nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

User changes domains help

jriker1

I have a bunch of users that are in Active Directory groups and being added automatically to Alfresco. The way it works:

DomainA group with username jriker DISABLED
DomainB group with username jriker ACTIVE

Both DomainA and DomainB has the same named AD groups and they all are stored in another meta group that I directly reference. Problem I'm having now is when people are moved to DomainB they are able to login still but none of their data is associated with them. How do I tell Alfresco these are the same users or is the problem that the system has not resync'd yet?

Thanks.

JR

Find more posts tagged with

Comments

jriker1

Thought I would revive this as I can't imagine an enterprise application would not be able to accommodate someone switching domains in an organization. Even if it was manually editing the database and updating some UUID or something. Anyone?

Thanks.

JR

afaust

Hello,

it all depends on how your authentication subsystem is set up with regards to the synchronization, and how you manage the identities in your LDAP/AD. We have a customer whose LDAP simply contains all trees of their domains and we have set up one authentication subsystem against this aggregated LDAP - when users change domains and their active flag is updated, the currently active account is considered for synchronisation with Alfresco. As long as the identifying property has the same value, the user is unaltered in Alfresco.

But when you have two or more subsystems configured (one for each domain) you actually cause Alfresco to delete and recreate users when they move, as two users from different subsystems are not considered to be the same individual as long as both subsystems are active.

So:
- ensure users move only between the domains covered by a single subsystem
- ensure user moves are atomic operations (if one account is deactivated and the new one will only be available two days later, you run the risk of the user being deleted in the meantime depending on your synchronisation interval / triggers)
- ensure the identifying property remains exactly the same (although case is probably irrelevant at least for 3.4 and lower)

Regards
Axel