Create AD user to sync with already existing alfresco user

Question

I need to create a user in AD and sync it with already existing user in alfresco. If i create a user in AD with the same username and password as in alfresco will it "connect" to the existing user in alfresco ? What global properties for sync do i need to add in order to not recreate the user in alfresco (or change his/her password)? Thanks in advance.

cristinamr · Accepted Answer

Thanks for the detailed explanation. You cannot do that.  At least in my knowledge. You cannot sync the user and password from Alfresco and load it into AD, sorry. Not at least configuring the sync on your AD.

You may need to think in other options, e.g., develop a process which extract all user's info and load into your AD (as CSV, for example).

Cheers,

Cristina.

heiko_robert · Accepted Answer

Alfresco and MS AD don't store clear text passwords, but the hash values using configurable hash algorithms.

Theoretically you can extract the hashes and the used hash algorithm from the Alfresco database and copy that to AD but there is no official support or API I know of from MS to do that. So you would need to hack the AD sync protocol. Depending on the Alfresco and AD version the hash algorithms differ, so you don't have any chance since the hash is not revertable by design.

A more practicable way would be to extract only the readable user properties (except password) using a simple javascript inside Alfresco, store the data in a file like CSV and write another windows batch script to run on the AD server which creates only once the users in AD with new passwords. You may send emails to the users with the new password in the same script.