LDAP Autenthicating with synchronization

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

tomekszy

Hello, I have a problem with importing values from LDAP server to Alfresco. When new domain user logs in, Alfresco is not registering him with email, name and surname etc, only login. Here is how it is looks like:

In alfresco-global.config I have:

authentication.chain=ldap1:ldap,alfrescoNtlm1:alfrescoNtlm

Here is my ldap-authentication.properties file:

ldap.authentication.userNameFormat=%s@mycompany.local ldap.authentication.java.naming.provider.url=ldap://########## ldap.authentication.defaultAdministratorUserNames=authjs ldap.synchronization.active=true ldap.synchronization.java.naming.security.principal=authjs ldap.synchronization.java.naming.security.credentials=########### ldap.synchronization.groupSearchBase=OU\=Groups,OU\=mycompanyname,DC\=mir,DC\=local ldap.synchronization.userSearchBase=OU\=Accounts,OU\=mycompanyname,DC\=mir,DC\=local ldap.synchronization.userIdAttributeName=sAMAccountName ldap.synchronization.userFirstNameAttributeName=givenName ldap.synchronization.userLastNameAttributeName=sn ldap.synchronization.userEmailAttributeName=mail ldap.synchronization.userOrganizationalIdAttributeName=company

afaust

Is the user in question actually a part of the Account organisation unit? Since you are using ldap.authentication.userNameFormat the LDAP authentication isn't actually looking up and verifying that the user is a part of this unit, so any user from other sub-trees in LDAP can login to but would not get their details synchronized because the synchronization does not find them due to the userSearchBase restriction.

You haven't listed the personQuery in your configuration - that could also cause the details not to be synchronised if the conditions somehow did not match the user in question.

Also - this configuration looks like you are actually using an AD as a LDAP server. Why are you not using the ldap-ad subsystem instead of ldap? The ldap-ad and ldap subsystems have different default personQuery configurations which could result in the last issue I mentioned above.