nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

LDAP Authentication For Sites

lchildress

I am a complete novice to Alfresco so bare with me! I have authentication working through Active Directory. I want to create individual sites for our various departments (I am with a government entity) and allow them access to the site based on their group membership in Active Directory. This question, I am sure, has been posted and answered already but I looked through the forum and was unable to find an answer.

Thank you in advance for either giving me some instruction, or pointing me to a link where this has already been answered.

Find more posts tagged with

Comments

borisstankov

Hello there,

First thing you need is the synchronization subsystem enabled and working properly in order Alfresco to take all groups and other important properties from your users' profiles.
For synchronization you need something like:

synchronization.syncOnStartup=true
synchronization.allowDeletions=true
synchronization.sinchronyzeChangesOnly=true
synchronization.syncWhenMissingPeopleLogIn=true
synchronization.import.cron=0 0 * * * ?

ldap.synchronization.active=true
ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.principal=AlfrescoService@doamin.com
ldap.synchronization.java.naming.security.credentials=YourPasswordForAlfrescoAccountInAD
#ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))
#ldap.synchronization.personDifferentialQuery=(objectclass\=*)
ldap.synchronization.groupSearchBase=ou=4,ou=3,dc=domain,dc=com
ldap.synchronization.userSearchBase=ou=1,ou=2,dc=domain,dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user
ldap.synchronization.enableProgressEstimation=true


ldap.authentication.defaultAdministratorUserNames=admin
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

After that you need to build you folder structure and Manage the Permissions for each folder –> disable the Inherite Permission button (so that no permission will be inherited from the mother folder), then add some groups to the have access to this folder - the button is right next to the Inherite one. Keep in mind that all subfolder will have this "inharite permission" enabled by default, so if you want to have more deeper folder structure then you need to go through them too.

Let me know how this sounds to you and you have any further questions.

Cheers!

lchildress

Your settings were very similar to mine, but I erased mine and used yours, keeping my active directory authentication settings. I am able to authenticate through Active Directory but cannot get synchronization to work at all. Additionally, my configuration will fail and the website will not load if I have ldap.synchronization.active=true in the configuration. If I comment out that line, the site will load and I can authenticate, but no synchronization. My config is as follows:

### LDAP Authentication ###
synchronization.syncOnStartup=true

synchronization.allowDeletions=true

synchronization.sinchronyzeChangesOnly=true

synchronization.syncWhenMissingPeopleLogIn=true

synchronization.import.cron=0 0 * * * ?

ldap.authentication.active=true

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad

ntlm.authentication.sso.enabled=true

ldap.authentication.allowGuestLogin=false

ldap.authentication.userNameFormat=%s@some-very-not-so-famous-organization.com

ldap.authentication.java.naming.provider.url=ldap://some-very-not-so-famous-organization.com:389

#ldap.synchronization.active=true

ldap.synchronization.java.naming.security.authentication=simple

ldap.synchronization.java.naming.security.principal=ldap@some-very-not-so-famous-organization.com

ldap.synchronization.java.naming.security.credentials=insert-incredible-password-here

ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))

ldap.synchronization.personDifferentialQuery=(objectclass\=*)

ldap.synchronization.groupSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.userSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName

ldap.synchronization.userFirstNameAttributeName=givenName

ldap.synchronization.userLastNameAttributeName=sn

ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user

ldap.synchronization.enableProgressEstimation=true

ldap.authentication.defaultAdministratorUserNames=admin

borisstankov

Hello there,

OK, that looks good, but in order to load your ldap-ad authentication you need to put this line first just after the "synchronization.import.cron":

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
‍‍‍

Second, you need to follow after that with:

ntlm.authentication.sso.enabled=false
‍‍‍

NOTE: it needs to be equals to "false". You can check this if you go through those potics in here: http://docs.alfresco.com/community/concepts/auth-ldap-intro.html

Also you need to put after those two parameters the parameter where you tells your alfresco that the ldap-ad authenticate is enabled:

ldap.authentication.active=true‍

Along with it put all params that include the ldap.authentication.

After that enable the ldap.synchronization. Uncomment the "ldap.synchronization.active" param.

Check like that and let me know if it works.

Cheers!

lchildress

First off, let me say THANK YOU, Boris. I did not expect someone to assist me like you have been willing and I want you to know I truly am appreciative. I made the changes you suggested, and show them below. However, when I enter the url to Alfresco, the site crashes. If I comment out ldap.syncronization.active=true, the site works and I am able to authenticate, but obviously nothing synchronizes.

synchronization.syncOnStartup=true

synchronization.allowDeletions=true

synchronization.sinchronyzeChangesOnly=true

synchronization.syncWhenMissingPeopleLogIn=true

synchronization.import.cron=0 0 * * * ?

authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad
ntlm.authentication.sso.enabled=false
ldap.authentication.active=true

ldap.authentication.userNameFormat=%s@some-very-not-so-famous-organization.com

ldap.authentication.java.naming.provider.url=ldap://dc-adcen.some-very-not-so-famous-organization.com:389

#ldap.synchronization.active=true

ldap.synchronization.java.naming.security.authentication=simple

ldap.synchronization.java.naming.security.principal=ldap@some-very-not-so-famous-organization.org

ldap.synchronization.java.naming.security.credentials=insert-incredible-password-here

ldap.synchronization.personQuery=(&(objectclass\=person)(objectClass\=user))

ldap.synchronization.personDifferentialQuery=(objectclass\=*)

ldap.synchronization.groupSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.userSearchBase=ou=Users - Internal,dc=some-very-not-so-famous-organization,dc=com

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

ldap.synchronization.userIdAttributeName=sAMAccountName

ldap.synchronization.userFirstNameAttributeName=givenName

ldap.synchronization.userLastNameAttributeName=sn

ldap.synchronization.userEmailAttributeName=mail

ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider

ldap.synchronization.personType=user

ldap.synchronization.enableProgressEstimation=true

ldap.authentication.defaultAdministratorUserNames=admin

borisstankov

There is no problem about it. I had a long time that I had some similar problems and I spent a lot of time in internet and doing tests before I made my configuration work fine.
Hmm this is interesting problem. Do you have any error messages in catalina.out log file located in /pathto/youralfresco/tomcat/logs/catalina.out during the same time when you try to open the site? Also what happens in the browser?

lchildress

I fixed a typo: synchronization.sinchronyzeChangesOnly=true => synchronization.synchronizeChangesOnly=true. After making that change, I no longer have to comment out ldap.synchronization.active=true. The site loads now with that line active. HOWEVER, nothing is imported from Active Directory. <sigh>

borisstankov

Ok, that's good and sorry about the typo…

What are the messages in the catalina log about the synchronization subsystem when you restart/start the alfresco service?

Do you have network connection between Alfresco and the ldap on port 389?
Do you see any entries on the LDAP server from the Alfresco?