Alfresco + LDAP: Control User Login

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

opnek

Dear all,

I just configured Alfresco to authenticate with LDAP. Everything works pretty well.

In my search-base are about 350 Users.

Now I have the following question:

Is it possible to allow only some users to login into Alfresco? I dont want all of the users to be able to login.

It would be great, if there is a way, that i create an AD-Group and only users who are member of this group are able to login.

Thanks in advance.

Kind Regards
Opnek

nickburch

I can read your question two ways, one of which is fairly easy, one isn't. Do you want to import all users from your AD into Alfresco, but only allow a small number to login but have all of them present in the system? Or do you want to have just a subset of your AD both present in Alfresco and able to log in?

I'm going to guess the latter, as that's what we're doing… As long as you can write an LDAP query that filters the users, you can do the filtering.

There are three main properties you need to tweak. The first one is ldap.synchronization.userSearchBase which controls where in your tree Alfresco starts looking for users. If you're able to put all your users who you want to be able to log in into their own tree, then there's really easy. Set the search base to something like ou=full users,dc=example,dc=com and all the users in ou=other users,dc=example,dc=com won't be synced and won't be able to log in. Simple! But rarely the setup you have

The other way is to use ldap.synchronization.personQuery and ldap.synchronization.personDifferentialQuery. These should be almost the same, with the latter only having a modified time filter on it. Assuming you want to exclude users in your Active Directory who've been marked as Disabled (and you probably do!), your queries would be something like:

ldap.synchronization.personQuery=(&(objectclass\=organizationalPerson)(!(userAccountControl\:1.2.840.113556.1.4.803\:\=2)))
ldap.synchronization.personDifferentialQuery=(&(objectclass\=organizationalPerson)(!(userAccountControl\:1.2.840.113556.1.4.803\:\=2))(!(modifyTimestamp<\={0})))‍‍

If you also want to restrict to just one group, add something like (memberOf="ou=alfresco users,ou=groups,dc=example,dc=com") . Have a play with an ldap query tool (eg ldapsearch or Apache DS client in Eclipse) to fine tune your filter. Oh, and don't forget to escape things like = signs in your properties file!