nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

MOVED - LDAP Configuration

mrojas73

Hi,

I am a new user of Alfresco and for days struggling to connect it to either my OpenLDAP or Active Directory systems.

It would be much easier if a user authentication page could be included under the Administration Console to configure this feature.

Thank you.

Find more posts tagged with

Comments

mrojas73

Belmekki;

I think that some HOW TOs for this basic configurations like this. Even though it sounds very easy for more experienced people like yourself, it is not as easy for noobs like me.

How about having a section just for HOW TOs where we can post complete guides to help others like me get through this basic stuff much quicker.

If I can get this one working, I will create the first one call HOW TO LDAP Authentication just like the Ubuntu, Trixbox and other project do.

So far the documentation and wikis I have found have bits and pieces you are supposed to put together, some one gives you a chuck of and xml file but doesn't specify if you need to configure the rest. So that's where I stand at this point.

Your information is great, it tells me that besides the ldap-authentication-context.xml, the chaining-authentication-context.xml I also need to configure the ldap-syncronization-context.xml. The question is, where is the best place to find real life examples of these type of configurations? Back to searching the forums again!

Thank you.

mrojas73

This is just great!

I will more than happy to test the HOW TO and provide as much feedback as possible. I can test on Ubuntu and openldap, Windows 2003 and Active Directory.

I will be trying your instructions here soon, I can't wait to be able to login using an user account from Active Directory.

Thank you very much Belmekki for taking the time to post and provide this so much needed information.

Marco.

mrojas73

Belmekki,

My intent with this post under this section was to raise an issue that new users are facing, and I still think that better documentation or easier implementation from inside Alfresco needs to be done.

On the other hand, I would like to move the discussion to a better place, maybe installation or configuration in the forums. I will create a new post and try to link it to this.

Thank you.

Marco.

Update:

Created new Thread for discussion here: http://forums.alfresco.com/en/viewtopic.php?f=9&t=14741

battletroll01

First and foremost a large amount of thanks to Belmekki!!!!
This forum was a tremendous help.
I am running the Alfresco Ent 3.0.1 on Linux Fedora 10 on a network that is Linux/Windows and all systems authenticate against Active Directory with Kerbreros (500+users). I have avoided LDAP for a while but this was the only solution for my current applications.

I did find it necessary to change the ldap-authentication.properties file to a little different settings than on this file.
If you are auth against AD I have tried this on 3 different servers and it worked by just renaming ldap-authentication.properties.sample to ldap-authentication.properties and changing the setting listed

# How to map the user id entered by the user to that passed through to LDAP
# - simple
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s
ldap.authentication.userNameFormat=%s@foobar.com

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
# This was necessary to talk to AD on secure LDAP
ldap.authentication.java.naming.provider.url=ldaps://ip to server:636

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
# SIMPLE worked for me
ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
# ldap account I use with the fully qualified name
ldap.authentication.java.naming.security.principal=ldapman@foobar.com

# The password for the default principal (only used for LDAP sync)
# Duh the password
ldap.authentication.java.naming.security.credentials=*************

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

vishal1

Hi Belmekki,

I am Configuring Alfresco 2.1 to work with LDAP (oracle OID). I am able to authenticate LDAP
user from alfresco using ldap-authentication-context.xml. But I am not able to login using
alfresco user (admin).

Could you please share your thoughts about synchronization & chaining authentication ?

Thanks in advance
Vishal

lakshya

Belmekki & battletroll01
Thanks a lot!!!!,

lakshya

Hello Belmekki & battletroll01,
I want to know the configuration of OpenDS in Alfresco

I have created user1 as
uid=user1,dc=example,dc=com

and user2
cn=user2,dc=example,dc=com

ldap-authentication.properties is:

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple 
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s     
ldap.authentication.userNameFormat=%s@example.com

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://10.199.92.3:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=user1@example.com


# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=test

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

I am not able to authenticate users in Alfresco.

Can you put some pointers on this???

mautidavis

Dear all,

I have done the necessary configurations to the files but when I login into the Alfresco Explorer I get this error:
Summary of error:

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
caused by:
javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
caused by:
java.lang.NullPointerException
‍‍‍‍‍‍‍

Detailed information about the error:

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:72)
at javax.faces.component.UICommand.broadcast(UICommand.java:109)
at javax.faces.component.UIViewRoot._broadcastForPhase(UIViewRoot.java:97)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:171)
at org.apache.myfaces.lifecycle.InvokeApplicationExecutor.execute(InvokeApplicationExecutor.java:32)
at org.apache.myfaces.lifecycle.LifecycleImpl.executePhase(LifecycleImpl.java:95)
at org.apache.myfaces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:70)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:139)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.alfresco.web.app.servlet.AuthenticationFilter.doFilter(AuthenticationFilter.java:94)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
at java.lang.Thread.run(Thread.java:619)
Caused by: javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:156)
at org.apache.myfaces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:61)
… 22 more
Caused by: java.lang.NullPointerException
at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.isGuestUserName(AbstractAuthenticationComponent.java:359)
at org.alfresco.repo.security.authentication.AbstractAuthenticationComponent.authenticate(AbstractAuthenticationComponent.java:124)
at org.alfresco.repo.security.authentication.AuthenticationServiceImpl.authenticate(AuthenticationServiceImpl.java:118)
at org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl.authenticate(ChainingAuthenticationServiceImpl.java:166)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:296)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:177)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:144)
at net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:80)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
at org.alfresco.repo.security.permissions.impl.ExceptionTranslatorMethodInterceptor.invoke(ExceptionTranslatorMethodInterceptor.java:49)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
at org.alfresco.repo.audit.AuditComponentImpl.audit(AuditComponentImpl.java:275)
at org.alfresco.repo.audit.AuditMethodInterceptor.invoke(AuditMethodInterceptor.java:69)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:107)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:166)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at $Proxy24.authenticate(Unknown Source)
at org.alfresco.web.bean.LoginBean.login(LoginBean.java:274)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.myfaces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:132)
… 23 more

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Anybody with an idea on how I can sort out this problem?

Please remember i can successfully login into the application but will not be able to do anything because of this error. Your suggestions on how i can sort out this problem, willl really be appreciated.

Regards,
Davis M Onsakia

dward

I suspect you are running Alfresco v3.2 with some out-of-date Spring configuration. Please state which Alfresco version you are using and what files you have changed.

mautidavis

Dear all,

I am using Afresco 3.0.0 (stable version). I have changed the following files:
ldap-authentication-context.xmlldap-authentication.propertiesldap-synchronisation.propertiesfile-servers-custom.xmlldap-synchronisation-context.xml

Any help?

Regards,
Davis M Onsakia

dward

OK, I've checked that line number on the 3.0 code and it suggests that you haven't set the tenantService property of one of your authentication components.

Note that your authentication component should look like the following and it's very important that it extends authenticationComponentBase:

    <bean id="authenticationComponent"
          class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl" 
          parent="authenticationComponentBase">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–
            
            This maps between what the user types in and what is passed through to the underlying LDAP authentication.
            
            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
            
            "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authenticate as "cn=Joe Bloggs,ou=London,dc=company,dc=com" 
            Usually for simple authentication. Simple authentication always uses the DN for the user.
            
            –>
            <value>${ldap.authentication.userNameFormat}</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>   
        <property name="escapeCommasInBind">
            <value>${ldap.authentication.escapeCommasInBind}</value>
        </property>
        <property name="escapeCommasInUid">
            <value>${ldap.authentication.escapeCommasInUid}</value>
        </property> 
    </bean>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Now why do you insist on using Labs v3? Could you please try upgrading to v3.2? Your repository should be upgraded automatically but please back everything up beforehand just in case…

harishns

Hi,
I am new to Alfresco, I am trying to login using LDAP , I made following changes in

%TOMCAT_HOME%\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\ldap-ad\ldap-ad-authentication.properties

ldap.authentication.userNameFormat=uid\=%s,ou\=< values which I got it from LDAP browser>

ldap.authentication.java.naming.provider.url=ldap://<ldap server ip>:389

ldap.authentication.java.naming.security.authentication=simple

ldap.synchronization.java.naming.security.principal=<user name @ domain>

Remaining settings kept as it is

After restarting the server, I am not able to login with my LDAP user credentials, it is acting as previous only, then I copied ldap-ad-authentication.properties and ldap-ad-authentication-context.xml file to %TOMCAT_HOME%\webapps\alfresco\WEB-INF\classes\alfresco\ folder to see any effects and found no effect.

