lost users and site memberships after AD user problem

[wssupport]

Hi everyone, we have recently had a problem whereby some of AD users had ampersand symbols in their departments which caused them to go missing from Alfresco (removed on the alfresco sync).

We found this problem and removed the offending ampersands from the users in question on the AD side and Alfresco has re-synced and the missing users show again. This is great but now the problem is these users have lost their sites that they were managing. It seems their site associations are broken since them disappearing and re-appearing in alfresco. 

Does anyone know how we can restore these associations, or even check what they were previously and re-apply them? We have backups including the postgres database dumps of before and after this issue.

We are using Alfresco Community 6.1.2 inside docker on Ubuntu server 18.04. 

[cristinamr]

Hi!

If you are able to have other machine with your last "valid" backup, you can check site by site the permissions you have using the node browser console.

After this, you'll need to create a javascript where set same permission to the new users in your new instance.

Cheers,

Cristina.

[wssupport]

ok thanks we will take a look, we have over 1000 users however so hopefully this can be made to iterate and correct them. We are not sure yet how many users were affected by this change but it might only have been a few hundred.

The thing is the users have re-appeared in Alfresco the same as they were before, so I wonder what has changed to make it loose these associations? The AD users in question were never deleted (only edited to change department field in AD).

[cristinamr]

The thing is the users have re-appeared in Alfresco the same as they were before, so I wonder what has changed to make it loose these associations?

This is quite interesting because magic does not exist. Did you check your logs? Just in case you have something else behind of this behabiour.

ok thanks we will take a look, we have over 1000 users however so hopefully this can be made to iterate and correct them. We are not sure yet how many users were affected by this change but it might only have been a few hundred.

I'll suggest you to do a javascript just to identify which cases have you got. Then you can think about next steps but first at all is better to know the impact of this.

[wssupport]

They re-appeared after we removed the ampersands in AD from the department field. We saw on the alfresco log that after an AD re-sync is when they re-appeared.

Adding the ampersand seems to have broken some users (in that the subsequent AD sync makes them dissapear from alfresco). Removing the ampersand and after Alfresco does it's scheduled AD sync it puts them back, but without their original sites (so their sites list is empty).

Hope this makes sense

[wssupport]

ok so this is partly solved now, we changed synchronizeChangesOnly to False in the global config and let is re-sync. This brought in the missing users. Then changed it back to true.

Now we still have over 1000 users missing their site memberships so am trying to do that will curl and no success currently. Posting a new thread for that.

Thanks for your help

[cristinamr]

I'm glad you could move one step further! I'll read your new post!

Cheers!