nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco/Ldap connect, but not authenticate - V3.0

nowhere

Hi all,
i'm encountering problems with alfresco - apacheDS integration.
Now i'll try to explain my troubles…
Following wiki instuction and several posts in this forum I've configured and renamed (cut off ".sample") those files:

- ldap-authentication-context.xml
- ldap-authentication.properties
- ldap-synchronisation-context.xml
- ldap-synchronisation.properties

For avoiding cifs exception changed the file-server.xml and left unchanged chaining-authentication-context.xml.sample (i'm non interested at moment, I suppose I can leave it so).

Here my more important settings:
file ldap-authentication.properties

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple 
#&nbsp;&nbsp;&nbsp; - this must be a DN and would be something like
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; CN=%s,DC=company,DC=com
# - digest
#&nbsp;&nbsp;&nbsp; - usually pass through what is entered
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; %s&nbsp;&nbsp;&nbsp;&nbsp; 
ldap.authentication.userNameFormat=cn=%s,ou=users,ou=system
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://localhost:10389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=reader

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secret

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

file ldap-synchronisation.properties

# 
# This properties file is used to configure LDAP syncronisation
#

# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
ldap.synchronisation.personSearchBase=ou=users,ou=system

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id&nbsp; property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfNames)

# The search base to use to find group objects
ldap.synchronisation.groupSearchBase=dc=company,dc=com

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronisation.groupType=groupOfNames

# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=member

# The cron expression defining when people imports should take place
ldap.synchronisation.import.person.cron=0 */10 * * * ?

# The cron expression defining when group imports should take place 
ldap.synchronisation.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

and, finally, my ApacheDS server.xml

…
&nbsp; <defaultDirectoryService id="directoryService" instanceId="default"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; workingDirectory="example.com"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allowAnonymousAccess="false"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; accessControlEnabled="false"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; denormalizeOpAttrsEnabled="false">
&nbsp;&nbsp;&nbsp; <systemPartition>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– use the following partitionConfiguration to override defaults for –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– the system partition&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <jdbmPartition id="system" cacheSize="100" suffix="ou=system" optimizerEnabled="true" syncOnWrite="true">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <indexedAttributes>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <jdbmIndex attributeId="1.3.6.1.4.1.18060.0.4.1.2.1" cacheSize="100"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; …
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </indexedAttributes>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </jdbmPartition>
&nbsp;&nbsp;&nbsp;&nbsp; </systemPartition>

&nbsp;&nbsp;&nbsp; <partitions>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; …
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <jdbmPartition id="alfresco" cacheSize="100" suffix="dc=company,dc=com" optimizerEnabled="true" syncOnWrite="true"/>
&nbsp;&nbsp;&nbsp; </partitions>

&nbsp;&nbsp;&nbsp; <interceptors>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <normalizationInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <authenticationInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <aciAuthorizationInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <defaultAuthorizationInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <exceptionInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <operationalAttributeInterceptor/>

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <!– Uncomment to enable the password policy interceptor
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <passwordPolicyInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <keyDerivationInterceptor/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>

&nbsp;&nbsp;&nbsp;&nbsp; …
&nbsp; <ldapService id="ldapsService"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enabled="true"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipPort="10636"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; enableLdaps="true">
&nbsp;&nbsp;&nbsp; <directoryService>#directoryService</directoryService>
&nbsp;&nbsp;&nbsp; <socketAcceptor>#socketAcceptor</socketAcceptor>
&nbsp; </ldapService>


&nbsp; <ldapService id="ldapService"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; ipPort="10389"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allowAnonymousAccess="false"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; saslHost="ldap.example.com"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; saslPrincipal="ldap/ldap.example.com@EXAMPLE.COM"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; searchBaseDn="ou=users,ou=system"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; maxTimeLimit="15000"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; maxSizeLimit="1000">

&nbsp;&nbsp;&nbsp; <directoryService>#directoryService</directoryService>
&nbsp;&nbsp;&nbsp; <socketAcceptor>#socketAcceptor</socketAcceptor>

&nbsp;&nbsp;&nbsp; <!– The list of supported authentication mechanisms.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; –>
&nbsp;&nbsp;&nbsp; <saslMechanismHandlers>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <simpleMechanismHandler mech-name="SIMPLE"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <cramMd5MechanismHandler mech-name="CRAM-MD5" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <digestMd5MechanismHandler mech-name="DIGEST-MD5" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <gssapiMechanismHandler mech-name="GSSAPI" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ntlmMechanismHandler mech-name="NTLM" ntlmProviderFqcn="com.foo.Bar"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ntlmMechanismHandler mech-name="GSS-SPNEGO" ntlmProviderFqcn="com.foo.Bar"/>
&nbsp;&nbsp;&nbsp; </saslMechanismHandlers>

