0

We perform migration from enterprise version Alfresco 4.2 to the 5.1. There are two Active Directory domains (primary and child) in company, for this reason we configure two LDAP(AD) subsystems in Alfresco 5.1.

Structure of properties: /opt/tomcat7/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap2 /opt/tomcat7/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1

Problem is that authentication and synchronistaion work only for one ldap-ad subsystem (ldap1 or ldap2), which have first place in the list of authentication chain (ldap1 and ldap2 don't work together).

Authentication chain screenshot

For a example, if ldap1 have first place in the list, that user's login from ldap2 fails (and conversely!). In this case I look error in alfresco.log:

Caused by: net.sf.acegisecurity.AuthenticationCredentialsNotFoundException: A valid SecureContext was not provided in the RequestContext

My properties:

/opt/tomcat7/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1/ldap-ad-authentication.properties

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@fake.local
ldap.authentication.java.naming.provider.url=ldap://fake.local:***
ldap.authentication.defaultAdministratorUserNames=fake_user
ldap.authentication.java.naming.referral=follow

ldap.synchronization.java.naming.security.principal=fake_user@fake.local
ldap.synchronization.java.naming.security.credentials=somepassword
ldap.synchronization.groupSearchBase=ou=Archiv,ou=FileServerGroups,ou=Groups,dc=fake,dc=local
ldap.synchronization.userSearchBase=dc=fake,dc=local
ldap.synchronization.groupDisplayNameAttributeName=description
ldap.synchronization.userOrganizationalIdAttributeNameCustom=distinguishedName
ldap.synchronization.com.sun.jndi.ldap.connect.pool=true

/opt/tomcat7/shared/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap2/ldap-ad-authentication.properties

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=false
ldap.authentication.userNameFormat=%s@gss.fake.local
ldap.authentication.java.naming.provider.url=ldap://gss.fake.local:***
ldap.authentication.defaultAdministratorUserNames=fake_user
ldap.authentication.java.naming.referral=follow

ldap.synchronization.java.naming.security.principal=fake_user@fake.local
ldap.synchronization.java.naming.security.credentials=somepassword%
ldap.synchronization.groupSearchBase=ou=Archiv,ou=FileServerGroups,ou=Groups,dc=gss,dc=fake,dc=local
ldap.synchronization.userSearchBase=dc=gss,dc=fake,dc=local
ldap.synchronization.groupDisplayNameAttributeName=description
ldap.synchronization.userOrganizationalIdAttributeNameCustom=distinguishedName
ldap.synchronization.com.sun.jndi.ldap.connect.pool=true

alfresco-global.properties

### Authentication ###
#authentication.chain=ldap1:ldap-ad,ldap2:ldap-ad,alfrescoNtlm1:alfrescoNtlm
authentication.chain=alfinst:alfrescoNtlm,ldap1:ldap-ad,ldap2:ldap-ad

Thanks in advance!

ERemarque
  • 497
  • 3
  • 16
  • Have you tried editing WEB-INF/classes/log4j.properties to turn on some authentication related loggers? Maybe some additional detail in the logs would help shed light on the issue. – Jeff Potts Oct 12 '18 at 20:25
  • Yes, we turned on some debug-options and have observed error in alfresco.log: DEBUG org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl] [http-bio-8080-exec-13] Authenticating user "test_user" ERROR [org.springframework.extensions.webscripts.AbstractRuntime] [http-bio-8080-exec-13] Exception from executeScript: 09160047 Wrapped Exception (with status template): A valid SecureContext was not provided in the RequestContext ... Caused by: net.sf.acegisecurity.AuthenticationCredentialsNotFoundException: A valid SecureContext was not provided in the RequestContext – ERemarque Oct 17 '18 at 13:28

1 Answers1

2

Finally, I resolved issue related to authentication users. I put empty string of parametr: 

ldap.authentication.userNameFormat=

for each LDAP subsystems in files ldap-ad-authentication.properties.

After, users from two ldaps could login successfully.

ldap.authentication.userNameFormat

Specifies how to map the user identifier entered by the user to that passed through to LDAP. If set to an empty string (the default for the ldap subsystem), an LDAP query involving ldap.synchronization.personQuery and ldap.synchronization.userIdAttributeName will be performed to resolve the DN from the user ID dynamically. This allows directories to be structured and does not require the user ID to appear in the DN.

If set to a non-empty value, the substring %s in this value will be replaced with the entered user ID to produce the ID passed to LDAP. This restricts LDAP user names to a fixed format. The recommended format of this value depends on your LDAP server.

ERemarque
  • 497
  • 3
  • 16