nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

cannot sync gruop info from ldap to Alfresco

ergoldeturone

I am using alfresco-labs-tomcat-3a.1032…..

In my ldap I have 2 groups and some users in them.
If i log as admin and go to "Manage User Groups", I can see only groups but cannot find any user in them !!!!
Is it a feature or a bug ?

this is my ldap-synchronisation.properties

# This properties file is used to configure LDAP syncronisation
#

# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
ldap.synchronisation.personSearchBase=ou=people,dc=opensso,dc=java,dc=net
[img][/img]
# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=*)

# The search base to use to find group objects
ldap.synchronisation.groupSearchBase=ou=groups,dc=opensso,dc=java,dc=net

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP era groupOfNames
ldap.synchronisation.groupType=groupOfNames

# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=uniqueMember

# The cron expression defining when people imports should take place   0 0 * * * ?

ldap.synchronisation.import.person.cron=0 0/2 * * * ? 

# The cron expression defining when group imports should take place 0 30 * * * ?

ldap.synchronisation.import.group.cron=0 0/2 * * * ? 

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

"uniqueMember" is the ldap attribute of the group object that defines the DN for its members.

Do anyone have the same problem ? Do anyone have a solution ?
Thanks

Find more posts tagged with

Comments

ergoldeturone

Thank you for your response belmekki,

The tag

<property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>‍‍‍

is uncommented by default (and I have not commented it).

In my alfresco.log file I have not any message regarding group synchronization (while if a misconfigure the ldap-synchronisation.xml I have a WARN message)

p.s.
the ldap server I use is OpenDS; but I think this should not influence this behavior

ergoldeturone

I turned on ldap debugging and what I found in the log file is

00:42:00,046 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for demo
00:42:00,098 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for paperino
00:42:00,131 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for oscare
00:42:00,156 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for admin
00:42:00,178 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for test
00:42:00,201 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource] Adding user for pluto
00:42:00,286 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Found 2
00:42:00,286 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Linking GROUP_nuovogruppo
00:42:00,286 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … uid=oscare,ou=people,dc=opensso,dc=java,dc=net
00:42:00,293 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Linking GROUP_testgroup
00:42:00,293 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … uid=oscare,ou=people,dc=opensso,dc=java,dc=net
00:42:00,301 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … uid=paperino,ou=people,dc=opensso,dc=java,dc=net
00:42:00,329 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Top 2
00:42:00,329 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Secondary 0
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

It seems like users and groups are properly found in ldap server, but I cannot see users in groups with the web client (Administration Console->Manage User Groups->Root Groups->(testgroup or nuovogruppo) !!!!

All this sounds very strange :shock:

ergoldeturone

moreover alfresco generates two temp files in tomcat/temp/alfresco (2 files every two minutes according to my cron expression) with the following content
one contains groups infos

<?xml version="1.0" encoding="UTF-8"?>
<view:view xmlns="" xmlns:nt="http://www.jcp.org/jcr/nt/1.0" xmlns:sys="http://www.alfresco.org/model/system/1.0" xmlns:ver="http://www.alfresco.org/model/versionstore/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:emailserver="http://www.alfresco.org/model/emailserver/1.0" xmlns:fm="http://www.alfresco.org/model/forum/1.0" xmlns:ia="com.infoaxon.alfresco.calendar" xmlns:rule="http://www.alfresco.org/model/rule/1.0" xmlns:wcm="http://www.alfresco.org/model/wcmmodel/1.0" xmlns:sv="http://www.jcp.org/jcr/sv/1.0" xmlns:usr="http://www.alfresco.org/model/user/1.0" xmlns:st="http://www.alfresco.org/model/site/1.0" xmlns:custom="custom.model" xmlns:app="http://www.alfresco.org/model/application/1.0" xmlns:module="http://www.alfresco.org/system/modules/1.0" xmlns:d="http://www.alfresco.org/model/dictionary/1.0" xmlns:blg="http://www.alfresco.org/model/blogintegration/1.0" xmlns:alf="http://www.alfresco.org" xmlns:mix="http://www.jcp.org/jcr/mix/1.0" xmlns:bpm="http://www.alfresco.org/model/bpm/1.0" xmlns:wca="http://www.alfresco.org/model/wcmappmodel/1.0" xmlns:cm="http://www.alfresco.org/model/content/1.0" xmlns:reg="http://www.alfresco.org/system/registry/1.0" xmlns:wcmwf="http://www.alfresco.org/model/wcmworkflow/1.0" xmlns:view="http://www.alfresco.org/view/repository/1.0" xmlns:act="http://www.alfresco.org/model/action/1.0" xmlns:wf="http://www.alfresco.org/model/workflow/1.0">
   <usr:authorityContainer view:childName="usr:GROUP_nuovogruppo" view:id="b606acc2-8120-4e91-bf02-6a55edd2073c">
      <usr:authorityName>GROUP_nuovogruppo</usr:authorityName>
   </usr:authorityContainer>
   <usr:authorityContainer view:childName="usr:GROUP_testgroup" view:id="98d8c632-f962-4bea-8f33-5ac2733e7844">
      <usr:authorityName>GROUP_testgroup</usr:authorityName>
   </usr:authorityContainer>
</view:view>‍‍‍‍‍‍‍‍‍

