nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

OpenLDAP Sync with Share

sthurrott

We have been able to install Share and sync it to our OpenLDAP server. The problem we have run into is that it puts all our users and groups in the Company Home directory. How do I put users in the User Home directory and keep groups in the Company Home directory?

Thanks

Find more posts tagged with

Comments

yyovkov

Hi sthurrott,

probably you will find helpful this post:
http://forums.alfresco.com/en/viewtopic.php?t=7133&highlight=nonunique+path

ofrxnz

in ldap-synchronization-context.xml

change this

<property name="attributeDefaults">
            <map>
                <entry key="cm:homeFolderProvider">
                    <value>${ldap.synchronisation.defaultHomeFolderProvider}</value>
                </entry>
            </map>
        </property>
    </bean>
‍‍‍‍‍‍‍‍‍

to this

 <property name="attributeDefaults">
            <map>
                <entry key="cm:homeFolderProvider">
                    <value>${ldap.synchronisation.userHomesHomeFolderProvider}</value>
                </entry>
            </map>
        </property>
    </bean>

‍‍‍‍‍‍‍‍‍‍

sthurrott

Thanks, we got it to work. Now onto the next thing…the groups imported without any users. I remember reading something about that in another forum.

ofrxnz

if the groups import without any users you need to change this in ldap-synchronization.properties

ldap.synchronisation.groupMemberAttributeName=member

change that variable so it is = what ever attribute your group members are under. i believe they need to be stored as their full DN

sthurrott

Thanks, we set the ldap.synchronisation.groupMemberAttributeName=member to what our group members are under but I'm not sure what you mean by them needing to be stored as their full DN. Could you give an example?

Thanks again…

ofrxnz

It should be it by default but
In my ldap server, group members are determined by the attribute 'member' holding a value like 'uid=username,ou=people,dc=company,dc=com' this is just the absolute path to a user.

so, since in your case alfresco is already finding groups and importing, the last step is to tell it what the group members are labeled as.
This label is defined under ldap.synchronisation.groupMemberAttributeName
in my case it is 'member'.

when alfresco scans a group and finds the attribute 'member' it looks at its value and adds it to a group.

so in mine, when ever alfresco finds a group, it looks for 'member' and adds it's value to the group. In my case the users absolute name looks something like 'uid=username,ou=people,dc=company,dc=com' (this will look different for you on both sides of the '=' )

My guess is you got it right, I just found it confusing when i first set it up because i am using Active Directory. In AD your absolute name (uid=username,ou=people,dc=company,dc=com) is not your 'Windows username'.

I was just trying to be clear. Sorry for any confusion.

Are your groups populating?

Adam

sthurrott

Not yet, we decided to reinstall Share because we were having several issues so I haven't been able to test out your solution.

Thanks

markuskopinits

Hi,

I'm using Alfresco 3.1.1
The LDAP syncronizations is working for users and groups but it's not putting the users inside the groups.

I've tried the ldap.synchronisation.groupMemberAttributeName attribute with "member", "membrUid", "memberOf"
but none off then worked.

Can you help me?

Thanks

mricher

Just to clarify the problem.

The LDAP server is storing the 'short name' eg. username in the field 'member' or 'memberUid' or 'memberOf'.

Alfresco on the other hand is expecting the full DN to be stored. (eg. cn=username,ou=People,dc=example,dc=com ).

It is a pain to have to modify the ldap (and all the other services) to support his.

However, it looks like it was resolved in the Enterprise version of Alfresco (as they added some fallback code to test for the shortname when the full DN fails).
JIRA: https://issues.alfresco.com/jira/browse/ETHREEOH-2508

Any chance of getting the small changes ported over to the Community edition?
Cheers,

R. Michael Richer

mrogers

Looks like it was put on HEAD last July.

mricher

Hmmm… Looks like I'll be investigating my problem (/sigh)… was hoping for a fast fix hehe.

I'm currently experiencing the identical issue on 3.2r2 … but it could be my configuration (either Alfresco or OpenLDAP)…
I'll bump up some logging, etc. and get back to here. (Tried it really quick with memberUid as the attribute…)

Any chance you have svn revision number of the changes? (just in case)

Thanks for the quick response,

Cheers

Mike

mricher

Well it was a configuration issue on my end… so I am able to sync now, and authenticate.
I had to use the DifferentialQuery's, etc. in 3.2r2 with the proper filters, and everything works.

I have ran into another problem, where an 'updated' Query fails to be used (without wiping the database and data directory).
I tried the cron method of performing a full sync, but still the 'new' accounts don't show up.

Initially (this works well):
user.name.caseSensitive=true
ldap.synchronization.synchronizeChangesOnly=false
ldap.synchronization.import.cron=0 0 * * * ?
ldap.synchronization.PersonQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))
ldap.synchronization.PersonDifferentialQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo))(!(modifyTimestamp<\={0})))
ldap.synchronization.GroupQuery=(&(objectClass\=posixGroup)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))

Now I wanted to add an additional OU to the list (cca – (ou\:dn\:\=cca) 😞
ldap.synchronization.PersonQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))
ldap.synchronization.PersonDifferentialQuery=(&(objectClass\=posixAccount)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo))(!(modifyTimestamp<\={0})))
ldap.synchronization.GroupQuery=(&(objectClass\=posixGroup)(\|(ou\:\dn\:\=adm)(ou\:dn\:\=grc)(ou\:dn\:\=cca)(ou\:dc\:\=cem)(ou\:dn\:\=evo)))

Restarting and waiting for the cron sync, both still do not permit access to the cca ou. If I wipe the database and the data dir, and restart, the system will reinitialize and make the cca container available as well.

Is there a step I'm missing for changing the Querys? (Although I am not expecting changes to the DIT on the ldap server, I'm just planning ahead…)

Mike

dward

That's because the system remembers the newest modification date of the objects it queries and only asks for those modified after that date in future syncs.

You could set

synchronization.synchronizeChangesOnly=false

which will cause the scheduled full sync job (which by default runs every midnight) to sync with everything regardless of modification date.

mricher

Typos, typos, typos..

All problems are corrected, and they do work as you say they will. ldapsearch queries with typos in them are just plain bad…

And even creating your own parameters are bad…. (eg. ldap.synchronization vs. synchronization, etc.)

In short, I shuold be taking more time confirming what I'm typing…

Thanks for the help and quick responses though. Works like a charm!

Mike

njeudy

Can you post your config file for ldap sync.

I try lots of solution, but i'm not able to sync group in alfresco:

- Login and user users works
- sync group works, but stay empty

I'm using openldap, and group are posixGroup with memberUid = uid (user uid)

Thanks,

Nicolas JEUDY