Alfresco支持LDAP验证
这里说的活动目录指的是公司内的AD服务器。希望能通过AD账户来访问Alfresco网站并设置相应的权限。
根据alfresco的官方做法，需要配置一个验证链。
首先用alfrescoNtlm来提供Ntlm验证功能；其次用passthru子系统把用户提供的用户名和密码转交给AD服务器进行验证；最后加上一个ldap-ad在alfresco和AD其同步账户。
创建子系统配置文件
这里有三个子系统，分别是alfrescoNtlm，passthru和ldap-ad。
验证链
首先要在alfresco-global.properties里声明验证链
验证链的声明格式如下：
authentication.chain=id1:type1,id2:type2......idn:typen
所以需要加入以下验证链：
authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru,ldap1:ldap-ad
验证链的第一个一定要声明alfrescoNtlm，后面两个一个用来验证的，一个是用来同步的，所以顺序没有关系。
配置文件
新建以下三个目录
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/afrescoNtlm/alfrescoNtlm1 tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1 tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1
再把相应验证子系统中的properties文件拷贝到目录里，
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication# ls -R .: alfrescoNtlm ldap-ad passthru ./alfrescoNtlm: alfrescoNtlm1 ./alfrescoNtlm/alfrescoNtlm1: alfresco-authentication.properties ntlm-filter.properties ./ldap-ad: ldap1 ./ldap-ad/ldap1: ldap-ad-authentication.properties ./passthru: passthru1 ./passthru/passthru1: ntlm-filter.properties passthru-authentication-context.properties
alfrescoNtlm
ntlm-filter.properties
ntlm.authentication.sso.enabled=false ntlm.authentication.mapUnknownUserToGuest=falsen tlm.authentication.browser.ticketLogons=true
alfresco-authentication.properties
alfresco.authentication.allowGuestLogin=false alfresco.authentication.authenticateCIFS=false
passthru
ntlm-filter.properties
tlm.authentication.sso.enabled=false^M ntlm.authentication.mapUnknownUserToGuest=false^M ntlm.authentication.browser.ticketLogons=true
passthru-authentication-context.properties
passthru.authentication.useLocalServer=false passthru.authentication.domain=hapsh.hitachi.com passthru.authentication.servers=192.168.1.5 passthru.authentication.guestAccess=false passthru.authentication.defaultAdministratorUserNames=2023
#Timeout value when opening a session to an authentication server, in milliseconds passthru.authentication.connectTimeout=5000 #Offline server check interval in seconds passthru.authentication.offlineCheckInterval=300 passthru.authentication.protocolOrder=NetBIOS,TCPIP passthru.authentication.authenticateCIFS=true passthru.authentication.authenticateFTP=true
ldap-ad
ldap-ad-authentication.properties
# This flag enables use of this LDAP subsystem for authentication. It may be # that this subsytem should only be used for synchronization, in which case # this flag should be set to false. ldap.authentication.active=false # # This properties file brings together the common options for LDAP authentication rather than editing the bean definitions # ldap.authentication.allowGuestLogin=false # How to map the user id entered by the user to taht passed through to LDAP # In Active Directory, this can either be the user principal name (UPN) or DN. # UPNs are in the form @domain and are held in the userPrincipalName attribute of a user ldap.authentication.userNameFormat=%[email protected]
# The LDAP context factory to use
ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
# The URL to connect to the LDAP server
ldap.authentication.java.naming.provider.url=ldap://192.168.1.5:389
# The authentication mechanism to use for password validation
ldap.authentication.java.naming.security.authentication=simple
# Escape commas entered by the user at bind time
# Useful when using simple authentication and the CN is part of the DN and contains commas
ldap.authentication.escapeCommasInBind=false
# Escape commas entered by the user when setting the authenticated user
# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
# pulled in as part of an LDAP sync
# If this option is set to true it will break the default home folder provider as space names can not contain \
ldap.authentication.escapeCommasInUid=false
# Comma separated list of user names who should be considered administrators by default
ldap.authentication.defaultAdministratorUserNames=administrator
# This flag enables use of this LDAP subsystem for user and group
# synchronization. It may be that this subsytem should only be used for
# authentication, in which case this flag should be set to false.
ldap.synchronization.active=true
# The authentication mechanism to use for synchronization
ldap.synchronization.java.naming.security.authentication=simple
# The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
ldap.synchronization.java.naming.security.principal=administrator@domain.local
# The password for the default principal (only used for LDAP sync)
ldap.synchronization.java.naming.security.credentials=password
# If positive, this property indicates that RFC 2696 paged results should be
# used to split query results into batches of the specified size. This
# overcomes any size limits imposed by the LDAP server.
ldap.synchronization.queryBatchSize=1000
# If positive, this property indicates that range retrieval should be used to fetch
# multi-valued attributes (such as member) in batches of the specified size.
# Overcomes any size limits imposed by Active Directory.
ldap.synchronization.attributeBatchSize=1000
# The query to select all objects that represent the groups to import.
ldap.synchronization.groupQuery=(objectclass\=group)
# The query to select objects that represent the groups to import that have changed since a certain time.
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))
# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(
userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))
# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
ldap.synchronization.groupSearchBase=DC\=Domain,DC\=local
# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
ldap.synchronization.userSearchBase=DC\=Domain,DC\=local
# The name of the operational attribute recording the last update time for a group or user. ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp # The timestamp format. Unfortunately, this varies between directory servers. ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z' # The attribute name on people objects found in LDAP to use as the uid in Alfresco ldap.synchronization.userIdAttributeName=sAMAccountName # The attribute on person objects in LDAP to map to the first name property in Alfresco ldap.synchronization.userFirstNameAttributeName=givenName # The attribute on person objects in LDAP to map to the last name property in Alfresco ldap.synchronization.userLastNameAttributeName=sn # The attribute on person objects in LDAP to map to the email property in Alfresco ldap.synchronization.userEmailAttributeName=mail # The attribute on person objects in LDAP to map to the organizational id property in Alfresco ldap.synchronization.userOrganizationalIdAttributeName=company # The default home folder provider to use for people created via LDAP import ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider # The attribute on LDAP group objects to map to the authority name property in Alfresco ldap.synchronization.groupIdAttributeName=cn # The attribute on LDAP group objects to map to the authority display name property in Alfresco ldap.synchronization.groupDisplayNameAttributeName=displayName # The group type in LDAP ldap.synchronization.groupType=group # The person type in LDAP ldap.synchronization.personType=user # The attribute in LDAP on group objects that defines the DN for its members ldap.synchronization.groupMemberAttributeName=member # If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries. ldap.synchronization.enableProgressEstimation=true
注意事项
- 所有的配置更改后都必须重启服务
- ldap-ad中的验证功能必须关闭，否则和passthru冲突
- AD的UPN是%[email protected]