AnsweredAssumed Answered

LDAP Auth and Synch in Alfresco 3.3

Question asked by aique on Jun 29, 2010
Latest reply on Aug 28, 2010 by zydoon
Hi!.

I'm trying to get the OpenLDAP authentication and synchronization process working in Alfresco 3.3. I've seen that in the version I'm using it's only needed change the /opt/Alfresco/tomcat/shared/classes/alfresco-global.properties file.

I don't have an admin user in the OpenLDAP, even I don't have any LDAP user password, so I only can log in as Alfresco admin and see in the all the users to check if the LDAP user are synchronized.

I changed my alfresco-global.properties but nothing seems to do. I log in as Alfresco admin, but I only can see the Alfresco internal users, no one from the LDAP.

Here is my alfresco-global.properties file


###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=/opt/Alfresco/alf_data

#
# Sample database connection properties
#————-
db.name=alfresco
db.username=alfresco
db.password=alfresco
db.host=localhost
db.port=3306

#
# External locations
#————-
ooo.exe=/opt/Alfresco/program/soffice
ooo.user=<%ShortInstallDir%>/alf_data/oouser
jodconverter.officeHome=/opt/Alfresco
jodconverter.portNumbers=8101
#ooo.enabled=false
#jodconverter.enabled=true
img.root=/usr/local
swf.exe=/opt/Alfresco/bin/pdf2swf

#
# Initial admin password
#————-
alfresco_user_store.adminpassword=209c6174da490caeb422f3fa5a7ae634

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://${db.host}:${db.port}/${db.name}

#
# Oracle connection
#
#oracle#db.driver=oracle.jdbc.OracleDriver
#oracle#db.url=jdbc:oracle:thin:@${db.host}:${db.port}:${db.name}

#
# SQLServer connection
# Requires jTDS driver version 1.2.5 and SNAPSHOT isolation mode
# Enable TCP protocol on fixed port db.port
# Prepare the database with:
# ALTER DATABASE db.name SET ALLOW_SNAPSHOT_ISOLATION ON;
#
#mssql#db.driver=net.sourceforge.jtds.jdbc.Driver
#mssql#db.url=jdbc:jtds:sqlserver://${db.host}:${db.port}/${db.name}
#mssql#db.txn.isolation=4096

#
# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)
#
#postgres#db.driver=org.postgresql.Driver
#postgres#db.url=jdbc:postgresql://${db.host}:${db.port}/${db.name}

#
# Index Recovery Mode
#————-
#index.recovery.mode=Auto

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service.  The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match.  For example:
#   .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
#authentication.chain=alfrescoNtlm1:alfrescoNtlm

# MODIFICACION_INI

authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap

# MODIFICACION_FIN

#
# URL Generation Parameters (The ${localname} token is replaced by the local server name)
#————-
#alfresco.context=alfresco
#alfresco.host=${localname}
#alfresco.port=8080
#alfresco.protocol=http
#
#share.context=share
#share.host=${localname}
#share.port=8080
#share.protocol=http

# MODIFICACION_INI

ldap.authentication.active=true
ldap.synchronization.active=true

# How to map the user id entered by the user to taht passed through to LDAP
# - simple
# - this must be a DN and would be something like
# CN=%s,DC=company,DC=com
# - digest
# - usually pass through what is entered
# %s
ldap.authentication.userNameFormat=uid=%s,ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://di002.edv.uniovi.es:389

# The authentication mechanism to use
ldap.authentication.java.naming.security.authentication=DIGEST-MD5

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=""

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=""

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

#
# This properties file is used to configure LDAP syncronisation
#

# The LDAP user to connect as to do the export operation.
ldap.synchronization.java.naming.security.principal=""

# The password for this user, if required
ldap.synchronization.java.naming.security.credentials=""

# The timestamp format
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

# The query to find the people to import
ldap.synchronization.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
ldap.synchronization.personSearchBase=ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es
ldap.synchronization.userSearchBase=ou=People,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronization.groupQuery=(objectclass=groupOfUniqueNames)

# The search base to use to find group objects
ldap.synchronization.groupSearchBase=ou=Group,ou=Departamento de Informatica,o=Universidad de Oviedo,c=es

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronization.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronization.groupType=groupOfUniqueNames

# The person type in LDAP
ldap.synchronization.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=uniqueMember

# The cron expression defining when people imports should take place
ldap.synchronization.import.person.cron=0 */10 * * * ?

# The cron expression defining when group imports should take place
ldap.synchronization.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronization.import.group.clearAllChildren=true

# MODIFICACION_FIN

Hope you can help me, I need to finish this project yesterday!.

Thanks.

Outcomes