&nbsp;&nbsp;&nbsp; <!– The desired quality-of-protection, used by DIGEST-MD5 and GSSAPI.&nbsp; –>
&nbsp;&nbsp;&nbsp; <saslQop>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <s:value>auth</s:value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <s:value>auth-int</s:value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <s:value>auth-conf</s:value>
&nbsp;&nbsp;&nbsp; </saslQop>

&nbsp;&nbsp;&nbsp; <!– The realms serviced by this SASL host, used by DIGEST-MD5 and GSSAPI. –>
&nbsp;&nbsp;&nbsp; <saslRealms>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <s:value>example.com</s:value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <s:value>apache.org</s:value>
&nbsp;&nbsp;&nbsp; </saslRealms>
…
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <apacheDS id="apacheDS"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; synchPeriodMillis="15000"
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; allowAnonymousAccess="false">

&nbsp;&nbsp;&nbsp; <directoryService>#directoryService</directoryService>
&nbsp;&nbsp;&nbsp; <ldapService>#ldapService</ldapService>
&nbsp;&nbsp;&nbsp; <ldapsService>#ldapsService</ldapsService>
&nbsp; </apacheDS>
…
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

So, when I start catalina, I think i get connect to LDAP server and I get the following error:

[13:33:26] ERROR [org.apache.directory.shared.ldap.codec.LdapMessageGrammar] - Incorrect DN given : daftAsABrush (0x64 0x61 0x66 0x74 0x41 0x73 0x41 0x42 0x72 0x75 0x73 0x68 ) is invalid : Bad DN : daftAsABrush
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - >>>==========================================
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - –> Decoding a PDU
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - >>>——————————————
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - — State = TAG_STATE_START —
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] -&nbsp;&nbsp; current byte : 0x30
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - Tag 0x30 has been decoded
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - — State = LENGTH_STATE_START —
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] -&nbsp;&nbsp; current byte : 0x2F
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - — State = LENGTH_STATE_END —
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] -&nbsp;&nbsp; current byte : 0x02
[13:33:26] DEBUG [org.apache.directory.shared.asn1.ber.Asn1Decoder] - Parent length : TLV expected length stack :&nbsp; - null
‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Is this the problem?
No error in Tomcat Log.
I have this configuration in Ldap server, browsed with Apache Studio: Here

So, when i start alfresco and try to login with user paolo, I get "Unable to login - unknown username/password" message

Where am I in wrong? If you need any else configuration information ask me, i'll try to get it for you understanding!
Thanks in advance!

Find more posts tagged with

Comments

cheffilet

What is your login name?

nowhere

Do you mean the user name i try to log in alfresco? I use "paolo" as defined in my ldap server with dn: cn=paolo,ou=users,ou=system and I use password as defined in attribute userPassword.
I hope this was your question…excuse me for my bad english.
Greetings

nowhere

I tried to configure chaining, my chaining-authentication-context.xml appears as follow:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <!– Chaining of both the services and components –>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationService" class="org.alfresco.repo.security.authentication.ChainingAuthenticationServiceImpl">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationServices">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationServiceImplJAAS"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="mutableAuthenticationService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationServiceImplAlfresco"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="sysAdminCache">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="sysAdminCache"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationComponent" class="org.alfresco.repo.security.authentication.ChainingAuthenticationComponentImpl">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<property name="authenticationComponents">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationComponentImplJAAS"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </list>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="mutableAuthenticationComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationComponentImplAlfresco"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;</bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <!– Alfresco Auth –>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationServiceImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationDao">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationDaoAlfresco"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="ticketComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="ticketComponent"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationComponentImplAlfresco"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="sysAdminCache">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="sysAdminCache"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationDaoAlfresco" class="org.alfresco.repo.security.authentication.RepositoryAuthenticationDao">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="nodeService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="nodeService"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="tenantService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="tenantService"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="dictionaryService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="dictionaryService"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="namespaceService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="namespaceService"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="searchService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="admSearchService"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="retryingTransactionHelper">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="retryingTransactionHelper"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="userNamesAreCaseSensitive">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>${user.name.caseSensitive}</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="passwordEncoder">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="passwordEncoder"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationComponentImplAlfresco" class="org.alfresco.repo.security.authentication.AuthenticationComponentImpl" parent="authenticationComponentBase">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationDao">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationDaoAlfresco"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationManager">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationManager"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="allowGuestLogin">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>true</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="nodeService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="nodeService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="personService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="personService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="transactionService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="transactionService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>

&nbsp;&nbsp; <!– ldap –> 
<bean id="authenticationServiceImplLDAP" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl" lazy-init="default" autowire="default" dependency-check="default">
 <property name="authenticationDao">
&nbsp; <ref bean="authenticationDaoLDAP" /> 
&nbsp; </property>
 <property name="ticketComponent">
&nbsp; <ref bean="ticketComponent" /> 
&nbsp; </property>
 <property name="authenticationComponent">
&nbsp; <ref bean="authenticationComponentImplLDAP" /> 
&nbsp; </property>
</bean>
<bean id="authenticationComponentImplLDAP" class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl" lazy-init="default" autowire="default" dependency-check="default">
 <property name="LDAPInitialDirContextFactory">
&nbsp; <ref bean="ldapInitialDirContextFactory" /> 
&nbsp; </property>
 <property name="userNameFormat">
 <!–&nbsp; cn=Manager,dc=khaz-domain,dc=com 
&nbsp; –> 
&nbsp; <value>cn=%s,ou=users,ou=system</value> 
&nbsp; </property>
&nbsp; </bean>
&nbsp; <bean id="authenticationDaoLDAP" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao" lazy-init="default" autowire="default" dependency-check="default" />
<!– fine –>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <!– JAAS –>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationServiceImplJAAS" class="org.alfresco.repo.security.authentication.AuthenticationServiceImpl">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationDao">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationDaoJAAS"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="ticketComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="ticketComponent"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="authenticationComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="authenticationComponentImplJAAS"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="sysAdminCache">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="sysAdminCache"/>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationComponentImplJAAS" class="org.alfresco.repo.security.authentication.jaas.JAASAuthenticationComponent">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="realm">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>COMPANY.COM</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="jaasConfigEntryName">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <value>Alfresco</value>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="nodeService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="nodeService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="personService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="personService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <property name="transactionService">
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <ref bean="transactionService" />
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </property>
&nbsp;&nbsp;&nbsp; </bean>
&nbsp;&nbsp;&nbsp; 
&nbsp;&nbsp;&nbsp; <bean id="authenticationDaoJAAS" class="org.alfresco.repo.security.authentication.ntlm.NullMutableAuthenticationDao"/>
&nbsp;&nbsp;&nbsp; 
</beans>‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

In this case, logging as admin/admin or as paolo/pwd I get the following exception:

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
caused by:
javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
caused by:
org.alfresco.error.AlfrescoRuntimeException: Not implemented

Any ideas? I'd like to consigure authentication with ldap server, also without chaining…
Thanks for any suggestions

nowhere

Hi again…
I also tried configuration with DIGEST:

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple 
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s     
ldap.authentication.userNameFormat=%s
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://ldap.example.com:10389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=DIGEST-MD5

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=reader

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secret

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Don't care of "ldap.authentication.java.naming.security.principal" and credentials, i set them in ldap-authentication-context.xml as follow:

<entry key="java.naming.security.principal">
                    <value>uid=admin,ou=system</value>
                </entry>
                
                <!– The password for the user defined above –>
                <entry key="java.naming.security.credentials">
                    <value>secret</value>
                </entry>
‍‍‍‍‍‍‍‍‍

and I get the following error (from ApancheDs log):

ERROR [org.apache.directory.server.ldap.handlers.BindHandler] - INVALID_CREDENTIALS: DIGEST-MD5: cannot acquire password for uid=admin,ou=system in realm : example.com‍

Hoping in some suggestions…i can't get out of this…

nowhere

Some else information…if someone can help me:
when I start Catalina, I get the following log:

17:23:50,390  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a string uid and password at lda
p://ldap.example.com:10389/
17:23:50,515  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for a simple dn and password at ldap
://ldap.example.com:10389/
17:23:50,640  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP
server does not fall back to anonymous bind for known principal and invalid cred
entials at ldap://ldap.example.com:10389/‍‍‍‍‍‍‍‍‍

and, always the log shows after a few minutes:

17:30:01,187  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 admin
17:30:01,187  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 fullname
17:30:01,203  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 adminrosa
17:30:01,218  DEBUG [authentication.ldap.LDAPPersonExportSource] Adding user for
 valerio
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] Found 1
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] Linking GROUP_Gr
oup One
17:30:01,484  DEBUG [authentication.ldap.LDAPGroupExportSource] … cn=Full Name
,dc=example,dc=com
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] … is member
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] Top 1
17:30:01,593  DEBUG [authentication.ldap.LDAPGroupExportSource] Secondary 0‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

but authentication fails…despite the ldap comunication seems to be working.
Why?

jcuzcano

hi

in my case, alfresco.log is show this

11:59:04,638 WARN [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://ldap.com:389
11:59:04,653 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not support simple string user ids and invalid credentials at ldap://ldap.com:389
11:59:04,700 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://ldap.com:389
11:59:04,716 INFO [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://ldap.com:389

but the process import users not was started!!!

