auth against active directoy using ldaps

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

elmuchacho

i found some informations about this by searching this forum and reading the wiki …

I have an ubuntu 8.04 LTS system with running alfresco on it …
Right now it works by using alfresco's local user db

I would like to login to alfresco by using my MS Active Directory credentials.
the ldap-connection is established (ldapsearch works)
now i need to configure the alfresco global properties file:
my 1st try will go like this:

### AUTH against MS-ADS
authentication.chain=passthru1:passthru,ldap1:ldap-ad
ldap.authentication.active=false
passthru.authentication.domain=
passthru.authentication.servers=test\\srv.test.local,srv.test.local
passthru.authentication.defaultAdministratorUserNames=administrator
ldap.authentication.java.naming.provider.url=ldap://srv.test.local:389
ldap.authentication.userNameFormat=%s@test.local
ldap.synchronization.java.naming.security.principal=administrator@test.local
ldap.synchronization.java.naming.security.credentials=verysecret
ldap.synchronization.groupSearchBase=ou=alfresco,dc=test,dc=local
ldap.synchronization.userSearchBase=ou=alfresco,dc=test,dc=local
‍‍‍‍‍‍‍‍‍‍‍‍‍

is this really all, what needs to be configured in alfresco in order to auth against an Win2k3 server with running AD?

after reboot (/etc/init.d/tomcat6 restart wont work) i can login with my AD credentials …
and if changing my passwd in AD, alfresco login uses the new credentials …

but if i create a new user in AD this user can't login to alfresco …

so i need to add the user twice ?! In AD and Alfresco?

rliu

A  couple things you should look at.

1. See how frequent the LDAP synchronization is occurring.
2. Look at your LDAP query as it may be selecting users of a certain group. Also, I'm not sure if the LDAP query detects whether the newly created user must sign in first before the account is activated.