nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco + Zimbra LDAP

vasisualy

Dear all,

Im trying to combine Alfresco with my existing Zimbra server.
My idea is to use zimba's LDAP server as the only one authentication mechanism.
It means that every Zimbra's user may login into Alfresco with the same credentials and the home folders as his/her full name.

As I see for this purpose I have to set
authentication.chain=ldap1:ldap
ldap.authentication.active=true
ldap.synchronization.active=true
…

My problem that LDAP schema in Zimbra is quite different than it was described in wiki and on this forum and I'm not LDAP guru.

Here is Zimbra LDAP scheme
[img]http://wiki.zimbra.com/images/b/bc/5_Zimbra_LDAP.4.1.2.jpg[/img]

Zimbra LDAP info http://wiki.zimbra.com/index.php?title=Zimbra_Directory_Service_(LDAP)
As you see there is no any subtrees.
All user info stores in flat structure. ()

Here is example of users LDIF record for Zimbra's user.
#——————————————————————————-
# This file has been generated on from zimbra.local:389
# by Softerra LDAP Browser 2.6 (http://www.ldapbrowser.com)
#——————————————————————————-
version: 1
dn: uid=vasisualy,ou=people,dc=zimbra,dc=local
zimbraMailTransport: lmtp:zimbra.local:7025
zimbraAccountStatus: active
zimbraMailDeliveryAddress: vasisualy@zimbra.local
initials: Middle
givenName: John
sn: Smith
userPassword: {SSHA}Zb9zGRCymqk76tjE9BBZT8D8789D0Hf6
zimbraMailStatus: enabled
zimbraId: f22d0251-453d-474a-a3e4-c4f2bf3c8698
mail: sti@zimbra.local
displayName: John Middle. Smith
uid: vasisualy
objectClass: organizationalPerson
objectClass: zimbraAccount
objectClass: amavisAccount
zimbraPasswordModifiedTime: 20090910110003Z
cn: John Middle. Smith
zimbraMailHost: zimbra.local
zimbraLastLogonTimestamp: 20090910134126Z
zimbraPrefDefaultSignatureId: f748cca8-04dd-4e7f-a066-187e22357b85
zimbraSignatureName: My signature
zimbraPrefMailSignature: Here is my signature.
zimbraSignatureId: f748cca8-04dd-4e7f-a066-187e22357b85
zimbraPrefUseTimeZoneListInCalendar: TRUE
postalCode: 01030
ou: Department No 1
zimbraAllowAnyFromAddress: FALSE
street:: 5th Street
zimbraNotes: Notes text.
description: Description
co: Ukraine
physicalDeliveryOfficeName: Office 1
l: Kiev
telephoneNumber: 1125
st: State
company: Company Name
—————–

I have done some work and authentication works.

When user logs into Alfresco as vasisualy it displays as vasisualy.
But I need a user like "John Middle. Smith" instead of vasisualy with home folder.
As I see for this I have to use LDAP sync and it is a problem for me now.

ldap.synchronization.personQuery=(&(ou\=*)(objectClass\=organizationalPerson)(zimbraMailStatus\=enabled))
ldap.synchronization.userSearchBase=ou\=People,dc\=zimbra,dc\=local
Alfresco imports users but stops on groups.

I do not know how to configure following group parameters in Alfresco for my LDAP my schema.
Could someone explain me this parameters more detailed than wiki?
ldap.synchronization.groupQuery=
ldap.synchronization.groupSearchBase=
ldap.synchronization.groupType=
ldap.synchronization.groupIdAttributeName=
ldap.synchronization.groupMemberAttributeName=

Is it possible to configure static non LDAP groups for LDAP users?

Thank you in advance.

Find more posts tagged with

Comments

ivan_plestina

By taking a quick look at the zimbra wiki I would say that zimbraDistributionList is equivalent to a group. Create one, add some members to it and then run some LDAP queries to map correct values. BTW, if you manage to get this all together, please post your configs.

vasisualy

Thank you, Ivan, for replay.

Unfortunately Zimbra's distribution list is not an equivalent of user group.
It's the same as aliases for mailing lists like info@company.com, support@company.com

I will try add custom group parameter to existing schema and make setup.

