Alfresco支持LDAP验证 - 安装部署 - Alfresco技术论坛

Alfresco技术论坛



查看: 2687|回复: 0

Alfresco支持LDAP验证

  [复制链接]


40

主题

41

帖子

427

积分

管理员

Rank: 9Rank: 9Rank: 9

积分
427
QQ
发表于 2019-5-7 20:18:45 | 显示全部楼层 |阅读模式
来源网络,实际是否有效本人没有验证过

这里说的活动目录指的是公司内的AD服务器。希望能通过AD账户来访问Alfresco网站并设置相应的权限。
  
根据alfresco的官方做法,需要配置一个验证链。
  
首先用alfrescoNtlm来提供Ntlm验证功能;其次用passthru子系统把用户提供的用户名和密码转交给AD服务器进行验证;最后加上一个ldap-ad在alfresco和AD其同步账户。

创建子系统配置文件   
这里有三个子系统,分别是alfrescoNtlm,passthru和ldap-ad。

验证链   
首先要在alfresco-global.properties里声明验证链
验证链的声明格式如下:
  1. authentication.chain=id1:type1,id2:type2......idn:typen
复制代码
所以需要加入以下验证链:
  1. authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru,ldap1:ldap-ad
复制代码
验证链的第一个一定要声明alfrescoNtlm,后面两个一个用来验证的,一个是用来同步的,所以顺序没有关系。

配置文件
新建以下三个目录
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/afrescoNtlm/alfrescoNtlm1
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1

再把相应验证子系统中的properties文件拷贝到目录里,
  1. tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication# ls -R
  2. .:
  3. alfrescoNtlm  ldap-ad  passthru

  4. ./alfrescoNtlm:
  5. alfrescoNtlm1

  6. ./alfrescoNtlm/alfrescoNtlm1:
  7. alfresco-authentication.properties  ntlm-filter.properties

  8. ./ldap-ad:
  9. ldap1

  10. ./ldap-ad/ldap1:
  11. ldap-ad-authentication.properties

  12. ./passthru:
  13. passthru1

  14. ./passthru/passthru1:
  15. ntlm-filter.properties  passthru-authentication-context.properties
复制代码

alfrescoNtlmntlm-filter.properties
  1. ntlm.authentication.sso.enabled=false
  2. ntlm.authentication.mapUnknownUserToGuest=falsen
  3. tlm.authentication.browser.ticketLogons=true
复制代码
alfresco-authentication.properties
  1. alfresco.authentication.allowGuestLogin=false
  2. alfresco.authentication.authenticateCIFS=false
复制代码

passthruntlm-filter.properties
  1. tlm.authentication.sso.enabled=false^M
  2. ntlm.authentication.mapUnknownUserToGuest=false^M
  3. ntlm.authentication.browser.ticketLogons=true
复制代码
passthru-authentication-context.properties



  1. passthru.authentication.useLocalServer=false
  2. passthru.authentication.domain=hapsh.hitachi.com
  3. passthru.authentication.servers=192.168.1.5
  4. passthru.authentication.guestAccess=false
  5. passthru.authentication.defaultAdministratorUserNames=2023
复制代码
  1. #Timeout value when opening a session to an authentication server, in milliseconds passthru.authentication.connectTimeout=5000 #Offline server check interval in seconds passthru.authentication.offlineCheckInterval=300 passthru.authentication.protocolOrder=NetBIOS,TCPIP passthru.authentication.authenticateCIFS=true passthru.authentication.authenticateFTP=true
复制代码

ldap-adldap-ad-authentication.properties
  1. # This flag enables use of this LDAP subsystem for authentication. It may be
  2. # that this subsytem should only be used for synchronization, in which case
  3. # this flag should be set to false.
  4. ldap.authentication.active=false

  5. #
  6. # This properties file brings together the common options for LDAP authentication rather than editing the bean definitions
  7. #
  8. ldap.authentication.allowGuestLogin=false
  9. #
  10. How to map the user id entered by the user to taht passed through to LDAP
  11. # In Active Directory, this can either be the user principal name (UPN) or DN.
  12. # UPNs are in the form @domain and are held in the userPrincipalName attribute of a user
  13. ldap.authentication.userNameFormat=%s@doamin.local
复制代码
  1. # The LDAP context factory to use
  2. ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory

  3. # The URL to connect to the LDAP server
  4. ldap.authentication.java.naming.provider.url=ldap://192.168.1.5:389

  5. # The authentication mechanism to use for password validation
  6. ldap.authentication.java.naming.security.authentication=simple

