Multi-tenancy and SSO (CAS+LDAP)

[danilo_barone]

Good morning all,
I have some questions, so I'm going to describe my situation:

In multi-tenancy structure, I have fore example 2 tenants.
-tenantdom1
-tenantdom2
So an user can login in alfresco by <username>@tenantdom1 or <username>@tenantdom2 (depending on wich tenant he is registered).

I configured SSO in Alfresco with CAS and LDAP. This configuration work, and LDAP users import work too, but I have a problem.
Although I read that there are issues about multi authentication on multi LDAP, this is not my problem: I have only one LDAP application.
Each tenant is identified in LDAP by an "organization unit". For example: o=tenantdom1 and o=tenantdom2. So each user of tenant1 will be under o=tenantdom1, and each user of tenant2 are under o=tenantdom2.

This is mi situation, and these are my questions:

1 - Do you have suggestions on how I can implement this architechture in Alfresco?
2 - I can import users from LDAP (using ldap.synchronisation.personSearchBase), but how I can import user from more dn?
3 - Do I need to implement a new "ldap-synchronisation-context"? How can I do?

Thank you all
Regards

Danilo

[danilo_barone]

I thought I can use the "ldap.synchronisation.personQuery" to find all tenant's users.
For Example:

ldap.synchronisation.personQuery=(&(objectclass=inetOrgPerson)(|(o=tenantdom1)(o=tenantdom2)))
‍‍‍

Is this correct?

Regards
Danilo

[danilo_barone]

other problem…
the organization unit "o" is not an attribute, so i can't insert it in the query… but I can start query on a "father-node" of all o=tenantdom1, o=tenantdom2…etc
we just need to insert an attribute to separate users that can access to Alfresco and any user that are in LDAP but cannot access to Alfresco.

What do you think?

Regards
Danilo
(I'm doing ping pong with myself…  )

[danilo_barone]

I'm continuing to test multi-tenancy importing from ldap, but…  :cry: I have many problems to understand this structure.
If I create an user of tenant1 (test@tenantdom1) in LDAP, simply by entering the username 'test@tenantdom1', Alfresco look it as a normal user, not as an user under tenant1 domain.
How can Alfresco recognize it?
I need your help because I didn't find any documentation on this situation…
Is there anyone who can suggest something, or give me a document that describe the integration with multi-tenancy and SSO?

I hope you write me soon

Regards
Danilo

[protenus]

Danilo,

While I cant help much (having same conceptual problems). We are also working on doing the same thing.

We are integrating with zimbra, so the users are located in differant domains
eg.
ou=people,dn=tenant1,dn=net
and
ou=people,dn=tenant2,dn=net

any ideas how to set up a LDAP to search both of these?

[tan]

Even I had a similar use case ,I did not find a neat solution but I made it work .

Not so great solution given below

1. Disable ldap sync by renaming ldap-synchronisation-context.xml to ldap-synchronisation-context.xml.sample in shared dir to avoid ldap import .If the import is enabled then users are created as normal users .

2. Now login as user1@tenant1 thru SSO(CAS +LDAP ) since LDAP authentication is enabled the user is created by alfresco under tenant1

Follow the same for tenant2 .

The trick is to avoid import and let alfresco create users if not available .Alfresco creates users under correct tenant as multi tenant feature is enabled.

I hope this crappy solution is of some help .

Warning : This is posted by an user who has just worked with alfresco for a month

[pp20218]

Hi,
I want to use LDAP with Zimbra.
If I create tenants with out LDAP configuration, it is working as expected.
But when I use LDAP and create tenants I am not able to login.
I created a tenant named tenant1 and tenant2.
I am using userid as admin@tenant1 but it is not accepting.

Pls help.

Thanx

[pp20218]

Can ANyone pls help on this?

[pp20218]

Any help pls..

I am eagerly waiting for the reply.

Thanx in advance

[pp20218]

Can anyone help pls?

Thanx in advance.