Bootstrapping users in 3.2r2

[bnordgren]

The short version is:

1. I'm using alfresco as a collaboration tool where "employees" can work together with external entities.


2. The organizational "powers that be" maintain an Active Directory for employees.


3. I maintain an LDAP directory of "external entities" and "groups relevant to me"


4. I'm using OpenLDAP's slapd-meta to combine the two directories into one DIT.


5. Paged results don't work thru a metadirectory

The number of users in the corporate Active Directory is more than 1000, but probably less than 10000.  My little directory doesn't have anyone yet.

My problem is that during the initial import, I get exactly one "page" worth of users, never more.  This is not Alfresco's fault, as this is exactly the behavior I get using ldapsearch too.  However, I need some way to preload users in bulk.  I can export the LDIF for the corporate server, and it seems (by looking at some old comments on the forums) that one used to be able to bootstrap users from an LDIF file.  I do not see that option in the current install instructions for 3.2r2, and there is scant mention of LDIF on the wiki.  Is there still some way to do this?

Alternatively, if I temporarily connect Alfresco directly to Active directory to "bootstrap" my users, will they be recognized as the same users when I point Alfresco back to my metadirectory?  (I don't alter the user ids or names).  Does alfresco remember where each user id came from?

Probably 95% of the user accounts I create thru this process will never actually log into the server.  The problem is, I won't know which 5% to preload.  I want the "potential users" to pre-exist in alfresco so that they can be invited to Share sites and such.  Besides, if nothing else Alfresco makes a nice telephone directory.

I know Alfresco will manage external users, but I will be turning that off if I can.  The point of the metadirectory is to have a central place to manage accounts for external users and provide authentication services to Alfresco, trac, subversion, etc.

Thanks,
Bryce

[bnordgren]

I gravely underestimated the number of users in the corporate active directory.  I'm currently adding 42905 users at the rate of 15 users/second.  It'll be a while.

What I'm trying:

1. Made an ssh tunnel thru the firewall between active directory and port 390 on my alfresco machine (389 is taken with my metadirectory server).


2. Made another ldap instance (called "bootstrap"), which connects to localhost:390.


3. Removed my "production" ldap instance from the authentication chain and added "bootstrap".


4. Killed the content repository, dropped and re-created the database.


5. Started Alfresco.

When it finally boots up, I'll reconfigure the authentication chain back to my production ldap server, log in, and see if it associates me with the username it just slurped out of AD.

25% done.  Cross fingers…

[bnordgren]

Result: It worked with "conditions".  All the users were imported.  All users got the first name, last name, uid, and email attributes set.  I can log in as me under the "production" ldap instance, and it recognizes me by my uid.

It's a little unclean because it clutters the logfile with notifications that users are being moved from the "bootstrap" user repository to my production one.  However, functionality does not appear to be affected. 

Just for future reference, I would be interested in hearing if the LDIF import option is still available…

[bnordgren]

Followup: It didn't really work.  When it migrates users from the bootstrap repository to the operational one, it deletes all their attributes.  It just took it a while to touch an account that I'd notice (mine).   :shock:

Not really sure what I'm going to try next.