nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Synchronization questions

jriker1

I have Synchronization kind of working in 3.2. I say kind of because if I hard code a name in for the CN it works fine. Problem and questions:

1. I have fields in AD ADAM for most of the fields in the user form. Is there a way to add additional attributes to pull from AD/ADAM if I have them? An example would be the location field in Alfresco I can map to a field in Adam.

2. Is there a way to limit the system to only pull users in a certain group? Keep in mind I'm in ADAM so only have two branches, Users and Groups. I have 70k people in my company so do not want to pull all users.

3. If I try pulling everyone, it pulls 1000 users only and eventually errors. After that I get error 500's in the browser after trying to login with access denied. It seems to ignore the default admin user in the ldap properties file. I read of an issue with pulling more than 1000 records and it was fixed in 3.2 but perhaps not. I know we can only pull 1000 records so not sure if this is a client limitation or a tool one. After the 1000 I just get a lengthy error in the alfresco log file.

Input would be appreciated.

Thanks.

JR

Find more posts tagged with

Comments

dward

1. Currently this requires you to override the attributeMapping property in Spring configuration in the extension classpath. You would simply add in a mapping for the location field.

2. Yes, modify your query to restrict the set of users it returns. I believe there is a memberof attribute you could use in your query.

3. The latest 3.2 builds use paged results with a preconfigured page size of 1000 so this should not happen. How recent is the build you are using?

jriker1

Thanks for your response. I am currently using 3.2 Build June 2nd I believe was the nightly build date. The 18th one seems incomplete with missing sample files and the sort so had to stop installing that one. Noticed unlike the others, there used to be a dev and non dev labeled build and now just the dev one that is smaller than the old ones.

JR

jriker1

1. Currently this requires you to override the attributeMapping property in Spring configuration in the extension classpath. You would simply add in a mapping for the location field.

2. Yes, modify your query to restrict the set of users it returns. I believe there is a memberof attribute you could use in your query.

3. The latest 3.2 builds use paged results with a preconfigured page size of 1000 so this should not happen. How recent is the build you are using?

jriker1

2. Yes, modify your query to restrict the set of users it returns. I believe there is a memberof attribute you could use in your query.

By the way, if you eliminate the user filter and hard code a single group in the group search base will it populate the system with all users from that group? So if I have an AD group called ALFRESCO and have 10 users in it, when the sync is done will I have 10 users from that group added to Share and have their attributes showing?

Thanks.

JR

dward

The user search is independent from the group search, so you would have to restrict that too.

dward

Which sample files were you missing? Note these are being phased out and replaced by preconfigured subsystems.

jriker1

Not sure the extent, however I know the custom-repository.properties and context.xml files were missing which has always been a big part of configuring the authentication, db settings, rmi info, and defining external executable paths.

JR

gronfelt

The custom-repository files are there in the Linux version, under tomcat/shared/classes/alfresco/extension.

jriker1

The custom-repository files are there in the Linux version, under tomcat/shared/classes/alfresco/extension.

Have you tried the latest version dated June 18th? The only way files get in the folder above you mention is to put the sample files download in there and it is not included in the latest build. Was in the prior, but not the latest nightly. When the war files were extracted, they weren't in there either.

JR

mrogers

As Dave says above, the old way of configuring alfresco has been "phased out".

In 3.2 custom-repository.properties no longer exists.

Dave has updated the Wiki with details already and I see more and more details being added each day.

jriker1

As Dave says above, the old way of configuring alfresco has been "phased out".

In 3.2 custom-repository.properties no longer exists.

Dave has updated the Wiki with details already and I see more and more details being added each day.

Thanks, noticed that the custom-hibernate-dialect.properties file is also missing. Hopefully I can find the necessary details on the Wiki to configure this setting what I set before in these custom files.

Thanks.