Anyway following parameters still are not clear for me.

ldap.synchronization.groupQuery=
ldap.synchronization.groupSearchBase=
ldap.synchronization.groupType=
ldap.synchronization.groupIdAttributeName=
ldap.synchronization.groupMemberAttributeName=

Could someone explain it for me.

Thank you in advance.

ivan_plestina

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfNames)

# The search base to use to find group objects
ldap.synchronisation.groupSearchBase=ou=groups,dc=company,dc=com

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronisation.groupType=groupOfNames

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=member
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Sync-ing a group is pretty much the same as sync-ing a user. groupQuery is just a proper LDAP query with a proper objectclass - very similar to the personQuery. This is why I said you could use zimbraDistributionList in a way that you put all target group members into a distribution list and then use something like:

ldap.synchronisation.groupQuery=(objectclass=zimbraDistributionList)
ldap.synchronisation.groupMemberAttributeName=member
‍‍‍

where 'member' field in LDAP should contain the person's userIdAttributeName that you defined in user's sync. So to conclude, if you settle that your username in Alfresco should be for example your email vasisualy@domain.com, and that email is also member of a zimbraDistributionList then you could have both users and groups in this way.

If you post results of a LDAP query that describes zimbraDistributionList I could be more concrete…

vasisualy

Here is LDIF record of Zimbra's Distribution list.
This list contain only one member.
Members are listed in zimbraMailForwardingAddress.
=============================

dn: uid=all_users,ou=people,dc=zimbra,dc=local
zimbraMailStatus: enabled
zimbraId: 88fb2bcb-bfd1-4806-8c28-a87d005831b1
displayName: All Users
mail: all_users@zimbra.local
uid: all_users
objectClass: zimbraDistributionList
objectClass: zimbraMailRecipient
zimbraMailAlias: all_users@zimbra.local
cn: All Users
description: All users in Zimbra
zimbraHideInGal: TRUE
zimbraMailForwardingAddress: vasisualy@zimbra.local

ivan_plestina

Ok so something like this should work if you settle with username@zombra.local form of usernames (and modify the user sync accordingly):

ldap.synchronisation.groupQuery=(objectclass=zimbraDistributionList)
ldap.synchronisation.groupSearchBase=dc=zimbra,dc=local
ldap.synchronisation.groupIdAttributeName=cn
ldap.synchronisation.groupType=zimbraDistributionList
ldap.synchronisation.groupMemberAttributeName=zimbraMailForwardingAddress
‍‍‍‍‍‍

dward

Please note that vasisualy's original question was regarding the v3.2 LDAP properties which all use the letter 'z' in their name and are documented here.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP

vasisualy

Thank you everyone for help.
I got first results.
I've done following steps.
1. Downloaded from Alfresco.com "Alfresco-Community-3.2-MacOS-X-Install" and install it w/o WCM and SharePoint protocol.
2. Created fresh MySQL DB.
3. Than I added following lines to /opt/Alfresco/tomcat/shared/classes/alfresco-global.properties
===============================================================
authentication.chain=ldap1:ldap

ldap.authentication.active=true
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=zimbra,dc=local
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://zimbra.local:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=vasisualy

ldap.synchronization.active=true

ldap.synchronization.queryBatchSize=1000
ldap.synchronization.java.naming.security.principal=uid=zimbra,cn=admins,cn=zimbra
ldap.synchronization.java.naming.security.credentials=Password

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

ldap.synchronization.userSearchBase=dc=zimbra,dc=local
ldap.synchronization.userIdAttributeName=zimbraMailDeliveryAddress
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=company
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

ldap.synchronization.personQuery=(&(objectClass=organizationalPerson)(zimbraMailStatus=enabled))
ldap.synchronization.personDifferentialQuery=(&(objectClass=organizationalPerson)(zimbraMailStatus=enabled)(!(modifyTimestamp<={0})))
ldap.synchronization.personType=organizationalPerson

ldap.synchronization.groupSearchBase=dc=zimbra,dc=local
ldap.synchronization.groupQuery=(&(objectclass=zimbraDistributionList)(zimbraMailStatus=enabled))
ldap.synchronization.groupDifferentialQuery=(&(objectclass=zimbraDistributionList)(zimbraMailStatus=enabled)(!(modifyTimestamp<={0})))
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=zimbraDistributionList
ldap.synchronization.groupMemberAttributeName=zimbraMailForwardingAddress

synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=true
# every 5 minutes
#ldap.synchronization.import.cron=0 * * * * ?
============================================

4. Alfresco started and on login I see in catalina.out following:
19:45:09,697 INFO [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
19:45:09,698 INFO [security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'AUTH.EXT.ldap1'
19:45:10,265 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'admin@zimbra.local'
19:45:10,661 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'wiki@zimbra.local'
19:45:11,016 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'spam.gq9grspa@zimbra.local'
19:45:11,257 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'ham.gftvdq5ag@zimbra.local'
19:45:11,470 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'vasisualy@zimbra.local'
19:45:11,753 INFO [security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'AUTH.EXT.ldap1'
19:45:11,782 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating group 'All Users'
19:45:11,916 INFO [security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'AUTH.EXT.ldap1'
19:45:11,918 INFO [security.sync.ChainingUserRegistrySynchronizer] 5 user(s) and 1 group(s) processed

User logged in and everything seems Ok.

But users synced in tricky way. Please see attached picture.
http://tinypic.com/r/27xecf5/3
or [img]http://i27.tinypic.com/27xecf5.jpg[/img]

I need an advice is the any way to point Alfresco that I logs as vasisualy and it corresponds to "Vasily Pupkin" and do not make
2 different user records: vasisualy and "Vasily Pupkin"

Thank you in advance.

dward

You need to set

ldap.synchronization.userIdAttributeName=uid

zimbraMailDeliveryAddress was the wrong attribute to use, as it contains the @zimbra.local suffix.

ivan_plestina

You need to set

ldap.synchronization.userIdAttributeName=uid

zimbraMailDeliveryAddress was the wrong attribute to use, as it contains the @zimbra.local suffix.

Wiki states:
ldap.synchronization.groupMemberAttributeName
The name of the multi-valued attribute on an LDAP group object that lists its members. If the value of this attribute parses as a Distinguished Name (DN) then the exporter will resolve the member name and type by looking up that DN, determining its object class (user or group) and getting the appropriate name attribute. This strategy will work with the groupOfNames class, for example. Otherwise, the attribute value is assumed to contain a user ID. This strategy will work with the posixGroup class, for example.

So, in order to use zimbraDistributionList as a "virtual group" (if I understood vasisualy correctly there are no real groups in zimbra LDAP scheme), he must also use email addresses as UIDs in Alfresco to map users to groups correctly. I would have put the same config as vasisualy.

I understand this is some black magic we're trying here but it would be great if Alfresco and Zimbra could integrate this way and we are very close to the solution.

ivan_plestina

Oh and btw, it looks to me that LDAP sync worked perfectly but authentication messed things up by creating another user… Can you try to modify:

ldap.authentication.userNameFormat=uid=%s,ou=people,dc=zimbra,dc=local‍

ldap.authentication.userNameFormat=%s@zimbra.local‍

Not sure if you'll need to escape that '@' with a '\'. This definately works with AD LDAP i.e. you can authenticate with your email. %s is what you type into the login form, and @zimbra.local is appended in the background automatically. No idea will it work for zimbra but it should solve the double users problem.

dward

Ivan, your suggeston won't work because zimbraMailDeliveryAddress is not part of the DN, and therefore it won't be able to resolve the entered user ID to a DN.

BUT, a change I am about to check in to HEAD will allow you to use any user attribute, including email address, as the user ID attribute, because we are going to support search based DN resolution when ldap.authentication.userNameFormat is empty.

So I'm afraid it's not possible now, but it will be just as soon as HEAD is open for check ins again.

vasisualy

I started to write this replay 2 hour late before yours.
Anyway I will put it.
I will try your advices and report soon.

You need to set
ldap.synchronization.userIdAttributeName=uid
zimbraMailDeliveryAddress was the wrong attribute to use, as it contains the @zimbra.local suffix.

I see. But zimbra's DistributionList contains in zimbraMailForwardingAddressattribute only e-mails not UIDS.

If I set ldap.synchronization.userIdAttributeName=uid it will conflict with Groups which contain e-mail not UIDs.

Am I wrong?

Thank you.

vasisualy

Dear mates,
I changed setting to ldap.synchronization.userIdAttributeName=uid

As expected duplicated users are gone.

part of Alfresco log:
23:54:40,416 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'wiki'
23:54:40,613 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'spam.gq9grspa'
23:54:40,854 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'ham.gftvdq5ag'
23:54:41,080 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating user 'vasisualy'
23:54:41,278 INFO [security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'AUTH.EXT.ldap1'
23:54:41,300 INFO [security.sync.ChainingUserRegistrySynchronizer] Creating group 'All Users'
23:54:41,352 INFO [security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'AUTH.EXT.ldap1'
23:54:41,353 INFO [security.sync.ChainingUserRegistrySynchronizer] 5 user(s) and 1 group(s) processed

Group 'All Users' was created as empty.
[img]http://i27.tinypic.com/dwxs9u.png[/img]

I think I need some manipulations on Zimbra side to achieve really good group integration.

Only few parameters are stii not clear for me.
ldap.synchronization.groupType=
ldap.synchronization.personType=
What does it really mean?

And is the any additional parameters in Alfresco configs to import persons attributes from LDAP?
like Organization: Job Title: Location: Presence Provider: , etc.

Thank you.

ivan_plestina

I think I need some manipulations on Zimbra side to achieve really good group integration.

Only few parameters are stii not clear for me.
ldap.synchronization.groupType=
ldap.synchronization.personType=
What does it really mean?

And is the any additional parameters in Alfresco configs to import persons attributes from LDAP?
like Organization: Job Title: Location: Presence Provider: , etc.

Thank you.

I believe dward's changes once in HEAD will fix things for you.

groupType and personType are mappings to the objectclass name in LDAP for groups and users. For example in AD groupType=group, in OpenLDAP it's groupOfNames and similar.

vasisualy

Hello all,

I've done myself a little tricky script.
This script based on script written by Carlos Vidal <cvidal@whitehatmail.fr> and found on Zimbra support forum
It modifies Zimbra's LDAP.

Example:
Zimbra distribution list alfresco_users@hansa.com.ua:
group1@company.com
user5@company.com

Run script as zimbra user
zimbra$ python /opt/bin/dl2groups.py -a -d -p `zmlocalconfig -s -m nokey zimbra_ldap_password`
Removing all existing group CNs from LDAP
Expanding and Processing DistributionLists and it's members
Done.

It makes LDAP records like

cn=alfresco_users,ou=groups,dc=company,dc=com
objectClass: groupOfNames (structural)
objectClass: top (abstract)
cn: alfresco_users
member: uid=user1,ou=people,dc=company,dc=com
member: uid=user1,ou=people,dc=company,dc=com
member: uid=user1,ou=people,dc=company,dc=com
description: desc
o: Alfresco users

Script parameters:
Parameters:
-a, –add :add group CN records according DistributionLists
-d, –del :remove all existing group CN records
-p, –print : print proposed changes

-u=name, –user=name :LDAP login as uid=name,cn=admins,cn=zimbra
                     :defaulf login is uid=zimbra,cn=admins,cn=zimbra
-p=, –pass=, –passwd=, password= :LDAP password
-b=, –base= :LDAP search base
-h, –help   : this help screen message
-l, –list    :list possible changes (for tesing)

This script accepts nested distribution lists and duplicated uses.

To add it to the Zimbra's crontab to run it hourly run (for detals see https://help.ubuntu.com/community/CronHowto )
zimbra@:~$ crontab -e

and add lines to the end of file
# ZIMBRAEND – DO NOT EDIT ANYTHING BETWEEN THIS LINE AND ZIMBRASTART

# Zimbra LDAP groups mirroring
*/15 * * * * /usr/bin/python /opt/bin/dl2groups.py -a -d -p `/opt/zimbra/bin/zmlocalconfig -s -m nokey zimbra_ldap_password` > /dev/null 2>&1

Update: I just updates last line. Now it works.

I know that this script is not perfect. Hope someone improve and contribute it.
Warning: this script tested only on my own zimbra instance. Please do proper backups procedures before running it first time.

I pasted dl2groups.py on   http://pastebin.com/RgJsn6PD

I will be glad for your response.

jimmykirk

Wow, that looks promising for us Zimbra users.

Does this change existing groups? Are you also using Zimbra for posix/samba authentication as well?

