LDAP syncs up 0 users and 0 groups - 3.3g on RHEL 5.5

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

jamied66

I have LDAP working for authentication just fine, but I think my problem w/syncronization now lies in how I'm telling it to query LDAP.  I can see my principal user hitting the LDAP server.  It just feels like I don't quite have the queries right.  If anyone would have a look I'd be extremely grateful:

I have a very simple LDAP tree:

ou=People,dc=mydomain,dc=com — contains users (uid=…)
ou=groups,dc=mydomain,dc=com — contains groups

I have the following set in alfresco:

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(&(objectclass\=groups)(memberOf\=ou\=groups,dc\=mydomain,dc\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groups)(memberOf\=ou\=groups,dc\=mydomain,dc\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=People)(memberOf\=ou\=People,dc\=mydomain,dc\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=People)(memberOf\=ou\=People,dc\=mydomain,dc\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))‍‍‍‍‍‍‍‍‍‍‍‍

I get the following in my startup logs:

16:34:30,806 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldap1'
16:34:30,809 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldap1'
16:34:31,085 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Commencing batch of 0 entries
16:34:31,086 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 Group Analysis: Completed batch of 0 entries
16:34:31,089 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldap1'
16:34:31,102 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Commencing batch of 0 entries
16:34:31,109 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] ldap1 User Creation and Association: Completed batch of 0 entries
16:34:31,109 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldap1'
16:34:31,109 User:System INFO  [security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
16:34:31,122  INFO  [management.subsystems.ChildApplicationContextFactory] Startup of 'Synchronization' subsystem, ID: [Synchronization, default] complete‍‍‍‍‍‍‍‍‍‍

Thanks,

Jamie

dward

An ou is an organizational unit, not a group, so you can't use memberof with it. You restrict the query to an ou using groupSearchBase and userSearchBase.

You need to find out what your group class is. Is it groupOfNames or groupOfUniqueNames?

Then set the following parameters appropriately

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=groups,dc\=mydomain,dc\=com

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=People,dc\=mydomain,dc\=com

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))

# The group type in LDAP
ldap.synchronization.groupType=groupOfNames

# The person type in LDAP
ldap.synchronization.personType=inetOrgPerson