Login via email or nickname not username (ldap-ad)

[erong]

Hi,

I am newest in Alfresco. Please help me in step by step.

Environment: Alfresco community edition in Ubuntu 14.04

I can login by username from ldap-ad. But I need to login by email, nickname or other properties.

Here is our AD architecture.

DN = User_Object

   |

   |- CN = Username 1

       |- mail: mail1@gmail.com

       |- nickname: Mary

       |- ...

   |- CN = Username 2

       |- mail: mail@gmail.com

       |- nickname: John

       |- ...

Here is alfresco-global.properties and login by user name. It work for me.

ldap.authentication.userNameFormat=CN=%s,OU=User_Object,OU=organization,DC=domain ldap.synchronization.userIdAttributeName=cn ldap.authentication.java.naming.provider.url=ldap://{$ip}:389 ldap.synchronization.groupSearchBase=OU=Group_Object,OU=organization,DC=domain ldap.synchronization.userSearchBase=OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.principal=CN={$username},OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.credentials={$password} ldap.synchronization.personQuery=(objectClass=*) ...

But I need to login via mail or nickname.

I try some solution as follow, but it can not login via mail/nickname correctly.

ldap.authentication.userNameFormat=%s ldap.synchronization.userIdAttributeName=mail (or nickname) ldap.authentication.java.naming.provider.url=ldap://{$ip}:389 ldap.synchronization.groupSearchBase=OU=Group_Object,OU=organization,DC=domain ldap.synchronization.userSearchBase=OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.principal=CN={$username},OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.credentials={$password} ldap.synchronization.personQuery=(objectClass=*) ...

ldap.authentication.userNameFormat=mail=%s,OU=User_Object,OU=organization,DC=domain ldap.synchronization.userIdAttributeName=mail

What exactly am I missing here? Any help would be highly appreciated. Thanks.

[afaust]

When you configure userNameFormat that must pattern must construct the distinguished name (DN) of the LDAP authority. You cannot use anything you want in there - it must match what your LDAP server is using for DN. There is typically only one unique DN for a user, so userNameFormat cannot be used for a "X OR Y" authentication use case.

Unfortunately, Alfresco only supports authenticating by one specific property against LDAP by default - the userIdAttributeName. When you don't set the userNameFormat than Alfresco will use the person query to lookup a person matching the provided login name against the userIdAttributeName. Since you can only configure one userIdAttributeName this too does not allow a "X OR Y" authentication use case.

Some members of the community have implemented custom solutions for "X OR Y" authentication, typically to support "user ID or email" authentication. I am not aware of a generic solution / approach that allows any number of arbirtrary LDAP attriibutes to be used, though I am generally interested to add such a functionality to one of my modules in the near future (Alfresco MT Support - the initial version adds extended LDAP support for multi-tenancy).