nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

(SOLUCIONADO)Problema alfresco v3 contra ldap

brouco

Hola tengo el siquiente problema intentento que alfresco loguee contra el ldap:

Mi fichero ldap-authentication.properties esta de la siguiente manera:

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s

ldap.authentication.userNameFormat=uid=%s,OU=People,DC=dominio,DC=loc

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://x.x.x.x:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=admin,dc=dominio,dc=loc


# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secreto

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

He modificado tambien los ficheros chaining-authentication-context.xml ldap-authentication-context.xml ldap-synchronisation-context.xml tal cual se indinca en la documentación oficial, pero al desplegarlo el log me devuelve lso siguientes errores:

17:24:07,722 INFO  [STDOUT] 17:24:07,716  WARN  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server supports anonymous bind ldap://172.20.36.8:389
17:24:07,760 INFO  [STDOUT] 17:24:07,760  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not support simple string user ids and invalid credentia ls at ldap://172.20.36.8:389
17:24:07,771 INFO  [STDOUT] 17:24:07,771  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and pass word at ldap://172.20.36.8:389
17:24:07,796 INFO  [STDOUT] 17:24:07,796  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and  invalid credentials at ldap://172.20.36.8:389
‍‍‍‍‍

Un saludo y gracias de antemano

Find more posts tagged with

Comments

pjcaracuel_2349

Buenas,

Te pongo post relacionados con tu error:
http://forums.alfresco.com/en/viewtopic.php?f=9&t=17255
http://forums.alfresco.com/en/viewtopic.php?f=9&t=18124
http://forums.alfresco.com/en/viewtopic.php?f=9&t=4851

Si no encuentras en ellos la solucion ya seguimos mirando mas.

SAludos

brouco

Hola bueno lo primero darte las gracias por contestar.

Sigo teniendo el mismo problema he echo las configuraciones tal cual aparecen en los post que me enviaste no se donde puede estar el problema.
Puede ser que por tener mal esos fichero no me cargue alfresco??
Por que si elimino los fichero referente a la autenticación contra ldap si que me carga pero con ellos me peta en el despliegue.

Un saludo y gracias

pjcaracuel_2349

oki,
puedes poner completo el contenido de alfresco.log?

Gracias

brouco

Tenia un fichero xml mal configurado ahora ya me carga la aplicacion solo que cuando me intento loguear con usuario del ldap me devuelve lo siguiente

javax.faces.FacesException: Error calling action method of component with id loginForm:submit
caused by:
javax.faces.el.EvaluationException: Exception while invoking expression #{LoginBean.login}
caused by:
java.lang.NullPointerException

