nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Is an OU mandatory in AD for ldap synchronization?

marcobusetto

Is an Organization Unit (OU) mandatory in Active Directory (AD) for ldap-ad synchronization?

I just configured Alfresco 3.3 to connect to an Active Directory. I'm a newbie in both and one of the firsts problems that I faced was that it seems mandatory the presence of an Organization Unit upstream. If I try to configure the ldap.synchronization.userSearchBase parameter without an OU element (i.e. only "DC\=mylab,DC\=loc") I get a synchronization exception error like "org.alfresco.error.AlfrescoRuntimeException: 04280001 User and group import failed".

I tried to search on this forum for somebody who faced and fixed this issue yet, but the only workaround seems to be the definition of an Organization Unit below wich all users can be found.

Does anybody knows some tip to avoid the adjusting of the AD organization to the Alfresco configuration?

Thanks in advance.

Find more posts tagged with

Comments

joe_m

I'm not an Active Directory expert either but I thought it was normal to split an AD domain into OUs, it eases administration, allows you to define group policies etc. I think it's only normal that Alfresco doesn't allow you to give access to everyone in the domain as you will most probably have different access rights for different OUs.

marcobusetto

I agree with you but I'm afraid it's not so obvious. In case you're installing Alfresco into a pretty complex company that didn't defined any OU but only some groups, I think it's impractical to adjust the AD organization to the Alfresco configuration and not the Alfresco configuration to the AD organization…

ivan_plestina

One reader of
my blog had a similar problem and had found it to be related to http://issues.alfresco.com/jira/browse/ALF-2796?page=com.atlassian.jira.plugin.system.issuetabpanels%3Achangehistory-tabpanel

l2hawk

I am new to Alfresco and confused about the AD authenication intergration. MS AD is a LDAP server which can be easily queried. I don't understand why Alfresco requires a specific OU. Has anyone tried to query for a Group Memebership?
DC=myDomain,DC=com,cn=AlfrescoGroup,ou=User

I have used this type of query in some of my scripts for pulling info from AD. In our org we create an OU for the branch office location, under that we have at least two more Computer and Users. This query should search all of the domain for users in the Users OU that are members of AlfrescoGroup.

Please let me know if this helps anyone.