Hyland Connect

aique · ‎06-02-2010

Hi!.

I'm trying to configure Alfresco to authenticate and generate users and groups using LDAP. I've followed an article where I need just to edit the alfresco-global.properties file in the folder alfresco/tomcat/shared/classes.

Here's my configuration:



###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=/opt/Alfresco/alf_data

#
# Sample database connection properties
#————-
db.name=alfresco
db.username=alfresco
db.password=alfresco
db.host=localhost
db.port=3306

#
# External locations
#————-
ooo.exe=/opt/Alfresco/program/soffice
ooo.user=<%ShortInstallDir%>/alf_data/oouser
jodconverter.officeHome=/opt/Alfresco
jodconverter.portNumbers=8101
#ooo.enabled=false
#jodconverter.enabled=true
img.root=/usr/local
swf.exe=/opt/Alfresco/bin/pdf2swf

#
# Initial admin password
#————-
alfresco_user_store.adminpassword=209c6174da490caeb422f3fa5a7ae634

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://${db.host}:${db.port}/${db.name}

#
# Oracle connection
#
#oracle#db.driver=oracle.jdbc.OracleDriver
#oracle#db.url=jdbc:oracle:thin:@${db.host}:${db.port}:${db.name}

#
# SQLServer connection
# Requires jTDS driver version 1.2.5 and SNAPSHOT isolation mode
# Enable TCP protocol on fixed port db.port
# Prepare the database with:
# ALTER DATABASE db.name SET ALLOW_SNAPSHOT_ISOLATION ON; 
#
#mssql#db.driver=net.sourceforge.jtds.jdbc.Driver
#mssql#db.url=jdbc:jtds:sqlserver://${db.host}:${db.port}/${db.name}
#mssql#db.txn.isolation=4096

#
# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)
#
#postgres#db.driver=org.postgresql.Driver
#postgres#db.url=jdbc:postgresql://${db.host}:${db.port}/${db.name}

#
# Index Recovery Mode
#————-
#index.recovery.mode=Auto

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service.  The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties 
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match.  For example:
#   .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
#authentication.chain=alfrescoNtlm1:alfrescoNtlm

# MODIFICACION_INI

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

# MODIFICACION_FIN

#
# URL Generation Parameters (The ${localname} token is replaced by the local server name)
#————-
#alfresco.context=alfresco
#alfresco.host=${localname}
#alfresco.port=8080
#alfresco.protocol=http
#
#share.context=share
#share.host=${localname}
#share.port=8080
#share.protocol=http

# MODIFICACION_INI

ldap.authentication.active=true
ldap.synchronization.active=true

# How to map the user id entered by the user to taht passed through to LDAP
# - simple
# - this must be a DN and would be something like
# CN=%s,DC=company,DC=com
# - digest
# - usually pass through what is entered
# %s
ldap.authentication.userNameFormat=uid=%s,ou=Group,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es
 
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
 
# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://di002.edv.uniovi.es:389
 
# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple
 
# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=admin,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es
 
# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secret
 
# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false
 
# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
 
#
# This properties file is used to configure LDAP syncronisation
#
 
# The LDAP user to connect as to do the export operation.
ldap.synchronization.java.naming.security.principal=cn=admin,dc=uniovi,dc=es
 
# The password for this user, if required
ldap.synchronization.java.naming.security.credentials=secret
 
# The timestamp format
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
 
# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)
 
# The search base of the query to find people to import
ldap.synchronisation.personSearchBase=ou=people,dc=uniovi,dc=es
ldap.synchronization.userSearchBase=ou=people,dc=uniovi,dc=es
 
# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid
 
# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName
 
# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn
 
# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail
 
# The attribute on person objects in LDAP to map to the organizational id property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o
 
# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider
 
# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfUniqueNames)
 
# The search base to use to find group objects
ldap.synchronization.groupSearchBase=ou=Group,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es
 
# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn
 
# The group type in LDAP
ldap.synchronisation.groupType=groupOfUniqueNames
 
# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson
 
# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=uniqueMember
 
# The cron expression defining when people imports should take place
ldap.synchronisation.import.person.cron=0 */10 * * * ?
 
# The cron expression defining when group imports should take place
ldap.synchronisation.import.group.cron=0 30 * * * ?
 
# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true

# MODIFICACION_FIN‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

But I can't get it working… Can you help me?, if you know another article about that or you know how to do what I want to do, please let me know.

Thanks!.

robertmarkbram · ‎06-07-2010

Hi Aique,

I haven't set up LDAP for Alfresco before and you have probably seen these already, but these two pages look promising: Enterprise Security and Authentication Configuration and an I HATE CUBICLE blog post: How to setup LDAP authentication in Alfresco.

Rob

aique · ‎07-11-2010

Thanks for your reply, but I'm still stuck.

Now a days the authentication process is working, but the synchronization process is not working. Here is the log about it:

Synchronizing users and groups with user registry 'ldap1'
Retrieving all groups from user registry 'ldap1'
ldap1 Group Analysis: Commencing batch of 0 entries
ldap1 Group Analysis: Completed batch of 0 entries
Retrieving all users from user registry 'ldap1'
ldap1 User Creation and Association: Commencing batch of 0 entries
ldap1 User Creation and Association: Completed batch of 0 entries
Finished synchronizing users and groups with user registry 'ldap1'
0 user(s) and 0 group(s) processed

My ldap properties file is:

ldap.authentication.active=true

ldap.authentication.allowGuestLogin=false

ldap.authentication.userNameFormat=uid=%s,ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

ldap.authentication.java.naming.provider.url=<url>

ldap.authentication.java.naming.security.authentication=SIMPLE

ldap.authentication.escapeCommasInBind=false

ldap.authentication.escapeCommasInUid=false

ldap.authentication.defaultAdministratorUserNames=

ldap.synchronization.active=true

ldap.synchronization.java.naming.security.principal=<ldap admin user>

ldap.synchronization.java.naming.security.credentials=<pass>

ldap.synchronization.queryBatchSize=1000

ldap.synchronization.attributeBatchSize=1000

ldap.synchronization.groupQuery=ou=Group,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

ldap.synchronization.groupDifferentialQuery=(objectclass=posixGroup)

ldap.synchronization.personQuery=ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

ldap.synchronization.personDifferentialQuery=(objectclass=inetOrgPerson)

ldap.synchronization.groupSearchBase=ou=Group,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

ldap.synchronization.userSearchBase=ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

ldap.synchronization.modifyTimestampAttributeName=

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

ldap.synchronization.userIdAttributeName=uid

ldap.synchronization.userFirstNameAttributeName=givenName

ldap.synchronization.userLastNameAttributeName=sn

ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.userOrganizationalIdAttributeName=o

ldap.synchronization.defaultHomeFolderProvider=homeDirectory

ldap.synchronization.groupIdAttributeName=cn

ldap.synchronization.groupDisplayNameAttributeName=description

ldap.synchronization.groupType=posixGroup

ldap.synchronization.personType=inetOrgPerson

ldap.synchronization.groupMemberAttributeName=memberUid

ldap.synchronization.enableProgressEstimation=true‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Here are some images from my LDAP, to check my parameters in the config file:

[img]http://ubuntuone.com/p/9Hz/[/img]

[img]http://ubuntuone.com/p/9Hx/[/img]

[img]http://ubuntuone.com/p/9Hy/[/img]

If some one find errors in my conf to help me in the synchronization process, I'll appreciate it very much

.

dward · ‎07-12-2010

See http://forums.alfresco.com/en/viewtopic.php?f=10&t=27732#p91240. Please do not duplicate this discussion.

Hyland Connect

Configuring LDAP