y no puedo loguearme el contenido del alfresco.log es el siguiente

08:56:21,742 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
09:04:56,286 ERROR [org.alfresco.repo.content.transform.magick.AbstractImageMagickContentTransformer] ImageMagickContentTransformer not available: Failed to perform ImageMagick transformation:
Execution result:
   os:         Linux
   command:    [./ImageMagick/bin/convert, /tmp/Alfresco/ImageMagickContentTransformer_init_source_1163725250571530281.gif, /tmp/Alfresco/ImageMagickContentTransformer_init_target_1079669312844360231.png]
   succeeded:  false
   exit code:  1
   out:
   err:        Cannot run program "./ImageMagick/bin/convert": java.io.IOException: error=2, No such file or directory
09:04:59,768 INFO  [org.alfresco.config.xml.XMLConfigService$PropertyConfigurer] Loading properties file from class path resource [alfresco/file-servers.properties]
09:05:03,799 DEBUG [org.alfresco.repo.security.authentication.ldap] preRegister called. Server=org.jboss.mx.server.MBeanServerImpl@e45076[ defaultDomain='jboss' ], name=log4j:logger=org.alfresco.repo.security.authentication.ldap
09:05:11,943 ERROR [org.alfresco.repo.content.transform.RuntimeExecutableContentTransformer] Failed to start a runtime executable content transformer:
Execution result:
   os:         Linux
   command:    [./bin/pdf2swf, -V]
   succeeded:  false
   exit code:  1
   out:
   err:        Cannot run program "./bin/pdf2swf": java.io.IOException: error=2, No such file or directory
09:05:13,412 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://172.20.36.8:389
09:05:13,432 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://172.20.36.8:389
09:05:13,449 INFO  [org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://172.20.36.8:389
09:05:35,672 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.MySQLInnoDBDialect.
09:05:36,752 INFO  [org.alfresco.repo.domain.schema.SchemaBootstrap] No changes were made to the schema.
09:05:40,401 WARN  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco 'dir.root' property is set to a relative path './alf_data'.  'dir.root' should be overridden to point to a specific folder.
09:05:40,402 INFO  [org.alfresco.repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: ./alf_data
09:05:40,522 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] Checking for patches to apply …
09:05:41,244 INFO  [org.alfresco.repo.admin.patch.PatchExecuter] No patches were required.
09:05:41,257 INFO  [org.alfresco.repo.module.ModuleServiceImpl] Found 0 module(s).
09:05:46,576 ERROR [org.alfresco.smb.protocol] Failed to get local domain/workgroup name, using default of WORKGROUP
09:05:46,577 ERROR [org.alfresco.smb.protocol] (This may be due to firewall settings or incorrect <broadcast> setting)
09:05:47,047 WARN  [org.alfresco.util.OpenOfficeConnectionTester] An initial OpenOffice connection could not be established.
09:05:47,115 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_13-b03; maximum heap size 506,313MB
09:05:47,117 INFO  [org.alfresco.service.descriptor.DescriptorService] Alfresco started (Labs): Current version 3.0.0 (Stable 1526) schema 1002 - Installed version 3.0.0 (Stable 1526) schema 1002
09:06:34,223 INFO  [org.alfresco.web.site.FrameworkHelper] Successfully Initialized Web Framework
09:07:23,546 ERROR [org.apache.myfaces.shared_impl.config.MyfacesConfig] Both MyFaces and the RI are on your classpath. Please make sure to use only one of the two JSF-implementations.

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Lo de los dos programas es por que aun no los tengo instalados.

Muchas gracias por tu ayuda

brouco

Ahora parece que no me da errores al loguearme solo que cada vez que me intento loguear con un usario del ldap no hace nada tan solo te devuelve contraseña o nombre de usuario incorrecto. En log no aparece nada lo unico cuando despliegas alfresco aparece esto pero no se si es por culpa de eso??

10:00:56,722 INFO  [STDOUT] 10:00:56,722  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://172.20.36.8:389
10:00:56,747 INFO  [STDOUT] 10:00:56,745  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://172.20.36.8:389
10:00:56,770 INFO  [STDOUT] 10:00:56,759  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://172.20.36.8:389
‍‍‍‍

pjcaracuel_2349

Uhmmm, a ver, intenta deshabilitar el usuario guest, para ello en el fichero authentication-services-context.xml

<property name="allowGuestLogin">
<value>true</value>
</property>

Por el valor false, reinicias y nos dices que tal. Si persiste el error, postea el nuevo contenido de alfresco.log

Saludos

brouco

Nada seguimos con el mismo error y sin poder autenticar usuarios de ldap

pjcaracuel_2349

A ver si con este post lo consigues arreglar
http://forums.alfresco.com/en/viewtopic.php?f=9&t=15596

Por otro lado, con que nombre te autenticas contra el ldap? username o nombre largo?

Saludos

brouco

Autentico con username

pjcaracuel_2349

Prueba a hacerlo con el nombre largo

Saludos

brouco

Nada esto no da tirado tu conseguiste que autenticase contra el ldap??