I'd love to have an "alfresco users" group to prevent my dummy accounts like "serveralerts@domain.com" from populating in Alfresco.

vasisualy

As you probably know Zimbra does not use traditional ou=group structure.
It uses distribution lists as uid=distribution_list

This script makes groups according distribution lists.

scyonix

Hi i'm getting the below error when itried to run the script on my zimbra server, pls help me to find out a solution…

zimbra@localhost$; python /tmp/dl2groups.py -a -d -p `zmlocalconfig -s -m nokey zimbra_ldap_password`
Removing all existing group CNs from LDAP
Expanding and Processing DistributionLists and it's members
createCnGroup: error for cn=test,ou=groups,dc=testmail,dc=example,dc=com
Traceback (most recent call last):
File "dl2groups.py", line 367, in ?
createCnGroup(l,grp,realmembs)
File "dl2groups.py", line 234, in createCnGroup
if type(e.message) == dict and e.message.has_key('desc'):
AttributeError: NAMING_VIOLATION instance has no attribute 'message'

vasisualy

Sorry for late response.
As I see script can not create ou=groups.

I use more than one mail domain in my Zimbra configuration.
How many mail domains do you use?

Try to change in script
LDAP_BASE = 'dc=local'

Try to run
zimbra> python dl2groups.py -l -p `zmlocalconfig -s -m nokey zimbra_ldap_password`

Does it print correct changes?

vasisualy

Dear mates,
I use Zimbra community edition 6.0.8 + Alfresco 3.3g community edition.
I works pretty good.

Here is my cron setting on zimbra server. It makes LDAP changes to provide ou=groups for Alfresco and other services.

zimbra@zimbraserver:~$ crontab -l
….
# ZIMBRAEND – DO NOT EDIT ANYTHING BETWEEN THIS LINE AND ZIMBRASTART

# Zimbra LDAP groups mirroring
# minute(s) hour(s) day(s)_of_month month(s) day(s)_of_week user command
*/15 * * * * /usr/bin/python /opt/bin/dl2groups.py -a -d -p `/opt/zimbra/bin/zmlocalconfig -s -m nokey zimbra_ldap_password` > /dev/null 2>&1

Here is cut from my Alfresco settings files.
Please note that I use 3 different domains in Zimbra thus in Alfresco I use 3 auth. chains.
In Zimbra I created for each of 3 domains distribution list like only_domain1, only_domain2, only_domain3
In my setting Alfresco imports only thees lists. I do not need in my Alfresco groups like support or info.
It also filters maintenance zimbra accounts, etc.

Please bear in mind that account synchronization and LDAP authentication is different things. 🙂

/opt/tomcat/shared/classes/alfresco-global.properties

…
# LDAP Sync options
synchronization.syncOnStartup=true
synchronization.synchronizeChangesOnly=false
# A cron expression defining when the scheduled synchronization job should run, by default at midnight every day
# java quartz cron see http://quartz.sourceforge.net/javadoc/org/quartz/CronTrigger.html
# http://www.quartz-scheduler.org/docs/tutorial/TutorialLesson06.html
# sync every 10 minutes
synchronization.import.cron=0 0/30 * * * ?
# Should we trigger a differential sync when a user is successfully authenticated who does not yet exist in Alfresco?
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
…
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap,ldap2:ldap,ldap3:ldap
# authentication.chain=crowd-auth:crowd-auth
alfresco.authentication.allowGuestLogin=false

# LDAP part (ldap1)
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=domain_1,dc=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://my_fimbra_server.com:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=my_zimbra_login

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=uid\=zimbra,cn\=admins,cn\=zimbra
ldap.synchronization.java.naming.security.credentials=PasswordForZimbraLdapUserZimbra
ldap.synchronization.queryBatchSize=1000

ldap.synchronization.groupQuery=(&(objectClass=groupOfNames)(cn=only_*))
ldap.synchronization.groupDifferentialQuery=(&(objectClass=groupOfNames)(cn=only_*))

ldap.synchronization.personQuery=(&(objectclass=organizationalPerson)(!(objectClass=zimbraCalendarResource))(zimbraMailStatus=enabled)(zimbraAccountStatus=active)(!(|(uid=wiki)(uid=admin)(uid=spam.*)(uid=ham.*)(uid=galsync)(uid=*robot*))))
ldap.synchronization.personDifferentialQuery=(&(objectclass=organizationalPerson)(!(objectClass=zimbraCalendarResource))(zimbraMailStatus=enabled)(zimbraAccountStatus=active)(!(|(uid=wiki)(uid=admin)(uid=spam.*)(uid=ham.*)(uid=galsync)(uid=*robot*)))(!(modifyTimestamp<\={0})))
#ldap.synchronization.personDifferentialQuery=(&(objectclass=organizationalPerson)(!(objectClass=zimbraCalendarResource))(zimbraMailStatus=enabled)(zimbraAccountStatus=active)(!(|(uid=wiki)(uid=admin)(uid=spam.*)(uid=ham.*)(uid=galsync)(uid=*robot*))))

ldap.synchronization.groupSearchBase=dc=com
ldap.synchronization.userSearchBase=dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=groupOfNames
ldap.synchronization.personType=organizationalPerson
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.enableProgressEstimation=true

