Hey all,
I posted about this problem in the forums a few days back and did not find any response
. So, iam trying my luck again.
I have Alfresco setup with NTLM pass-thru authentication with Active Directory for both CIFS and alfresco and also have LDAP user/Group Sync setup.
However, when I check out the groups that have been synced in alfresco there seem to be no users under them. The users & groups are synced properly and there are no errrors in the logs. Its only that from the administrative console iam not able to see what users belong to a group. I have also applied the fix mentioned in one of the topics which doesnt sync empty groups from the AD.
below is my ldap-authentication-context.xml
Below is the AD properties of one of my groups..
Below is one of my Users properties in the AD
Iam using alfresco-1.2.1-linux-community.bin. Everything else works fine and only this problem is stopping me from going into production.
Does anyone have LDAP user/group sync succesfully with AD and does everything work fine ?
Please advice how to debug this issue.
Dushyanth
I posted about this problem in the forums a few days back and did not find any response
. So, iam trying my luck again.I have Alfresco setup with NTLM pass-thru authentication with Active Directory for both CIFS and alfresco and also have LDAP user/Group Sync setup.
However, when I check out the groups that have been synced in alfresco there seem to be no users under them. The users & groups are synced properly and there are no errrors in the logs. Its only that from the administrative console iam not able to see what users belong to a group. I have also applied the fix mentioned in one of the topics which doesnt sync empty groups from the AD.
below is my ldap-authentication-context.xml
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
<!– DAO that rejects changes - LDAP is read only at the moment –>
<bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
<property name="proxyInterfaces">
<value>org.alfresco.repo.security.authentication.MutableAuthenticationDao</value>
</property>
<property name="transactionManager">
<ref bean="transactionManager"/>
</property>
<property name="target">
<bean class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao">
<property name="nodeService">
<ref bean="nodeService"/>
</property>
</bean>
</property>
<property name="transactionAttributes">
<props>
<prop key="*">${server.transaction.mode.default}</prop>
</props>
</property>
</bean>
<!– LDAP authentication configuration –>
<!–
You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
authentication routes, like Active Directory.
–>
<bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="userNameFormat">
<!–
This maps between what the user types in and what is passed through to the underlying LDAP authentication.
"%s" - the user id is passed through without modification.
Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
"cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authentricate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
Usually for simple authentication.
–>
<value>samaccountname=%s</value>
</property>
</bean>
<!–
This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
to pull them out of the LDAP reopsitory
–>
<bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
<property name="initialDirContextEnvironment">
<map>
<!– The LDAP provider –>
<entry key="java.naming.factory.initial">
<value>com.sun.jndi.ldap.LdapCtxFactory</value>
</entry>
<!– The url to the LDAP server –>
<entry key="java.naming.provider.url">
<value>ldap://192.168.0.1:389</value>
</entry>
<!– The authentication mechanism to use –>
<!– Some sasl authentication mechanisms may require a realm to be set –>
<!– java.naming.security.sasl.realm –>
<!– The available options will depend on your LDAP provider –>
<entry key="java.naming.security.authentication">
<value>simple</value>
</entry>
<!– The id of a user who can read group and user information –>
<!– This does not go through the pattern substitution defined above and is used "as is" –>
<entry key="java.naming.security.principal">
<value>CN=systems,CN=Users,DC=abc,DC=com</value>
</entry>
<!– The password for the user defined above –>
<entry key="java.naming.security.credentials">
<value>xyz</value>
</entry>
</map>
</property>
</bean>
<!– Ldap Syncronisation support –>
<!–
There can be more than one stack of beans that import users or groups. For example, it may be easier
to have a version of ldapPeopleExportSource, and associated beans, for each sub-tree of your ldap directory
from which you want to import users. You could then limit users to be imported from two or more sub tress and ignore
users found else where. The same applies to the import of groups.
The defaults shown below are for OpenLDAP.
–>
<!– Extract user information from LDAP and transform this to XML –>
<bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
<!–
The query to select objects that represent the users to import.