Este es mi log

11:17:49,237 INFO  [TomcatDeployer] deploy, ctxPath=/alfresco, warUrl=…/deploy/alfresco.war/
11:17:55,271 INFO  [[/alfresco]] Set web app root system property: 'webapp.root' = [/home/jboss/jboss-4.2.2.GA/server/default/./deploy/alfresco.war/]
11:17:55,313 INFO  [[/alfresco]] Initializing Spring root WebApplicationContext
11:18:37,276 INFO  [STDOUT] 11:18:37,273  INFO  [config.xml.XMLConfigService$PropertyConfigurer] Loading properties file from class path resource [alfresco/file-servers.properties]
11:18:41,805 INFO  [STDOUT] 11:18:41,805  DEBUG [security.authentication.ldap] preRegister called. Server=org.jboss.mx.server.MBeanServerImpl@121ab80[ defaultDomain='jboss' ], name=log4j:logger=org.alfresco.repo.security.authentication.ldap
11:18:51,695 INFO  [STDOUT] 11:18:51,694  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a string uid and password at ldap://172.20.36.8:389
11:18:51,738 INFO  [STDOUT] 11:18:51,737  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for a simple dn and password at ldap://172.20.36.8:389
11:18:51,772 INFO  [STDOUT] 11:18:51,760  INFO  [authentication.ldap.LDAPInitialDirContextFactoryImpl] LDAP server does not fall back to anonymous bind for known principal and invalid credentials at ldap://172.20.36.8:389
11:19:13,609 INFO  [STDOUT] 11:19:13,609  INFO  [domain.schema.SchemaBootstrap] Schema managed by database dialect org.hibernate.dialect.MySQLInnoDBDialect.
11:19:14,704 INFO  [STDOUT] 11:19:14,703  INFO  [domain.schema.SchemaBootstrap] No changes were made to the schema.
11:19:18,205 INFO  [STDOUT] 11:19:18,204 User:System WARN  [repo.admin.ConfigurationChecker] The Alfresco 'dir.root' property is set to a relative path './alf_data'.  'dir.root' should be overridden to point to a specific folder.
11:19:18,205 INFO  [STDOUT] 11:19:18,205 User:System INFO  [repo.admin.ConfigurationChecker] The Alfresco root data directory ('dir.root') is: ./alf_data
11:19:18,275 INFO  [STDOUT] 11:19:18,274 User:System INFO  [admin.patch.PatchExecuter] Checking for patches to apply …
11:19:18,955 INFO  [STDOUT] 11:19:18,955 User:System INFO  [admin.patch.PatchExecuter] No patches were required.
11:19:18,964 INFO  [STDOUT] 11:19:18,964 User:System INFO  [repo.module.ModuleServiceImpl] Found 0 module(s).
11:19:24,229 INFO  [STDOUT] 11:19:24,229 User:System ERROR [alfresco.smb.protocol] Failed to get local domain/workgroup name, using default of WORKGROUP
11:19:24,230 INFO  [STDOUT] 11:19:24,229 User:System ERROR [alfresco.smb.protocol] (This may be due to firewall settings or incorrect <broadcast> setting)
11:19:24,713 INFO  [STDOUT] 11:19:24,713 User:System WARN  [alfresco.util.OpenOfficeConnectionTester] An initial OpenOffice connection could not be established.
11:19:24,780 INFO  [STDOUT] 11:19:24,780 User:System INFO  [service.descriptor.DescriptorService] Alfresco JVM - v1.6.0_13-b03; maximum heap size 506,313MB
11:19:24,782 INFO  [STDOUT] 11:19:24,781 User:System INFO  [service.descriptor.DescriptorService] Alfresco started (Labs): Current version 3.0.0 (Stable 1526) schema 1002 - Installed version 3.0.0 (Stable 1526) schema 1002
11:20:02,580 INFO  [TomcatDeployer] deploy, ctxPath=/jmx-console, warUrl=…/deploy/jmx-console.war/
11:20:02,828 INFO  [TomcatDeployer] deploy, ctxPath=/share, warUrl=…/deploy/share.war/
11:20:05,903 WARN  [JBossJSFConfigureListener] MyFaces JSF implementation found!  This version of JBoss AS ships with the java.net implementation of JSF.  There are known issues when mixing JSF implementations.  This warning does not apply to MyFaces component libraries such as Tomahawk.  However, myfaces-impl.jar and myfaces-api.jar should not be used without disabling the built-in JSF implementation.  See the JBoss wiki for more details.
11:20:05,956 INFO  [[/share]] Initializing Spring root WebApplicationContext

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

pjcaracuel_2349

Si claro, por eso te lo decia, solo que yo tengo la version 2.2.3 Enterprise.

Mira este post dicen que lo resuelven pero claro conestas cosas nunca se sabe
http://forums.alfresco.com/en/viewtopic.php?f=9&t=14741

Saludos

brouco

Al fin ya consegui que autentique contra el ldap muchisimas gracias tio.
Lo malo es que ahora no puedo loguearme con admin/admin

pjcaracuel_2349

Pos vamos a ver,

Postea el contenido de todos los ficheros que has modificado para la autenticacion ldap, a ver si asi vemos algo.

Saludos

brouco

ldap-authentication.properties

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

# How to map the user id entered by the user to taht passed through to LDAP
# - simple
#    - this must be a DN and would be something like
#      CN=%s,DC=company,DC=com
# - digest
#    - usually pass through what is entered
#      %s

/bin/bash: indent: command not found

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://secreto:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=SIMPLE

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=admin,dc=secreto,dc=loc


# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=secreto


# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
~
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ldap-authentication-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

   <!– The main configuration has moved into a properties file –>

    <bean name="ldapAuthenticationPlaceholderConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
        <property name="ignoreUnresolvablePlaceholders">
            <value>true</value>
        </property>
        <property name="locations">
            <value>classpath:alfresco/extension/ldap-authentication.properties</value>
        </property>
    </bean>

    <!– DAO that rejects changes - LDAP is read only at the moment. It does allow users to be deleted with out warnings from the UI. –>

    <bean name="authenticationDao" class="org.alfresco.repo.security.authentication.DefaultMutableAuthenticationDao" >
        <property name="allowDeleteUser">
            <value>true</value>
        </property>
    </bean>


    <!– LDAP authentication configuration –>

    <!–

    You can also use JAAS authentication for Kerberos against Active Directory or NTLM if you also require single sign on from the
    web browser. You do not have to use LDAP authentication to synchronise groups and users from an LDAP store if it supports other
    authentication routes, like Active Directory.

    –>

    <bean id="authenticationComponent"
          class="org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl"
          parent="authenticationComponentBase">
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapInitialDirContextFactory"/>
        </property>
        <property name="userNameFormat">
            <!–

            This maps between what the user types in and what is passed through to the underlying LDAP authentication.

            "%s" - the user id is passed through without modification.
            Used for LDAP authentication such as DIGEST-MD5, anything that is not "simple".
  "cn=%s,ou=London,dc=company,dc=com" - If the user types in "Joe Bloggs" the authenticate as "cn=Joe Bloggs,ou=London,dc=company,dc=com"
            Usually for simple authentication. Simple authentication always uses the DN for the user.

            –>
            <value>${ldap.authentication.userNameFormat}</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService" />
        </property>
        <property name="personService">
            <ref bean="personService" />
        </property>
        <property name="transactionService">
            <ref bean="transactionService" />
        </property>
        <property name="escapeCommasInBind">
            <value>${ldap.authentication.escapeCommasInBind}</value>
        </property>
        <property name="escapeCommasInUid">
            <value>${ldap.authentication.escapeCommasInUid}</value>
        </property>
    </bean>

    <!–

    This bean is used to support general LDAP authentication. It is also used to provide read only access to users and groups
    to pull them out of the LDAP reopsitory

    –>

    <bean id="ldapInitialDirContextFactory" class="org.alfresco.repo.security.authentication.ldap.LDAPInitialDirContextFactoryImpl">
        <property name="initialDirContextEnvironment">
            <map>
                <!– The LDAP provider –>
                <entry key="java.naming.factory.initial">
                    <value>${ldap.authentication.java.naming.factory.initial}</value>
                </entry>

                <!– The url to the LDAP server –>
                <!– Note you can use space separated urls - they will be tried in turn until one works –>
                <!– This could be used to authenticate against one or more ldap servers (you will not know which one ….) –>
                <entry key="java.naming.provider.url">
                    <value>${ldap.authentication.java.naming.provider.url}</value>
                </entry>

                <!– The authentication mechanism to use      –>
                <!– Some sasl authentication mechanisms may require a realm to be set –>
                <!–                java.naming.security.sasl.realm –>
                <!– The available options will depend on your LDAP provider –>

 <entry key="java.naming.security.authentication">
                    <value>${ldap.authentication.java.naming.security.authentication}</value>
                </entry>

                <!– The id of a user who can read group and user information –>
                <!– This does not go through the pattern substitution defined above and is used "as is" –>
                <entry key="java.naming.security.principal">
                    <value>${ldap.authentication.java.naming.security.principal}</value>
                </entry>

                <!– The password for the user defined above –>
                <entry key="java.naming.security.credentials">
                    <value>${ldap.authentication.java.naming.security.credentials}</value>
                </entry>
            </map>
        </property>
    </bean>

</beans>


‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ldap-syncronization.properties

#
# This properties file is used to configure LDAP syncronisation
#

# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
ldap.synchronisation.personSearchBase=ou=People,dc=secreto,dc=loc

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfNames)

# The search base to use to find group objects
ldap.synchronisation.groupSearchBase=dc=secreto,dc=loc

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronisation.groupType=groupOfNames

# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=member

# The cron expression defining when people imports should take place
ldap.synchronisation.import.person.cron=0 0 * * * ?
# The cron expression defining when group imports should take place
ldap.synchronisation.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

ldap-syncronization-context.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans.dtd'>

<beans>

        <bean name="ldapSynchronisationPlaceholderConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
            <property name="ignoreUnresolvablePlaceholders">
            <value>true</value>
        </property>
        <property name="locations">
            <value>classpath:alfresco/extension/ldap-synchronisation.properties</value>
        </property>
    </bean>

    <!–
                Wire up the same context as used for LDAP authentication. You could use another context: just replace this
                 alias with the bean definition
    –>

    <alias alias="ldapSyncInitialDirContextFactory" name="ldapInitialDirContextFactory"/>

    <!– Ldap Syncronisation support –>

    <!–

    There can be more than one stack of beans that import users or groups. For example, it may be easier
    to have a version of ldapPeopleExportSource, and associated beans, for each sub-tree of your ldap directory
    from which you want to import users. You could then limit users to be imported from two or more sub tress and ignore
    users found else where. The same applies to the import of groups.

    The defaults shown below are for OpenLDAP.

    –>


    <!– Extract user information from LDAP and transform this to XML –>

    <bean id="ldapPeopleExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPPersonExportSource">
        <!–
        The query to select objects that represent the users to import.

        For Open LDAP, using a basic schema, the following is probably what you want:
        (objectclass=inetOrgPerson)

        For Active Directory:
        (objectclass=user)
        –>
        <property name="personQuery">
            <value>${ldap.synchronisation.personQuery}</value>
 </property>

        <!–
        The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
        –>
        <property name="searchBase">
            <value>${ldap.synchronisation.personSearchBase}</value>
        </property>

        <!–
        The unique identifier for the user.

        THIS MUST MATCH WHAT THE USER TYPES IN AT THE LOGIN PROMPT

        For simple LDAP authentication this is likely to be "cn" or, less friendly, "distinguishedName"

        In OpenLDAP, using other authentication mechanisms "uid", but this depends on how you map
        from the id in the LDAP authentication request to search for the inetOrgPerson against which
        to authenticate.

        In Active Directory this is most likely to be "sAMAccountName"

        This property is mandatory and must appear on all users found by the query defined above.

        –>
        <property name="userIdAttributeName">
            <value>${ldap.synchronisation.userIdAttributeName}</value>
        </property>

        <!– Services –>
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapSyncInitialDirContextFactory"/>
        </property>
        <property name="personService">
            <ref bean="personService"></ref>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property>

        <!–
        This property defines a mapping between attributes held on LDAP user objects and
        the properties of user objects held in the repository. The key is the QName of an attribute in
        the repository, the value is the attribute name from the user/inetOrgPerson/.. object in the
        LDAP repository.
        –>
        <property name="attributeMapping">
            <map>
                <entry key="cm:userName">
   <!– Must match the same attribute as userIdAttributeName –>
                    <value>${ldap.synchronisation.userIdAttributeName}</value>
                </entry>
                <entry key="cm:firstName">
                    <!– OpenLDAP: "givenName" –>
                    <!– Active Directory: "givenName" –>
                    <value>${ldap.synchronisation.userFirstNameAttributeName}</value>
                </entry>
                <entry key="cm:lastName">
                    <!– OpenLDAP: "sn" –>
                    <!– Active Directory: "sn" –>
                    <value>${ldap.synchronisation.userLastNameAttributeName}</value>
                </entry>
                <entry key="cm:email">
                    <!– OpenLDAP: "mail" –>
                    <!– Active Directory: "???" –>
                    <value>${ldap.synchronisation.userEmailAttributeName}</value>
                </entry>
                <entry key="cm:organizationId">
                    <!– OpenLDAP: "o" –>
                    <!– Active Directory: "???" –>
                    <value>${ldap.synchronisation.userOrganizationalIdAttributeName}</value>
                </entry>
                <!– Always use the default –>
                <entry key="cm:homeFolderProvider">
                    <null/>
                </entry>
            </map>
        </property>
        <!– Set a default home folder provider –>
        <!– Defaults only apply for values above –>
        <property name="attributeDefaults">
            <map>
                <entry key="cm:homeFolderProvider">
                    <value>${ldap.synchronisation.defaultHomeFolderProvider}</value>
                </entry>
            </map>
        </property>
    </bean>

