LDAP (AD) Account inheritance question

[sjordi]

HI,
We're currently integrating our Alfresco with LDAP through an active directory.
The problem we face is that once synchronized, it actually creates the 4,000+ account at once.
Then everybody can connect.

Is there a way to avoid this?
We'd like to allow only specific persons, defined in groups, to connect to Alfresco.
Mainly two sets of persons, defined in two groups.

Any way to have only those persons synchronized and related accounts created in Alfresco?
If yes, how can we do this?
Thanks for any help.

[afaust]

Hello,

depending on your layout within the LDAP (AD) and your ability to express the conditions in an LDAP query, you can select the people that are being synchronized by configuring the ldap.synchronization.personQuery and ldap.synchronization.personDifferentialQuery (http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2).

Regards
Axel

[sjordi]

Ok we found a way to avoid creating everything, but we still struggle with the queries in order to try to get info from groups.

The idea is to have a group called Applications->Alfresco->DNP
In this one we have three groups: DNP-Admin, DNP-Manager, DNP-Read
We have set persons in each group.
When Alfresco syncs, it sees the three groups but says that the users don't have the right distinguished names.
It has the correct name, so this means that it correctly sees who is in which group, but still it doesn't use it.
Here is the error
Failed to resolve member of group 'GG-DNP-Admin' with distinguished name: CN=Jordi,OU=DSIC,OU=VILLE-GE,DC=activedir,DC=ville-geneve,DC=ch

Our queries are as follows:
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimeStamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimeStamp<\={0})))
ldap.synchronization.groupSearchBase=ou\=Alfresco,ou\=Applications,dc\=activedir,dc\=ville-geneve,dc\=ch
ldap.synchronization.userSearchBase=ou\=Alfresco,ou\=Applications,dc\=activedir,dc\=ville-geneve,dc\=ch
ldap.synchronization.modifyTimestampAttributeName=modifyTimeStamp


Any idea?
Thanks for your help.
Steve