掲示板
Liferay 6.1 GA2 CE is not importing all users from Active Directory
11年前 に Marek Najmajer によって更新されました。
Liferay 6.1 GA2 CE is not importing all users from Active Directory
New Member 投稿: 1 参加年月日: 13/01/17 最新の投稿
We are preparing a Proof-of-Concept for Liferay-AD-Alfresco integration.
After setting up authentication and user import from Active Director I realized, there are only 700 from total 4000 active users imported!
I've tested user import clicking button "Test LDAP Users" and learned that there are many users with no asterisks in Password column.
Under the sample user table there was a comment:
"The above results include users which are missing the required attributes (Screen Name, Password, Email Address, First Name, and Last Name). These users will not be imported until these attributes are filled in."
And in fact I analyzed it with LDAP Browser with a ldap query: (&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(userPassword=*))) finding even more guys without password visible.
Microsoft says something about differences between userPassword and unicodePwd with the former visible through LDAP and the latter invisible.
Anyway is there any solution for this problem?
Or we must do an epic failure with our concept unproven?
Here is the configuration implemented through Control Panel\Portal Settings\Authentication\LDAP:
LDAP: Enabled (but not Required)
Default Values: (to start with) Microsoft Active Directory Server
Base Provider URL: ldap://10.12.201.222:389
Base DN: dc=ca,dc=company,dc=com
Principal: cn=administrator,cn=users,dc=ca,dc=company,dc=com
Credentials: (administrator password)
Authentication Search Filter: (&(objectCategory=person)(sAMAccountName=@screen_name@))
Import Search Filter: (&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
Screen Name: sAMAccountName
Password: userPassword
Email Address: mail
Full Name: cn
First Name: givenName
Last Name: sn
Job Title: title
Group: memberOf
Import Search Filter: (objectClass=groupOfUniqueNames)
Group Name: cn
Description: description
User: uniqueMember
Import Enabled: Checked
Import on Startup Enabled: Checked
Use LDAP Password Policy: Unchecked
After setting up authentication and user import from Active Director I realized, there are only 700 from total 4000 active users imported!
I've tested user import clicking button "Test LDAP Users" and learned that there are many users with no asterisks in Password column.
Under the sample user table there was a comment:
"The above results include users which are missing the required attributes (Screen Name, Password, Email Address, First Name, and Last Name). These users will not be imported until these attributes are filled in."
And in fact I analyzed it with LDAP Browser with a ldap query: (&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(userPassword=*))) finding even more guys without password visible.
Microsoft says something about differences between userPassword and unicodePwd with the former visible through LDAP and the latter invisible.
Anyway is there any solution for this problem?
Or we must do an epic failure with our concept unproven?
Here is the configuration implemented through Control Panel\Portal Settings\Authentication\LDAP:
LDAP: Enabled (but not Required)
Default Values: (to start with) Microsoft Active Directory Server
Base Provider URL: ldap://10.12.201.222:389
Base DN: dc=ca,dc=company,dc=com
Principal: cn=administrator,cn=users,dc=ca,dc=company,dc=com
Credentials: (administrator password)
Authentication Search Filter: (&(objectCategory=person)(sAMAccountName=@screen_name@))
Import Search Filter: (&(objectClass=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
Screen Name: sAMAccountName
Password: userPassword
Email Address: mail
Full Name: cn
First Name: givenName
Last Name: sn
Job Title: title
Group: memberOf
Import Search Filter: (objectClass=groupOfUniqueNames)
Group Name: cn
Description: description
User: uniqueMember
Import Enabled: Checked
Import on Startup Enabled: Checked
Use LDAP Password Policy: Unchecked