    <!– Extract group information from LDAP and transform this to XML –>

    <bean id="ldapGroupExportSource" class="org.alfresco.repo.security.authentication.ldap.LDAPGroupExportSource">
        <!–
        The query to select objects that represent the groups to import.

        For Open LDAP, using a basic schema, the following is probably what you want:
        (objectclass=groupOfNames)
For Active Directory:
        (objectclass=group)
        –>
        <property name="groupQuery">
            <value>${ldap.synchronisation.groupQuery}</value>
        </property>

        <!–
        The seach base restricts the LDAP query to a sub section of tree on the LDAP server.
        –>
        <property name="searchBase">
            <value>${ldap.synchronisation.groupSearchBase}</value>
        </property>

        <!–
        The unique identifier for the user. This must match the userIdAttributeName on the ldapPeopleExportSource bean above.
        –>
        <property name="userIdAttributeName">
            <value>${ldap.synchronisation.userIdAttributeName}</value>
        </property>

        <!–
        An attribute that is a unique identifier for each group found.
        This is also the name of the group with the current group implementation.
        This is mandatory for any groups found.

        OpenLDAP: "cn" as it is mandatory on groupOfNames
        Active Directory: "cn"

        –>
        <property name="groupIdAttributeName">
            <value>${ldap.synchronisation.groupIdAttributeName}</value>
        </property>

        <!–
        The objectClass attribute for group members.
        For each member of a group, the distinguished name is given.
        The object is looked up by its DN. If the object is of this class it is treated as a group.
        –>
        <property name="groupType">
            <value>${ldap.synchronisation.groupType}</value>
        </property>

        <!–
        The objectClass attribute for person members.
        For each member of a group, the distinguished name is given.
        The object is looked up by its DN. If the object is of this class it is treated as a person.
        –>
        <property name="personType">

  <value>${ldap.synchronisation.personType}</value>
        </property>
        <property name="LDAPInitialDirContextFactory">
            <ref bean="ldapSyncInitialDirContextFactory"/>
        </property>
        <property name="namespaceService">
            <ref bean="namespaceService"/>
        </property>

        <!–
        The repeating attribute on group objects (found by query or as sub groups)
        used to define membership of the group. This is assumed to hold distinguished names of
        other groups or users/people; the above types are used to determine this.

        OpenLDAP: "member" as it is mandatory on groupOfNames
        Active Directory: "member"

        –>
        <property name="memberAttribute">
            <value>${ldap.synchronisation.groupMemberAttributeName}</value>
        </property>

        <property name="authorityDAO">
            <ref bean="authorityDAO"/>
        </property>
    </bean>

    <!– Job definitions to import LDAP people and groups –>
    <!– The triggers register themselves with the scheduler –>
    <!– You may comment in the default scheduler to enable these triggers –>
    <!– If a cron base trigger is what you want seee scheduled-jobs-context.xml for examples. –>

    <!– Trigger to load poeple –>
    <!– Note you can have more than one initial (context, trigger, import job and export source) set –>
    <!– This would allow you to load people from more than one ldap store –>

    <bean id="ldapPeopleTrigger" class="org.alfresco.util.CronTriggerBean">
        <property name="jobDetail">
            <bean id="ldapPeopleJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapPeopleImport"/>
                        </entry>
                    </map>
                </property>

 </bean>
        </property>
        <property name="cronExpression">
                        <value>${ldap.synchronisation.import.person.cron}</value>
                </property>
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
    </bean>