JR

mrogers

yes that file has gone too. To be replaced by alfresco-global.properties

http://wiki.alfresco.com/wiki/Database_Configuration

jriker1

yes that file has gone too. To be replaced by alfresco-global.properties

http://wiki.alfresco.com/wiki/Database_Configuration

Thanks a bunch. This is exactly what I needed for the DB stuff. I also used to edit the custom-hibernate-dialect.properties and uncomment the MySQL dialect line

hibernate.dialect=org.hibernate.dialect.MySQLInnoDBDialect

Is this required anymore and exist elsewhere?

Thanks.

JR

Edit: I see it now in the Wiki. Although it doesn't talk about MySQL for some reason which is odd since the download says only use with MySQL for now, Looks like I just add the above dialect into the same file.

jriker1

I was able to get things working with the alfresco-global.properties file, but only in it's original location under webapps/alfresco/WEB-INF/classes. Putting the file under shared/classes/alfresco/extension doesn't seem to be read in. I have installed Tomcat 6, configured the shared.loader path but it's not reading in. Am I missing something? Also I saw the extensions folder with extension/messages/web-extension folders in it. Are those files really needed? Assume some class path in SUSE is missing or something.

JR

fo1337

I was able to get things working with the alfresco-global.properties file, but only in it's original location under webapps/alfresco/WEB-INF/classes. Putting the file under shared/classes/alfresco/extension doesn't seem to be read in. I have installed Tomcat 6, configured the shared.loader path but it's not reading in. Am I missing something? Also I saw the extensions folder with extension/messages/web-extension folders in it. Are those files really needed? Assume some class path in SUSE is missing or something.

JR

Actually I've just started a thread with the same question. http://forums.alfresco.com/en/viewtopic.php?f=9&t=20056. I have no idea why my alfresco-global.properties doesn't get read, and I use Tomcat 5… Help!!!

_sax

To get back to the original topic I'm a bit puzzled if it is possible to sync from several ldap branches (ou).

I use 3.2CE and it works perfectly for one branch
ldap.synchronization.userSearchBase=ou=\_Departments,dc=intranet,dc=ads-users,dc=staff

Now I have another branch of users, that would like to use Alfresco, too.
ldap.synchronization.userSearchBase=ou=\_Global,dc=central,dc=staff

Is it possible, to group them in one line?
Or is this functionality not yet there, as being related to https://issues.alfresco.com/jira/browse/ETHREEOH-1806

dward

jriker1: At no point did we say that alfresco-global.properties belongs under alfresco/extension. You put it directly under $TOMCAT_HOME/shared/classes.

dward

_sax: If your sync can't be expressed as a single query under a single search base, then you could set up a chain in alfresco-global.properties. E.g.:

authentication.chain=ldap1:ldap-ad,ldap2:ldap-ad

… and configure different queries and search bases for each. You set ldap.authentication.active=false for the instance that you don't want to handle authentication.

To configure independent properties for ldap1 and ldap2, you will need to use the extension classpath mechanism described here

http://wiki.alfresco.com/wiki/Alfresco_Subsystems#Properties

and you will need a 3.3 nightly build, as it was broken in the v3.2 community release.

_sax

Thank you.

When looking at http://forums.alfresco.com/en/viewtopic.php?f=9&t=16051&p=52680 it seems to provide another path to solve this. But how would such a query translate from CDATA to the format in alfresco-global.properties?
(& (ou=\_Departments,dc=intranet,dc=ads-users,dc=staff)(ou=\_Global,dc=central,dc=staff)) seems too simple.

If I'd use your approach with a "new" subsystem, I would set up a folder alfresco/subsystems/Authentication/ldap-ad/SomeAdditionalStaff to synchronize a specific branch? In it I would place the corresponding ldap-ad-authentication.properties pointing to the additional users and "register" it within my authentication chain. Are there additional steps to announce it to the system?
But this would take time until the next release to be ready for actual usage in productive systems.

Finally, theres this thread http://forums.alfresco.com/en/viewtopic.php?f=9&t=19239&p=63326 basically adding a trigger. Besides being a not-so-clean approach, would that even work with 3.2?

