Help a Total Newb With AD Sync With Alfresco 4.0.D Please

[jwintersteen]

Hello,
I'm trying desperately to get Alfresco 4.0.D to work properly with a AD LDAP system.
Here is the relevant info from the alfresco-global.properties file.

Authentication Chain

authentication.chain=passthru1:passthru,ldap-ad1:ldap-ad,alfrescoNtlm1:alfrescoNtlm‍

Passthrough

passthru.authentication.sso.enabled=truepassthru.authentication.allowGuestLogin=falsepassthru.authentication.authenticateCIFS=falsepassthru.authentication.authenticateFTP=falsepassthru.authentication.servers=10.0.2.27passthru.authentication.domain=mydomainnamepassthru.authentication.useLocalServer=falsepassthru.authentication.defaultAdministratorUserNames=administratorpassthru.authentication.connectTimeout=5000passthru.authentication.offlineCheckInterval=300passthru.authentication.protocolOrder=TCPIP,NETBIOS‍‍‍‍‍‍‍‍‍‍‍

LDAP Authentication

ldap.authentication.active=trueldap.authentication.java.naming.security.authentication=simpleldap.authentication.userNameFormat=%sldap.authentication.allowGuestLogin=falseldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactoryldap.authentication.java.naming.provider.url=ldap://ldapserverip:389ldap.authentication.escapeCommasInBind=falseldap.authentication.escapeCommasInUid=false‍‍‍‍‍‍‍‍

LDAP Synchronization

ldap.synchronization.active=trueldap.synchronization.java.naming.security.principal=CN=adminaccount,CN=admingroup,DC=mydomainname,DC=comldap.synchronization.java.naming.security.credentials=mydomainpasswordldap.synchronization.queryBatchSize=1000ldap.synchronization.attributeBatchSize=1000ldap.synchronization.groupQuery=(objectclass\=group)ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))ldap.synchronization.groupSearchBase=DC\=mydomainname,DC\=comldap.synchronization.userSearchBase=DC\=mydomainname,DC\=comldap.synchronization.modifyTimestampAttributeName=modifyTimestampldap.synchronization.timestampFormat=yyyyMMddHHmmssldap.synchronization.userIdAttributeName=sAMAccountNameldap.synchronization.userFirstNameAttributeName=givenNameldap.synchronization.userLastNameAttributeName=snldap.synchronization.userEmailAttributeName=mailldap.synchronization.groupIdAttributeName=cnldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProviderldap.synchronization.groupType=groupldap.synchronization.personType=userldap.synchronization.groupMemberAttributeName=membersynchronization.synchronizeChangesOnly=truecifs.enabled=false‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Passthrough, and authentication work just fine. If I log in with any AD accounts the user is then searchable inside Alfresco, but that is the only way they show up.

I get this synch error from the stdout log:

2012-07-19 10:28:07,042  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Starting 'Synchronization' subsystem, ID: [Synchronization, default] 2012-07-19 10:28:07,089  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, passthru1] 2012-07-19 10:28:07,809  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, passthru1] complete 2012-07-19 10:28:07,809  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1] 2012-07-19 10:28:07,918  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, ldap-ad1] complete 2012-07-19 10:28:07,918  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Starting 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1] 2012-07-19 10:28:08,012  INFO  [management.subsystems.ChildApplicationContextFactory] [Thread-1] Startup of 'Authentication' subsystem, ID: [Authentication, managed, alfrescoNtlm1] complete 2012-07-19 10:28:08,012  INFO  [security.sync.ChainingUserRegistrySynchronizer] [Thread-1] Synchronizing users and groups with user registry 'ldap-ad1' 2012-07-19 10:28:08,028  INFO  [security.sync.ChainingUserRegistrySynchronizer] [Thread-1] Retrieving all groups from user registry 'ldap-ad1' 2012-07-19 10:28:08,028  ERROR [security.sync.ChainingUserRegistrySynchronizer] [Thread-1] Synchronization aborted due to error org.alfresco.repo.security.authentication.AuthenticationException: 06190000 LDAP authentication failed.   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:119)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:94)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:87)   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry$3.<init>(LDAPUserRegistry.java:670)   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:667)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:632)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:435)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$6.doWork(ChainingUserRegistrySynchronizer.java:1650)   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:519)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.onBootstrap(ChainingUserRegistrySynchronizer.java:1644)   at org.springframework.extensions.surf.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:56)   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:97)   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ChildApplicationContext.publishEvent(ChildApplicationContextFactory.java:485)   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:685)   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:667)   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:473)   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEventInternal(SafeApplicationEventMulticaster.java:209)   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEvent(SafeApplicationEventMulticaster.java:180)   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:303)   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:276)   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:197)   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)   at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:63)   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4135)   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4630)   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:546)   at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:637)   at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:563)   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:498)   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1277)   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:321)   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)   at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:445)   at org.apache.catalina.core.StandardService.start(StandardService.java:519)   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)   at org.apache.catalina.startup.Catalina.start(Catalina.java:581)   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)   at java.lang.reflect.Method.invoke(Method.java:597)   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 ]   at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)   at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)   at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)   at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)   at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)   at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)   at javax.naming.InitialContext.init(InitialContext.java:223)   at javax.naming.InitialContext.<init>(InitialContext.java:197)   at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:114)   … 50 more2012-07-19 10:28:08,043  WARN  [security.sync.ChainingUserRegistrySynchronizer] [Thread-1] Failed initial synchronize with user registries org.alfresco.repo.security.authentication.AuthenticationException: 06190000 LDAP authentication failed.   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:119)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:94)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:87)   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry$3.<init>(LDAPUserRegistry.java:670)   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:667)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:632)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:435)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$6.doWork(ChainingUserRegistrySynchronizer.java:1650)   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:519)   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.onBootstrap(ChainingUserRegistrySynchronizer.java:1644)   at org.springframework.extensions.surf.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:56)   at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:97)   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ChildApplicationContext.publishEvent(ChildApplicationContextFactory.java:485)   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)   at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:685)   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:667)   at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:473)   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEventInternal(SafeApplicationEventMulticaster.java:209)   at org.alfresco.repo.management.SafeApplicationEventMulticaster.multicastEvent(SafeApplicationEventMulticaster.java:180)   at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:303)   at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:911)   at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:428)   at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:276)   at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:197)   at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:47)   at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:63)   at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4135)   at org.apache.catalina.core.StandardContext.start(StandardContext.java:4630)   at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)   at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)   at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:546)   at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:637)   at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:563)   at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:498)   at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1277)   at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:321)   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:119)   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)   at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)   at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)   at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:445)   at org.apache.catalina.core.StandardService.start(StandardService.java:519)   at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)   at org.apache.catalina.startup.Catalina.start(Catalina.java:581)   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)   at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)   at java.lang.reflect.Method.invoke(Method.java:597)   at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)   at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1 ]   at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)   at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)   at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)   at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)   at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)   at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)   at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)   at javax.naming.InitialContext.init(InitialContext.java:223)   at javax.naming.InitialContext.<init>(InitialContext.java:197)   at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)   at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:114)   … 50 more‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I would appreciate any help you guys may be able to give. Thanks in advance.

[arodriguez]

Hi,

Did your trouble has been fixed ?

I'm having similar issues … if you can share us your knowledge in this matter 

Best regards.

[bopolissimus]

There may be other issues, but at least *this* line needs to have the equals signs escaped.  e.g.,


> ldap.synchronization.java.naming.security.principal=CN=adminaccount,CN=admingroup,DC=mydomainname,DC=com

ldap.synchronization.java.naming.security.principal=CN\=adminaccount,CN\=admingroup,DC\=mydomainname,DC\=com

although I didn't hit this problem myself since my *.security.principal is of the form: adminaccount@mydomainname.com