Can any one tell me is there anything wrong in this procedure.

I am using latest code from SVN which is 3.2.0 (@build-number@) schema 3002

Help needed

Thanks in advance

dward

You clearly haven't read any of the information on this thread or the wiki. You should not be editing any files under WEB-INF.

You need a file called %TOMCAT_HOME%\shared\classes\alfresco-global.properties with your settings in it.

authentication.chain=ldap1:ldap-ad
ldap.authentication.userNameFormat=%s@domain
ldap.authentication.java.naming.provider.url=ldap://domaincontroller.company.com:389
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.java.naming.security.principal=alfresco@domain
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=Alfresco,dc=domain
ldap.synchronization.userSearchBase=ou\=User Accounts,ou=\Alfresco,dc=domain

Go read

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP

harishns

Oh!!.
Thanks for your information.
I did the changes on alfresco-global.properties and found all my user data are synchronized with local database and I am able to login with my LDAP credentials (username and password).

Actually my requirement is the login using LDAP credentials and whenever user changed their password, they should be able to login with their new password.

What I observed is whenever I restart the server. it is synchronizing all the user data and updating with local database. this take huge time due to large user database. I would like to know is there any other method where, I can simply authenticate against my LDAP server credential every time instead of local database?

Thanks

dward

With the settings I sent you, the authentication is performed directly against the LDAP server. When a user logs in, their username and password is checked by trying to bind to the LDAP directly with that username and password.

The server synchronizes other user attributes such as email address (but never password) so that they are available to the Alfresco repository. By default the server will synchronize this information when it starts up and when an user is successfully authenticated who doesn't yet exist in the repository. These syncs are 'differential' in that they only query the information changed since the last sync. So you shouldn't find that they take very long at all after the first startup.

Also by default, a scheduled job runs every midnight to do a 'full sync'. This detects deleted users and groups. You can disable this or change it to also do a faster differential sync.

See http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem

harishns

Cool !!. it is working !!

Thank you

harishns

Hi,
I am facing problem with NTML SSO which I wanted to chain with my LDAP configuration .
I have made glocal properties changes

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap-ad

ldap.authentication.userNameFormat=%s@<url>
ldap.authentication.java.naming.provider.url=<url>
ldap.authentication.defaultAdministratorUserNames=Id
ldap.synchronization.java.naming.security.principal=email id
ldap.synchronization.java.naming.security.credentials=
ldap.synchronization.groupSearchBase=<LDAP url>
ldap.synchronization.userSearchBase=<URL>

ntlm.authentication.sso.enabled=true

after restarting the server, if I try to browse, I will get windows dialog to enter user name and passwd , in that whatever I enter, it is not accepting , I was expecting to get username and password from my system automatically, but it is neither taking credentials from my system nor it is accepting credentials what I enter in the dialog.

I would like to know is there any thing else, I am missing.

Thanks

harishns

Hi,
I didn't notice one thing in the LDAP is that. after the Synchronization is done, if I change the password on my LDAP server, my application is accepting the new password as well as old password also.

I would like to know is there any place where I can disable authentication with local database.

Thanks

oferprtz

Hello all,

I'm quite new at the Alfresco system.

first of all im using: Alfresco 3.2 CE with Microsoft windows server 2003 r2.
i tried to configure ldap on the alfresco but with no success.
among the articles i've read, i've tried configuration especially from these sites:
http://forums.alfresco.com/en/viewtopic.php?f=9&t=14741
http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP

ive been told not to touch this directory at all: e:\Alfresco\tomcat\webapps\share\WEB-INF
with all the configuration files inside… mmm…

so i tried to do the following:
1. I've changed the file: e:\Alfresco\tomcat\shared\classes\alfresco-global.properties
authentication.chain=ldap1:ldap-ad
ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.provider.url=ldap://my-server:389
ldap.authentication.defaultAdministratorUserNames=ofer
ldap.synchronization.java.naming.security.principal=ofer@mycompany.com
ldap.synchronization.java.naming.security.credentials=**********
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=MYGROUP,dc=MYCOMPANY,dc=MYCOMPANY_SUFFIX
ldap.synchronization.userSearchBase=ou\=User Accounts,ou\=MYGROUP,dc=MYCOMPANY,dc=MYCOMPANY_SUFFIX

and give it a shot, but no success im still getting this error:

18:24:29,338  INFO  [alfresco.config.JndiPropertyPlaceholderConfigurer] Loading
properties file from class path resource [alfresco/alfresco-shared.properties]
18:24:29,776  INFO  [management.subsystems.ChildApplicationContextFactory] Start
up of 'Authentication' subsystem, ID: [Authentication, managed, ldap1] complete
18:24:29,807  INFO  [management.subsystems.ChildApplicationContextFactory] Start
up of 'fileServers' subsystem, ID: [fileServers, default] complete
18:24:29,807  INFO  [management.subsystems.ChildApplicationContextFactory] Start
ing 'imap' subsystem, ID: [imap, default]
18:24:29,854  INFO  [alfresco.config.JndiPropertyPlaceholderConfigurer] Loading
properties file from class path resource [alfresco/alfresco-shared.properties]
18:24:29,948  INFO  [management.subsystems.ChildApplicationContextFactory] Start
up of 'imap' subsystem, ID: [imap, default] complete
18:24:29,948  INFO  [repo.usage.UserUsageTrackingComponent] Enabled - calculate missing user usages …
18:24:30,010  INFO  [repo.usage.UserUsageTrackingComponent] Found 0 users to recalculate
18:24:30,010  INFO  [repo.usage.UserUsageTrackingComponent] … calculated missing usages for 0 users
18:24:30,010  INFO  [management.subsystems.ChildApplicationContextFactory] Starting 'Synchronization' subsystem, ID: [Synchronization, default]
18:24:30,432  INFO  [alfresco.config.JndiPropertyPlaceholderConfigurer] Loading properties file from class path resource [alfresco/alfresco-shared.properties]
18:24:30,870 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
18:24:30,885 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldap1'
18:24:30,963 User:System ERROR [security.sync.ChainingUserRegistrySynchronizer] Synchronization aborted due to error
org.alfresco.repo.security.authentication.AuthenticationException: 11060000 LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:116)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:91)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:82)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry$3.<init>(LDAPUserRegistry.java:596)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:593)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:521)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:396)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$7.doWork(ChainingUserRegistrySynchronizer.java:1217)
        at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:514)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.onBootstrap(ChainingUserRegistrySynchronizer.java:1211)
        at org.alfresco.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:62)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:637)
        at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:454)
        at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:377)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:246)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:189)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:49)
        at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:69)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
        at org.apache.catalina.core.StandardContext.start(StandardContext.java:4342)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)

        at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:627)
        at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:553)
        at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:488)
        at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
        at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)

        at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)

        at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
        at org.apache.catalina.core.StandardService.start(StandardService.java:516)
        at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
        at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308:  LdapErr: DSID 0C090334, comment: AcceptSecurityContext error, data 525, vece ]

        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)

        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:111)
        … 53 more
18:24:31,010 User:System WARN  [security.sync.ChainingUserRegistrySynchronizer] Failed initial synchronize with user registries org.alfresco.repo.security.authentication.AuthenticationException: 11060000 LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:116)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:91)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:82)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry$3.<init>(LDAPUserRegistry.java:596)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getGroups(LDAPUserRegistry.java:593)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncWithPlugin(ChainingUserRegistrySynchronizer.java:521)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:396)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$7.doWork(ChainingUserRegistrySynchronizer.java:1217)
        at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:514)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.onBootstrap(ChainingUserRegistrySynchronizer.java:1211)
        at org.alfresco.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:62)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory$ApplicationContextState.start(ChildApplicationContextFactory.java:637)
        at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.start(AbstractPropertyBackedBean.java:454)
        at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:377)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:246)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:189)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:49)
        at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:69)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
        at org.apache.catalina.core.StandardContext.start(StandardContext.java:4342)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
        at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:627)
        at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:553)
        at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:488)
        at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
        at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
        at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
        at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
        at org.apache.catalina.core.StandardService.start(StandardService.java:516)
        at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
        at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece ]