Thanks for your appreciated help so far.

dward

The first topic you reference makes use of reverse group mapping via the memberof attribute. This is possible on AD, and on Open LDAP if you enable "Reverse Group Membership Maintenance".

http://www.openldap.org/doc/admin24/overlays.html#Reverse%20Group%20Membership%20Maintenance

However, it wouldn't work with your example, where you are trying to use multiple organization units, rather than groups.

I don't know what else you are going on about. Didn't you read the wiki?

To be precise: If you had this in alfresco-global.properties:

authentication.chain=ldap1:ldap-ad,ldap2:ldap-ad

Then you could control the properties of your two LDAP instances in

$TOMCAT_HOME/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1/custom-ldap.properties

and

$TOMCAT_HOME/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap2/custom-ldap.properties

Note the directory names have to match up with the names and types in your authentication chain.

The second topic concerns custom spring configuration that wouldn't be valid in v3.2.

v3.2 enterprise will have all the necessary fixes, but if you want them now, then try out the v3.3 community nightly build.

_sax

Thanks again for taking your time!
What you described related to subsystems was what I expected. I'll give it a try!
Your comments on the other two approach saved me quite some time, thanks.
So now I've got a clear perspective on this topic.
The most recent nightly is dated August 11th and it does look promising.
Is there any timeframe for 3.3CE?

_sax

I proceeded with 3.3dev (August 11th) and following http://wiki.alfresco.com/wiki/Alfresco_Subsystems#Properties I came to this:

authentication.chain=ldapad1:ldap-ad,ldapad2:ldap-ad

Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad
*ldap-ad-authentication.properties - standard values that came preconfigured
*ldap-ad-authentication-context.xml

Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldapad1
*ldap-ad-authentication.properties - my values for one ldap branch

Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldapad2
*ldap-ad-authentication.properties - my values for another ldap branch

I got

14:37:00,016 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldapad1'
14:37:00,017 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Forced synchronization with user registry 'ldapad1'; some users and groups previously created by synchronization with this user registry may be removed.
14:37:00,017 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldapad1'
14:37:00,112 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldapad1'
14:37:00,208 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldapad1'
14:37:00,208 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed
14:37:00,214 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Synchronizing users and groups with user registry 'ldapad2'
14:37:00,214 WARN [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Forced synchronization with user registry 'ldapad2'; some users and groups previously created by synchronization with this user registry may be removed.
14:37:00,214 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all users from user registry 'ldapad2'
14:37:00,298 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Retrieving all groups from user registry 'ldapad2'
14:37:00,358 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] Finished synchronizing users and groups with user registry 'ldapad2'
14:37:00,359 INFO [org.alfresco.repo.security.sync.ChainingUserRegistrySynchronizer] 0 user(s) and 0 group(s) processed

So in an empty installation nothing gets imported.
If I remove the subfolders ldap-adX and set the default ldap-ad-authentication.properties in …/ldap-ad to the values of one branch, all users in that branch get imported.

dward

Please read it more carefully. Why did you use

Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldapad1/ldap-ad-authentication.properties

and

Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad/ldapad2/ldap-ad-authentication.properties

?

That should have been

Alfresco/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldapad1/ldap-ad-authentication.properties

and

Alfresco/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldapad2/ldap-ad-authentication.properties

You should not be editing anything inside Alfresco/tomcat/webapps as this will be lost the next time you upgrade!

_sax

I overlooked that, sorry.
Having finally followed the actual instruction, I don't get further.

With
/Alfresco/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad
ldap-ad-authentication.properties - properties of one ldap-branch

in place and
/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/ldap-ad
ldap-ad-authentication.properties - with standard properties
ldap-ad-authentication-context.xml

the system in the extension area doesn't even get recognized at startup.
If I remove the properties file from the standard location (WEB-INF), Alfresco is not initializing any authentication system:
'Failed initial synchronize with user registries'
If I add the context.xml to the extension area, the situation remains the one described above.
That stays the same when adding the intended subfolders ldapad1 and ldapad2 in extension.

dward

READ VERY CAREFULLY! You still haven't got the extension path right.

_sax

I'm really sorry, I missed to apply the change regarding the id to the authentication chain. RIght now, it finally works!
Thank you for your patience.