Alfresco authentication with Active Directory

[arundech_l]

Dear all

Can I configure Alfresco 5.1 CE to authenticate with Active Directory without importing users from Active Directory into Alfresco?

I'll create users in alfresco manually but authenticate  on Active Directory when do login.

Is it possible?

Thanks.

[mrks_js1]

No - If you create them manually they will be in a different repository. 

[arundech_l]

Hi Markus

Thanks for your reply

If I set ad configure in alfresco-global.properties, alfresco will always import user into repository, right?

Thanks.

[mrks_js1 · Accepted solution]

you can enable/disable both parts via these properties: ldap.authentication.active & ldap.synchronization.active
but if you login with an ldap user, it will be synchronized. it might not have all the properties from ldap but it will be in your system. 

[arundech_l]

Thanks so much.

[pratu9]

Hello Markus,

I am facing issue with user synchronization. Before we created users in the AD and added to Alfresco group for login. But now we are facing issue related to user login. If we create a new user on the AD it will not able to log in on Alfresco. We want to create users locally on Alfresco but new user option in Admin console is disabled. Could you please help with this?

Thanks,

Pratiksha

[mrks_js1]

Maybe it is more helpful if you let us know what you are trying to achieve? to me it sounds like you have a whole bunch of users in your ldap but only a small group of them should have access to alfresco respectively be synchronized. 

[arundech_l]

The thing is in AD has only 1 OU which contain all users and I have to configure alfresco to authen with this AD. But the owner of this AD not allow me to import all users into alfresco, he allow only the users who need to use alfresco.

Sorry I just saw that I didn't submit my reply.

[cver]

I had / have? a similar problem with Alfresco 4.2 ONE : there are many non-Alfresco users in our AD, many of which are "non persons" (meeting rooms etc) which made it tricky to stay below the licence limit. The key to slve it was to set up a filter in the sync page. Maybe it  could work for you be as well ? That way, only one part of the AD is sync'ed. Of course in your case it means that the AD has to contain some field that can be used to select only Alfresco users. 

[arundech_l]

Hi Christophe

Thanks for your suggestion. Now I can sync AD with my requirement by using ldap.authentication.active & ldap.synchronization.active properties as Markus Joos's suggestion.

Thanks.