        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:111)
        … 53 more
18:24:31,041  INFO  [management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete
18:24:31,620  INFO  [service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_16-b01; maximum heap size 506.313MB 
18:24:31,620  INFO  [service.descriptor.DescriptorService] Alfresco started (Community): Current version 3.2.0 (r2 2440) schema 3300 - Originally installed version 3.2.0 (r2 2440) schema 3300
18:24:32,666  INFO  [module.vti.VtiServer] Vti server started successfully on port: 7070‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

2. i've also changed the file: E:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\ldap-ad\ldap-ad-authentication.properties
but still the same error when the server is starting up…

# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=true

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#
ldap.authentication.allowGuestLogin=true

# How to map the user id entered by the user to taht passed through to LDAP
# In Active Directory, this can either be the user principal name (UPN) or DN.
# UPNs are in the form <sAMAccountName>@domain and are held in the userPrincipalName attribute of a user
ldap.authentication.userNameFormat=%s

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://myserver.com:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=simple

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=ofer

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=admin@mycompany.com

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=***********

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=group)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=MYOU,dc=MYCOMPANY

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=User Accounts,ou\=MYOU,dc=MYCOMPANY

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=sAMAccountName

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=MYCOMPANY

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronization.groupType=group

# The person type in LDAP
ldap.synchronization.personType=user

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member

# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
ldap.synchronization.enableProgressEstimation=true‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Im actually spent 2 full days to make it work, ive read tons of articles in the internet and wiki's but with no success…

can someone please help me?
what ive did wrong?

thank you for reading this..

ofer.

wolfsden3

* BTW - sorry for necroposting, this is BS though if the user community is still having the same problem for a year and a half

alfresco-3.4.d
CentOS 5.5, x86

OK all - here's the MAIN PROBLEM with anything open source especially if you can run it on multiple platforms…documentation = ****. Even your attempt although 'helpful' in a small sense is not 'complete'. For idiots like me you need to s-p-e-l-l things out literally.

For example:

For you AD you will have no problem if you configure well :
$Alfresco_Home\Tocamt\shared\classes\alfresco\extension\ldap-authentication-context.properties (For authentication)
$Alfresco_Home\Tocamt\shared\classes\alfresco\extension\ldap-synchronization-context.properties (To synchronize groups and user from AD)
$Alfresco_Home\Tocamt\shared\classes\alfresco\extension\chaining-authentication-context.properties (to get both alfresco users and ldap users in the same time)
With OpenLdap you will loose you CIFS ( incompatibility between two encryptions MD5 in openldap and MD4 for cifs ) .
Add this lines to :
$Alfresco_Home\Tocamt\webapps\alfresco\web-inf\classes\log4J.properties

It seems that I do in fact have a full path of:

/opt/alfresco-3.4.d/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldap-authentications.properties
* Why are there files here and what do they do? They don't seem to be the SAME files anyway, yours has the word 'context' in them? Mine do not.

I also have files here which match what the post has above:

/opt/alfresco-3.4.d/tomcat/shared/classes/alfresco/extension
* Here I have a lot of '*.xml.sample' files, the * meaning anything from customModel.xml.sample to web-scripts-config-custom.xml.sample, etc, etc

I suspect that I need to tweak /opt/alf…/tomcat/shard/classes/alfresco/extension and throw all the files you're talking about in there but they don't exist so I created them. When creating them and tweaking for my Windows Active Directory environment I restart Alfresco (on CentOS: /etc/init.d/alfresco restart) and I try to hit the logon portal http://myserver:8080/alfresco and it gives me a 404 error not found until I whack my xml files (by whack I mean delete or rename .old or _old).

So the whole 'tutorial' in my view is incomplete and flat doesn't work. Is this a Windows tutorial? I suspect it is but it's hard to tell.

The wiki as people here have mentioned is lacking.

All I want to do is setup Active Directory authentication but Alfresco is seriously lacking documentation and a web gui. WTF? Someone told me that Alfresco is an 'enterprise' product, I'm laughing and crying at the same time because I've now wasted weeks (as have others) on what seems to be something just above crapware.

I may sound harsh but I'm just frustrated and annoyed at this point. So much in fact I'm writing this post which I usually use as a 'last resort', after that I need to take my frustrations out on the neighbor dog who barks far too much

Anyway - WTF? Isn't there a clear freaking tutorial on how to get AD Authentication kickin? WTF? Doesn't Alfresco have a web gui to configure the **** thing? Instead you have to muddle around with xml and .properties files?