For Open LDAP, using a basic schema, the following is probably what you want:
(objectclass=inetOrgPerson)
For Active Directory:
(objectclass=user)
–>
<!–
<property name="personQuery">
<value>(objectclass=user)</value>
</property>
–>
<property name="personQuery">
<value><![CDATA[(&(objectclass=user)(cn=*)(sn=*)(mail=*)(company=*))]]></value>
</property>
<!–
The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
–>
<property name="searchBase">
<value>dc=internal,dc=directi,dc=com</value>
</property>
<!–
The unique identifier for the user.
THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT
For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"
In OpenLDAP, using other authentication mechanisms "uid", but this depends on how you map
from the id in the LDAP authentication request to search for the inetOrgPerson against which
to authenticate.
In Active Directory this is most likely to be "sAMAccountName"
This property is mandatory and must appear on all users found by the query defined above.
–>
<property name="userIdAttributeName">
<value>samaccountname</value>
</property>
<!– Services –>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="personService">
<ref bean="personService"></ref>
</property>
<property name="namespaceService">
<ref bean="namespaceService"/>
</property>
<!–
The path to the location of a space to use as the default home folder.
This folder should be readable by all users, or a group to which all imported users belong.
–>
<property name="defaultHomeFolder">
<value>/app:company_home</value>
</property>
<!–
This property defines a mapping between attributes held on LDAP user objects and
the properties of user objects held in the repository. The key is the QName of an attribute in
the repository, the value is the attribute name from the user/inetOrgPerson/.. object in the
LDAP repository.
–>
<property name="attributeMapping">
<map>
<entry key="cm:userName">
<!– Must match the same attribute as userIdAttributeName –>
<value>samaccountname</value>
</entry>
<entry key="cm:firstName">
<!– OpenLDAP: "givenName" –>
<!– Active Directory: "givenName" –>
<value>givenName</value>
</entry>
<entry key="cm:lastName">
<!– OpenLDAP: "sn" –>
<!– Active Directory: "sn" –>
<value>sn</value>
</entry>
<entry key="cm:email">
<!– OpenLDAP: "mail" –>
<!– Active Directory: "???" –>
<value>mail</value>
</entry>
<entry key="cm:organizationId">
<!– OpenLDAP: "o" –>
<!– Active Directory: "???" –>
<value>company</value>
</entry>
</map>
</property>
</bean>
<!– Extract group information from LDAP and transform this to XML –>
<bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
<!–
The query to select objects that represent the groups to import.
For Open LDAP, using a basic schema, the following is probably what you want:
(objectclass=groupOfNames)
For Active Directory:
(objectclass=group)
–>
<property name="groupQuery">
<!–<value>(objectclass=group)</value>–>
<value><![CDATA[(&(objectclass=group) (member=*))]]></value>
</property>
<!–
The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
–>
<property name="searchBase">
<value>dc=internal,dc=directi,dc=com</value>
</property>
<!–
The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above.
–>
<property name="userIdAttributeName">
<value>uid</value>
</property>
<!–
An attribute that is a unique identifier for each group found.
This is also the name of the group with the current group implementation.
This is mandatory for any groups found.
OpenLDAP: "cn" as it is mandatory on groupOfNames
Active Directory: "cn"
–>
<property name="groupIdAttributeName">
<value>cn</value>
</property>
<!–
The objectClass attribute for group members.
For each member of a group, the distinguished name is given.
The object is looked up by its DN. If the object is of this class it is treated as a group.
–>
<property name="groupType">
<value>groupOfNames</value>
</property>
<!–
The objectClass attribute for person members.
For each member of a group, the distinguished name is given.
The object is looked up by its DN. If the object is of this class it is treated as a person.
–>
<property name="personType">
<value>inetOrgPerson</value>
</property>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="namespaceService">
<ref bean="namespaceService"/>
</property>
<!–
The repeating attribute on group objects (found by query or as sub groups)
used to define membership of the group. This is assumed to hold distinguished names of
other groups or users/people; the above types are used to determine this.
