nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

LDAP Authentication from 2 domains

I am using alfresco Community - 5.1.0 (r127059-b7)

Currently I am doing LDAP authentication from 1 domain with the following entry in the config:

ldap.authentication.userNameFormat=%s@x.y.z

Now I need additionally a second domain like:

ldap.authentication.userNameFormat=%s@a.b.c

How I can do ldap authentication from 2 domains ?

Is that somehow possible?

How would be the entry in the config ?

thx for your help

Find more posts tagged with

Alfresco Content Services

Comments

Hi,

never had to use this, but maybe a starting point:

Example: authentication and synchronization with two ldap-ad subsystems | Alfresco Documentation

Regards,

Martin

Hi:

Consider a more complex authentication chain composed by two ldap-ad in alfresco-global.properties

authentication.chain=ldap1:ldap-ad,ldap2:ldap-ad

And you have to create an structure under

$TOMCAT/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad

.
├── ldap1
│ └── ldap-ad-authentication.properties
└── ldap2
└── ldap-ad-authentication.properties

for the corresponding properties, than now are not in alfresco-global.properties

Example: authentication and synchronization with two ldap-ad subsystems | Alfresco Documentation

Regards.

--C.

You are faster Martin Ehe

--C.

By the way, regarding the example I would say that in recent Alfresco 5 versions, it is not possible to copy the authentication subsystem sample properties from WEB-INF. Now they are inside a jar.

Regards.

--C.

...but your answer is more detailed (more quality takes more time)

I tried that way already, but the users of the other domain will not be synced.

Our current domain is ldap2, group and users are from the same domain z.b.c,

ldap1 is in in the tree, but not current domain, group is in z.b.c, the users coming from a.b.c

As you can see in the logfile, ldap2 will be synced properly, group+users

but ldap1 only the group will be synced, not the users.

properties for ldap1:

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@a.b.c
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://xx.xx.xx.xx
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@a.b.c
ldap.synchronization.java.naming.security.credentials=xxxxxx
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(&(objectclass\=group)(CN\=GP_A_ALFRESCO))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(CN\=GP_A_ALFRESCO))
ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf=CN\=GP_A_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=a,DC\=b,DC\=c))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(memberOf=CN\=GP_A_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=a,DC\=b,DC\=c))
ldap.synchronization.groupSearchBase=DC\=a,DC\=b,DC\=c
ldap.synchronization.userSearchBase=DC\=b,DC\=c
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

ldap properties for ldap2:

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@z.b.c
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://xx.xx.xx.xx
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@z.b.c
ldap.synchronization.java.naming.security.credentials=xxxxx
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(&(objectclass\=group)(CN\=GP_B_ALFRESCO))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(CN\=GP_B_ALFRESCO))
ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf=CN\=GP_B_ALFRESCO,OU\=Groups,OU\=NO,OU\=WAY,DC\=z,DC\=b,DC\=c))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(memberOf=CN\=GP_B_ALFRESCO,OU\=Groups,OU\=NO,OU\=WAY,DC\=z,DC\=b,DC\=c))
ldap.synchronization.groupSearchBase=DC\=z,DC\=b,DC\=c
ldap.synchronization.userSearchBase=DC\=z,DC\=b,DC\=c
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

alfresco.log:

2017-06-19 15:00:00,222 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronizing users and groups with user registry 'ad1'
2017-06-19 15:00:00,222 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Full synchronization with user registry 'ad1'
2017-06-19 15:00:00,222 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-19 15:00:00,238 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Retrieving groups changed since 19.06.2017 14:03:34 from user registry 'ad1'
2017-06-19 15:00:00,643 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Commencing batch of 1 entries
2017-06-19 15:00:00,659 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Processed 1 entries out of 1. 100% complete. Rate: 62 per second. 0 failures detected.
2017-06-19 15:00:00,659 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Completed batch of 1 entries
2017-06-19 15:00:18,053 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Retrieving all users from user registry 'ad1'
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=6 User Creation and Association: Commencing batch of 0 entries
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=6 User Creation and Association: Completed batch of 0 entries
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=5 User Association: Commencing batch of 2 entries
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=5 User Association: Processed 2 entries out of 2. 100% complete. 0 failures detected.
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad1,id2=5 User Association: Completed batch of 2 entries
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Finished synchronizing users and groups with user registry 'ad1'
2017-06-19 15:00:32,390 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] 0 user(s) and 1 group(s) processed
2017-06-19 15:00:32,405 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronizing users and groups with user registry 'ad2'
2017-06-19 15:00:32,405 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Full synchronization with user registry 'ad2'
2017-06-19 15:00:32,405 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-19 15:00:32,421 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Retrieving groups changed since 19.06.2017 14:00:50 from user registry 'ad2'
2017-06-19 15:00:32,452 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=1 Group Analysis: Commencing batch of 1 entries
2017-06-19 15:00:32,452 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=1 Group Analysis: Processed 1 entries out of 1. 100% complete. 0 failures detected.
2017-06-19 15:00:32,452 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=1 Group Analysis: Completed batch of 1 entries
2017-06-19 15:00:32,499 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Retrieving users changed since 19.06.2017 12:04:51 from user registry 'ad2'
2017-06-19 15:00:32,499 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=6 User Creation and Association: Commencing batch of 16 entries
2017-06-19 15:00:32,608 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=6 User Creation and Association: Processed 16 entries out of 16. 100% complete. Rate: 146 per second. 0 failures detected.
2017-06-19 15:00:32,608 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Synchronization,Category=directory,id1=ad2,id2=6 User Creation and Association: Completed batch of 16 entries
2017-06-19 15:00:32,624 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] Finished synchronizing users and groups with user registry 'ad2'
2017-06-19 15:00:32,624 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-10] 16 user(s) and 1 group(s) processed

just a question for understanding:

Is the LDAP Source ldap.authentication.java.naming.provider.url=ldap://xx.xx.xx.xx

the same in both configurations?

yes, it's same address

have you tried your queries with a ldap tool (like Apache Directory Studio) to verify the results?

Just tried and I didn't get the expected result.

I think the problem is, that I have no access to the parent domain.

The domain tree is like:

b.c.

----a.b.c

----c.b.c

----

----

----z.b.c

Our domain is z.b.c.

I have in my group of domain z.b.c a cross domain member from the domain a.b.c

So I used the user search base b.c.

But when I try to sync with 2 ldap systems under the path tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad

I get the result as you can see in the logfile.

When I dont use any subsystem under extension folder, just use the alfresco-global.properties I get the user from the domain a.b.c. synced to

the group of the domain z.b.c, but only if in the group a user of the domain z.b.c already exists, otherwise not. I really dont understand.

But I need that both domains can register in alfresco, like

ldap.authentication.userNameFormat=%s@a.b.c and ldap.authentication.userNameFormat=%s@z.b.c

so I have to sync from two ldap subsystems

alfresco-global.properties without 2 subsystems:

# LDAP
authentication.chain=alfrescoNtlm1:alfrescoNtlm,myldap:ldap-ad
synchronization.synchronizeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=false
synchronization.autoCreatePeopleOnLogin=false
synchronization.authCreatePeopleOnLogin=false
synchronization.syncOnStartup=true
synchronization.import.cron=0 0/10 * ? * *

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@z.b.c
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://xxx.xxx.xxx.xxx
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@z.b.c
ldap.synchronization.java.naming.security.credentials=xxxxx
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(&(objectclass\=group)(CN\=GP_A_ALFRESCO))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(CN\=GP_A_ALFRESCO))
ldap.synchronization.personQuery=(&(objectclass\=user)(|(memberOf=CN\=GP_A_ALFRESCO_DEV,OU\=Groups,OU\=NO,OU\=WAY,DC\=z,DC\=b,DC\=c)(memberOf=CN\=GP_A_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=a,DC\=b,DC\=c)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(|(memberOf=CN\=GP_A_ALFRESCO,OU\=Groups,OU\=NO,OU\=WAY,DC\=z,DC\=b,DC\=c)(memberOf=CN\=GP_A_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=a,DC\=b,DC\=c)))
ldap.synchronization.groupSearchBase=DC\=z,DC\=b,DC\=c
ldap.synchronization.userSearchBase=DC\=b,DC\=c
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

alfresco.log without 2 subsystems:

2017-06-20 13:50:00,176 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronizing users and groups with user registry 'myldap'
2017-06-20 13:50:00,176 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Full synchronization with user registry 'myldap'
2017-06-20 13:50:00,176 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-20 13:50:00,207 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Retrieving groups changed since 20.06.2017 13:22:20 from user registry 'myldap'
2017-06-20 13:50:00,394 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Commencing batch of 1 entries
2017-06-20 13:50:00,410 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Processed 1 entries out of 1. 100% complete. Rate: 62 per second. 0 failures detected.
2017-06-20 13:50:00,410 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Completed batch of 1 entries
2017-06-20 13:50:39,349 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Retrieving users changed since 20.06.2017 01:52:04 from user registry 'myldap'
2017-06-20 13:51:12,734 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=6 User Creation and Association: Commencing batch of 2 entries
2017-06-20 13:51:47,461 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=6 User Creation and Association: Processed 2 entries out of 2. 100% complete. Rate: 0 per second. 0 failures detected.
2017-06-20 13:51:47,461 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Synchronization,Category=directory,id1=myldap,id2=6 User Creation and Association: Completed batch of 2 entries
2017-06-20 13:51:47,476 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] Finished synchronizing users and groups with user registry 'myldap'
2017-06-20 13:51:47,476 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-4] 2 user(s) and 1 group(s) processed
2017-06-20 14:00:00,323 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronizing users and groups with user registry 'myldap'
2017-06-20 14:00:00,323 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Full synchronization with user registry 'myldap'
2017-06-20 14:00:00,323 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-20 14:00:00,369 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Retrieving groups changed since 20.06.2017 13:22:20 from user registry 'myldap'
2017-06-20 14:00:00,557 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Commencing batch of 1 entries
2017-06-20 14:00:00,572 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Processed 1 entries out of 1. 100% complete. Rate: 66 per second. 0 failures detected.
2017-06-20 14:00:00,572 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-9] Synchronization,Category=directory,id1=myldap,id2=1 Group Analysis: Completed batch of 1 entries

Is it possible to allow multiple domains in alfresco-global.properties,

without two ldap subsytems,i.e.:

ldap.authentication.userNameFormat=%s@z.b.c

ldap.authentication.userNameFormat=%s@a.b.c

How would be the format ?

ldap.authentication.userNameFormat=%s@?

using only %s is not working

The right way for me to do was to bind two ldap-systems,

without any cross-domain members in any group (caused sync problems)

to be able to allow multiple domain sync.

Now I have the problem that users of the second domain are not be able to login.

Does anyone have an idea ?

iisn't

ldap.authentication.userNameFormat=%s@z.b.c

in the first config and

ldap.authentication.userNameFormat=%s@a.b.c

in the second not working?

b.c.

----a.b.c

----c.b.c

----

----

----z.b.c (our domain)

ldap.authentication.userNameFormat=%s@a.b.c

yes, here the login doesnt work, but sync works lika a charm

on our domain z.b.c login works same before with only one ldap system

Multidomain synchronisation and authentication has only a very limited support in Alfresco. We tried this just some months ago. To summarize:

Limitations

CIFS/WebDAV Auth, SSO using Kerberos support only one directory. We extended the kerberos implementation to handle the whole user principle instead of only the username part (which we know will conflict with the multi tenancy support) but stopped since we didn't want to rewrite the whole group sync.

You can:

define many independent domains (in Alfresco managed in zones) for sync and web authentication having different domains. You need to put all ldap subsystem instances in the auth chain. They work all independent and in sequence on login. Be careful if you have rules for failed logins on AD/LDAP if you work with different configs against the same AD/LDAP.

You cannot:

use the same groups accross different zones. You will see unexpected behavior since the groups will switch on sync from zone to zone and only the users belonging to the active zone will be members in the Alfresco group after sync. The group membership sync logic asumes a user as deleted if a user is not returned as memberOf attribute from the group. If the memberOf user is not member of the zone he will be ignored or cause a softfail.