  7. # Escape commas entered by the user at bind time
  8. # Useful when using simple authentication and the CN is part of the DN and contains commas
  9. ldap.authentication.escapeCommasInBind=false

  10. # Escape commas entered by the user when setting the authenticated user
  11. # Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is
  12. # pulled in as part of an LDAP sync
  13. # If this option is set to true it will break the default home folder provider as space names can not contain \
  14. ldap.authentication.escapeCommasInUid=false

  15. # Comma separated list of user names who should be considered administrators by default
  16. ldap.authentication.defaultAdministratorUserNames=administrator

  17. # This flag enables use of this LDAP subsystem for user and group
  18. # synchronization. It may be that this subsytem should only be used for
  19. # authentication, in which case this flag should be set to false.
  20. ldap.synchronization.active=true

  21. # The authentication mechanism to use for synchronization
  22. ldap.synchronization.java.naming.security.authentication=simple

  23. # The default principal to bind with (only used for LDAP sync). This should be a UPN or DN
  24. ldap.synchronization.java.naming.security.principal=administrator@domain.local

  25. # The password for the default principal (only used for LDAP sync)
  26. ldap.synchronization.java.naming.security.credentials=password

  27. # If positive, this property indicates that RFC 2696 paged results should be
  28. # used to split query results into batches of the specified size. This
  29. # overcomes any size limits imposed by the LDAP server.
  30. ldap.synchronization.queryBatchSize=1000

  31. # If positive, this property indicates that range retrieval should be used to fetch
  32. # multi-valued attributes (such as member) in batches of the specified size.
  33. # Overcomes any size limits imposed by Active Directory.      
  34. ldap.synchronization.attributeBatchSize=1000

  35. # The query to select all objects that represent the groups to import.
  36. ldap.synchronization.groupQuery=(objectclass\=group)

  37. # The query to select objects that represent the groups to import that have changed since a certain time.
  38. ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))

  39. # The query to select all objects that represent the users to import.
  40. ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))

  41. # The query to select objects that represent the users to import that have changed since a certain time.
  42. ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(
  43. userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))

  44. # The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
  45. ldap.synchronization.groupSearchBase=DC\=Domain,DC\=local

  46. # The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
  47. ldap.synchronization.userSearchBase=DC\=Domain,DC\=local
复制代码
  1. # The name of the operational attribute recording the last update time for a group or user.
  2. ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp

  3. # The timestamp format. Unfortunately, this varies between directory servers.
  4. ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'

  5. # The attribute name on people objects found in LDAP to use as the uid in Alfresco
  6. ldap.synchronization.userIdAttributeName=sAMAccountName

  7. # The attribute on person objects in LDAP to map to the first name property in Alfresco
  8. ldap.synchronization.userFirstNameAttributeName=givenName

  9. # The attribute on person objects in LDAP to map to the last name property in Alfresco
  10. ldap.synchronization.userLastNameAttributeName=sn

  11. # The attribute on person objects in LDAP to map to the email property in Alfresco
  12. ldap.synchronization.userEmailAttributeName=mail

  13. # The attribute on person objects in LDAP to map to the organizational id  property in Alfresco
  14. ldap.synchronization.userOrganizationalIdAttributeName=company

  15. # The default home folder provider to use for people created via LDAP import
  16. ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider

  17. # The attribute on LDAP group objects to map to the authority name property in Alfresco
  18. ldap.synchronization.groupIdAttributeName=cn

  19. # The attribute on LDAP group objects to map to the authority display name property in Alfresco
  20. ldap.synchronization.groupDisplayNameAttributeName=displayName

  21. # The group type in LDAP
  22. ldap.synchronization.groupType=group

  23. # The person type in LDAP
  24. ldap.synchronization.personType=user

  25. # The attribute in LDAP on group objects that defines the DN for its members
  26. ldap.synchronization.groupMemberAttributeName=member

  27. # If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.
  28. ldap.synchronization.enableProgressEstimation=true
复制代码

注意事项
  • 所有的配置更改后都必须重启服务
  • ldap-ad中的验证功能必须关闭,否则和passthru冲突
  • AD的UPN是%s@domain.local

回复

使用道具 举报

您需要登录后才可以回帖 登录 | 立即注册

本版积分规则



QQ|小黑屋| Alfresco技术论坛 ( 闽ICP备15015720号 )

GMT+8, 2020-2-27 12:40 , Processed in 0.106764 second(s), 19 queries .

快速回复 返回顶部 返回列表