nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

ldap-ad: allow login for users of specific security group

jahu

Hello,

I am running Alfresco Community Edition 201702 and trying to get ldap-ad authentication to work to my liking. I would like Alfresco to synchronize with our Active Directory, but only allow users of a specific group (AlfrescoUsers) to login to Alfresco, and deny any other login attempts.

Currently, I have synchronization working, and I can login to Alfresco with AD users. My problem is, is that any user can login that is in AD, not just the members of the AlfrescoUsers security group I created.

Does anyone have any insight into why all users in AD are allowed to login, and not just users of the AlfrescoUsers security group?

I have attached my alfresco-global.properties that I have all of my configuration in, and also the synchronization section of alfresco.log

Thank you,

-Jason

alfresco.log.zip

alfresco-global.properties.zip

Find more posts tagged with

Alfresco Content Services

Accepted answers

mehe

Hi Jason,

your person LDAP query seems to be wrong:

(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(|(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=Groups,dc=domain,dc=net)))

i think you want objectclass=user AND userAcountControl... AND memberOf... but you put an OR "|" before memberOf condition.

(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=Groups,dc=domain,dc=net))

should be ok (without having verified it in real life).

regards,

Martin

All comments

mehe

Hi Jason,

your person LDAP query seems to be wrong:

(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(|(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=Groups,dc=domain,dc=net)))

i think you want objectclass=user AND userAcountControl... AND memberOf... but you put an OR "|" before memberOf condition.

(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=Groups,dc=domain,dc=net))

should be ok (without having verified it in real life).

regards,

Martin

jpotts

Who do you want to show up in Alfresco? If the answer is "everyone in LDAP" while the answer to "Who do you want to be able to authenticate?" is "a subset of users as specified by this group" then the answer is that you have to create two LDAP configurations, one will be enabled for sync-only and will sync the entire LDAP directory. The other will be disabled for sync but enabled for authentication and it will specify the person query that points to the group you want to restrict to.

I should mention that this technique was first described to me by Axel Faust in the #alfresco IRC channel.

cesarista

Yes, Martin's query will work for the users under defined user base.

But maybe the differential query will not, because you deal everything inside the AD group, so the timestamp of the user is not touched when adding users to the AD group (whenChanged). A walkaround for this is to define user differential query equal to user query, but full sync is done everyday instead of differential.

Another way of selecting a group of users belonging to different levels in the AD, is via custom extension attributes in AD (i.e: "alf") users, so you have to include the extension attribute in the users query. This will respect whenChanged parameter, because the user is modified (changing the timestamp) when applying the extension attribute.

Regards.

--C.

cesarista

Hi Jason:

All users are allowed to authenticate via LDAP-AD in principle. By default Alfresco, create and sync accounts on login when they does not exist. But if you set the properties below, you would restrict the ldap auth only to those synced users.

create.missing.people=false
synchronization.autoCreatePeopleOnLogin=false
synchronization.syncWhenMissingPeopleLogIn=false

Regards.

--C.

mehe

...the query I mentioned is exact the one Jason has defined in his attached alfresco-global.properties. He just added the OR sign in the query, which should not be the case for his intentions.

He also defined the differential query in then right way (again, just the OR sign is too much)

Because the query will only import Users which are members of ou=Alfresco, only those user will be able to login (allowDeletions=true, so the user not in ou=Alfresco will be deleted - no login possible).

I would let synchronization.syncWhen... =true, so new users in ou Alfresco will be able to log in without having to wait for a scheduled LDAP Sync - what do you think Cesar?

Setting the two other values (create) to false should be fine.

Are you sure that a change in "memberOf" would not affect the whenChanged/modifiedTimestamp setting?

jahu

Thank you all for your help and suggestions. I have applied all of the changes/additions that you have suggested, and I believe it is working for me now. These are the changes/additions I've made to the alfresco-global.properties configuration file:

Added:

create.missing.people=false
synchronization.autoCreatePeopleOnLogin=false
synchronization.syncWhenMissingPeopleLogIn=false

I also changed my person queries as well:

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=Groups,dc=domain,dc=com))

ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(&(memberOf=cn\=AlfrescoUsers,ou=Alfresco,ou=groups,dc=domain,dc=com))(!(modifyTimestamp<\={0})))

(basically just change OR to AND).