OpenLDAP: "member" as it is mandatory on groupOfNames
Active Directory: "member"
–>
<property name="memberAttribute">
<value>member</value>
</property>
</bean>
<!– Job definitions to import LDAP people and groups –>
<bean id="ldapPeopleTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
<property name="jobDetail">
<bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapPeopleImport"/>
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 30 seconds of starting the repository –>
<property name="startDelay">
<value>30000</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<!–<value>3600000</value>–>
<value>300000</value>
</property>
</bean>
<bean id="ldapGroupTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
<property name="jobDetail">
<bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapGroupImport"/>
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 30 seconds of starting the repository –>
<property name="startDelay">
<value>30000</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<!–<value>3600000</value>–>
<value>300000</value>
</property>
</bean>
<!– The bean that imports xml describing people –>
<bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponent"/>
</property>
<property name="transactionService">
<ref bean="transactionComponent"/>
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent"/>
</property>
<property name="exportSource">
<ref bean="ldapPeopleExportSource"/>
</property>
<!– The store that contains people - this should not be changed –>
<property name="storeRef">
<value>${spaces.store}</value>
</property>
<!– The location of people nodes within the store defined above - this should not be changed –>
<property name="path">
<value>/${system.system_container.childname}/${system.people_container.childname}</value>
</property>
<!– If true, clear all existing people before import, if false update/add people from the xml –>
<property name="clearAllChildren">
<value>false</value>
</property>
<property name="nodeService">
<ref bean="nodeService"/>
</property>
<property name="searchService">
<ref bean="searchService"/>
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService"/>
</property>
</bean>
<!– The bean that imports xml descibing groups –>
<bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponent"/>
</property>
<property name="transactionService">
<ref bean="transactionComponent"/>
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent"/>
</property>
<property name="exportSource">
<ref bean="ldapGroupExportSource"/>
</property>
<!– The store that contains group information - this should not be changed –>
<property name="storeRef">
<value>${alfresco_user_store.store}</value>
</property>
<!– The location of group information in the store above - this should not be changed –>
<property name="path">
<value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>
</property>
<!– If true, clear all existing groups before import, if false update/add groups from the xml –>
<property name="clearAllChildren">
<value>true</value>
</property>
<property name="nodeService">
<ref bean="nodeService"/>
</property>
<property name="searchService">
<ref bean="searchService"/>
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService"/>
</property>
</bean>
</beans>
Below is the AD properties of one of my groups..
member
CN=Test User1,OU=Users,OU=DeptSysad,OU=departments,DC=abc,DC=com
CN=Test User2,OU=Users,OU=DeptSysad,OU=departments,DC=abc,DC=com
cn
Sysad
groupType
-2147483646
instanceType
4
distinguishedName
CN=Sysad,OU=Groups,OU=DeptSysad,OU=departments,DC=abc,DC=com
objectCategory
CN=Group,CN=Schema,CN=Configuration,DC=abc,DC=com
objectClass
top
group
objectGUID
$8??C?f
objectSid
ry5??U
name
Sysad
sAMAccountName
Sysad
sAMAccountType
268435456
uSNChanged
951186
uSNCreated
8885
whenChanged
20060605105457.0Z
whenCreated
20030310071555.0Z
Below is one of my Users properties in the AD
Records -> 1
memberOf
CN=Sysad,OU=Groups,OU=DeptSysad,OU=departments,DC=abc,DC=com
accountExpires
9223372036854775807
adminCount
1
badPasswordTime
127937344763593750
badPwdCount
0
codePage
0
cn
Test User1
company
ABC
countryCode
0
department
System Administration
description
displayName
ABC
mail
xyz@abc.com
givenName
Dushyanth
homeDirectory
D:\roaming\Users\Sysads\testuser1
instanceType
4
lastLogoff
0
lastLogon
127940038810312500
logonCount
1248
msNPAllowDialin
TRUE
distinguishedName
CN=Test User1,OU=Users,OU=DeptSysad,OU=departments,DC=abc,DC=com
objectCategory
CN=Person,CN=Schema,CN=Configuration,DC=abc,DC=com
objectClass
top
person
organizationalPerson
user
objectGUID
Vz?@?5C`
objectSid
ry5??\
primaryGroupID
513
profilePath
\\192.168.0.1\testuser1
pwdLastSet
127584589241562500
name
Test User1
sAMAccountName
testuser1
sAMAccountType
805306368
sn
user1
telephoneNumber
7639
title
System Administrator
userAccountControl
66048
userParameters
m: d
userPrincipalName
testuser1@abc.com
uSNChanged
916355
uSNCreated
5381
whenChanged
20060601213908.0Z
whenCreated
20030310071730.0Z
wWWHomePage
Iam using alfresco-1.2.1-linux-community.bin. Everything else works fine and only this problem is stopping me from going into production.
