0

I've got an Alfresco install setup (on Windows) to use the LDAP-AD authentication model. When users login with just their username, it properly creates the account and allows access. However, if they login by e-mail address it logs them into a "broken" account. None of their stuff is accessible and it doesn't even show as a real account.

I'd be OK with either the e-mail address login redirecting to the plain username login, or with completely denying e-mail address logins.

It appears that if we never had to add any more users that I could do a synchronization.autoCreatePeopleOnLogin = false in the configuration to prevent these e-mail partial accounts. However, our environment has new people needing to auto-add on frequent intervals (enough so that tweaking the configs and resetting the service each time would get old real fast) and the LDAP-AD configuration requires auto creation (manual account creation options are grayed out).

Other ideas?

edit - adding config since it sounds like something I did caused this rather than lacking something...

### Active Directory Integration ###
authentication.chain=passthru1:passthru,ldap1:ldap-ad
passthru.authentication.sso.enabled=false
passthru.authentication.allowGuestLogin=false
passthru.authentication.authenticateCIFS=false
passthru.authentication.authenticateFTP=false
passthru.authentication.servers=domain.com
passthru.authentication.domain=DOMAIN
passthru.authentication.useLocalServer=false
passthru.authentication.defaultAdministratorUserNames=specialadminaccount
passthru.authentication.connectTimeout=5000
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=TCPIP,NETBIOS
ldap.authentication.active=false
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.userNameFormat=%s
ldap.authentication.allowGuestLogin=false
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://domain.com:389
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.synchronization.active=true
ldap.synchronization.java.naming.security.principal= DOMAIN\\specialadminaccount
ldap.synchronization.java.naming.security.credentials=password
ldap.synchronization.queryBatchSize=1000
ldap.synchronization.groupDifferentialQuery=(&(objectclass=nogroup)(!(modifyTimestamp<\={0})))
ldap.synchronization.personQuery=(&(objectclass=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
ldap.synchronization.personDifferentialQuery=(& (objectclass=user)(!(modifyTimestamp<\={0})))
ldap.synchronization.groupQuery=(objectclass\=group)
ldap.synchronization.groupSearchBase=cn\=users,dc=domain,dc=com
ldap.synchronization.userSearchBase=cn\=users,dc=domain,dc=com
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
ldap.synchronization.timestampFormat=yyyyMMddHHmmss’.0Z’
ldap.synchronization.userIdAttributeName=sAMAccountName
ldap.synchronization.userFirstNameAttributeName=givenName
ldap.synchronization.userLastNameAttributeName=sn
ldap.synchronization.userEmailAttributeName=mail
ldap.synchronization.userOrganizationalIdAttributeName=msExchALObjectVersion
ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider
ldap.synchronization.groupIdAttributeName=cn
ldap.synchronization.groupType=Nogroup
ldap.synchronization.personType=user
ldap.synchronization.groupMemberAttributeName=member
synchronization.synchronizeChangesOnly=false
7
  • Why have you set things up to allow them to login by email, and not only by username?
    – Gagravarr
    Nov 24, 2014 at 15:54
  • I haven't done so on purpose. While having e-mail and username login go to the same place would be the ideal state, it would be acceptable to only login via username. However, I don't know how to do that. I'll go grab my config and add it to the post. I thought turning e-mail off was an extra option that I just didn't know... Nov 24, 2014 at 20:01
  • If you just want Active Directory authentication, why have you got passthru1 on your authentication chain? And if you're not sure, does the problem go away if you remove it?
    – Gagravarr
    Nov 25, 2014 at 15:22
  • 1
    At this point, I'd suggest you just give Alfresco support a ring. They deal with this stuff day-in, day-out, and will know exactly what you've done wrong and what to fix!#
    – Gagravarr
    Nov 25, 2014 at 22:17
  • 1
    I saw some of the blogs where it is mentioned that using ldap.synchronization.userIdAttributeName=mail will let me login with email id. but what i saw is that user id is showing up as email id but login is not getting enabled. for me the User Name is showing as email id when i search for user. I think some more configuration is required. the following are the changes I have done ------------------------ ldap.authentication.userNameFormat=mail=%s ################ ldap.synchronization.userIdAttributeName=mail
    – R-JANA
    Mar 16, 2015 at 11:49

1 Answer 1

1

Also look at the post at https://forums.alfresco.com/forum/installation-upgrades-configuration-integration/configuration/ldap-authentication-ad-email#comment-155600 to see whats is going on.

The issue is alfresco does a dn look up and it does not search for an object and then try to login with password.

In that kind of scenario you have to be extra careful how your dn looks in ldap.

Please look at the screenshot to see that even though all the other attributes are same the identification of dn has made a difference and I could only login via [email protected] but other login did not work.

the properties changes are as below

ldap.authentication.userNameFormat=mail=%s,ou=people,dc=organisation,dc=com
ldap.synchronization.userIdAttributeName=mail

enter image description here

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .