nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

LDAP Synchronization of User Details

fkeller

Hello,

we have installed and setup Alfresco CE 3.2 on ubuntu 9.04 using the cononical partner repository. Authentication against ldap (MS AD) works fine with three AD Servers (chaining).
Now we want to sync the User Details from AD (Mail Address, given name, …) to alfresco. what would be the best way to do this?

We tried to get ldap sync up and running but it didn't work.

thanks for help

Find more posts tagged with

Comments

dward

My recommendation would be to get LDAP sync up and running! It's worthwhile taking the latest community nightly build, as several performance and stability improvements have been made.

Please paste in your alfresco-global.properties, plus the full errors from alfresco.log that occur when an LDAP sync is triggered.

fkeller

thanks for reply, the problem is, that there is nothing in the log files from the sync process.

here are the global.properties file

###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=/var/lib/alfresco

#
# Sample database connection properties
#————-
db.name=xxx
db.username=xxx
db.password=xxx
db.host=xxx
db.port=xxx

#
# External locations
#————-
ooo.exe=/usr/bin/soffice
img.root=/usr
swf.exe=/usr/bin/alfresco-pdf2swf

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://${db.host}:${db.port}/${db.name}
hibernate.dialect=org.hibernate.dialect.MySQLInnoDBDialect

#
# Index Recovery Mode
#————-
#index.recovery.mode=Auto

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service. ▒The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match. ▒For example:
# ▒ .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap-ad

#
# IMAP
#————-
#imap.server.enabled=true
#imap.server.port=143
#imap.server.host=localhost
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

dward

You say that you are chaining against three AD servers, but yet you only have a single LDAP server in your authentication chain.

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap-ad

Plus you haven't actually set any of the LDAP properties! How do you expect it to work?

See

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

fkeller

The ldap chaining is setup like in the example zip ( chaining-example.zip ) file with the configs for that.

and the authentication is working for all three ad servers configured there. the ldap.properties are set in the tomcat/shared/classes/alfresco/extensions/ldap-authentication.properties file.

in the config i posted before only one ldap chain is set, because of testing things.

thanks for trying to help

dward

Please do not use chaining-example.zip. It is not valid for v3.2 and has been removed from HEAD. Please remove your custom spring configuration and tell me what doesn't work when you configure things through alfresco-global.properties.

fkeller

thanks for the reply, but know i'm at the end of my knowledge.

can you please give me a hint or a link to a good example how to configure three ldap chains with the global properties file?

thanks

dward

I've already pointed you at the Wiki, which explains the authentication.chain property and all the other properties you can add to alfresco-global.properties to control your subsystems. I don't know what else I can do. I've added a new advanced example here.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Example_2:_Advanced_LDAP_Chain

You will need the latest Community nightly build

fkeller

okay, i've stup this like your examples, it works fine. i can login with ad users, but the sync doesn't work at the moment.

the error message is:

WARN  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Failed initial synchronize with user registries
org.alfresco.repo.security.authentication.AuthenticationException: 07140000 LDAP authentication failed.
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:115)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.getDefaultIntialDirContext(LDAPInitialDirContextFactoryImpl.java:90)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry$PersonIterator.<init>(LDAPUserRegistry.java:756)
        at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.getPersons(LDAPUserRegistry.java:455)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.syncPersonsWithPlugin(ChainingUserRegistrySynchronizer.java:379)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.synchronize(ChainingUserRegistrySynchronizer.java:270)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$1$1.execute(ChainingUserRegistrySynchronizer.java:916)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:326)
        at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:233)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer$1.doWork(ChainingUserRegistrySynchronizer.java:908)
        at org.alfresco.repo.security.authentication.AuthenticationUtil.runAs(AuthenticationUtil.java:489)
        at org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer.onBootstrap(ChainingUserRegistrySynchronizer.java:904)
        at org.alfresco.util.AbstractLifecycleBean.onApplicationEvent(AbstractLifecycleBean.java:62)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.alfresco.repo.management.subsystems.ChildApplicationContextFactory.start(ChildApplicationContextFactory.java:460)
        at org.alfresco.repo.management.subsystems.AbstractPropertyBackedBean.onApplicationEvent(AbstractPropertyBackedBean.java:276)
        at org.springframework.context.event.SimpleApplicationEventMulticaster$1.run(SimpleApplicationEventMulticaster.java:77)
        at org.springframework.core.task.SyncTaskExecutor.execute(SyncTaskExecutor.java:49)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:75)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:246)
        at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:617)
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:355)
        at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:246)
        at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:189)
        at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:49)
        at org.alfresco.web.app.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:69)
        at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:3843)
        at org.apache.catalina.core.StandardContext.start(StandardContext.java:4338)
        at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:791)
        at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:771)
        at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:525)
        at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:627)
        at org.apache.catalina.startup.HostConfig.deployDescriptors(HostConfig.java:553)
        at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:488)
        at org.apache.catalina.startup.HostConfig.start(HostConfig.java:1149)
        at org.apache.catalina.startup.HostConfig.lifecycleEvent(HostConfig.java:311)
        at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1053)
        at org.apache.catalina.core.StandardHost.start(StandardHost.java:719)
        at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
        at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
        at org.apache.catalina.core.StandardService.start(StandardService.java:516)
        at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
        at org.apache.catalina.startup.Catalina.start(Catalina.java:578)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.commons.daemon.support.DaemonLoader.start(DaemonLoader.java:177)
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903AA, comment: AcceptSecurityContext error, data 525, v1771]
        at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3041)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2987)
        at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2789)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2703)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:293)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
        at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
        at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
        at javax.naming.InitialContext.init(InitialContext.java:223)
        at javax.naming.ldap.InitialLdapContext.<init>(InitialLdapContext.java:134)
        at org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl.buildInitialDirContext(LDAPInitialDirContextFactoryImpl.java:101)
        … 58 more
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

we connect to the ad server using port 636.

thanks for help

dward

Please check the parameters

ldap.synchronization.java.naming.security.principal
ldap.synchronization.java.naming.security.credentials

These must be set to a username and password that you can log in to the LDAP directory with.

OpenLDAP example:

ldap.synchronization.java.naming.security.principal=cn\=Manager,dc\=company,dc\=com
ldap.synchronization.java.naming.security.credentials=secret

Active Directory example:

ldap.synchronization.java.naming.security.principal=alfresco@domain
ldap.synchronization.java.naming.security.credentials=secret

fkeller

thanks for the reply, fixed this in just this moment. i forgot to set the @domain in username.

I think the sync process can now login on the ad server but it doesn't sync anything.

12:01:30,058 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
12:01:30,063 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldap1'
12:01:30,316 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldap1'
12:01:30,532 DEBUG [org.alfresco.repo.security.sync.ldap.LDAPUserRegistry] Found 0
12:01:30,537 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
12:01:30,537 INFO  [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
‍‍‍‍‍‍‍‍

this is the output from the logfile. can you please give me a hint where to search to fix this problem? i thing there is an issue withe the sync settings

ldap.synchronization.import.cron=0 0 0 * * ?
ldap.authentication.allowGuestLogin=true
synchronization.synchronizeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.autoCreatePeopleOnLogin=true
ldap.synchronisation.personQuery=objectClass=user
ldap.synchronisation.userIdAttributeName=sAMAccountName
ldap.synchronisation.userFirstNameAttributeName=givenName
ldap.synchronisation.userLastNameAttributeName=sn
ldap.synchronisation.userEmailAttributeName=mail
ldap.synchronisation.import.group.cron=0 2/5 * * * ?
ldap.synchronisation.import.group.clearAllChildren=false
‍‍‍‍‍‍‍‍‍‍‍‍‍

and the settings for searchbase and username

fkeller

so now i get a new message after setting

ldap.synchronization.personQuery=(&(objectclass=user)(!(sAMAccountName=Guest)))
‍‍‍

User returned by user search does not have mandatory user id attribute‍

so i think if this is fixed the sync will be up and running.

here is the setting for userid

ldap.synchronisation.userIdAttributeName=sAMAccountName
‍‍

dward

Please use the default queries which include a bitmask on userAccountControl to only return real users. Or if you insist on excluding the Guest user…

ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(sAMAccountName=Guest))(!(modifyTimestamp<\={0})))

fkeller

i changed the settings, but get the same warn message

User returned by user search does not have mandatory user id attribute‍

thanks for help

dward

It's only a warning message. It wouldn't stop the sync. So it must mean that your query is returning one (bad) result.

Use an ldap browser tool such as the one on http://www.ldapbrowser.com to connect to the directory and work out where the users are, what type they are and the correct value for ldap.synchronization.userSearchBase

fkeller

i have fixed the problem, there was a typo

ldap.synchronization. is the right one, not ldap.synchronisation

thanks for all your help!

but i have one last question. which attributes are supported to sync from ad server? is it possible to sync mobile phone number and addresses too?

big thanks

dward

Currently you would need to override the Spring configuration to expand the list of mapped attributes.

If you copy

%TOMCAT_HOME%\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\common-ldap-context.xml

to the following path (assuming that authentication.chain=ldap1:ldap-ad)

%TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap1\custom-ldap-context.xml

then you can edit the attributeMapping property of the userRegistry bean.

Note this Spring override capability requires that you are using a recent v3.3 nightly build (as it wasn't working in the 3.2 community release).

jriker1

Currently you would need to override the Spring configuration to expand the list of mapped attributes.

If you copy

%TOMCAT_HOME%\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\common-ldap-context.xml

to the following path (assuming that authentication.chain=ldap1:ldap-ad)

%TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap1\custom-ldap-context.xml

then you can edit the attributeMapping property of the userRegistry bean.

Note this Spring override capability requires that you are using a recent v3.3 nightly build (as it wasn't working in the 3.2 community release).

How do you physically get it to use the custom-ldap-context.xml file? The original is under Authentication not in the ldap-ad branch, however that said, should it show in the catalina.out when starting the system?

Thanks.

JR

dward

You just need to put it in the right directory. It automatically includes everything in the appropriate extension directory with a filename *-context.xml.

jriker1

You just need to put it in the right directory. It automatically includes everything in the appropriate extension directory with a filename *-context.xml.

It's working. Cool thanks. For the items in the /alfresco/WEB-INF/classes/alfresco/subsystems/Synchronization/default folder structure, how would you extend those? What is the pathing for like extending the default-synchronization.properties file?

Thanks.

JR

dward

alfresco/extension/subsystems/Synchronization/default/default/anythingyoulike.properties

See

http://wiki.alfresco.com/wiki/Alfresco_Subsystems#Properties

fkeller

iafter all is working fine now, thanks for that, i found one thing which i want to fix. All imported users get the user home created under company home. is there a possibility to configure that the user homes will be created under company home / user homes?

or must i move them by hand by editing the properties of each user?

greets

dward

This was logged and fixed in

https://issues.alfresco.com/jira/browse/ETHREEOH-2535

Just set

ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

Or build the latest code from HEAD.

fkeller

thx for this info.

will implement that. must i move or delete the created homefolders under company home by hand? or will this be done automaticaly?

dward

I'm afraid you'll have to move them manually.

fkeller

okay, i was prepared for that

can i do that within the cifs share? take them all an drag and drop into user homes?

dward

Probably not. Although we think that if you delete the user homes, they will be 'lazily' recreated in the right place on login. Take a backup of your database and alf_data first before you try this out.

fkeller

okay, i've tested the thing with cifs share and its working. take them and drag and drop in user homes

thanks for your help

mrojas73

Can you post your final configurations? It would help the rest of us a lot, I am trying to follow the posts to accomplish synchronization but since there isn't a clear final solution it is taking me a lot of Alfresco restarts…very slow.

Thanks.

mrojas73

Currently you would need to override the Spring configuration to expand the list of mapped attributes.

If you copy

%TOMCAT_HOME%\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\common-ldap-context.xml

to the following path (assuming that authentication.chain=ldap1:ldap-ad)

%TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap1\custom-ldap-context.xml

then you can edit the attributeMapping property of the userRegistry bean.

Note this Spring override capability requires that you are using a recent v3.3 nightly build (as it wasn't working in the 3.2 community release).

I am running the nightly build and I don't have %TOMCAT_HOME%\shared\classes\alfresco\extension\subsystems\Authentication\ldap-ad\ldap1\custom-ldap-context.xml

I guess I can copy the entire directory but I don't know if that will do anything.

Thanks

fkeller

       <property name="attributeMapping">
            <map>
                <entry key="cm:userName">
                    <!– Must match the same attribute as userIdAttributeName –>
                    <value>${ldap.synchronization.userIdAttributeName}</value>
                </entry>
                <entry key="cm:firstName">
                    <!– OpenLDAP: "givenName" –>
                    <!– Active Directory: "givenName" –>
                    <value>${ldap.synchronization.userFirstNameAttributeName}</value>
                </entry>
                <entry key="cm:lastName">
                    <!– OpenLDAP: "sn" –>
                    <!– Active Directory: "sn" –>
                    <value>${ldap.synchronization.userLastNameAttributeName}</value>
                </entry>
                <entry key="cm:email">
                    <!– OpenLDAP: "mail" –>
                    <!– Active Directory: "???" –>
                    <value>${ldap.synchronization.userEmailAttributeName}</value>
                </entry>
                <entry key="cm:organizationId">
                    <!– OpenLDAP: "o" –>
                    <!– Active Directory: "???" –>
                    <value>${ldap.synchronization.userOrganizationalIdAttributeName}</value>
                </entry>

                <entry key="cm:mobile">
                    <value>${ldap.synchronization.userMobileAttributeName}</value>
                </entry>
                <entry key="cm:telephone">
                    <value>${ldap.synchronization.userTelephoneAttributeName}</value>
                </entry>

                <!– Always use the default –>
                <entry key="cm:homeFolderProvider">
                    <null/>
                </entry>
            </map>
        </property>
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

that is what i have in my config, but not all things are working. I also trying to figure out the right keys. The Mobile and Telephone Attribute aren't working for me, the other ones do.

telesforos

Don't you have to modify the ldap-ad-authentication-context.xml file to point to the custom-ldap-context.xml file?