Does anyone have LDAP user/group sync succesfully with AD and does everything work fine ?
Please advice how to debug this issue.
Dushyanth
As per your instructions i changed uid to "samaccountname". however i still have the same issue.
My Issue:
=======
* Users sync fine
* Groups sync fine
* but when i login to alfresco admin console and click on a group - it shows NO Users in it. All the groups are empty
* I am pulling my hair trying to figure this one out
below is my ldap-authentication-context.xml and an excerpt from my log files
Log Excerpt:
========
My Conf File:
========
My Issue:
=======
* Users sync fine
* Groups sync fine
* but when i login to alfresco admin console and click on a group - it shows NO Users in it. All the groups are empty
* I am pulling my hair trying to figure this one out
below is my ldap-authentication-context.xml and an excerpt from my log files
Log Excerpt:
========
User dhwani.g
19:21:03,925 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for ravi.g
User ravi.g
19:21:04,063 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for sheldon.g
User sheldon.g
19:21:04,138 DEBUG [authentication.ldap.LDAPGroupExportSource] Found 93
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_web-promo
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Domain Computers
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Programmers_WHI
19:21:04,139 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=nikunj.s,OU=Users,OU=DeptProductEngg,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,156 DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for shailesh.g
User shailesh.g
19:21:04,159 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_MSCRM Role (Salesperson)
19:21:04,159 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_HR
19:21:04,160 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Margaret Rodrigues,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,163 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Kinnari Gandhi,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,167 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Sumita Das,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,171 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=savita.s,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,174 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=nandini S,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,178 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Mavis Fernandes,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,182 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Aljo Joseph,OU=Users,OU=DeptHR,OU=departments,DC=internal,DC=directi,DC=com
19:21:04,185 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=shivkumari,OU=Users,OU=DeptBilling,OU=departments,DC=internal,DC=directi,DC=com
19:21:07,373 DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Guests
19:21:07,374 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=TsInternetUser,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,376 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_CVS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,927 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_ACCOUNTS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,930 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_ACCOUNTS,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,933 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_DIRECTI-2K,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,937 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Domain Guests,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,939 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_CRM,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,942 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IWAM_CRM,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,945 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=Guest,CN=Users,DC=internal,DC=directi,DC=com
19:21:07,948 DEBUG [authentication.ldap.LDAPGroupExportSource] … CN=IUSR_CVSSERVER,CN=Users,DC=internal,DC=directi,DC=com
My Conf File:
========
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>
<beans>
<!– DAO that rejects changes - LDAP is read only at the moment –>
<bean id="alfDaoImpl" class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
<property name="proxyInterfaces">
<value>org.alfresco.repo.security.authentication.MutableAuthenticationDao</value>
</property>
<property name="transactionManager">
<ref bean="transactionManager"/>
</property>
<property name="target">
<bean class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao">
<property name="nodeService">
<ref bean="nodeService"/>
</property>
</bean>
</property>
<property name="transactionAttributes">
<props>
<prop key="*">${server.transaction.mode.default}</prop>
</props>
</property>
</bean>
<!– LDAP authentication configuration –>
<!–
You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
authentication routes, like Active Directory.
–>
<bean id="authenticationComponentImpl" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="userNameFormat">
<!–
This maps between what the user types in and what is passed through to the underlying LDAP authentication.
"%s" - the user id is passed through without modification.
Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
"cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authentricate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
Usually for simple authentication.
–>
<value>samaccountname=%s</value>
</property>
</bean>
<!–
This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
to pull them out of the LDAP reopsitory
–>
<bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
<property name="initialDirContextEnvironment">
<map>
<!– The LDAP provider –>
<entry key="java.naming.factory.initial">
<value>com.sun.jndi.ldap.LdapCtxFactory</value>
</entry>
<!– The url to the LDAP server –>
<entry key="java.naming.provider.url">
<value>ldap://192.168.0.35:389</value>
</entry>
<!– The authentication mechanism to use –>
<!– Some sasl authentication mechanisms may require a realm to be set –>
<!– java.naming.security.sasl.realm –>
<!– The available options will depend on your LDAP provider –>
<entry key="java.naming.security.authentication">
<value>simple</value>
</entry>
<!– The id of a user who can read group and user information –>
<!– This does not go through the pattern substitution defined above and is used "as is" –>
<entry key="java.naming.security.principal">
<value>CN=installer,CN=Users,DC=internal,DC=directi,DC=com</value>
</entry>
<!– The password for the user defined above –>
<entry key="java.naming.security.credentials">
<value>d0ntask</value>
</entry>
</map>
</property>
</bean>
<!– Ldap Syncronisation support –>
<!–
There can be more than one stack of beans that import users or groups. For example, it may be easier
to have a version of ldapPeopleExportSource, and associated beans, for each sub-tree of your ldap directory
from which you want to import users. You could then limit users to be imported from two or more sub tress and ignore
users found else where. The same applies to the import of groups.
The defaults shown below are for OpenLDAP.
–>
<!– Extract user information from LDAP and transform this to XML –>
<bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
<!–
The query to select objects that represent the users to import.
For Open LDAP, using a basic schema, the following is probably what you want:
(objectclass=inetOrgPerson)
For Active Directory:
(objectclass=user)
–>
<!–
<property name="personQuery">
<value>(objectclass=user)</value>
</property>
–>
<property name="personQuery">
<value><![CDATA[(&(objectclass=user)(cn=*)(sn=*)(mail=*)(company=*))]]></value>
</property>
<!–
The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
–>
<property name="searchBase">
<value>dc=internal,dc=directi,dc=com</value>
</property>
<!–
The unique identifier for the user.
THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT
For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"
In OpenLDAP, using other authentication mechanisms "uid", but this depends on how you map
from the id in the LDAP authentication request to search for the inetOrgPerson against which
to authenticate.
In Active Directory this is most likely to be "sAMAccountName"
This property is mandatory and must appear on all users found by the query defined above.
<value>sAMAccountName</value>
–>
<property name="userIdAttributeName">
<value>samaccountname</value>
</property>
<!– Services –>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="personService">
<ref bean="personService"></ref>
</property>
<property name="namespaceService">
<ref bean="namespaceService"/>
</property>
<!–
The path to the location of a space to use as the default home folder.
This folder should be readable by all users, or a group to which all imported users belong.
–>
<property name="defaultHomeFolder">
<value>/app:company_home</value>
</property>
<!–
This property defines a mapping between attributes held on LDAP user objects and
the properties of user objects held in the repository. The key is the QName of an attribute in
the repository, the value is the attribute name from the user/inetOrgPerson/.. object in the
LDAP repository.
–>
<property name="attributeMapping">
<map>
<entry key="cm:userName">
<!– Must match the same attribute as userIdAttributeName –>
<value>samaccountname</value>
</entry>
<entry key="cm:firstName">
<!– OpenLDAP: "givenName" –>
<!– Active Directory: "givenName" –>
<value>givenName</value>
</entry>
<entry key="cm:lastName">
<!– OpenLDAP: "sn" –>
<!– Active Directory: "sn" –>
<value>sn</value>
</entry>
<entry key="cm:email">
<!– OpenLDAP: "mail" –>
<!– Active Directory: "???" –>
<value>mail</value>
</entry>
<entry key="cm:organizationId">
<!– OpenLDAP: "o" –>
<!– Active Directory: "???" –>
<value>company</value>
</entry>
</map>
</property>
</bean>
<!– Extract group information from LDAP and transform this to XML –>
<bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
<!–
The query to select objects that represent the groups to import.
For Open LDAP, using a basic schema, the following is probably what you want:
(objectclass=groupOfNames)
For Active Directory:
(objectclass=group)
–>
<property name="groupQuery">
<value>(objectclass=group)</value>
<!–<value><![CDATA[(&(objectclass=group) (member=*))]]></value>–>
</property>
<!–
The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
–>
<property name="searchBase">
<value>dc=internal,dc=directi,dc=com</value>
</property>
<!–
The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above.