I'm tired of trying to reverse engineer this thing. It might take me several months to figure it all out which is why I hope someone can point me to an 'authoritative' how to. All I know is I'm not the ONLY one who's looking for this, I'm not the ONLY one who's wasted precious life and I'm not the ONLY one who's irritated beyond belief

Love,

Truly pissed, annoyed and frustrated 🙂

scouil

Well, maybe the problem with open source documentation is that people don't try to understand it, take the first out-of-date tutorial they find and complain it doesn't work.

Quick simplified overview of the configuration system in 3.4 (your version).
You have an overwriting system for configurations. The only file you'll need to edit will be "alfresco-global.properties" that can overwrite the other configurations
(see: http://wiki.alfresco.com/wiki/Repository_Configuration#alfresco-global.properties_.28V3.2.2B.29 )

With that new insight, please read again dward's nice post 7 posts before yours.

You clearly haven't read any of the information on this thread or the wiki. You should not be editing any files under WEB-INF.

You need a file called %TOMCAT_HOME%\shared\classes\alfresco-global.properties with your settings in it.

authentication.chain=ldap1:ldap-ad
ldap.authentication.userNameFormat=%s@domain
ldap.authentication.java.naming.provider.url=ldap://domaincontroller.company.com:389
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.java.naming.security.principal=alfresco@domain
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=Alfresco,dc=domain
ldap.synchronization.userSearchBase=ou\=User Accounts,ou=\Alfresco,dc=domain

Go read

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP

If it's still not working, I'd advise you to first try to get the authentication working and disable the synchronisation.
In its simplest form all you need is to add the following line in your alfresco-global.properties:

authentication.chain=ldap1:ldap-ad
ldap.authentication.userNameFormat=%s@yourDomain
ldap.authentication.java.naming.provider.url=ldap://domaincontroller.company.com:389
ldap.synchronization.active=false
‍‍‍‍‍‍

Whatever your OS is, once you've located alfresco-global.properties , edit it as such, restart your server and try to login.
Then come back for more advanced configuration because if you leave it as it you've a security hole.

Hope this works!

hans

Hi @ all,

i am quite new with Alfresco and i am trying to get LDAP authentication running with Alfresco Community 4.

I followed this Link here
http://www.ochounos.com/#blog/6

Can anyone look over it and tell me if there is something else i have to do ? Ist the Step by Step complete on that Link ?
Or does somebody have a better way or a Step by step INstruction that works !!!

Here my settings in the LDAP File settings in Alfresco:

ldap.authentication.active=true
synchronization.syncWhenMissingPeopleLogIn=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=uid=%s,ou=Users,dc=mycompany.co.at,dc=at
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://ldap-server.local:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=uid\=administrator,ou\=mycompany.co.at,dc\=mycompany.co.at,dc\=at
ldap.synchronization.java.naming.security.credentials=Password
ldap.synchronization.queryBatchSize=0
ldap.synchronization.attributeBatchSize=0
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou\=Groups,dc\=mycompany.co.at,dc\=at
ldap.synchronization.userSearchBase=ou\=Users,dc\=mycompany.co.at,dc\=at
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userOrganizationalIdAttributeName=o
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupDisplayNameAttributeName=description
ldap.synchronization.groupType=groupOfNames
ldap.synchronization.personType=inetOrgPerson
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

–> Is there something missing ????? :shock:

I get this following Error messages in the Tomcat Log:

2012-10-24 14:49:37,159 ERROR [extensions.webscripts.AbstractRuntime] [http-8080-11] Exception from executeScript - redirecting to status template error: 09240004 Login failed
org.springframework.extensions.webscripts.WebScriptException: 09240004 Login failed
at org.alfresco.repo.web.scripts.bean.AbstractLoginBean.login(AbstractLoginBean.java:75)
at org.alfresco.repo.web.scripts.bean.LoginPost.executeImpl(LoginPost.java:73)
at org.springframework.extensions.webscripts.DeclarativeWebScript.executeImpl(DeclarativeWebScript.java:235)
at org.springframework.extensions.webscripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:64)
at org.alfresco.repo.web.scripts.RepositoryContainer$2.execute(RepositoryContainer.java:393)
at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:388)
at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:462)
at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:500)
at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:275)
at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:372)
at org.springframework.extensions.webscripts.AbstractRuntime.executeScript(AbstractRuntime.java:209)
at org.springframework.extensions.webscripts.servlet.WebScriptServlet.service(WebScriptServlet.java:118)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.alfresco.web.app.servlet.GlobalLocalizationFilter.doFilter(GlobalLocalizationFilter.java:58)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:470)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:298)
at org.apache.coyote.http11.Http11AprProcessor.process(Http11AprProcessor.java:861)
at org.apache.coyote.http11.Http11AprProtocol$Http11ConnectionHandler.process(Http11AprProtocol.java:579)
at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1584)
at java.lang.Thread.run(Thread.java:662)

