nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Sync problem (?) with Active Directory

lchoonch

I'm new to Alfresco and just spent the last week configuring Alfresco 3.2. I use AD and I am experiencing a problem with the synchronization with AD. Every time my AD user logs in, Alfresco creates all the users. Is the normal behaviour ? My configuration is

ldap.authentication.active=false
ldap.authentication.defaultAdministratorUserName=admin,Administrator
ldap.authentication.userNameFormat=cn\=%s,cn\=Users,dc\=myhome,dc\=net

ldap.synchronization.active=true
ldap.synchronization.java,naming.security.principal=cn\=Test Admin,cn\=Users,dc\=myhome,dc\=net
ldap.synchronization.java.naming.security.credentials=<some password>
ldap.synchronization.userSearchBase=cn\=Users,dc\=myhome,dc\=net

synchronization.synchronizeChangesOnly=false
synchronization.syncWhenMissingPeopleLogin=true
synchronization.autoCreatePeopleOnLogin=true

Can someone give some suggestions ? Thanks.

Find more posts tagged with

Comments

jbaldo

Maybe you've resolved this by now, but when an unknown user attempts to login and is authenticated, it triggers a sync. Your config is attempting to do a sync at this location:

ldap.synchronization.userSearchBase=cn\=Users,dc\=myhome,dc\=net

I think by default it attempts to add the first 1000 users.

You can narrow the scope by adding a query string which only selects users with certain attributes:

ldap.synchronization.personDifferentialQuery
The query to select objects that represent the users to export that have changed since a certain time. Should use the placeholder {0} in place of a timestamp in the format specified by ldap.synchronization.timestampFormat. The timestamp substituted will be the maximum value of the attribute named by ldap.synchronization.modifyTimestampAttributeName the last time users were queried. This query is used in 'differential sync mode', which by default is triggered whenever a user is successfully authenticated that does not yet exist in Alfresco. See The Synchronization Subsystem.

http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuration_2

lchoonch

thank you I manage to resolve this. It is as you said the ldap syncs on login if the user has not been created. This was not the only problem. Narrowing the sync query AND also excluding the Guest user ( I am using AD ) fixed the problem for me.

dward

FYI it queries in batches of 1000 users at a time but is not restricted to 1000 users. It just uses multiple round-trips to the LDAP server to retrieve the users. This is controlled by:

ldap.synchronization.queryBatchSize