Liferay 6.1 RC1 - LDAP import works, authentication doesn't

[Sam Collett，修改在12 年前。]

Set up Liferay 61. RC1 on a Windows Server 2008 R2 using a SQL Server database. I have managed to import from Active Directory the users I want. However, I cannot log in using the credentials of a user that has been imported. Worked in 6.0.6 (set up the same way) but not the release candidate.

portal-ext.properties (password not imported as shouldn't it pass through credentials?)

ldap.import.interval=100
ldap.import.method=group
ldap.import.enabled=true
ldap.import.on.startup=true
ldap.import.user.password.enabled=false 
ldap.import.user.password.autogenerated=true

Authentication search filter is set to (&(objectCategory=person)(sAMAccountName=@screen_name@))

When I log in, I don't see anything in the Tomcat console window.

[Hiran Chaudhuri，修改在12 年前。]

Sam Collett:

Set up Liferay 61. RC1 on a Windows Server 2008 R2 using a SQL Server database. I have managed to import from Active Directory the users I want. However, I cannot log in using the credentials of a user that has been imported. Worked in 6.0.6 (set up the same way) but not the release candidate.

portal-ext.properties (password not imported as shouldn't it pass through credentials?)

ldap.import.user.password.enabled=false 
ldap.import.user.password.autogenerated=true

Just a guess:

Why is password import disabled, but password autogeneration is true?
Either that second setting has no value, or it could cause LR to generate new passwords during import, which then are probably different from the LDAP version.
What happens if you change it to false?

[Sam Collett，修改在12 年前。]

Hiran Chaudhuri:

Just a guess:

Why is password import disabled, but password autogeneration is true?
Either that second setting has no value, or it could cause LR to generate new passwords during import, which then are probably different from the LDAP version.
What happens if you change it to false?

It worked with the current stable 6.0.6 version, so thought it should with this one. However, I don't see how Liferay distinguishes and imported LDAP user from one created in the portal itself (just from looking at the User_ table). Based on Use case B in Keeping user passwords secure

[Hiran Chaudhuri，修改在12 年前。]

Sam Collett:

Hiran Chaudhuri:

Why is password import disabled, but password autogeneration is true?

It worked with the current stable 6.0.6 version, so thought it should with this one. However, I don't see how Liferay distinguishes and imported LDAP user from one created in the portal itself (just from looking at the User_ table). Based on Use case B in Keeping user passwords secure

Ok, that makes sense.

Thank you also for the link, it increased my understanding of the LDAP integration.
However I am still worried what happens if a user is removed on LDAP, because then LR cannot import user data and things it has a local account only.
Which would mean the company decides to remove user credentials, but LR still let's that user in.

[Michael John Macrohon，修改在11 年前。]

Hi Hiran,

There is an option in liferay to authentication user only from AD (LDAP) and will not allow other users that are not registered active user from AD.

In version 6.x goto Portal Settings->LDAP->Authentication check Required option.

[Scharwenka Wu，修改在11 年前。]

I have the same issue of 6.1 RC2.

I can import MS-Active Director user into Liferay, but authentication failed.

Set to "Required" is not work.

It look like Liferay will import password, and then do authentication itself.
But in most situation, AD password is encrypted and cannot be gotten.
We just wants that Liferay can do authentication with AD, anybody knows how to do that?

Regads,

[Scharwenka Wu，修改在11 年前。]

In 6.1.1 RC2 , it work.

Just setup correct LDAP setting. And check the "enable" + "use LDAP Policy", then
no mater using "screen name" or "e-mail", it will do authentication with AD.

[Gustavo Pimenta，修改在10 年前。]

Scharwenka Wu:

In 6.1.1 RC2 , it work.

Just setup correct LDAP setting. And check the "enable" + "use LDAP Policy", then
no mater using "screen name" or "e-mail", it will do authentication with AD.

Hello!!!
What would be the correct LDAP setting?
Could you please give a screenshot?