Alfresco + LDAPS (389-ds) Sync + Аунтефикацию

Johnny_K, 23/07/2014 - 17:46
alfresco 4.2.f
добавил в файл alfresco-global.properties следующие параметры

####LDAP AUTHENTICATION ####
authentication.chain=alfrescoNtlm1:alfrescoNtlm,ldap1:ldap
 
# This flag enables use of this LDAP subsystem for authentication. It may be
# that this subsytem should only be used for synchronization, in which case
# this flag should be set to false.
ldap.authentication.active=true
 
#
# This properties file brings together the common options for LDAP authentication rather than editing the bean 
#
ldap.authentication.allowGuestLogin=false
 
# How to map the user id entered by the user to that passed through to LDAP
ldap.authentication.userNameFormat=uid\=%s
 
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.read.timeout=30000
 
# The URL to connect to the LDAP server 
ldap.authentication.java.naming.provider.url=ldaps://ldap-00.test.local:636
 
# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple
 
# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false
 
# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is 
# pulled in as part of an LDAP sync
 
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
 
# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=admin,Administrator,alfresco
 
# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for 
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true
 
# The authentication mechanism to use for synchronization
ldap.synchronization.java.naming.security.authentication=simple
 
# The default principal to use (only used for LDAP sync)
ldap.synchronization.java.naming.security.principal=uid\=replica,cn\=config
 
# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=Test2014
 
# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=0
 
# If positive, this property indicates that range retrieval should be used to fetch
# multi-valued attributes (such as member) in batches of the specified size.
# Overcomes any size limits imposed by Active Directory.        
ldap.synchronization.attributeBatchSize=1000
 
# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)
 
# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))
 
# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)
 
# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))
 
# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=ou\=Staff,dc\=test,dc\=local
 
# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=ou\=Staff,dc\=test,dc\=local
 
# The name of the operational attribute recording the last update time for a group or user.
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
 
# The timestamp format. Unfortunately, this varies between directory servers.
ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z'
 
# The attribute name on people objects found in LDAP to use as the uid in Alfresco
ldap.synchronization.userIdAttributeName=uid
 
# The attribute on person objects in LDAP to map to the first name property in Alfresco
ldap.synchronization.userFirstNameAttributeName=givenName
 
# The attribute on person objects in LDAP to map to the last name property in Alfresco
ldap.synchronization.userLastNameAttributeName=sn
 
# The attribute on person objects in LDAP to map to the email property in Alfresco
ldap.synchronization.userEmailAttributeName=mail
 
# The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
ldap.synchronization.userOrganizationalIdAttributeName=o
 
# The default home folder provider to use for people created via LDAP import
ldap.synchronization.defaultHomeFolderProvider=largeHomeFolderProvider
 
# The attribute on LDAP group objects to map to the authority name property in Alfresco
ldap.synchronization.groupIdAttributeName=cn
 
# The attribute on LDAP group objects to map to the authority display name property in Alfresco
ldap.synchronization.groupDisplayNameAttributeName=description
 
 
# The group type in LDAP
ldap.synchronization.groupType=groupOfNames
 
# The person type in LDAP
ldap.synchronization.personType=inetOrgPerson
 
# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member
 
# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.

 
Подцепил сертификат, пользователи и группы засинхронизировались. Под админом вхожу в альфреску и вижу всех пользователей из 389-ds. Однако, когда пытаюсь залогиниться под  юзверем из LDAP, не пускает говорит не верный логин или пароль или система в дауне. Не могу понять где косяк, в логах по поводу не правильной авторизации ничего нету. Все пароли проставлены верно.
Если у кого возникал такой вопрос поделитесь, как решили?
 
Форумы »

Комментарии

Johnny_K
24/07/2014 - 16:51
 Все получилось, спасибо сам разобрался 

ldap.authentication.userNameFormat=uid\=%s

данный параметр нужно оставить пустым и все заработает 
ldap.authentication.userNameFormat=
Johnny_K
25/07/2014 - 17:13
 радость моя была не долгой. Возник следующий вопрос:
как синхронизировать мемберов внутри группы.

 пользователи синхронизируются и авторизируются без проблем, группы синхронизируются но они пустые, внутри тупо нету мемберов ад групп, хотя в ад они конечно же есть.
В итоге пришлось играться с этим параметром:

# The attribute in LDAP on group objects that defines the DN for its members
ldap.synchronization.groupMemberAttributeName=member 

Однако пока что без вариантов. 

OlegLOM
28/07/2014 - 12:59
ldap.synchronization.groupSearchBase=dc\=test,dc\=local
ldap.synchronization.userSearchBase=dc\=test,dc\=local

а то грузим одно, а фильтрим другое.

и
ldap.authentication.userNameFormat=%s@test.local
Johnny_K
30/07/2014 - 16:29
 Мне не нужен корневой OU, чтобы от туда еще всякая фигня грузилась, не вижу разницы между вашими добавлениями и те которые уже есть. 
ldap.authentication.userNameFormat=%s@test.local
не помагает сразу проподает авторизация с лдапом
Добавить комментарий