AnsweredAssumed Answered

Authentication problem with Alfresco Mobil with Kerberos authentication and LDAP sync

Question asked by rglauser on Jan 29, 2016
Latest reply on Feb 13, 2016 by mikeh
Hi

I have problems to connect to alfresco with LDAP-Users. I activated Kerberos authentication which works perfectly for CIFS and HTTP Share. Users are synced also correctly with my LDAP configuration.

My problem is now, that Kerberos-Usernames and LDAP-Usernames are not in sync, so I cannot login on mobile-app with LDAP-Usersname. I can only connect with Kerberos-User-Name like that:

Username that is working in Mobile-APP:
"username@DOMAIN.COM"

Username not working in Mobile-APP:
"username"

Username working in Browser-Login:
"username"

When I log in with "username@DOMAIN.COM" with the mobile app, there is a new username created in Alfresco in parallel with the user "username" that comes from LDAP.

I would like to log in always only with "username" and not with "username@DOMAIN.COM". So I thin there must be something wrong inside my alfresco-global.properties:

###Configuring Kerberos authentication
kerberos.authentication.realm=DOMAIN.COM
kerberos.authentication.sso.enabled=true
kerberos.authentication.authenticateCIFS=true
kerberos.authentication.user.configEntryName=Alfresco
kerberos.authentication.cifs.configEntryName=AlfrescoCIFS
kerberos.authentication.http.configEntryName=AlfrescoHTTP
kerberos.authentication.defaultAdministratorUserNames=Administrator
kerberos.authentication.stripUsernameSuffix=true

### Configuring AD authentication ###
ldap.authentication.active=false
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=
#ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://ldap.domain.com:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=Administrator
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal=alfresco_ldap@domain.com
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.attributeBatchSize=1000
synchronization.synchronizeChangesOnly=false
synchronization.import.cron=0 0/5 * * * ?
synchronization.allowDeletions=true
synchronization.syncWhenMissingPeopleLogIn=true

ldap.synchronization.modifyTimestampAttributeName=whenChanged

ldap.synchronization.groupSearchBase=DC=domain,DC=com
ldap.synchronization.groupQuery=(&(objectclass=group)(memberOf:1.2.840.113556.1.4.1941:=CN=GG_Alfresco,OU=DOMAIN Gruppen,DC=domain,DC=com))
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(whenChanged<\={0})))

ldap.synchronization.userSearchBase=DC=domain,DC=com
ldap.synchronization.personQuery=(&(objectclass=user)(|(memberOf=CN=alfresco_user,OU=DOMAIN Ressource,DC=domain,DC=com))(userAccountControl:1.2.840.113556.1.4.803:=512))
ldap.synchronization.personDifferentialQuery=(&(objectclass=user)(|(memberOf=CN=alfresco_user,OU=DOMAIN Ressource,DC=domain,DC=com))(userAccountControl:1.2.840.113556.1.4.803:=512)(!(whenChanged<={0})))

############################################

Does someone have an idea where my problem comes from?

Best regards,
René

Outcomes