the other contains users info

<?xml version="1.0" encoding="UTF-8"?>
<view:view xmlns="" xmlns:nt="http://www.jcp.org/jcr/nt/1.0" xmlns:sys="http://www.alfresco.org/model/system/1.0" xmlns:ver="http://www.alfresco.org/model/versionstore/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:emailserver="http://www.alfresco.org/model/emailserver/1.0" xmlns:fm="http://www.alfresco.org/model/forum/1.0" xmlns:ia="com.infoaxon.alfresco.calendar" xmlns:rule="http://www.alfresco.org/model/rule/1.0" xmlns:wcm="http://www.alfresco.org/model/wcmmodel/1.0" xmlns:sv="http://www.jcp.org/jcr/sv/1.0" xmlns:usr="http://www.alfresco.org/model/user/1.0" xmlns:st="http://www.alfresco.org/model/site/1.0" xmlns:custom="custom.model" xmlns:app="http://www.alfresco.org/model/application/1.0" xmlns:module="http://www.alfresco.org/system/modules/1.0" xmlns:d="http://www.alfresco.org/model/dictionary/1.0" xmlns:blg="http://www.alfresco.org/model/blogintegration/1.0" xmlns:alf="http://www.alfresco.org" xmlns:mix="http://www.jcp.org/jcr/mix/1.0" xmlns:bpm="http://www.alfresco.org/model/bpm/1.0" xmlns:wca="http://www.alfresco.org/model/wcmappmodel/1.0" xmlns:cm="http://www.alfresco.org/model/content/1.0" xmlns:reg="http://www.alfresco.org/system/registry/1.0" xmlns:wcmwf="http://www.alfresco.org/model/wcmworkflow/1.0" xmlns:view="http://www.alfresco.org/view/repository/1.0" xmlns:act="http://www.alfresco.org/model/action/1.0" xmlns:wf="http://www.alfresco.org/model/workflow/1.0">
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>demo</cm:owner>
      <cm:userName>demo</cm:userName>
      <cm:firstName></cm:firstName>
      <cm:lastName>demo</cm:lastName>
      <cm:email></cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>404ccafc-c192-48c2-8c6b-a804e38f66ea</sys:node-uuid>
   </cm:person>
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>paperino</cm:owner>
      <cm:userName>paperino</cm:userName>
      <cm:firstName>Paperino</cm:firstName>
      <cm:lastName>Paolino</cm:lastName>
      <cm:email>paperino@liferay.com</cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>823777b4-9e5a-4650-ae25-e21225967386</sys:node-uuid>
   </cm:person>
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>oscare</cm:owner>
      <cm:userName>oscare</cm:userName>
      <cm:firstName>Oscar</cm:firstName>
      <cm:lastName>Bianchi</cm:lastName>
      <cm:email>o.bianchi@reply.it</cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>ff764872-719b-4c35-8bb5-3835f1ff832d</sys:node-uuid>
   </cm:person>
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>admin</cm:owner>
      <cm:userName>admin</cm:userName>
      <cm:firstName>admin</cm:firstName>
      <cm:lastName>admin</cm:lastName>
      <cm:email></cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>ae0aec26-fcdb-4785-a8fd-15933f7ff54e</sys:node-uuid>
   </cm:person>
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>test</cm:owner>
      <cm:userName>test</cm:userName>
      <cm:firstName>Joe</cm:firstName>
      <cm:lastName>Bloggs</cm:lastName>
      <cm:email>test@liferay.com</cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>dc1f8eea-9fbb-40f4-b516-9938d03afcfc</sys:node-uuid>
   </cm:person>
   <cm:person view:childName="cm:person">
      <cm:ownable></cm:ownable>
      <cm:owner>pluto</cm:owner>
      <cm:userName>pluto</cm:userName>
      <cm:firstName>pluto</cm:firstName>
      <cm:lastName>pluto</cm:lastName>
      <cm:email>pluto@pluto.it</cm:email>
      <cm:organizationId></cm:organizationId>
      <cm:homeFolderProvider>personalHomeFolderProvider</cm:homeFolderProvider>
      <sys:node-uuid>01e070cb-3b59-4226-bb60-b5c513c01af8</sys:node-uuid>
   </cm:person>
</view:view>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