So you should go ahead if you don't share groups managed on ldap/AD but you will fail if you require to use shared groups. If you only need to authenticate in the browser you may try having only one sync config since you have only one directory server. User query may be e.g.

(& (objectClass=user)(|(userPrincipalName=*@abc.com)(userPrincipalName=*@xyz.net)))

You could then add a second ldap subsystem config only having authentication active
ldap.synchronization.active=false

ldap.authentication.active=true

ldap.authentication.userNameFormat=%s@xyz.net

Just thinking: maybe a "ldap proxy" that gathers users and groups (with nlscd) in an alfresco compatible way could be a solution... but this would be a more than a "just try" job.

booltrue booltrue A passthru based subsystem may be used or combined for authentication, using ldap-ad subsystem for syncing. Finally, completely agree with Heiko Robert‌ comments.

Regards.

--C.

Thanks for detailed explanation, but I am a little confused what is the difference between your (‌) explanation and my attempt with two ldap subsytems, or maybe just I dont understand right.

I am syncing two different groups of two different child domains as you can see in the configs.

Maybe you can explain for me more clearer, due I dont understand.

What do I need to change, so that both domains can authenticate.

Currently only members of our domain z.b.c can authenticte to the system,

the members of the other domain a.b.c can not do.

Syncing of both domains works properly.

Maybe the problem is the authentication.chain

It seems to be defined in both subsystems and so only the secon one "wins". I think you have to move the authentication.chain into alfresco-global.properties (only), delete it from the subsystems and use both subsystems in the chain.

No - if you need multiple instances of a subsystem you can't define in the alfresco-global.properties.

It is no problem to define multiple ldap instances in one chain which will used for auth in sequence one by one until the end of the chain is reached, but the chain will only work for the web filter - not cifs and not for sso configs.‌: Maybe you have SSO configured?

Here the current used ldap ad1, ad2 configs and the authentication chain from alfresco-global.properties.

Synchronization works properly for that configuration.

Authentication works only for ad1, that's our domain.

For the other domain authentication is not working.

Maybe helpful: we are using Windows Active Directory and the users login to alfresco share

Could another authentication chain property solves the problem ?

properties for ldap ad1:

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@z.b.c
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://30.184.2.41:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@z.b.c
ldap.synchronization.java.naming.security.credentials=Alfresco123
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupQuery=(&(objectclass\=group)(CN\=GP_Z_ALFRESCO))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(CN\=GP_Z_ALFRESCO))
ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf=CN\=GP_Z_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=z,DC\=b,DC\=c) (userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(memberOf=CN\=GP_Z_ALFRESCO,OU\=Groups,OU\=TEST,OU\=ME,DC\=z,DC\=b,DC\=c) (userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.groupSearchBase=DC\=z,DC\=b,DC\=c
ldap.synchronization.userSearchBase=DC\=z,DC\=b,DC\=c
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

properties for ldap ad2:

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@a.b.c
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://30.184.2.41:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=admin@a.b.c
ldap.synchronization.java.naming.security.credentials=Alfresco123
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(|(CN\=GP_A_ALFRESCO) (CN\=GP_B_ALFRESCO)))
ldap.synchronization.personQuery=(&(objectclass\=user)(|(memberOf=CN\=GP_A_ALFRESCO,OU\=GOAHEAD,DC\=a,DC\=b,DC\=c)(memberOf=CN\=GP_B_ALFRESCO,OU\=GOAHEAD,DC\=a,DC\=b,DC\=c)) (userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(|(memberOf=CN\=GP_A_ALFRESCO,OU\=GOAHEAD,DC\=a,DC\=b,DC\=c)(memberOf=CN\=GP_B_ALFRESCO,OU\=GOAHEAD,DC\=a,DC\=b,DC\=c)) (userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.groupSearchBase=DC\=a,DC\=b,DC\=c
ldap.synchronization.userSearchBase=DC\=a,DC\=b,DC\=c
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=displayName
ldap.synchronization.groupType=group
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

alfresco-global.properties:

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ad1:ldap-ad,ad2:ldap-ad
synchronization.synchronizeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=false
synchronization.autoCreatePeopleOnLogin=false
synchronization.authCreatePeopleOnLogin=false
synchronization.syncOnStartup=true
synchronization.import.cron=0 0/15 * ? * *

Hi Heiko,

sorry but I think you didn't get me right. It's clear that that you need to have two subsystem definitions (and sync is already working for booltrue). We're just talking about LDAP Authentication and the Web-filter, not about Cifs or SSO, as far as I understood - But you have to put the authentication.chain definition with the two ldap subsystem-def-labels into the alfresco-global.properties to be able to ldap-authenticate against two ldap subsystem. See http://docs.alfresco.com/4.0/tasks/auth-example-twoldap-ad.html

seems to be nearly identical to a working config that I use in a customer system (Alfresco 4.2)...

The only differences to mine are

in alfresco-global.properties:

ntlm.authentication.sso.enabled=false

in ldap ad properties I don't have

ldap.authentication.active=true

but this shouldn't be the problem, maybe it's just my older Alfresco Version...

I could give it a try:

ntlm.authentication.sso.enabled=false

in alfresco-global.properties

and should I remove:

ldap.authentication.active=true

from both ldap properties and move it to alfresco-global.properties, or does it have not any effect ?

can't really say about ldap.authentication.active - this should have no effect. Has switching the order of your ad in the authentication.chain any effect?

For our domain not, for the other domain I dont know.

Couldn't test it yet.

I don't have a ad with 2 realms to test at the moment. Could you please test with only the ad in the chain which does not work?

Martin Ehe‌: you config is different. you use ldap for sync only but ntlm for auth for both if you have set

ldap.authentication.active=true

means the subsystem is not used for authentication but for sync

So I keep the subsytem ad configs like they are, with

ldap.authentication.active=true in both sytem ?

I wanted to move that entry to alfresco-global.properties

But I will set in alfresco-global.properties

ntlm.authentication.sso.enabled=false

Ok, or any changes to try ?

I will test the ad in the chain, that does not work.

Heiko Robert I just overlooked the ldap.authentication.active=true (misspelled in the search 🙂 )

It's in the config - so config isn't different...

I tested all again, and it's working.

All subsytems are synced correctly and authentication works for all.

It already worked before, but the user of the other domain, who tested authentication, did sthg. wrong.

Is there a limit of how many subsystems can be used ?

Thanks for your support.

I am synchronizing now 3 subsystems ad1 (our domain z.b.c), ad2 (domain x.b.c) and ad3 (domain a.b.c),

but sometimes I get synchronization errors that I dont understand. Authentication still works.

The errors occur with the other domains a.b.c and the new domain x.b.c, but not with our domain z.b.c

I dont understand the error log entries properly.

alfresco.log:

2017-06-28 11:15:00,161 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronizing users and groups with user registry 'ad1'
2017-06-28 11:15:00,161 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Full synchronization with user registry 'ad1'
2017-06-28 11:15:00,161 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-28 11:15:00,177 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Retrieving groups changed since 21.06.2017 14:34:21 from user registry 'ad1'
2017-06-28 11:15:00,239 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Commencing batch of 1 entries
2017-06-28 11:15:00,255 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Processed 1 entries out of 1. 100% complete. Rate: 62 per second. 0 failures detected.
2017-06-28 11:15:00,255 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=1 Group Analysis: Completed batch of 1 entries
2017-06-28 11:15:00,271 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Retrieving users changed since 28.06.2017 09:05:42 from user registry 'ad1'
2017-06-28 11:15:00,286 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=6 User Creation and Association: Commencing batch of 17 entries
2017-06-28 11:15:00,333 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=6 User Creation and Association: Processed 17 entries out of 17. 100% complete. Rate: 361 per second. 0 failures detected.
2017-06-28 11:15:00,333 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization,Category=directory,id1=ad1,id2=6 User Creation and Association: Completed batch of 17 entries
2017-06-28 11:15:00,349 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Finished synchronizing users and groups with user registry 'ad1'
2017-06-28 11:15:00,349 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] 17 user(s) and 1 group(s) processed
2017-06-28 11:15:00,364 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronizing users and groups with user registry 'ad2'
2017-06-28 11:15:00,364 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Full synchronization with user registry 'ad2'
2017-06-28 11:15:00,364 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Some users and groups previously created by synchronization with this user registry may be removed.
2017-06-28 11:15:00,380 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Retrieving groups changed since 27.06.2017 15:08:07 from user registry 'ad2'
2017-06-28 11:15:21,502 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 05280100 Error during LDAP Search. Reason:x.b.c:389
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1303)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:691)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:973)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronizeInternal(ChainingUserRegistrySynchronizer.java:719)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:448)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob$1.doWork(UserRegistrySynchronizerJob.java:46)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob.execute(UserRegistrySynchronizerJob.java:42)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:216)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)
Caused by: javax.naming.CommunicationException: x.b.c:389 [Root exception is java.net.ConnectException: Connection timed out: connect]
   at com.sun.jndi.ldap.LdapReferralContext.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapReferralException.getReferralContext(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at javax.naming.directory.InitialDirContext.search(Unknown Source)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1282)
   ... 9 more
Caused by: java.net.ConnectException: Connection timed out: connect
   at java.net.DualStackPlainSocketImpl.connect0(Native Method)
   at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
   at java.net.PlainSocketImpl.connect(Unknown Source)
   at java.net.SocksSocketImpl.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
   at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClientFactory.createPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.getOrCreateConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.get(Unknown Source)
   at com.sun.jndi.ldap.pool.Pool.getPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.LdapPoolManager.getLdapClient(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
   at com.sun.jndi.url.ldap.ldapURLContextFactory.getObjectInstance(Unknown Source)
   at javax.naming.spi.NamingManager.getURLObject(Unknown Source)
   at javax.naming.spi.NamingManager.processURL(Unknown Source)
   at javax.naming.spi.NamingManager.processURLAddrs(Unknown Source)
   at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
   ... 18 more
2017-06-28 11:15:21,534 ERROR [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] [DefaultScheduler_Worker-2] Synchronization aborted due to error
org.alfresco.error.AlfrescoRuntimeException: 05280100 Error during LDAP Search. Reason:x.b.c:389
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1303)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:691)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:973)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronizeInternal(ChainingUserRegistrySynchronizer.java:719)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:448)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob$1.doWork(UserRegistrySynchronizerJob.java:46)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob.execute(UserRegistrySynchronizerJob.java:42)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:216)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)
Caused by: javax.naming.CommunicationException: x.b.c:389 [Root exception is java.net.ConnectException: Connection timed out: connect]
   at com.sun.jndi.ldap.LdapReferralContext.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapReferralException.getReferralContext(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at javax.naming.directory.InitialDirContext.search(Unknown Source)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1282)
   ... 9 more
Caused by: java.net.ConnectException: Connection timed out: connect
   at java.net.DualStackPlainSocketImpl.connect0(Native Method)
   at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
   at java.net.PlainSocketImpl.connect(Unknown Source)
   at java.net.SocksSocketImpl.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
   at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClientFactory.createPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.getOrCreateConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.get(Unknown Source)
