Set up Liferay 61. RC1 on a Windows Server 2008 R2 using a SQL Server database. I have managed to import from Active Directory the users I want. However, I cannot log in using the credentials of a user that has been imported. Worked in 6.0.6 (set up the same way) but not the release candidate.

portal-ext.properties (password not imported as shouldn't it pass through credentials?)



Authentication search filter is set to (&(objectCategory=person)(sAMAccountName=@screen_name@))

When I log in, I don't see anything in the Tomcat console window.

Just a guess:

Why is password import disabled, but password autogeneration is true?
Either that second setting has no value, or it could cause LR to generate new passwords during import, which then are probably different from the LDAP version.
What happens if you change it to false?

It worked with the current stable 6.0.6 version, so thought it should with this one. However, I don't see how Liferay distinguishes and imported LDAP user from one created in the portal itself (just from looking at the User_ table). Based on Use case B in Keeping user passwords secure

Ok, that makes sense.

Thank you also for the link, it increased my understanding of the LDAP integration.
However I am still worried what happens if a user is removed on LDAP, because then LR cannot import user data and things it has a local account only.
Which would mean the company decides to remove user credentials, but LR still let's that user in.

Hi Hiran,

There is an option in liferay to authentication user only from AD (LDAP) and will not allow other users that are not registered active user from AD.

In version 6.x goto Portal Settings->LDAP->Authentication check Required option.

I have the same issue of 6.1 RC2.

I can import MS-Active Director user into Liferay, but authentication failed.

Set to "Required" is not work.

It look like Liferay will import password, and then do authentication itself.
But in most situation, AD password is encrypted and cannot be gotten.
We just wants that Liferay can do authentication with AD, anybody knows how to do that?

Regads,

In 6.1.1 RC2 , it work.

Just setup correct LDAP setting. And check the "enable" + "use LDAP Policy", then
no mater using "screen name" or "e-mail", it will do authentication with AD.