Plz can somebody help me i am trying on that since weeks.

ops:

ops:

THX in advance !!

scouil

Hello,

I don't know about this site. Is it usually reliable?
I just don't understand why you would try to follow a tutorial from an external source, even older than the official ones.
And then you come and post in a thread right under a post saying:

Well, maybe the problem with open source documentation is that people don't try to understand it, take the first out-of-date tutorial they find and complain it doesn't work.

So please read the post right before and try the configuration dward proposed. I think it was the best answer in this thread.
If it still doesn't work, try the 4-lines long configuration I gave right after.
When approaching a new system, it's usually a good practice to start small, understand how it works and get it to grow.
Get thos small examples to work and

Then come back for more advanced configuration because if you leave it as it you've a security hole.

hans

Hi Scouil,

you are right, its just i tried so much and reat a lot but still can not get it done.
I will go over this Thread from the begining and try again and give some Feedback if i get it done.

Thx. for getting a… kicked it woke me up

kr Hans

deman

Hi
I am using Apache Directory LDAP for user Authentication and Alfresco for data managemnet . I want to connect both of them . And User Authentication should be provided by LDAP only. Can someone help to make connection in between them .

Thank you

sasquatch58

Have a look at the Help files.
LDAP is covered here http://docs.alfresco.com/4.2/topic/com.alfresco.enterprise.doc/concepts/auth-ldap-intro.html

Cheers, Sasquatch

gangadharjwala

Hi All,

Here i am facing problem to configure openLDAP with alfresco.

here i have placed the alfresco.war file in JBOSS-EAP-6 and that i need to configure openLDAP.
so for that i am placing the below configuration on WEB-INF/classes/alfresco/subsystems/Authentication/ldap/ldap-authentication.properties

ldap.authentication.userNameFormat=uid=%s,ou=it,dc=taashee,dc=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://IP:389
ldap.authentication.java.naming.security.authentication=simple
ldap.synchronization.active=false
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=cn\=Manager,dc\=taashee,dc\=com
ldap.synchronization.java.naming.security.credentials=PED
ldap.synchronization.userSearchBase=ou\=it,dc\=taashee,dc\=com
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid

but i am not able to login through LDAP users and also i am not getting any ERROR logs related that.

in one of the site i have seen we need to add this details on alfresco-global.properties file for this i have renamed alfresco-global.properties.sample to alfresco-global.properties below path /WEB-INF/classes/
and i am placing above LDAP configuration.

than also i am not able to connect.

than i placed same LDAP configuration on repositories.properties file of WEB-INF/classes/alfresco/repository.properties

than also i am not able to login as through LDAP user.

Can any one help me out on which file i need to add.this LDAP configuration.here i am using only alfresco.war file this war file i am placing on JBOSS-EAP-6.

mrogers

No! Don't change anything in WEB-INF ever.

alfresco-global.properties goes in the SHARED folder. Since you are using JBOSS this will be sonmething like C:\jboss\server\default\conf

You will need to set your authentication chain there.

gangadharjwala

Hi Mrogers,

Thanks for you reply ..

Hear i am configuring alfersco with jboss-eap-6 ,and compare to JBOSS-EAP5 and JBOSS-EAP6 the configuration is different..can u please tel me where we need to place shared and endorsed folders on JBOSS-EAP-6… i have placed this directories in the path /opt/jboss-eap-6.1/standalone/configuration

is this correct place to place this folders and here i am doing migration of alfresco form TOMCAT to JBOSS-EAP-6

gangadharjwala

Hi Mrogers,

now it is working i have taken a authentication chain on repository.properties file as follows

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap