AnsweredAssumed Answered

Alfresco 3.2 + Ldap

Question asked by sgdiaz on Oct 6, 2009
Latest reply on Oct 7, 2009 by pjcaracuel_2349
Hola buenas,

Os escribo ya que tras leer y leer distintos post y documentacion en la wiki no he sigo capaz de configurar alfresco para que lo usuarios se logueen contra openldap que tengo montado.

Lo primero he de decir que tengo la version comunity 3.2 instalada y que respecto a versiones anteriores creo que la configuracion del ldap ha cambiado.He seguido aunque me ha costado el siguiente enlace http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems#Configuring_the_Authentication_Chain y he modificado el fichero alfresco-global.properties  de C:\Alfresco\tomcat\shared\classes adaptandolo lo mas posibles a lo que necesito.De momento no necesito sincronizar los usuarios con el servidor ldap asi que he puesto ha false la propiedad correspondiente.quedando algo como:


###############################
## Common Alfresco Properties #
###############################

#
# Sample custom content and index data location
#————-
dir.root=C:/Alfresco/alf_data

#
# Sample database connection properties
#————-
db.name=alfresco
db.username=alfresco
db.password=alfresco 
db.host=localhost
db.port=3306

#
# External locations
#————-
ooo.exe=C:/Archivos de programa/Alfresco/OpenOffice.org/program/soffice
img.root=C:/Archivos de programa/Alfresco/ImageMagick
swf.exe=C:/Archivos de programa/Alfresco/bin/pdf2swf

#
# MySQL connection
#————-
db.driver=org.gjt.mm.mysql.Driver
db.url=jdbc:mysql://${db.host}:${db.port}/${db.name}
#hibernate.dialect=org.hibernate.dialect.MySQLDialect

#
# Index Recovery Mode
#————-
#index.recovery.mode=Auto

#
# Outbound Email Configuration
#————-
#mail.host=
#mail.port=25
#mail.username=anonymous
#mail.password=
#mail.encoding=UTF-8
#mail.from.default=alfresco@alfresco.org
#mail.smtp.auth=false

#
# Alfresco Email Service and Email Server
#————-

# Enable/Disable the inbound email service.  The service could be used by processes other than
# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.
#————-
#email.inbound.enabled=true

# Email Server properties
#————-
#email.server.enabled=true
#email.server.port=25
#email.server.domain=alfresco.com
#email.inbound.unknownUser=anonymous

# A comma separated list of email REGEX patterns of allowed senders.
# If there are any values in the list then all sender email addresses
# must match.  For example:
#   .*\@alfresco\.com, .*\@alfresco\.org
# Allow anyone:
#————-
#email.server.allowed.senders=.*

#
# The default authentication chain
# To configure external authentication subsystems see:
# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems
#————-
#authentication.chain=alfrescoNtlm1:alfrescoNtlm

authentication.chain=ldap1:ldap

#
# IMAP
#————-
#imap.server.enabled=true
#imap.server.port=143
#imap.server.host=localhost

#
# This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
#

ldap.authentication.active=true
ldap.synchronization.active=false

# How to map the user id entered by the user to taht passed through to LDAP
# - simple
# - this must be a DN and would be something like
# CN=%s,DC=company,DC=com
# - digest
# - usually pass through what is entered
# %s
ldap.authentication.userNameFormat=uid=%s,dc=dguadalajara,dc=es

# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://***.***.**.*:389

# The authentication mechanism to use
#ldap.authentication.java.naming.security.authentication=DIGEST-MD5
ldap.authentication.java.naming.security.authentication=simple

# The default principal to use (only used for LDAP sync)
ldap.authentication.java.naming.security.principal=cn=admin,dc=dguadalajara,dc=es

# The password for the default principal (only used for LDAP sync)
ldap.authentication.java.naming.security.credentials=******

# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false

# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false

#
# This properties file is used to configure LDAP syncronisation
#

# The LDAP user to connect as to do the export operation.
ldap.synchronization.java.naming.security.principal=cn=admin,dc=dguadalajara,dc=es

# The password for this user, if required
ldap.synchronization.java.naming.security.credentials=******

# The timestamp format
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'

# The query to find the people to import
ldap.synchronisation.personQuery=(objectclass=inetOrgPerson)

# The search base of the query to find people to import
#REVISION
ldap.synchronisation.personSearchBase=dc=dguadalajara,dc=es
ldap.synchronization.userSearchBase=dc=dguadalajara,dc=es

# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronisation.userIdAttributeName=uid

# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronisation.userFirstNameAttributeName=givenName

# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronisation.userLastNameAttributeName=sn

# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronisation.userEmailAttributeName=mail

# The attribute on person objects in LDAP to map to the organizational id property in Alfresco
ldap.synchronisation.userOrganizationalIdAttributeName=o

# The default home folder provider to use for people created via LDAP import
ldap.synchronisation.defaultHomeFolderProvider=personalHomeFolderProvider

# The query to find group objects
ldap.synchronisation.groupQuery=(objectclass=groupOfUniqueNames)

# The search base to use to find group objects
#REVISION
ldap.synchronization.groupSearchBase=dc=dguadalajara,dc=es

# The attribute on LDAP group objects to map to the gid property in Alfrecso
ldap.synchronisation.groupIdAttributeName=cn

# The group type in LDAP
ldap.synchronisation.groupType=groupOfUniqueNames

# The person type in LDAP
ldap.synchronisation.personType=inetOrgPerson

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronisation.groupMemberAttributeName=uniqueMember

# The cron expression defining when people imports should take place
ldap.synchronisation.import.person.cron=0 */10 * * * ?

# The cron expression defining when group imports should take place
ldap.synchronisation.import.group.cron=0 30 * * * ?

# Should all groups be cleared out at import time?
# - this is safe as groups are not used in Alfresco for other things (unlike person objects which you should never clear out during an import)
# - setting this to true means old group definitions will be tidied up.
ldap.synchronisation.import.group.clearAllChildren=true</pre>


Tras esta modificación arranco el servidor y pruebo a loguearme en alfresco con el unico usuario que tengo en el ldap pero no funciona , me logueo con el usuario y password por defecto de alfresco y entro sin problemas.

A continuación compruebo si el fichero alfresco-global.properties se ha desplegado correctamente en tomcat C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes
pero en esta ubicacion no esta el fichero,eso si hay un alfresco-global.properties.sample .Esto me hace deducir que si se debiese encontrar en esta ubicacion asi que copio el  lfresco-global.properties y lo echo en C:\Alfresco\tomcat\webapps\alfresco\WEB-INF\classes.


Intento arrancar tomcat pero me da el siguiente error , access denied for user 'alfresco' @ 'localhost'.De momento este error me sorprende ya que tras instalar alfresco ejecuto el bat db_setup.bat que crea el schema alfresco en base de dato y ademas crea el usuario alfresco con todos los privilegios sobre dicho schema.


Por tanto , mis preguntas son:
1-¿Cual es la ubicacion del fichero alfresco-global.properties?
2-Si en mi base de datos Mysql el usuario alfresco esta creado con los privilegios correspondientes sobre el schema de alfresco ¿por qué podría ser el error access denied for user 'alfresco' @ 'localhost'?
3-¿Es necesario tocar mas ficheros aparte del alfresco-global.properties para que alfresco se loguee contra un Ldap?


Bueno esto es todo ,espero haberme explicado correctamente ya que soy nuevo en esto de alfresco y sobre todo espero que podais ayudarme ya que necesito resolverlo.


Un saludo y muchas gracias

Outcomes