   at com.sun.jndi.ldap.pool.Pool.getPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.LdapPoolManager.getLdapClient(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
   at com.sun.jndi.url.ldap.ldapURLContextFactory.getObjectInstance(Unknown Source)
   at javax.naming.spi.NamingManager.getURLObject(Unknown Source)
   at javax.naming.spi.NamingManager.processURL(Unknown Source)
   at javax.naming.spi.NamingManager.processURLAddrs(Unknown Source)
   at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
   ... 18 more
2017-06-28 11:15:21,549 ERROR [org.quartz.core.JobRunShell] [DefaultScheduler_Worker-2] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.error.AlfrescoRuntimeException: 05280100 Error during LDAP Search. Reason:x.b.c:389
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1303)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:691)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:973)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronizeInternal(ChainingUserRegistrySynchronizer.java:719)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:448)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob$1.doWork(UserRegistrySynchronizerJob.java:46)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob.execute(UserRegistrySynchronizerJob.java:42)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:216)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)
Caused by: javax.naming.CommunicationException: x.b.c:389 [Root exception is java.net.ConnectException: Connection timed out: connect]
   at com.sun.jndi.ldap.LdapReferralContext.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapReferralException.getReferralContext(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at javax.naming.directory.InitialDirContext.search(Unknown Source)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1282)
   ... 9 more
Caused by: java.net.ConnectException: Connection timed out: connect
   at java.net.DualStackPlainSocketImpl.connect0(Native Method)
   at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
   at java.net.PlainSocketImpl.connect(Unknown Source)
   at java.net.SocksSocketImpl.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
   at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClientFactory.createPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.getOrCreateConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.get(Unknown Source)
   at com.sun.jndi.ldap.pool.Pool.getPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.LdapPoolManager.getLdapClient(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
   at com.sun.jndi.url.ldap.ldapURLContextFactory.getObjectInstance(Unknown Source)
   at javax.naming.spi.NamingManager.getURLObject(Unknown Source)
   at javax.naming.spi.NamingManager.processURL(Unknown Source)
   at javax.naming.spi.NamingManager.processURLAddrs(Unknown Source)
   at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
   ... 18 more
2017-06-28 11:15:21,549 ERROR [org.quartz.core.ErrorLogger] [DefaultScheduler_Worker-2] Job (DEFAULT.ldapPeopleJobDetail threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: org.alfresco.error.AlfrescoRuntimeException: 05280100 Error during LDAP Search. Reason:x.b.c:389]
   at org.quartz.core.JobRunShell.run(JobRunShell.java:227)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:563)
Caused by: org.alfresco.error.AlfrescoRuntimeException: 05280100 Error during LDAP Search. Reason:x.b.c:389
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1303)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:691)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:973)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronizeInternal(ChainingUserRegistrySynchronizer.java:719)
   at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:448)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob$1.doWork(UserRegistrySynchronizerJob.java:46)
   at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:548)
   at org.alfresco.repo.security.sync.UserRegistrySynchronizerJob.execute(UserRegistrySynchronizerJob.java:42)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:216)
   ... 1 more
Caused by: javax.naming.CommunicationException: x.b.c:389 [Root exception is java.net.ConnectException: Connection timed out: connect]
   at com.sun.jndi.ldap.LdapReferralContext.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapReferralException.getReferralContext(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
   at javax.naming.directory.InitialDirContext.search(Unknown Source)
   at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.processQuery(LDAPUserRegistry.java:1282)
   ... 9 more
Caused by: java.net.ConnectException: Connection timed out: connect
   at java.net.DualStackPlainSocketImpl.connect0(Native Method)
   at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
   at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
   at java.net.PlainSocketImpl.connect(Unknown Source)
   at java.net.SocksSocketImpl.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.connect(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at java.net.Socket.<init>(Unknown Source)
   at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
   at com.sun.jndi.ldap.Connection.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapClientFactory.createPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.getOrCreateConnection(Unknown Source)
   at com.sun.jndi.ldap.pool.Connections.get(Unknown Source)
   at com.sun.jndi.ldap.pool.Pool.getPooledConnection(Unknown Source)
   at com.sun.jndi.ldap.LdapPoolManager.getLdapClient(Unknown Source)
   at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
   at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
   at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
   at com.sun.jndi.url.ldap.ldapURLContextFactory.getObjectInstance(Unknown Source)
   at javax.naming.spi.NamingManager.getURLObject(Unknown Source)
   at javax.naming.spi.NamingManager.processURL(Unknown Source)
   at javax.naming.spi.NamingManager.processURLAddrs(Unknown Source)
   at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
   ... 18 more

Please don't blow up the threads by adding other questions which may be related but describe other issues.

The stack trace describes the issue:

Caused by: java.net.ConnectException: Connection timed out: connect

I suggest you increase the timeout to a value you have to find out.

# set timeout for 100 sec
ldap.authentication.java.naming.read.timeout=100000

Sry, you're right.

Thanks anyway for support.