Login via email or nickname not username (ldap-ad)

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

erong

Hi,

I am newest in Alfresco. Please help me in step by step.

Environment: Alfresco community edition in Ubuntu 14.04

I can login by username from ldap-ad. But I need to login by email, nickname or other properties.

Here is our AD architecture.

DN = User_Object

   |

   |- CN = Username 1

       |- mail: mail1@gmail.com

       |- nickname: Mary

       |- ...

   |- CN = Username 2

       |- mail: mail@gmail.com

       |- nickname: John

       |- ...

Here is alfresco-global.properties and login by user name. It work for me.

ldap.authentication.userNameFormat=CN=%s,OU=User_Object,OU=organization,DC=domain ldap.synchronization.userIdAttributeName=cn ldap.authentication.java.naming.provider.url=ldap://{$ip}:389 ldap.synchronization.groupSearchBase=OU=Group_Object,OU=organization,DC=domain ldap.synchronization.userSearchBase=OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.principal=CN={$username},OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.credentials={$password} ldap.synchronization.personQuery=(objectClass=*) ...

But I need to login via mail or nickname.

I try some solution as follow, but it can not login via mail/nickname correctly.

ldap.authentication.userNameFormat=%s ldap.synchronization.userIdAttributeName=mail (or nickname) ldap.authentication.java.naming.provider.url=ldap://{$ip}:389 ldap.synchronization.groupSearchBase=OU=Group_Object,OU=organization,DC=domain ldap.synchronization.userSearchBase=OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.principal=CN={$username},OU=User_Object,OU=organization,DC=domain ldap.synchronization.java.naming.security.credentials={$password} ldap.synchronization.personQuery=(objectClass=*) ...

ldap.authentication.userNameFormat=mail=%s,OU=User_Object,OU=organization,DC=domain ldap.synchronization.userIdAttributeName=mail

What exactly am I missing here? Any help would be highly appreciated. Thanks.

afaust

When you configure userNameFormat that must pattern must construct the distinguished name (DN) of the LDAP authority. You cannot use anything you want in there - it must match what your LDAP server is using for DN. There is typically only one unique DN for a user, so userNameFormat cannot be used for a "X OR Y" authentication use case.

Unfortunately, Alfresco only supports authenticating by one specific property against LDAP by default - the userIdAttributeName. When you don't set the userNameFormat than Alfresco will use the person query to lookup a person matching the provided login name against the userIdAttributeName. Since you can only configure one userIdAttributeName this too does not allow a "X OR Y" authentication use case.

Some members of the community have implemented custom solutions for "X OR Y" authentication, typically to support "user ID or email" authentication. I am not aware of a generic solution / approach that allows any number of arbirtrary LDAP attriibutes to be used, though I am generally interested to add such a functionality to one of my modules in the near future (Alfresco MT Support - the initial version adds extended LDAP support for multi-tenancy).