Problems with LDAP user synchronisation

[patrick_gill]

I have followed the examples provided in the Wiki and these forums to setup LDAP login on two LDAP servers (working fine) and I am now trying to get the user synchronisation working. For some reason the users are not getting synchronised but the groups are. This is what I have in my ldap-authentication-context.xml:

    <bean id="ldapPeopleTrigger" class="org.alfresco.util.TriggerBean">
        <property name="jobDetail">
            <bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapPeopleImport"/>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <!– Start after 5 minutes of starting the repository –>
        <property name="startDelay">
            <value>300000</value>
        </property>
        <!– Repeat every hour –>
        <property name="repeatInterval">
            <value>3600000</value>
        </property>
        <!– Commented out to disable –>
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
    </bean>
    
    <bean id="ldapGroupTrigger" class="org.alfresco.util.TriggerBean">
        <property name="jobDetail">
            <bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapGroupImport"/>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <!– Start after 5 minutes of starting the repository –>
        <property name="startDelay">
            <value>300000</value>
        </property>
        <!– Repeat every hour –>
        <property name="repeatInterval">
            <value>3600000</value>
        </property>
        <!– Commented out to disable –>
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
        
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

And the log outputs:

15:12:02,562 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Community Network): Current version 2.1.0 (482) schema 64 - Installed version 2.1.0 (482) schema 64
15:16:41,328 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Found 0
15:16:41,328 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Top 0
15:16:41,343 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Secondary 0
‍‍‍‍‍‍

:?: Any ideas why the group import runs but the user import doesn't? Does it have anything to do with chaining? I have the following:

ldap-authentication-context.xml

    <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <value>uid=%s,ou=people,dc=mycompany,dc=co.uk</value>
        </property>
    </bean>
    
    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry>
                <entry key="java.naming.provider.url">
                    <value>ldaps://myldap1:636</value>
                </entry>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>
                </entry>
            </map>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

chaining-authentication-context.xml

    <bean id="authenticationServiceImpl" class="org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl">
        <property name="authenticationServices">
            <list>
                <ref bean="authenticationServiceImplLDAP1"/>
                <ref bean="authenticationServiceImplLDAP2"/>
            </list>
        </property>
    </bean>

    <bean id="authenticationServiceImplLDAP1" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoLDAP1"/>
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponent"/>
        </property>
    </bean>
    
    <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory1"/>
        </property>
        <property name="userNameFormat">
            <value>uid=%s,ou=people,dc=mycompany,dc=co.uk</value>
        </property>
    </bean>
    
    <bean id="ldapInitialDirContextFactory1" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry>
                <entry key="java.naming.provider.url">
                    <value>ldaps://myldap1:636</value>
                </entry>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>
                </entry>
            </map>
        </property>
    </bean>
    
    <bean id="authenticationDaoLDAP1" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao"/>

    <bean id="authenticationServiceImplLDAP2" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
        <property name="authenticationDao">
            <ref bean="authenticationDaoLDAP2"/>
        </property>
        <property name="ticketComponent">
            <ref bean="ticketComponent"/>
        </property>
        <property name="authenticationComponent">
            <ref bean="authenticationComponentImplLDAP2"/>
        </property>
    </bean>
    
    <bean id="authenticationComponentImplLDAP2" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory2"/>
        </property>
        <property name="userNameFormat">
            <value>uid=%s,ou=people,dc=mycompany,dc=co.uk</value>
        </property>
    </bean>
    
    <bean id="ldapInitialDirContextFactory2" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <entry key="java.naming.factory.initial">
                    <value>com.sun.jndi.ldap.LdapCtxFactory</value>
                </entry>
                <entry key="java.naming.provider.url">
                    <value>ldaps://myldap2:636</value>
                </entry>
                <entry key="java.naming.security.authentication">
                    <value>simple</value>
                </entry>
            </map>
        </property>
    </bean>
    
    <bean id="authenticationDaoLDAP2" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao"/>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Could there be some sort of conflict?

[patrick_gill]

I have now resolved this issue. As it turns out I had set the objectClass incorrectly for the personQuery property. It now exports users without a problem. Having said that, a log line saying something like 'No users found for objectClass = whatever' would have been a lot more useful than no output what-so-ever.

[robertoroberto]

Hi, how have you done to log debug info about ldap import user?

5:16:41,328 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Found 0
15:16:41,328 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Top 0
15:16:41,343 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Secondary 0

Regards.