Due to I use 3 auth. chains I had to create on Alfresco server 3 directories in /opt/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/
ldap1 - empty. We already set settings for ldap1 in alfresco-global.properties
ldap2 - for 2nd chain
contains file ldap-authentication.properties
ldap3 - for 3rd chain
contains file ldap-authentication.properties

In my case file ldap-authentication.properties is almost the same for ldap2 and ldap3
The only difference is domain names.

# LDAP part
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=domain_2,dc=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://my_fimbra_server.com:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
#ldap.authentication.defaultAdministratorUserNames=my_zimbra_login

Wish you luck.

wiz561

Hi,

I'm attempting to do this exact thing and can't get it to work properly. I've tried a few things in this thread, and can't get it to authenticate or create users. Since my machine authenticates to LDAP just fine, I figured I would post a snip of my ldap.conf file…

–ldap.conf–
base dc=csl-mail,dc=<domain>,dc=com
binddn uid=zmposix,cn=appaccts,cn=zimbra
bindpw zmposis%password
ldap_version 3
nss_initgroups_ignoreusers backup,bin,daemon,games,gnats,irc,libuuid,list,lp,mail,man,news,proxy,root,sshd,sync,sys,syslog,uucp,www-data
pam_password md5
rootbinddn uid=zmposixroot,cn=appaccts,cn=zimbra
uri ldap://csl-mail.
—

—alfresco-global.properties—
authentication.chain=zimbraldap:ldap,alfrescoNtlm1:alfrescoNtlm
ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=zimbra,dc=csl-mail,dc=<domain>,dc=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://192.168.120.10:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=<<my username>>
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=uid=zmposix,cn=appaccts,cn=zimbra
ldap.synchronization.java.naming.security.credentials=zmposis%password
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=posixGroup)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=posixGroup)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(objectclass\=posixAccount)
ldap.synchronization.personDifferentialQuery=(&(objectclass\=posixAccount)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou=groups,dc=csl-mail,dc=<domain>,dc=com
ldap.synchronization.userSearchBase=ou=people,dc=csl-mail,dc=<domain>,dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=zimbraId
ldap.synchronization.defaultHomeFolderProvider=homeDirectory
ldap.synchronization.groupIdAttributeName=gidNumber
ldap.synchronization.groupType=posixGroup
ldap.synchronization.personType=organizationalPerson
ldap.synchronization.groupMemberAttributeName=memberUid
ldap.synchronization.enableProgressEstimation=true

#other stuff
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false
–

Any help is appreciated.

leonk

Did you have any luck with that configuration?
If yes, post your solution please.

wiz561

I haven't had any luck with the configurations. I'm hoping somebody could help because it's no easy task.

wiz561

OK, I figured half of it out…

First, I turned on the ldap debug mode in zimbra and monitored /var/log/debug, despite the fact the logs should end up in /var/log/zimbra.log.

After that, I viewed a sample logon over ssh, which authenticates to the ldap server…just to see what I should be seeing during ldap authentication. Then looked at the alfresco one and made a minor change. I don't know if it helped the problem or not.

The interesting thing I found is that during one instance, I deleted my user account from alfresco, but it would never re-add it. I don't know if there's a way to resync user accounts in alfresco or not. What I did was go into my zimbra admin page and edited the address property so it would update my user record. Restarted alfresco, and I was able to logon.

Here's my global snippet that worked…

authentication.chain=zimbraldap:ldap,alfrescoNtlm1:alfrescoNtlm

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=uid=%s,ou=people,dc=csl-mail,dc=<domain>,dc=com
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://192.168.120.10:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=<<username>>
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=uid=zmposixroot,cn=appaccts,cn=zimbra
ldap.synchronization.java.naming.security.credentials=<<<password>>>
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupQuery=(objectclass\=posixGroup)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=posixGroup)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(objectclass\=posixAccount)
ldap.synchronization.personDifferentialQuery=(&(objectclass\=posixAccount)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=ou=groups,dc=csl-mail,dc=<domain>,dc=com
ldap.synchronization.userSearchBase=ou=people,dc=csl-mail,dc=<domain>,dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=zimbraId
ldap.synchronization.defaultHomeFolderProvider=homeDirectory
ldap.synchronization.groupIdAttributeName=gidNumber
ldap.synchronization.groupType=posixGroup
ldap.synchronization.personType=organizationalPerson
ldap.synchronization.groupMemberAttributeName=memberUid
ldap.synchronization.enableProgressEstimation=true

#other stuff
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=false

==============

Now, one thing that didn't work are cifs mounts. I'm thinking that my cifs authentication part is messed up, as I can mount as admin but not a user. So onto that part now….

louise

So, i've done with a working LDAP configuration to sync users and groups from Zimbra (see below), but one thing missing yet… The Alfresco synchronizer service reads from LDAP and writes all users and all groups into repository, but does not reproduce nested group hierarchy.

Debug log reports with group names as non-existent:

12:50:33,657  DEBUG [security.sync.ChainingUserRegistrySynchronizer] Ignoring non-existent member 'XXX-99@XXX.hu' in groups {'YYY9@XXX.hu'}
…
12:50:33,661  DEBUG [security.sync.ChainingUserRegistrySynchronizer] Ignoring non-existent member 'XXX@XXX.hu' in groups {'YYY@XXX.hu'}
‍‍‍‍‍

shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldap1/ldap-authentication.properties:

…

# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldap://zimbra.XXX.hu:389

# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple

…

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The authentication mechanism to use for synchronization
ldap.synchronization.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.synchronization.java.naming.security.principal=uid\=zimbra,cn\=admins,cn\=zimbra

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=ZIMBRA_LDAP_PASSWORD

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=zimbraDistributionList)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=zimbraDistributionList)(!(modifyTimestamp<\={0})))


# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(objectClass\=organizationalPerson)

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=organizationalPerson)(!(modifyTimestamp<\={0})))


# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=people,dc\=XXX,dc\=hu

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=people,dc\=XXX,dc\=hu


# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'


# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=mail

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=displayName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=cn

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider


# The attribute on LDAP group objects to map to the authority name property in Alfresco
ldap.synchronization.groupIdAttributeName=mail

# The attribute on LDAP group objects to map to the authority display name property in Alfresco (v3.3+)
ldap.synchronization.groupDisplayNameAttributeName=mail

# The group type in LDAP
ldap.synchronization.groupType=zimbraDistributionList

# The person type in LDAP
ldap.synchronization.personType=organizationalPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=zimbraMailForwardingAddress

# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
ldap.synchronization.enableProgressEstimation=true

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

halione

Hello Community,

im trying to get a Zimbra LDAP synced with the Alfreso LDAP, in order to import the Users from Zimbra.

1.) Authenticate to the Zimbra LDAP:
- Do i need to configure a special user with the Accessrights in Zimbra and type this usersettings in the Alfresco Config File in order to get Acces to the Zimbra LDAP? If not, how can i provide a mechanism that not everybody can fetch the LDAP Schema from Zimbra?

2.) Is the Synchronisation in bothways? Im asking because i dont want to change the Zimbra LDAP.

would be graet if anybody has an answer on this questions…

Sincerly Halion

uthen

Dear all,

Im trying to combine Alfresco 4.0.e (already setup on Ubuntu 12.04 Sever) with my existing Zimbra Collaboration Suite Open Source Edition 7.2.0 (on Ubuntu 10.04.4 Sever).

Can you provide me with step by step instructions please.

skuran

Hello, sorry to revive an old thread but, i am having similar problems Alfresco + Zimbra Auth and found myself into this thread. Wiz561, you are referring to groupType=posixGroup which does not exist in Zimbra LDAP schema, are you using a modified schema?

skuran

Hi thread,

Anyone having a working Zimbra LDAP auth config without LDAP schema patch and duplicate home folders? Please post here. I am running Alfresco 4.2.e on Centos 6.5. I think this is not solved yet.

Best regards,

Suleyman