    <bean id="ldapGroupTrigger" class="org.alfresco.util.CronTriggerBean">
        <property name="jobDetail">
            <bean id="ldapGroupJobDetail" class="org.springframework.scheduling.quartz.JobDetailBean">
                <property name="jobClass">
                    <value>org.alfresco.repo.importer.ImporterJob</value>
                </property>
                <property name="jobDataAsMap">
                    <map>
                        <entry key="bean">
                            <ref bean="ldapGroupImport"/>
                        </entry>
                    </map>
                </property>
            </bean>
        </property>
        <property name="cronExpression">
                        <value>${ldap.synchronisation.import.group.cron}</value>
                </property>
        <property name="scheduler">
            <ref bean="schedulerFactory" />
        </property>
    </bean>

    <!– The bean that imports xml describing people –>

    <bean id="ldapPeopleImport" class="org.alfresco.repo.importer.ExportSourceImporter">
        <property name="importerService">
            <ref bean="importerComponentWithBehaviour"/>
        </property>
        <property name="transactionService">
            <ref bean="transactionComponent"/>
        </property>
        <property name="exportSource">
            <ref bean="ldapPeopleExportSource"/>
        </property>

        <!– The store that contains people - this should not be changed –>
        <property name="storeRef">
            <value>${spaces.store}</value>

 </property>

        <!– The location of people nodes within the store defined above - this should not be changed –>
        <property name="path">
            <value>/${system.system_container.childname}/${system.people_container.childname}</value>
        </property>

        <!– If true, clear all existing people before import, if false update/add people from the xml –>
        <property name="clearAllChildren">
            <value>false</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="searchService">
            <ref bean="searchService"/>
        </property>
        <property name="namespacePrefixResolver">
            <ref bean="namespaceService"/>
        </property>


        <property name="caches">
            <set>
                <ref bean="permissionsAccessCache"/>
            </set>
        </property>
    </bean>

    <!– The bean that imports xml descibing groups –>

    <bean id="ldapGroupImport" class="org.alfresco.repo.importer.ExportSourceImporter">
        <property name="importerService">
            <ref bean="importerComponentWithBehaviour"/>
        </property>
        <property name="transactionService">
            <ref bean="transactionComponent"/>
        </property>
        <property name="exportSource">
            <ref bean="ldapGroupExportSource"/>
        </property>
        <!– The store that contains group information - this should not be changed –>
        <property name="storeRef">
            <value>${alfresco_user_store.store}</value>
        </property>

        <!– The location of group information in the store above - this should not be changed –>
        <property name="path">
            <value>/${alfresco_user_store.system_container.childname}/${alfresco_user_store.authorities_container.childname}</value>

 </property>

        <!– If true, clear all existing groups before import, if false update/add groups from the xml –>
        <property name="clearAllChildren">
            <value>${ldap.synchronisation.import.group.clearAllChildren}</value>
        </property>
        <property name="nodeService">
            <ref bean="nodeService"/>
        </property>
        <property name="searchService">
            <ref bean="searchService"/>
        </property>
        <property name="namespacePrefixResolver">
            <ref bean="namespaceService"/>
        </property>

        <!– caches to clear on import of groups –>
        <property name="caches">
            <set>
                <ref bean="userToAuthorityCache"/>
                <ref bean="permissionsAccessCache"/>
            </set>
        </property>

        <!– userToAuthorityCache –>
    </bean>

</beans>

‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

pjcaracuel_2349

oki, no habia leido que ya te habias autenticado… ahhh admin /admin no es usuario del ldap.

Echale un vistazo a esta entrada de la wiki.
http://wiki.alfresco.com/wiki/Security_Services#Chaining
Por otro lado, siempre puedes añadir usuarios "administradores" que si esten en el ldap.Para ello tenemos que editar el fichero:

authority-services-context.xml

en:

/webapps/alfresco/WEB-INF/classes/alfresco/

Encontraremos entre las primeras líneas la propiedad "adminUsers". Añadimos los usuarios que serán administradores en nuestro sistema

Saludos

brouco

Una ultima pregunta como puedo hacer para autenticarme en vez de por nombre apelllido apellido
coja solo el username
uid

pjcaracuel_2349

De eso creo recordar que hablamos en el siguiente post.
http://forums.alfresco.com/es/viewtopic.php?f=11&t=740

Saludos