Problemas configurar Alfresco 3.3 con LDAP Windows 2003

[pedrol]

Buenas a todos.

Estoy intentando que la versión de Alfresco 3.3 que tengo instalada se autorice con LDAP de un windows 2003 server.
He estado mirando la documentación y en los foros y no encuentro ninguna solución para esta versión concreta.

La configuración de alfresco-global.properties

###############################

## Common Alfresco Properties #

###############################



#

# Sample custom content and index data location

#————-

dir.root=/var/lib/alfresco/alf_data



#

# Sample database connection properties

#————-

db.name=alfresco

db.username=alfresco

db.password=alfresco

db.host=localhost

db.port=3306



#

# External locations

#————-

#ooo.exe=soffice

#ooo.enabled=false

#img.root=./ImageMagick

#swf.exe=./bin/pdf2swf



#

# MySQL connection

#————-

db.driver=org.gjt.mm.mysql.Driver

db.url=jdbc:mysql://localhost/alfresco


#

# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)

#

#db.driver=org.postgresql.Driver

#db.url=jdbcostgresql://localhost:5432/alfresco



#

# Index Recovery Mode

#————-

#index.recovery.mode=AUTO



#

# Outbound Email Configuration

#————-

#mail.host=

#mail.port=25

#mail.username=anonymous

#mail.password=

#mail.encoding=UTF-8

#mail.from.default=alfresco@alfresco.org

#mail.smtp.auth=false



#

# Alfresco Email Service and Email Server

#————-



# Enable/Disable the inbound email service.  The service could be used by processes other than

# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.

#————-

#email.inbound.enabled=true



# Email Server properties

#————-

#email.server.enabled=true

#email.server.port=25

#email.server.domain=alfresco.com

#email.inbound.unknownUser=anonymous



# A comma separated list of email REGEX patterns of allowed senders.

# If there are any values in the list then all sender email addresses

# must match. For example:

#   .*\@alfresco\.com, .*\@alfresco\.org

# Allow anyone:

#————-

#email.server.allowed.senders=.*



#

# The default authentication chain

# To configure external authentication subsystems see:

# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems

#————-

#authentication.chain=alfrescoNtlm1:alfrescoNtlm

#authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru,ldap1:ldap



authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru,ldap1:ldap



#

# URL Generation Parameters (The ${localname} token is replaced by the local server name)

#————-

#alfresco.context=alfresco

#alfresco.host=${localname}

#alfresco.port=8080

#alfresco.protocol=http

#

#share.context=share

#share.host=${localname}

#share.port=8080

#share.protocol=http





ldap.authentication.active=true





# How to map the user id entered by the user to taht passed through to LDAP

# - simple

# - this must be a DN and would be something like

# CN=%s,DC=company,DC=com

# - digest

# - usually pass through what is entered

# %s

ldap.authentication.userNameFormat=CN=%s,DC=midominio,DC=es



# The LDAP context factory to use

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory



# The URL to connect to the LDAP server

ldap.authentication.java.naming.provider.url=ldap://servidor:389



# The authentication mechanism to use

#ldap.authentication.java.naming.security.authentication=DIGEST-MD5

ldap.authentication.java.naming.security.authentication=simple



# The default principal to use (only used for LDAP sync)

ldap.authentication.java.naming.security.principal=CN=alfresco,DC=midominio,DC=es



# The password for the default principal (only used for LDAP sync)

ldap.authentication.java.naming.security.credentials=alfresco



# Escape commas entered by the user at bind time

# Useful when using simple authentication and the CN is part of the DN and contains commas

ldap.authentication.escapeCommasInBind=false



# Escape commas entered by the user when setting the authenticated user

# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is

# pulled in as part of an LDAP sync

# If this option is set to true it will break the default home folder provider as space names can not contain \

ldap.authentication.escapeCommasInUid=false

Para ello he creado un usuario que sea administrador del dominio llamado "alfresco".

Con todo esto no consigo que se autorice con LDAP.

Me aparece un mensaje de error al abrir la web de inicio:

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'globalAuthenticationFilter' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/ntlm-filter-context.xml]: Cannot resolve reference to bean 'AuthenticationComponent' while setting bean property 'authenticationComponent'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'AuthenticationComponent' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Cannot resolve reference to bean 'authenticationComponent' while setting bean property 'target'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authenticationComponent' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Cannot resolve reference to bean 'passthruServers' while setting bean property 'passthruServers'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'passthruServers' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Invocation of init method failed; nested exception is org.alfresco.error.AlfrescoRuntimeException: 03230004 Error setting passthru domain, Failed to find domain controller or browse master for DOMAIN
caused by:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'AuthenticationComponent' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Cannot resolve reference to bean 'authenticationComponent' while setting bean property 'target'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authenticationComponent' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Cannot resolve reference to bean 'passthruServers' while setting bean property 'passthruServers'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'passthruServers' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Invocation of init method failed; nested exception is org.alfresco.error.AlfrescoRuntimeException: 03230004 Error setting passthru domain, Failed to find domain controller or browse master for DOMAIN
caused by:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'authenticationComponent' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Cannot resolve reference to bean 'passthruServers' while setting bean property 'passthruServers'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'passthruServers' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Invocation of init method failed; nested exception is org.alfresco.error.AlfrescoRuntimeException: 03230004 Error setting passthru domain, Failed to find domain controller or browse master for DOMAIN
caused by:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'passthruServers' defined in file [/opt/Alfresco/tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/Authentication/passthru/passthru-authentication-context.xml]: Invocation of init method failed; nested exception is org.alfresco.error.AlfrescoRuntimeException: 03230004 Error setting passthru domain, Failed to find domain controller or browse master for DOMAIN
caused by:
org.alfresco.error.AlfrescoRuntimeException: 03230004 Error setting passthru domain, Failed to find domain controller or browse master for DOMAIN