jcuzcano

I'm working with Alfresco 2.1 with OpenLdap

nowhere

What's your "ldap.synchronisation.import.person.cron" setting?
If it can help you, read this: https://issues.alfresco.com/jira/browse/ALFCOM-1211, it seems that if your ldap server accepts anonymous bind alfresco will not work with it…

jcuzcano

in my ldap.synchronisation.properties file modify this parameter
ldap.synchronisation.import.person.cron=0 0/1 * * * ? then this job execute each minute

but alfresco log get this information

12:57:00,021 ERROR [org.quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
java.lang.NullPointerException
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:218)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
12:57:00,021 ERROR [org.quartz.core.ErrorLogger] Job (DEFAULT.ldapPeopleJobDetail threw an exception.
org.quartz.SchedulerException: Job threw an unhandled exception. [See nested exception: java.lang.NullPointerException]
   at org.quartz.core.JobRunShell.run(JobRunShell.java:213)
   at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: java.lang.NullPointerException
   at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:218)
   at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
   at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
   … 1 more

nowhere

Sorry, i'm completely new to both Alfresco and ldap…
I can't get sinchron if I allows anonymous bind on my ldap server and use ldap.authentication.java.naming.security.authentication=simple, but with a different exception from you.
If I were you, as thumb's rule, I'd deny anonymous bind on openldap because it's known to cause problem with alfresco. Otherwise use authentication=DIGEST-MD5… it works also with anonymous bind allowed for me.
Let me know 🙂

nowhere

Can someone make a list of files to modify in order to get ldap working? So I could review my configuration…
Thanks in advance,
Nowhere

eduardoc

Hi Nowhere,

Did you get some response?
Can you share with us?

Thanks.

mautidavis

Dear all,

I am almost getting the same problem with LDAP. Please find attached a portion of my catalina.out log file:

catalina.out

16:00:00,019  ERROR [quartz.core.JobRunShell] Job DEFAULT.ldapPeopleJobDetail threw an unhandled Exception:
org.alfresco.repo.importer.ExportSourceImporterException: Failed to import
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:211)
        at org.alfresco.repo.importer.ImporterJob.execute(ImporterJob.java:44)
        at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
        at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused by: org.alfresco.repo.security.authentication.AuthenticationException: LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:90)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:79)
        at org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource.generateExport(LDAPPersonExportSource.java:160)
        at org.alfresco.repo.importer.ExportSourceImporter.doImport(ExportSourceImporter.java:178)
        … 3 more
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 8009030C: LdapErr: DSID-0C09043E, comment: AcceptSecurityContext error, data 0, vece]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3005)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2951)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2753)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2667)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:287)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.InitialContext.<init>(InitialContext.java:197)
        at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:86)

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

it seems that the authenitication works but importation of users is not possible ( i hope that this is correct interpretation of this log file). What might be preventing the importation? Please help.

Regards,
Davis M Onsakia

dward

For any other confused readers, we're talking about v3.0 here. Please ignore this thread if you are configuring v3.2 because all you need to worry about is alfresco-global.properties.

Please double-check the following parameter values in $TOMCAT_HOME/alfresco/extension/ldap-authentication.properties

ldap.authentication.java.naming.security.authentication
ldap.authentication.java.naming.security.principal
ldap.authentication.java.naming.security.credentials

You have to be able to connect to the LDAP directory using that type of bind and that username and password. Here's typical values for OpenLDAP:

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.security.principal=cn=Manager,dc=company,dc=com
ldap.authentication.java.naming.security.credentials=secret

Here's typical values for Active Directory:

ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.java.naming.security.principal=alfresco@domain
ldap.authentication.java.naming.security.credentials=password

Please do not try to use this advice on v3.2 - the parameter names have changed!

brice

dward, please, would you be so kind giving us corresponding 3.2 parameters' names ?!

I tried many configuration and still cannot authenticate whereas these properties work with apache :
AuthType Basic
AuthBasicProvider ldap
AuthLDAPBindDN "cn=admin,dc=myCompany,dc=com"
AuthLDAPBindPassword "secret"
AuthLDAPURL "ldap://127.0.0.1:389/ou=people,dc=myCompany,dc=com?uid"
AuthLDAPGroupAttributeIsDN on
Require ldap-group cn=myprivategroup,ou=groups ,dc=myCompany,dc=com

my best guess would be something as :
ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.provider.url=ldap://127.0.0.1:389/cn=admin,ou=people,dc=myCompany,dc=com?uid
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=true
ldap.authentication.escapeCommasInUid=true

but I don't see where to put admin credentials but to the synchronisation part, which is not mandatory !

dward

ldap.authentication.java.naming.provider.url=ldap://127.0.0.1:389
ldap.synchronization.java.naming.security.principal=cn\=admin,ou\=people,dc\=myCompany,dc\=com
ldap.synchronization.java.naming.security.credentials=secret
ldap.synchronization.groupSearchBase=ou\=groups,dc\=myCompany,dc\=com
ldap.synchronization.userSearchBase=ou\=people,dc\=myCompany,dc\=com