NTLM passthru, LDAP synchro and user access restriction

[lascaux]

Hi,

I configured a LDAP synchro (Active Directory) in order to copy users from a particular group into Alfresco.
I also commented the bean <bean id="authenticationComponentImpl"  in the ldap-authentication-context.xml file

I modified the web.xml file to activate the NTLM passthru (in order to allow the access to alfresco without login/password)
the file ntlm-authentication-context.xml has been left to its default value (no "servers" values, "useLocalServer" set to true)

A user from the AD group (so which is synchronized) can connect successfuly to alfresco, but it also allows people which are not part of the group to connect to alfresco (the account is then created in Alfresco).

is it normal ?
How can we restrict the access only to the syncrhonized users ??

Thanks

Sylvain

[andy]

Hi

You can turn off the auto creation of people - no one without imported details will be able to log in.

Over-ride the person service bean and change the property createMissingPeople to false.

   <!– The person service.                                                –>

    <bean id="personService" class="org.alfresco.repo.security.person.PersonServiceImpl">
 …….
        <property name="createMissingPeople">
           <value>false</value>
        </property
…….
    </bean>
‍‍‍‍‍‍‍‍‍‍‍

Regards

Andy

[lascaux]

You can turn off the auto creation of people - no one without imported details will be able to log in.

Over-ride the person service bean and change the property createMissingPeople to false.

   <!– The person service.                                                –>

    <bean id="personService" class="org.alfresco.repo.security.person.PersonServiceImpl">
 …….
        <property name="createMissingPeople">
           <value>false</value>
        </property
…….
    </bean>
‍‍‍‍‍‍‍‍‍‍‍

Thanks Andy,

But where to override this bean ??

[andy]

Hi

Take the defintion from authentication-services-context.xml and put it in extensions, somewhere like custom-authentication-services-context.xml.
Then make your changes - this will over-ride the bean defintion. Any file matching *-context.xml will be found in the extensions directory.

Regards

Andy