allow subset users from to login

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

kossel

Hi

I'm using alfresco 4.0.e with active directory.
I have a AD structure like this:

DC

—Departments
——Management
——HR
——Engineering
—Machines
—System Users
—–ldap_admin
—–dns_admin
—Users
——Alfresco Users
‍‍‍‍‍‍‍‍‍‍‍

Since I just want ppl under ou=departments to use alfresco so I create a "security group" in AD call Alfresco Users which has member all people inside ou=departments.

my config for sync is

ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectClass\=user)(memberOf\=CN=Alfresco Users,CN\=Users,DC\=domain,DC\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(&(objectClass\=user)(memberOf\=CN\=Alfresco Users,CN\=Users,DC\=domain,DC\=com)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupSearchBase=CN\=users,DC\=domain,DC\=com
ldap.synchronization.userSearchBase=ou\=Departments,DC\=domain,DC\=com‍‍‍‍‍‍‍

But I don't know what am I missing because I still can login with user: dns_admin pass: pass_of_dns_admin or ldap_admin
and if I remove someone inside ou=Departments from the group of Alfresco Users, he still can login into alfresco 😕

I also used ldap tools (ldp.exe) and the personQuery indeed returns the list of users who I wanted to have alfresco access 😕

please advice

kossel

Update:

I came back to office today, and everything seems oks… those users I removed from the Alfresco users groups can't not longer login, and neither those system users.. seems the schedule sync did the job.

now I m wondering if it's possible to make "remove from groups" has effect sooner and not wait to full sync at night?