–>
<property name="userIdAttributeName">
<value>samaccountname</value>
</property>
<!–
An attribute that is a unique identifier for each group found.
This is also the name of the group with the current group implementation.
This is mandatory for any groups found.
OpenLDAP: "cn" as it is mandatory on groupOfNames
Active Directory: "cn"
–>
<property name="groupIdAttributeName">
<value>cn</value>
</property>
<!–
The objectClass attribute for group members.
For each member of a group, the distinguished name is given.
The object is looked up by its DN. If the object is of this class it is treated as a group.
–>
<property name="groupType">
<value>groupOfNames</value>
</property>
<!–
The objectClass attribute for person members.
For each member of a group, the distinguished name is given.
The object is looked up by its DN. If the object is of this class it is treated as a person.
–>
<property name="personType">
<value>inetOrgPerson</value>
</property>
<property name="LDAPInitialDirContextFactory">
<ref bean="ldapInitialDirContextFactory"/>
</property>
<property name="namespaceService">
<ref bean="namespaceService"/>
</property>
<!–
The repeating attribute on group objects (found by query or as sub groups)
used to define membership of the group. This is assumed to hold distinguished names of
other groups or users/people; the above types are used to determine this.
OpenLDAP: "member" as it is mandatory on groupOfNames
Active Directory: "member"
–>
<property name="memberAttribute">
<value>member</value>
</property>
</bean>
<!– Job definitions to import LDAP people and groups –>
<bean id="ldapPeopleTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
<property name="jobDetail">
<bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapPeopleImport"/>
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 30 seconds of starting the repository –>
<property name="startDelay">
<value>30000</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<value>3600000</value>
</property>
</bean>
<bean id="ldapGroupTrigger" class="org.springframework.scheduling.quartz.SimpleTriggerBean">
<property name="jobDetail">
<bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
<property name="jobClass">
<value>org.alfresco.repo.importer.ImporterJob</value>
</property>
<property name="jobDataAsMap">
<map>
<entry key="bean">
<ref bean="ldapGroupImport"/>
</entry>
</map>
</property>
</bean>
</property>
<!– Start after 30 seconds of starting the repository –>
<property name="startDelay">
<value>30000</value>
</property>
<!– Repeat every hour –>
<property name="repeatInterval">
<value>3600000</value>
</property>
</bean>
<!– The bean that imports xml describing people –>
<bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponent"/>
</property>
<property name="transactionService">
<ref bean="transactionComponent"/>
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent"/>
</property>
<property name="exportSource">
<ref bean="ldapPeopleExportSource"/>
</property>
<!– The store that contains people - this should not be changed –>
<property name="storeRef">
<value>${spaces.store}</value>
</property>
<!– The location of people nodes within the store defined above - this should not be changed –>
<property name="path">
<value>/${system.system_container.childname}/${system.people_container.childname}</value>
</property>
<!– If true, clear all existing people before import, if false update/add people from the xml –>
<property name="clearAllChildren">
<value>false</value>
</property>
<property name="nodeService">
<ref bean="nodeService"/>
</property>
<property name="searchService">
<ref bean="searchService"/>
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService"/>
</property>
</bean>
<!– The bean that imports xml descibing groups –>
<bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
<property name="importerService">
<ref bean="importerComponent"/>
</property>
<property name="transactionService">
<ref bean="transactionComponent"/>
</property>
<property name="authenticationComponent">
<ref bean="authenticationComponent"/>
</property>
<property name="exportSource">
<ref bean="ldapGroupExportSource"/>
</property>
<!– The store that contains group information - this should not be changed –>
<property name="storeRef">
<value>${alfresco_user_store.store}</value>
</property>
<!– The location of group information in the store above - this should not be changed –>
<property name="path">
<value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>
</property>
<!– If true, clear all existing groups before import, if false update/add groups from the xml –>
<property name="clearAllChildren">
<value>true</value>
</property>
<property name="nodeService">
<ref bean="nodeService"/>
</property>
<property name="searchService">
<ref bean="searchService"/>
</property>
<property name="namespacePrefixResolver">
<ref bean="namespaceService"/>
</property>
</bean>
</beans>
