Sync problem (?) with Active Directory

[lchoonch]

I'm new to Alfresco and just spent the last week configuring Alfresco 3.2.  I use AD and I am experiencing a problem with the synchronization with AD.  Every time my AD user logs in, Alfresco creates all the users.  Is the normal behaviour ?  My configuration is

ldap.authentication.active=false
ldap.authentication.defaultAdministratorUserName=admin,Administrator
ldap.authentication.userNameFormat=cn\=%s,cn\=Users,dc\=myhome,dc\=net

ldap.synchronization.active=true
ldap.synchronization.java,naming.security.principal=cn\=Test Admin,cn\=Users,dc\=myhome,dc\=net
ldap.synchronization.java.naming.security.credentials=<some password>
ldap.synchronization.userSearchBase=cn\=Users,dc\=myhome,dc\=net

synchronization.synchronizeChangesOnly=false
synchronization.syncWhenMissingPeopleLogin=true
synchronization.autoCreatePeopleOnLogin=true

Can someone give some suggestions ?   Thanks.

[jbaldo]

Maybe you've resolved this by now, but when an unknown user attempts to login and is authenticated, it triggers a sync.  Your config is attempting to do a sync at this location:

ldap.synchronization.userSearchBase=cn\=Users,dc\=myhome,dc\=net

I think by default it attempts to add the first 1000 users.

You can narrow the scope by adding a query string which only selects users with certain attributes:

ldap.synchronization.personDifferentialQuery
    The query to select objects that represent the users to export that have changed since a certain time. Should use the placeholder {0} in place of a timestamp in the format specified by ldap.synchronization.timestampFormat. The timestamp substituted will be the maximum value of the attribute named by ldap.synchronization.modifyTimestampAttributeName the last time users were queried. This query is used in 'differential sync mode', which by default is triggered whenever a user is successfully authenticated that does not yet exist in Alfresco. See The Synchronization Subsystem.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

[lchoonch]

thank you I manage to resolve this.  It is as you said the ldap syncs on login if the user has not been created. This was not the only problem.  Narrowing the sync query AND also excluding the Guest user ( I am using AD ) fixed the problem for me.

[dward]

FYI it queries in batches of 1000 users at a time but is not restricted to 1000 users. It just uses multiple round-trips to the LDAP server to retrieve the users. This is controlled by:

ldap.synchronization.queryBatchSize