One more question: Because I was syncing all users before, any users that were synced before I made the configuration change are still able to login. Is there a way to clear Alfresco's user/authentication cache, or (this may be an entirely different subject) is there a way to make Alfresco sync directly from AD, instead of caching users?

Thank you all again, I appreciate it!

-Jason

cesarista

Hi Martin:

Regarding synchronization.syncWhen... =true, I'm not completely sure if this property depends on the other ones. By the way, with the new OOTB Support Tools addon, I think you can run the scheduled job on demand (I did not tested yet). If it is not possible it would be a nice feature for Support Tools in Beecon hackathon (Axel Faust‌). This is a nice feature of the Support Tools in EE edition.

If you only change the group object I will say no. Before, you may do a minor "tricky" user modification to change the timestamp, and it will work for this user.

Regards.

--C.

afaust

"Scheduled Jobs" tool is already included in OOTBee Support Tools. What might be of added value in the future might be to provide a tool for configuring LDAP at runtime so your test cycles can be shorter.

mehe

I don't think the users are cached but not deleted by now. You can see this in the user administration (admin console). Because your ...allowDeletions flag is true, all you need is a full-sync.

Your can force this by temporarily setting the differential query to the same value as the full query like Cesar Capillas mentioned above, and restart alfresco.

But alfresco has already created a user home for each of your users. These home directories will not be deleted (this is normally a good thing, because you don't want to have user-data deleted when you accidentally misconfigured the sync).

Make sure the value of synchronization.allowDeletions is really true, because if set to false, all your unwanted-synced users will only be untagged and converted to local users (uahhh). But this is explained in the docs http://docs.alfresco.com/5.2/concepts/sync-delete.html

I fear you'd have to write a script to delete the home-folders of the non-existing/allowed users. Maybe someone in the community has done that already.

...or you just don't care about the unused folders - but they can behave bad, when you sync a formerly not allowed user. Then a second home folder with a number added to the username will be created.

mehe

Hi Cesar,

thank you for clarifying the "memberOf" thing - I always wondered why some users weren't synced like expected, but a few days later they were in sync - probably of some change I didn't notice (bad password time...)

I also saw that whenChanged seem not to be propagated between multiple DCs, which has the effect that I had to use a distinct DC for syncing...

...and thanks to Axel Faust and the others who work(ed) on the OOTBee Support Tools

cesarista

Maybe a modification of this script helps (for iterating between a defined array of users, and not for all users). Be careful with deletions.

Alfresco, massive delete of users | Programming and So

Regards.

--C.

afaust

Even if you have the allowDeletions set to false you can still technically trigger a synchronisation that deletes users that should no longer exist. This can be done via the JavaScript Console tool and I have a Gist that shows how synchronisation can be triggered with a different setting than may be configured for synchronisation.

mehe

...I should setup a knowledge base for things like these with a sophisticated solr/elasticsearch index

Thanx again Axel

jahu

Ah, thank you. If you can't tell already, I'm extremely green with Alfresco! I didn't know it was as easy as removing the user in the admin console, I figured there would be more cleanup to do.

I am not worried about the users home directory, those can live on into eternity. If I do run into problems later on, I will find a way to remove them, most likely using Cesar's suggestion with modifying the mass user deletion script he linked to.

One more side question since it's been mentioned a few times: Is the only way to do a full sync is by setting the differential query the same as the full query, then restarting the Alfresco server?

Thank you again everyone!

-Jason

afaust

No - there are alternatives. See my response further up the chain. Using the JavaScript Console you can always trigger a full synchronisation.

cesarista

No, you can also set:

synchronization.synchronizeChangesOnly=false

The default is true. But this only applies on cron syncs, not for the subsystem startup for example.

Regards.

--C.

mehe

Hi Jason, no (see the other answers) but it is an easy way to force the full sync if you need it just now - without installing anything else.

jelenajjovanosk

Hello,

I am running Alfresco Community Edition and trying to get ldap-ad authentication to work to my liking. I would like Alfresco to authenticate with our Active Directory, but only allow users of a specific group (Alfresco(My Alfresco group belogns to Users group)) to login to Alfresco, and deny any other login attempts.