A ver si me podéis ayudar.

Gracias.

[vam]

Buenas, a ver si esto te ayuda:

Si lo que quieres es que los usuarios que pertenecen al directorio activo introduzcan su usuairio/contraseña, debes modificar en el archivo 'alfresco-global.properties', las siguientes líneas:

authentication.chain=ldap1:ldap

ldap.authentication.active=true
ldap.authentication.allowGuestLogin=true
ldap.authentication.userNameFormat=%s@tudominio
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
ldap.authentication.java.naming.provider.url=ldap://servidor:389
ldap.authentication.java.naming.security.authentication=simple
ldap.authentication.escapeCommasInBind=false
ldap.authentication.escapeCommasInUid=false
ldap.authentication.defaultAdministratorUserNames=‍‍‍‍‍‍‍‍‍‍‍‍

Este trozo es el que hace que reconozca los usuarios del directorio activo.

Si lo que quieres es que los usuarios accedan directamente, mediante Single Sign On, debes añadir las siguientes líneas:

authentication.chain=passthru1:passthru,ldap1:ldap

passthru.authentication.useLocalServer=false
passthru.authentication.domain=
passthru.authentication.servers=TUDOMINIO\\servidor
passthru.authentication.guestAccess=false
passthru.authentication.defaultAdministratorUserNames=
#Timeout value when opening a session to an authentication server, in milliseconds
passthru.authentication.connectTimeout=30000
#Offline server check interval in seconds
passthru.authentication.offlineCheckInterval=300
passthru.authentication.protocolOrder=NetBIOS,TCPIP
passthru.authentication.authenticateCIFS=true
passthru.authentication.authenticateFTP=true‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Espero que con esto ya se solucione tu problema.

[pedrol]

He modificado los parámetros que me indicas con los datos necesarios y ya no se produce el error pero al querer entrar con un usuario no accede y nos dice que usuario y contraseña desconocidos.

He agregado lo que me indicas, quedando alfresco-global.properties como sigue:

ldap.authentication.active=false


ldap.authentication.allowGuestLogin=true



# How to map the user id entered by the user to taht passed through to LDAP

# - simple

# - this must be a DN and would be something like

# CN=%s,DC=company,DC=com

# - digest

# - usually pass through what is entered

# %s


#ldap.authentication.userNameFormat=CN=%s,DC=aso,DC=es
ldap.authentication.userNameFormat=%s@aso.es



# The LDAP context factory to use

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory



# The URL to connect to the LDAP server

ldap.authentication.java.naming.provider.url=ldap://10.***.**.**:389



# The authentication mechanism to use

#ldap.authentication.java.naming.security.authentication=DIGEST-MD5

ldap.authentication.java.naming.security.authentication=simple



# The default principal to use (only used for LDAP sync)

#ldap.authentication.java.naming.security.principal=CN=alfresco,DC=aso,DC=es



# The password for the default principal (only used for LDAP sync)

#ldap.authentication.java.naming.security.credentials=alfresco



# Escape commas entered by the user at bind time

# Useful when using simple authentication and the CN is part of the DN and contains commas

ldap.authentication.escapeCommasInBind=false



# Escape commas entered by the user when setting the authenticated user

# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is

# pulled in as part of an LDAP sync

# If this option is set to true it will break the default home folder provider as space names can not contain \

ldap.authentication.escapeCommasInUid=false

#passthru.authentication.servers=DOMAIN1\\aso.es


- Tampoco puedo entrar con el usuario administrado -> admin

¿Que puede estar pasando?
Gracias.

[vam]

Cuando escribí antes, me confundí, esta línea debe tener el valro 'true'

ldap.authentication.active=true

Ya no debería de darte problemas. A ver que tal

[pedrol]

Me sigue dando usuario y contraseña incorrecta para los usuarios del dominio que estoy probando y también con el usuario admin de alfresco.

??

