nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

LDAP: Ignoring non-existent member

bostaxola

This is s side by side schema:

[img]http://i60.tinypic.com/2ignlte.png[/img]

I want to filter the access to only members of "cn=****,ou=subjects,ou=groups,dc=domain,dc=com", inside this group members DN is stored in "member" attribute (http://i62.tinypic.com/29ekqp1.png). I've trying since Friday, but I can't sync the members attributes like, mail, name… just the uid. If I try log in with a group non-member user I can't. I have take a look at Active Directory authentication: allow just group of users and other post, but I can't seem to find the right configuration. I hope you can lend me a hand, thank you.

The catalina.out can be found in http://pastebin.com/0et0DVmU (Full sync part is at the end highlighted)

ldap-authentication.properties (/opt/alfresco-5.0.a/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldap1/ldap-authentication.properties)

ldap.authentication.active=true

ldap.authentication.allowGuestLogin=false

ldap.authentication.defaultAdministratorUserNames=admin

ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false

#ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldaps://ldap.domain.com:636
ldap.authentication.java.naming.security.authentication=simple

ldap.authentication.userNameFormat=uid\=%s,ou\=people,dc\=domain,dc\=com

ldap.synchronization.active=true

ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

ldap.synchronization.enableProgressEstimation=true

ldap.synchronization.groupDifferentialQuery=(&(objectclass=groupOfNames)(!(modifyTimestamp<={0})))
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupMemberAttributeName=member
ldap.synchronization.groupQuery=(objectclass=groupOfNames)
ldap.synchronization.groupSearchBase=cn\=****,ou\=subjects,ou\=groups,dc\=domain,dc\=com
ldap.synchronization.groupType=groupOfNames

ldap.synchronization.java.naming.security.authentication=simple
ldap.synchronization.java.naming.security.credentials=******** [real password changed for *]
ldap.synchronization.java.naming.security.principal=uid\=admin,ou\=system,dc\=domain,dc\=com

ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

ldap.synchronization.personDifferentialQuery=(&(cn\=****)(objectClass\=GroupOfNames)(uid\=%s,ou\=people,dc\=domain,dc\=com))!(modifyTimestamp<={0})))
ldap.synchronization.personQuery=(&(cn\=****)(objectClass\=GroupOfNames)(uid\=%s,ou\=people,dc\=domain,dc\=com))
ldap.synchronization.personType=inetOrgPerson

#ldap.synchronization.queryBatchSize=1000

ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userIdAttributeName=uid
ldap.synchronization.userLastNameAttributeName=schacSn1
ldap.synchronization.userOrganizationalIdAttributeName=eduPersonAffiliation
ldap.synchronization.userSearchBase=ou\=people,dc\=domain,dc\=com
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

alfresco-global.properties

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

#Sync Settings
synchronization.synchronizeChangesOnly=false
synchronization.syncOnStartup=true
synchronization.syncWhenMissingPeopleLogIn=true
# Full sync every minute to check only
synchronization.import.cron=0 0/1 * * * ?
‍‍‍‍‍‍‍‍‍‍

Find more posts tagged with

Comments

hgindl

i guess it should be

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=inetOrgPerson)(memberof\=cn\=****,ou\=subjects,ou\=groups,dc\=domain,dc\=com))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(memberof\=cn\=****,ou\=subjects,ou\=groups,dc\=domain,dc\=com)(!(modifyTimestamp<\={0})))
‍‍‍‍‍‍‍

kind regards,
hannes

bostaxola

Thank you for your answer hgindl, but I tried doing it that way and the result was the same "Ignoring non-existent member". With (&(objectclass\=inetOrgPerson)(memberof\=cn\=****,ou\=subjects,ou\=groups,dc\=domain,dc\=com)), ldapsearch returns nothing, with "(&(cn\=****)(objectClass\=GroupOfNames)(uid\=%s,ou\=people,dc\=domain,dc\=com)) returns the group's: dn, cn, members, owners, objectClass, description and seeAlso.