My problem is, is that any user can login that is in AD, not just the members of the Alfresco group I created.

Does anyone have any insight into why all users in AD are allowed to login, and not just users of the Alfresco group? I read every answer to this question, but I didn't find solution.

This is my LDAP AD configuration:

#########################
#LDAP CONFIGURATION#
#########################

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap-ad1:ldap-ad

ldap.authentication.allowGuestLogin=false
# Disable guest logins

ntlm.authentication.mapUnknownUserToGuest=false
# Disable guest logins

ntlm.authentication.sso.enabled=false
# Disable SSO logins

ldap.synchronization.userSearchBase=dc=domain,dc=net
# Domain search base

#########################
#LDAP AUTHENTIFICATION #
#########################

ldap.authentication.active=true
#when true enables use of this LDAP subsystem for authentication

ldap.authentication.allowGuestLogin=false
# Disable guest logins

ldap.authentication.userNameFormat=%s@domain.net
#In Active Directory, this can either be the user principal name (UPN) or DN.

ldap.authentication.java.naming.security.authentication=simple
#simple -The basic LDAPuthentication mechanism arequiring the user name and password to be passed over the wire unencrypted.

ldap.authentication.java.naming.read.timeout=30000
#If Alfresco Content Services cannot get a LDAP response within that period, it aborts the read attempt.

ldap.authentication.java.naming.provider.url=ldap://XXXXXXX:389
#AD server address

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

ldap.authentication.defaultAdministratorUserNames=Administrator
# Admin users logins

########################
#LDAP SYNCHRONISATION #
########################
ldap.synchronization.active=true

synchronization.syncWhenMissingPeopleLogIn=true
# Tries to find user in allowed Ad group

#####################
#LDAP PERSON QUERY #
#####################

ldap.synchronization.personQuery=(&(objectclass\=user)(memberOf\=cn\=Alfresco,cn\=Users,dc\=domain,dc\=net)(userAccountControl:1.2.840.113556.1.4.803:=512))
# Query to grabb all users in alfresco group with full path

Thank you,

-Jelena

nlemus

Hello friends,

I sign in alfresco "admin portal > repository> in user homes" all the synchronized users of the ldap appear, this create a folder of each user of the ldap .

How can I make those folders not be created with default synchronization?

I want them to be created as long as you give them permission in alfresco to sign only.

Syedjunaid

Hi Jeff,

In your reply you said that LDAP authentication can be done without enabling synchronization and you can restrict users through person query, right ? but I tried doing the same thing and it didn't work. Following are the properties that I configured on my Alfresco. I am running Alfresco v6.0.a (Docker based).

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.provider.url=ldap://<my-ldap-server-ip>:<port>
ldap.authentication.userNameFormat=uid=%s,ou=<myldap's-ou>,dc=<myldap's-dc>,dc=<myldap's-dc>

ldap.synchronization.active=false

ldap.synchronization.userSearchBase=ou=<myldap's-ou>,dc=<myldap's-dc>,dc=<myldap's-dc>
ldap.synchronization.personQuery=(&(objectclass\=sambaSamAccount)(accountStatus=\active)(sambaBadPasswordCount\=0)(category\=DMS))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=sambaSamAccount)(accountStatus\=active)(sambaBadPasswordCount\=0)(category\=DMS)(!(modifyTimestamp<\={0})))

As you can see the person query, I want the users whose account are active can login into Alfresco.

Now the problem is all the users on my ldap's server are logging into Alfresco even if they're account on ldap server is deactivated. Moreover, I checked the logs on my ldap server and found that my Alfresco is connected perfectly with the ldap server but my person query cannot reach the ldap server. There are no parameters of my person query in my ldap's logs.

Kindly help me to resolve this issue. Please look into above mentioned configured properties that if I have missed something. Your help would be highly appreciated.

Thank you

EddieMay

Hi @Syedjunaid,

As this thread has an approved solution, I would recommend starting a new thread - people often overlook solved posts.

HTH,