AnsweredAssumed Answered

LDAP Configuration - Alfresco V3.2 - Login failed [SOLVED]

Question asked by oferprtz on Dec 8, 2009
Latest reply on Dec 16, 2009 by mattyc
Hello all,

I'm quite new at the Alfresco system.

first of all im using: Alfresco 3.2 CE with Microsoft windows server 2003 r2.
i tried to configure ldap on the alfresco but with no success.
i've read:
http://forums.alfresco.com/en/viewtopic.php?f=9&t=14741
http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#LDAP

ive been told not to touch this directory at all: e:\Alfresco\tomcat\webapps\share\WEB-INF
with all the configuration files inside…

so i tried to do the following:
1. I've changed the file: e:\Alfresco\tomcat\shared\classes\alfresco-global.properties
authentication.chain=ldap1:ldap-ad
ldap.authentication.userNameFormat=%s
ldap.authentication.java.naming.provider.url=ldap://my-server:389
ldap.authentication.defaultAdministratorUserNames=ofer
ldap.synchronization.java.naming.security.principal=ofer@mycompany.com
ldap.synchronization.java.naming.security.credentials=**********
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=MYGROUP,dc=MYCOMPANY,dc=MYCOMPANY_SUFFIX
ldap.synchronization.userSearchBase=ou\=User Accounts,ou\=MYGROUP,dc=MYCOMPANY,dc=MYCOMPANY_SUFFIX

restarted alfresco and it didnt work…

2. ive changed back the file alfresco-global.properties to its original state and did the following:
   a. Updated the file: c:\Alfresco\tomcat\shared\classes\alfresco-global.properties to contain:
           authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap
   b. ive copied the file: ldap-authentication.properties from: E:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes\alfresco\subsystems\Authentication\ldap\ldap-authentication.properties
      to: E:\Alfresco\tomcat\shared\classes\alfresco\extension\subsystems\Authentication\ldap\ldap1\
      and ive put the following arguments inside:
   
# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=true

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#
ldap.authentication.allowGuestLogin=true

# How to map the user id entered by the user to taht passed through to LDAP
# In Active Directory, this can either be the user principal name (UPN) or DN.
# UPNs are in the form <sAMAccountName>@domain and are held in the userPrincipalName attribute of a user
ldap.authentication.userNameFormat=%s

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://myserver.com:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=simple

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=ofer

# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true

# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=admin@mycompany.com

# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=***********

# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000

# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=group)

# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=Security Groups,ou\=MYOU,dc=MYCOMPANY

# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=User Accounts,ou\=MYOU,dc=MYCOMPANY

# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=sAMAccountName

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=MYCOMPANY

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronization.groupType=group

# The person type in LDAP
ldap.synchronization.personType=user

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member

# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
ldap.synchronization.enableProgressEstimation=true



and give it a shot, but no success im still getting this error:
09:49:19,159 ERROR [org.alfresco.web.scripts.AbstractRuntime] Exception from executeScript - redirecting to status template error: 11080008 Login failed
org.alfresco.web.scripts.WebScriptException: 11080008 Login failed
   at org.alfresco.repo.web.scripts.bean.AbstractLoginBean.login(AbstractLoginBean.java:81)
   at org.alfresco.repo.web.scripts.bean.LoginPost.executeImpl(LoginPost.java:79)
   at org.alfresco.web.scripts.DeclarativeWebScript.executeImpl(DeclarativeWebScript.java:223)
   at org.alfresco.web.scripts.DeclarativeWebScript.execute(DeclarativeWebScript.java:70)
   at org.alfresco.repo.web.scripts.RepositoryContainer$2.execute(RepositoryContainer.java:372)
   at org.alfresco.repo.transaction.RetryingTransactionHelper.doInTransaction(RetryingTransactionHelper.java:327)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecute(RepositoryContainer.java:422)
   at org.alfresco.repo.web.scripts.RepositoryContainer.transactionedExecuteAs(RepositoryContainer.java:439)
   at org.alfresco.repo.web.scripts.RepositoryContainer.executeScript(RepositoryContainer.java:262)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:306)
   at org.alfresco.web.scripts.AbstractRuntime.executeScript(AbstractRuntime.java:183)
   at org.alfresco.web.scripts.servlet.WebScriptServlet.service(WebScriptServlet.java:122)
   at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
   at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
   at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
   at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
   at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
   at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128)
   at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
   at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
   at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:286)
   at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:845)
   at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
   at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
   at java.lang.Thread.run(Thread.java:619)


ive also tried to change the parameter usernameformat=%s to:
ldap.authentication.userNameFormat=uid=%s,ou\=MY_OU,dc\=MY_COMPANY,dc\=MY_company
but still the same error…



Im actually spent 2 full days to make it work, ive read tons of articles in the internet and wiki's but with no success… :cry:

can someone please help me?
what ive did wrong?

thank you for reading this..

ofer.

Outcomes