Alfresco and Active Directory authentication

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

bruno_galindro

Hi all,
     I have configured Alfresco 3.2 to search for users in Active Directory base. How the best config I can do to solve these following requirements?

1 - Only users that are within a specific group in a specific OU can access Alfresco. e.g.: cn=alfresco,ou=internal_access,dc=domain,dc=com  <– This means a alfresco group inside internal_access OU

2 - When I delete a user on domain, that user needs to be deleted on afresco too.

3 - When I remove a user from the group, the access of that user to Alfresco must be denided.

4 - The Active Directory user cannot be deleted from Alfresco.

dward

1.

ldap.synchronization.personQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(memberOf=cn=alfresco,ou=internal_access,dc=domain,dc=com))
ldap.synchronization.personDifferentialQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(memberOf=cn=alfresco,ou=internal_access,dc=domain,dc=com)(!(modifyTimestamp<\={0})))

2. That will happen on a nightly basis in the scheduled full sync as long as

synchronization.synchronizeChangesOnly=false

See http://wiki.alfresco.com/wiki/The_Synchronization_Subsystem

3. With the current defaults, that will only happen once sync removes the user from Alfresco. However, with an upcoming check in to HEAD (once we get the all clear to start checking in) you could use the new 'dynamic user ID resolution' feature to ensure that users who are not returned by the person query are not authenticated.

4. So you want the users to remain in Alfresco but not be authenticated when you remove them from the group? In that case you want this. personQuery will be used in authentication only. But unfortunately it won't be possible to delete any users with this configuration.

synchronization.synchronizeChangesOnly=true # No deletions
ldap.synchronization.personQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(memberOf=cn=alfresco,ou=internal_access,dc=domain,dc=com))
ldap.synchronization.personDifferentialQuery=(&(objectclass=user)(userAccountControl:1.2.840.113556.1.4.803:=512)(!(modifyTimestamp<\={0})))
ldap.authentication.userNameFormat=# Leave blank for dynamic user ID resolution coming soon!