Alfresco with Active Directory

[sla1733]

Hello. Made setting for communication Alfresco with Active Directory on windows 2012, all users were transferred to alfresco, was created for each home user space and there is an opportunity to be authorized by the domain user through a web browser, but authorization through the Windows Explorer works only for the users added manually in Alfresco. Tell me how to make it possible to log in and domain users through Windows Explorer. Integration with Active Directory made by adding in /alfresco-global.properties of the following records:

# MS Active Directory Integration
authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
ntlm.authentication.sso.enabled=false

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=%s@domain.lan
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://dc.domain.lan:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=admin
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@domain.lan
ldap.synchronization.java.naming.security.credentials=password
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(whenChanged<\={0})))
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged<\={0})))
ldap.synchronization.groupSearchBase=DC\=domain,DC\=lan
ldap.synchronization.userSearchBase=DC\=domain,DC\=lan
ldap.synchronization.modifyTimestampAttributeName=whenChanged
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=cn
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProviderr
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true
ldap.authentication.java.naming.read.timeout=5000

[heiko_robert]

Did you try UNC path \\hostname@8080\alfresco\webdav\ ?

Additionally there are some Windows requirements for the "Web Client" windows services which is handling the communication between windows explorer and the webdav server (Alfresco) using IE.

I highly recommend to use https with trusted certs and port 443 to work around these restrictions.

Additionally if your clients don't have a proxy configured in IE and you use FQN hostname you need to configure AuthForwardServerList in Windows.

Be careful by using sso (kerberos.authentication.sso.enabled=true😞 Alfresco does not support fallback to "normal" authentication which may lock out non domain members.

[sla1733]

"AuthForwardServerList" is configured. I tried UNC path \\ hostname @ 8080 \ alfresco \ webdav \, also changed the value of the BasicAuthLevel parameter to 2 in HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ WebClient \ Parameters. The result is the same, I can’t log in as a domain user.

[fedorow]

Make shure WebClient service is started.

https://docs.alfresco.com/5.2/concepts/troubleshoot-webdav.html

p.s. for microsoft clients alfresco recomend use aos insted webdav. Try http://localhost:8080/alfresco/aos