mmtman]

A rather old thread, but I had the same problem recently, so I thought I'd post in case I (or someone else) needs to deal with this problem again.

I had the exact same issue with getting the "UnknownHostException: domain" message.  For some reason, it didn't like my group and user search bases and this was the cause of the problem.  I changed the user and group search bases to be the root level of the DIT: dc=<domain>,dc=<local>  and then I didn't have any more issues with this.

For reference, I followed these guides online:
(1) http://andoylang.wordpress.com/2010/07/18/alfresco-with-active-directory/
I used all of the things here, just be careful with copy-and-pasting as some things (like single quotes) may not paste correctly. (See https://forums.alfresco.com/en/viewtopic.php?f=8&t=37604)

(2) http://onalfresco.blogspot.com/2011/01/alfresco-authentication-and-integration.html
The one above uses the root-level search bases, which I wasn't doing initially and was having this issue, but then I decided to do what was shown here and it worked. In conjunction with this, this may also be helpful, but didn't try it exactly (https://forums.alfresco.com/en/viewtopic.php?f=9&t=38113)