nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco sync AD-Alfresco blocked account

trompe

Good Morning.

I have an Alfresco installation, in which users can authenticate themselves by validating against an Active Directory.

It turns out that if the password is entered incorrectly 3 times, the user is locked in the AD and when its lock is deactivated, it is not reflected in Alfresco. In other words, state synchronization is not performed.

I have been reading the documentation about it: https://docs.alfresco.com/5.2/concepts/ldap-sync-user.html (for my version of Alfresco), but it is not clear to me if with

synchronization.externalUserControl=true
synchronization.externalUserControlSubsystemName=ldap

it is enough ... is there a cronjob or site where I indicate how often the status should be kept updated or would it be 100% transparent? (If it is transparent and directly validates with the AD its state ... then I have something wrong configured, because Alfresco thinks that the user is still blocked).

UPDATE:

When the user is blocked by a high retry to put the password wrong, it gets blocked in AD and in Alfresco.

When unlocking in the AD, the user can authenticate in the AD (in other services) but in Alfresco, it is still blocked and cannot be authenticated. How can this be solved?

The guidelines I have followed are these:

https://docs.alfresco.com/5.2/concepts/ldap-sync-user.html

Find more posts tagged with

Alfresco Content Services

Comments

afaust

Synchronization by default only runs once every night. This can be configured using the synchronization.import.cron property in alfresco-global.properties. The question then remains what the acceptable duration after unblocking is for Alfresco to synch the state change, e.g. if you want to run the synch hourly, semi-hourly or even more regularly.

trompe

My problem is that when the user is blocked because there is a login retry with an incorrect password, the user is blocked in the Active Directory and cannot access Alfresco. That's right.
But when unlocking the user in AD, the user still cannot access Alfresco, even though several days have passed and the sync script has been run. What could be the problem?

EddieMay

Hi @trompe,

There is a discussion of a similar problem - might be worth taking a look at the solutions suggest there.

HTH,