…but there isn't any group-user relationship info !!!!

ergoldeturone

Thank you for you r response;
I am happy to know I have a good configuration and I have imported users successfully….so help me understand where I am wrong !!!
When I log in as "paperino", member of group "testgroup", I cannot see its partecipation in group "testgroup" (in the user profile) and neither when I log as admin I cannot see anyone in "testgroup" looking into the Administration Console->Group Management.

How can I be sure that a user is correctly "contained" in a group using the web client ?

Thanks
Andrea

ronnytimmermans

When you configure in the LDAP synchronisation the membership in groups (InetOrgperson or other), take care of case sensitivity, so the setting is completely the same as your configuration in LDAP.
Regards,
Ronny.

admina

Hello ,
I have the same probleme with the group.
Some group are ok, but other are empty.
and i have the error message below:
Thank you .

12:26:50,666 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … CN=user1,DC=dom,DC=com
12:26:50,666 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … is member
12:26:50,681 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … CN=user2,DC=dom,DC=com
12:26:50,681 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] … is member
12:26:50,681 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Linking GROUP_Utilisateurs du modèle COM distribué
12:26:50,681 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Top 271
12:26:50,681 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource] Secondary 0
12:27:51,025 ERROR [org.quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:214)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: org.springframework.orm.hibernate3.HibernateJdbcException: JDBC exception on Hibernate data access; nested exception is org.hibernate.exception.GenericJDBCException: could not delete: [org.alfresco.repo.domain.hibernate.ChildAssocImpl#21]
   at org.springframework.orm.hibernate3.SessionFactoryUtils.convertHibernateAccessException(SessionFactoryUtils.java:636)
   at org.springframework.orm.hibernate3.HibernateAccessor.convertHibernateAccessException(HibernateAccessor.java:407)
   at org.springframework.orm.hibernate3.HibernateTemplate.execute(HibernateTemplate.java:372)
   at org.springframework.orm.hibernate3.HibernateTemplate.execute(HibernateTemplate.java:333)
   at org.alfresco.repo.node.db.hibernate.HibernateNodeDaoServiceImpl.getChildAssocs(HibernateNodeDaoServiceImpl.java:854)
   at org.alfresco.repo.node.db.hibernate.HibernateNodeDaoServiceImpl.deleteNodeInternal(HibernateNodeDaoServiceImpl.java:632)
   at org.alfresco.repo.node.db.hibernate.HibernateNodeDaoServiceImpl.deleteNode(HibernateNodeDaoServiceImpl.java:604)
   at sun.reflect.GeneratedMethodAccessor346.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:585)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:281)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:187)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:154)
   at org.alfresco.repo.transaction.TransactionalDaoInterceptor.invoke(TransactionalDaoInterceptor.java:68)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
   at $Proxy1.deleteNode(Unknown Source)
   at org.alfresco.repo.node.db.DbNodeServiceImpl.deleteNode(DbNodeServiceImpl.java:896)
   at sun.reflect.GeneratedMethodAccessor340.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:585)
   at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:281)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:187)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:154)
   at org.alfresco.repo.transaction.SingleEntryTransactionResourceInterceptor.invokeInternal(SingleEntryTransactionResourceInterceptor.java:163)
   at org.alfresco.repo.transaction.SingleEntryTransactionResourceInterceptor.invoke(SingleEntryTransactionResourceInterceptor.java:138)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:176)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:210)
   at $Proxy3.deleteNode(Unknown Source)
   at sun.reflect.GeneratedMethodAccessor340.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:585)
   at org.alfresco.repo.service.StoreRedirectorProxyFactory$RedirectorInvocationHandler.invoke(StoreRedirectorProxyFactory.java:221)
   at $Proxy4.deleteNode(Unknown Source)
   at sun.reflect.GeneratedMethodAccessor340.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
   at java.lang.reflect.Method.invoke(Method.java:585)

lakshya

Hello,
I want to configure OpenDS LDAP server with Alfresco.
Can any one tell me how to ?????