few users are unable to authenticate by ldap?why?

[smkhawaja]

Hi guys,

I am facing a strange issue.

I am using this ldap.authentication.userNameFormat as mentioned below
ldap.authentication.userNameFormat=CN=%s,ou=Alfresco_West,dc=dare,dc=local
in ldap authentication file
"/opt/alfresco/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldap1/ldap-authentication.properties"

Its really strange, few users are able to authenticate while others or not. Any idea why? or how can I troubleshoot it?

Thanks in advance.

Soh

[kyriakos]

i am using the ldap-ad subsystem
wait to make the changes and i tell you

[kyriakos]

cn=%s
dc=domain
ou= ?? ->   multipe organization units (OUs)
my question is i want to add all units so is there a general symbol or something or i leave it blank ?

[dward]

With active directory you can use a User Principal Name (UPN) to authenticate. This has a fixed suffix, so doesn't need to encode any OUs. Use an LDAP browser to determine what the correct UPN suffix is by looking up the userPrincipalName attribute of one of your users.

If you want to search multiple ous in groupSearchBase and userSearchBase, just shorten them so that they only contain the common suffix of all your DNs. For example:

# How to map the user id entered by the user to taht passed through to LDAP
# In Active Directory, this can either be the user principal name (UPN) or DN.
# UPNs are in the form <sAMAccountName>@domain and are held in the userPrincipalName attribute of a user
ldap.authentication.userNameFormat=%s@domain

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=dc=domain,dc=com

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=dc=domain,dc=com
‍‍‍‍‍‍‍‍‍‍‍‍

Please undo any changes you made to userIdAttributeName or comment it out.

[kyriakos]

ldap.synchronization.userIdAttributeName=sAMAccountName

should i change it to

ldap.synchronization.userIdAttributeName=%s@domain ?

[kyriakos]

maaaaaaate i can see at query all of my users and groups!! thank you you are god!!!!!!!!!!!!

[dward]

"No" to your question above. That's the LDAP attribute used by Active Directory to store your user ID.

[smkhawaja]

I have fixed my problem with
ldap.authentication.userNameFormat=%s

I was using ldap.authentication.userNameFormat=CN=%s,ou=Alfresco_West,dc=companyname,dc=local and had an issue few users werent able to authenticat. Anyhow this is solved.

How can we generate alfresco.log as a separate log file rather then all authentication and user movement should be written in catalina.out?

[dward]

See http://logging.apache.org/log4j/1.2/manual.html

BTW alfresco.log will appear in the current directory when you start alfresco.