[vam]

¿Esta línea la tienes en el fichero?
authentication.chain=ldap1:ldap

Es que no la has puesto en el mensaje y no sé si es que no la tienes puesta en el fichero de configuración o que se te ha pasado escribirla en el mensaje. Si te falta, puede ser de esto. De esta manera solo se conectarían los usuarios del directorio activo, si además vais a crear usuarios en alfresco deberías de poner:

authentication.chain=ldap1:ldap,alfrescoNTLM1:alfrescoNTLM

[pedrol]

Nada, no se consigue entrar ni con el usuario administrador.

te pongo el fichero de configuración completo.

###############################

## Common Alfresco Properties #

###############################


#

# Sample custom content and index data location

#————-

dir.root=/var/lib/alfresco/alf_data


#

# Sample database connection properties

#————-

db.name=alfresco

db.username=alfresco

db.password=alfresco

db.host=localhost

db.port=3306



#

# External locations

#————-

#ooo.exe=soffice

#ooo.enabled=false

#img.root=./ImageMagick

#swf.exe=./bin/pdf2swf



#

# MySQL connection

#————-

db.driver=org.gjt.mm.mysql.Driver

db.url=jdbc:mysql://localhost/alfresco

hibernate.dialect=org.hibernate.dialect.MySQLInnoDBDialect

#

# PostgreSQL connection (requires postgresql-8.2-504.jdbc3.jar or equivalent)

#

#db.driver=org.postgresql.Driver

#db.url=jdbcostgresql://localhost:5432/alfresco



#

# Index Recovery Mode

#————-

#index.recovery.mode=AUTO



#

# Outbound Email Configuration

#————-

#mail.host=

#mail.port=25

#mail.username=anonymous

#mail.password=

#mail.encoding=UTF-8

#mail.from.default=alfresco@alfresco.org

#mail.smtp.auth=false



#

# Alfresco Email Service and Email Server

#————-



# Enable/Disable the inbound email service.  The service could be used by processes other than

# the Email Server (e.g. direct RMI access) so this flag is independent of the Email Service.

#————-

#email.inbound.enabled=true



# Email Server properties

#————-

#email.server.enabled=true

#email.server.port=25

#email.server.domain=alfresco.com

#email.inbound.unknownUser=anonymous



# A comma separated list of email REGEX patterns of allowed senders.

# If there are any values in the list then all sender email addresses

# must match. For example:

#   .*\@alfresco\.com, .*\@alfresco\.org

# Allow anyone:

#————-

#email.server.allowed.senders=.*



#

# The default authentication chain

# To configure external authentication subsystems see:

# http://wiki.alfresco.com/wiki/Alfresco_Authentication_Subsystems

#————-

#authentication.chain=alfrescoNtlm1:alfrescoNtlm

#authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1assthru,ldap1:ldap



authentication.chain=ldap1:ldap,alfrescoNtlm1:alfrescoNtlm


#

# URL Generation Parameters (The ${localname} token is replaced by the local server name)

#————-

#alfresco.context=alfresco

#alfresco.host=${localname}

#alfresco.port=8080

#alfresco.protocol=http

#

#share.context=share

#share.host=${localname}

#share.port=8080

#share.protocol=http





ldap.authentication.active=true



ldap.authentication.allowGuestLogin=true



# How to map the user id entered by the user to taht passed through to LDAP

# - simple

# - this must be a DN and would be something like

# CN=%s,DC=company,DC=com

# - digest

# - usually pass through what is entered

# %s

#ldap.authentication.userNameFormat=CN=%s,DC=aso,DC=es



ldap.authentication.userNameFormat=%s@aso.es



# The LDAP context factory to use

ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory



# The URL to connect to the LDAP server

ldap.authentication.java.naming.provider.url=ldap://10.***.**.**:389



# The authentication mechanism to use

#ldap.authentication.java.naming.security.authentication=DIGEST-MD5

ldap.authentication.java.naming.security.authentication=simple



# The default principal to use (only used for LDAP sync)

#ldap.authentication.java.naming.security.principal=CN=alfresco,DC=aso,DC=es



# The password for the default principal (only used for LDAP sync)

#ldap.authentication.java.naming.security.credentials=alfresco



# Escape commas entered by the user at bind time

# Useful when using simple authentication and the CN is part of the DN and contains commas

ldap.authentication.escapeCommasInBind=false



# Escape commas entered by the user when setting the authenticated user

# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is

# pulled in as part of an LDAP sync

# If this option is set to true it will break the default home folder provider as space names can not contain \

ldap.authentication.escapeCommasInUid=false



#passthru.authentication.servers=DOMAIN1\\aso.es

[pedrol]

Ya puede conectar correctamente con LDAP.

VAN muchas gracias por todo, me has sido de mucha ayuda, ya llevaba varios días intentando configurarlo.

Después de configurarlo como me has dicho, he reiniciado la máquina y perfecto.

     

Muchas gracias…

[vam]

Debería de dejarte entrar con el login del usuario y contraseña, pero prueba a introducir en el usuario: login@tudominio. si esto no funciona, modifica la siguiente línea, a ver si de esta manera te dejase.
ldap.authentication.userNameFormat=CN=%s,DC=aso,DC=es

Al configurarlo para la autenticación con el directorio activo, con el usuario admin, no puedes entrar.