Hello,
In my alfresco-global.properties I'm using the following authentication chain :
authentication.chain=ldap1:ldap,passthru1
assthru,alfrescoNtlm1:alfrescoNtlm
With this authentication chain I do have the error with ldap SYNC.
If I use the following authentication chain :
authentication.chain=passthru1assthru
I don't have any error message, and I'm still able to log on using my LDAP credential.
I though ldap chain was needed for passthru ?
Regards
In my alfresco-global.properties I'm using the following authentication chain :
authentication.chain=ldap1:ldap,passthru1
assthru,alfrescoNtlm1:alfrescoNtlmWith this authentication chain I do have the error with ldap SYNC.
If I use the following authentication chain :
authentication.chain=passthru1
assthruI don't have any error message, and I'm still able to log on using my LDAP credential.
I though ldap chain was needed for passthru ?
Regards
Hi,
try this way… authentication.chain=passthru1assthru,ldap1:ldap
if it is working working, post your ldap configuration..
try this way… authentication.chain=passthru1
assthru,ldap1:ldapif it is working working, post your ldap configuration..
Hello,
thanks for the reply I try :
authentication.chain=passthru1assthru,ldap1:ldap
Still get the error, but I was able to log in.
To be sure I created a new user on my LDAP, I've been able to log in but I get error in the logs :
WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] User authenticated but failed to sync with user registry
org.alfresco.repo.security.authentication.AuthenticationException: 11300011 Unable to connect to LDAP Server; check LDAP configuration
[…]
Caused by: javax.naming.InvalidNameException: [LDAP: error code 34 - invalid DN
I change again the authentication.chain to
authentication.chain=passthru1assthru
I got no error at all.
here is my tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap/ldap1/ldap-authentication.properties :
And my passthru configuration file :
So I think The solution is only to declare the passthru, but I would like to know why the ldap1 connector is not anymore needed.
Thanks in advance.
thanks for the reply I try :
authentication.chain=passthru1
assthru,ldap1:ldapStill get the error, but I was able to log in.
To be sure I created a new user on my LDAP, I've been able to log in but I get error in the logs :
WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] User authenticated but failed to sync with user registry
org.alfresco.repo.security.authentication.AuthenticationException: 11300011 Unable to connect to LDAP Server; check LDAP configuration
[…]
Caused by: javax.naming.InvalidNameException: [LDAP: error code 34 - invalid DN
I change again the authentication.chain to
authentication.chain=passthru1
assthruI got no error at all.
here is my tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap/ldap1/ldap-authentication.properties :
# This flag enables use of this LDAP subsystem for authentication. It may be
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://ldap.mycompany.com
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=user1
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=cn\=username,o\=ou,dc\=company,dc\=com
ldap.synchronization.java.naming.security.credentials=******
ldap.synchronization.queryBatchSize=0
ldap.synchronization.attributeBatchSize=0
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=dc\=company,dc\=com
ldap.synchronization.userSearchBase=dc\=company,dc\=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userFirstNameAttributeName=mail
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=o
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=description
ldap.synchronization.groupType=groupOfNames
ldap.synchronization.personType=inetOrgPerson
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true
And my passthru configuration file :
passthru.authentication.useLocalServer=false
passthru.authentication.domain=MyDomain
passthru.authentication.servers=192.168.1.2
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=
#Timeout value when opening a session to an authentication server, in milliseconds
passthru.authentication.connectTimeout=5000
#Offline server check interval in seconds
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true
So I think The solution is only to declare the passthru, but I would like to know why the ldap1 connector is not anymore needed.
Thanks in advance.
Hello,
Sorry for the noise, I finally find the difference between 3.3.g and 3.4.c
In the new configuration there is a new parameter :
# The group type in LDAP
ldap.synchronization.groupType=groupOfNames
So that's why it didn't work with my old configuration file.
Regards.
Sorry for the noise, I finally find the difference between 3.3.g and 3.4.c
In the new configuration there is a new parameter :
# The group type in LDAP
ldap.synchronization.groupType=groupOfNames
So that's why it didn't work with my old configuration file.
Regards.
