Synchronizing deleted LDAP group?

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

jimbojw

Hi all,

I have Alfresco community 3.3 (nightly from Aug 11) installed and synchronizing with Active Directory.

To set up, I performed the following steps:

1. Created a new folder (space)
2. In Manage Space Users, I unchecked the box for inheriting from the parent space
3. I added a group previously imported from AD called TEST_USERS
4. Confirmed that testuser1 (a member) could manipulate the directory

Then, to test:
5. On the Domain Controller, I deleted the AD group TEST_USERS
6. Restarted Alfresco
7. In the startup logs, I see:

15:59:14,082 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
15:59:14,113 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving users changed since Aug 29, 2009 4:00:34 AM from user registry 'ldap1'
15:59:14,316 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving groups changed since Aug 29, 2009 4:03:24 AM from user registry 'ldap1'
15:59:14,456 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
15:59:14,456 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
15:59:14,472 User:System INFO  [management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [default] complete‍‍‍‍‍‍

So it appears that Alfresco did not pick up on the removed group.  Going into Alfresco's administration console -> Manage Groups, I still see TEST_USERS.

Is this the intended behavior?  If not, what should it be doing?  Thanks in advance.

dward

To detect deleted users and groups, Alfresco has to query ALL users and groups from the LDAP directory. Not just those that have changed.

This is called a full sync, and only happens in the scheduled job that runs by default every midnight.

Alfresco does a faster 'differential sync' where it only queries for changed users and groups whenever a missing user is successfully authenticated and whenever the server is started up.

See http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem for more details.