Hopefully someone will see this and offer some help, since it tells me I cannot start my own thread.
Basically, using the 5.0 build, I can't seem to get LDAP Sync or Passthru to work.
It seems to be authenticating users from AD, but no info syncs, and the error in the log is not very helpful.
I've done a lot of searches thru the forms, and the biggest issue I'm finding is that there's seems to be no one single 'How-To' for AD. I find suggestions that offer suggestions in direct conflict with other's directions, or are done in what seems to be a completely different manner, and the bulk of the results of my searches are for older versions, and not 5.x
Here's my global config, covering the entire Auth configuration. I've substituted the domain HELPME for my actual domain. I realize this looks very bloated, but this is putting together everyone's suggestion for why it's not working, as found in other's posts asking for help:
#Authentication settings
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,passthru1
assthru
ntlm.authentication.sso.enabled=false
### CIFS/SMB Server Configuration ###
cifs.enabled=true
cifs.domain=ld.local
cifs.serverName=${localname}A
cifs.hostannounce=true
#CIFS with LDAP We have to use passthru for CIFS due to limitations in how cifs has to authenticate
ntlm.authentication.authenticateCIFS=false
#Must be disabled to allow chained password-based login
ntlm.authentication.sso.enabled=false
alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false
passthru.authentication.authenticateCIFS=true
passthru.authentication.useLocalServer=false
passthru.authentication.domain=HELPME.org
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=admin,administrator
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP,NETBIOS
passthru.authentication.servers=HELPME.org\\SVR-001-DC01,HELPME.org\\SVR-002-DC01,SVR-003-DC01
passthru.authentication.offlineCheckInterval=300
#LDAP authentication
ldap.authentication.userNameFormat=cn=%s,ou=facilities,ou=users,dc=HELPME,dc=org
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.security.authentication=SIMPLE
ldap.authentication.java.naming.security.principal=cn=alfresco,dc=HELPME,dc=org
ldap.authentication.java.naming.security.credentials=APassword
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@HELPME.org
ldap.authentication.java.naming.provider.url=ldap://SVR-001-DC01.HELPME.org:389
ldap.authentication.defaultAdministratorUserNames=admin,administrator
ldap.authentication.active=false
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=alfresco@HELPME.Org
ldap.synchronization.java.naming.security.credentials=APassword
ldap.synchronization.groupSearchBase=OU=Security_Groups,OU=HELPME,DC=Org
ldap.synchronization.userSearchBase=OU=Facilities,OU=Users,DC=HELPME,DC=Org
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
I have verified that the AD/LDAP account 'alfresco' can read/view any user in AD using the tool Softerra LDAP Browser 4.5, and the account can fully roam the AD. It is a member of 'Domain Users' only.
When the app is started, I'm presented with the login prompt, so Passthru isn't working.
I can enter my AD ID/PW and it does log me in, but all profile info is blank, and of course it shows my login ID and not my common name.
This is the error / reason in the log when AD Sync tries to kick in:
2015-12-24 00:23:52,504 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason
rg:389
Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reasonrg:389
Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Failed initial synchronize with user registries
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reasonrg:389
Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
Basically, using the 5.0 build, I can't seem to get LDAP Sync or Passthru to work.
It seems to be authenticating users from AD, but no info syncs, and the error in the log is not very helpful.
I've done a lot of searches thru the forms, and the biggest issue I'm finding is that there's seems to be no one single 'How-To' for AD. I find suggestions that offer suggestions in direct conflict with other's directions, or are done in what seems to be a completely different manner, and the bulk of the results of my searches are for older versions, and not 5.x
Here's my global config, covering the entire Auth configuration. I've substituted the domain HELPME for my actual domain. I realize this looks very bloated, but this is putting together everyone's suggestion for why it's not working, as found in other's posts asking for help:
#Authentication settings
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,passthru1
assthruntlm.authentication.sso.enabled=false
### CIFS/SMB Server Configuration ###
cifs.enabled=true
cifs.domain=ld.local
cifs.serverName=${localname}A
cifs.hostannounce=true
#CIFS with LDAP We have to use passthru for CIFS due to limitations in how cifs has to authenticate
ntlm.authentication.authenticateCIFS=false
#Must be disabled to allow chained password-based login
ntlm.authentication.sso.enabled=false
alfresco.authentication.authenticateCIFS=false
#alfresco.authentication.allowGuestLogin=false
passthru.authentication.authenticateCIFS=true
passthru.authentication.useLocalServer=false
passthru.authentication.domain=HELPME.org
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=admin,administrator
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP,NETBIOS
passthru.authentication.servers=HELPME.org\\SVR-001-DC01,HELPME.org\\SVR-002-DC01,SVR-003-DC01
passthru.authentication.offlineCheckInterval=300
#LDAP authentication
ldap.authentication.userNameFormat=cn=%s,ou=facilities,ou=users,dc=HELPME,dc=org
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.security.authentication=SIMPLE
ldap.authentication.java.naming.security.principal=cn=alfresco,dc=HELPME,dc=org
ldap.authentication.java.naming.security.credentials=APassword
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@HELPME.org
ldap.authentication.java.naming.provider.url=ldap://SVR-001-DC01.HELPME.org:389
ldap.authentication.defaultAdministratorUserNames=admin,administrator
ldap.authentication.active=false
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=alfresco@HELPME.Org
ldap.synchronization.java.naming.security.credentials=APassword
ldap.synchronization.groupSearchBase=OU=Security_Groups,OU=HELPME,DC=Org
ldap.synchronization.userSearchBase=OU=Facilities,OU=Users,DC=HELPME,DC=Org
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
I have verified that the AD/LDAP account 'alfresco' can read/view any user in AD using the tool Softerra LDAP Browser 4.5, and the account can fully roam the AD. It is a member of 'Domain Users' only.
When the app is started, I'm presented with the login prompt, so Passthru isn't working.
I can enter my AD ID/PW and it does log me in, but all profile info is blank, and of course it shows my login ID and not my common name.
This is the error / reason in the log when AD Sync tries to kick in:
2015-12-24 00:23:52,504 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason
rg:389Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason
rg:389Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [localhost-startStop-1] Failed initial synchronize with user registries
org.alfresco.error.AlfrescoRuntimeException: 11240001 Error during LDAP Search. Reason
rg:389Caused by: javax.naming.CommunicationException: org:389 [Root exception is java.net.UnknownHostException: org]
Caused by: java.net.UnknownHostException: org
2015-12-24 00:23:52,692 INFO [org.alfresco.repo.management.subsystems.ChildApplicationContextFactory] [localhost-startStop-1] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
