這里說的活動目錄指的是公司內(nèi)的AD服務(wù)器。希望能通過AD賬戶來訪問Alfresco網(wǎng)站并設(shè)置相應(yīng)的權(quán)限。
根據(jù)alfresco的官方做法，需要配置一個驗證鏈。
首先用alfrescoNtlm來提供Ntlm驗證功能；其次用passthru子系統(tǒng)把用戶提供的用戶名和密碼轉(zhuǎn)交給AD服務(wù)器進行驗證；最后加上一個ldap-ad在alfresco和AD其同步賬戶。
這里有三個子系統(tǒng)，分別是alfrescoNtlm，passthru和ldap-ad。
首先要在alfresco-global.properties里聲明驗證鏈
驗證鏈的聲明格式如下：
authentication.chain=id1:type1,id2:type2......idn:typen
所以需要加入以下驗證鏈：
authentication.chain=alfrescoNtlm1:alfrescoNtlm,passthru1:passthru,ldap1:ldap-ad
驗證鏈的第一個一定要聲明alfrescoNtlm，后面兩個一個用來驗證的，一個是用來同步的，所以順序沒有關(guān)系。
新建以下三個目錄
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/afrescoNtlm/alfrescoNtlm1tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/passthru/passthru1tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication/ldap-ad/ldap1
再把相應(yīng)驗證子系統(tǒng)中的properties文件拷貝到目錄里，
tomcat/webapps/alfresco/WEB-INF/classes/alfresco/extension/subsystems/Authentication# ls -R.:alfrescoNtlm ldap-ad passthru./alfrescoNtlm:alfrescoNtlm1./alfrescoNtlm/alfrescoNtlm1:alfresco-authentication.properties ntlm-filter.properties./ldap-ad:ldap1./ldap-ad/ldap1:ldap-ad-authentication.properties./passthru:passthru1./passthru/passthru1:ntlm-filter.properties passthru-authentication-context.properties
ntlm-filter.properties
ntlm.authentication.sso.enabled=falsentlm.authentication.mapUnknownUserToGuest=falsentlm.authentication.browser.ticketLogons=true
alfresco-authentication.properties
alfresco.authentication.allowGuestLogin=falsealfresco.authentication.authenticateCIFS=false
ntlm-filter.properties
tlm.authentication.sso.enabled=false^Mntlm.authentication.mapUnknownUserToGuest=false^Mntlm.authentication.browser.ticketLogons=true
passthru-authentication-context.properties
passthru.authentication.useLocalServer=false passthru.authentication.domain=hapsh.hitachi.com passthru.authentication.servers=192.168.1.5 passthru.authentication.guestAccess=false passthru.authentication.defaultAdministratorUserNames=2023
#Timeout value when opening a session to an authentication server, in milliseconds passthru.authentication.connectTimeout=5000 #Offline server check interval in seconds passthru.authentication.offlineCheckInterval=300 passthru.authentication.protocolOrder=NetBIOS,TCPIP passthru.authentication.authenticateCIFS=true passthru.authentication.authenticateFTP=true
ldap-ad-authentication.properties
# This flag enables use of this LDAP subsystem for authentication. It may be# that this subsytem should only be used for synchronization, in which case# this flag should be set to false.ldap.authentication.active=false## This properties file brings together the common options for LDAP authentication rather than editing the bean definitions#ldap.authentication.allowGuestLogin=false#How to map the user id entered by the user to taht passed through to LDAP# In Active Directory, this can either be the user principal name (UPN) or DN.# UPNs are in the form @domain and are held in the userPrincipalName attribute of a userldap.authentication.userNameFormat=%s@doamin.local
# The LDAP context factory to useldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory# The URL to connect to the LDAP serverldap.authentication.java.naming.provider.url=ldap://192.168.1.5:389# The authentication mechanism to use for password validationldap.authentication.java.naming.security.authentication=simple# Escape commas entered by the user at bind time# Useful when using simple authentication and the CN is part of the DN and contains commasldap.authentication.escapeCommasInBind=false# Escape commas entered by the user when setting the authenticated user# Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is# pulled in as part of an LDAP sync# If this option is set to true it will break the default home folder provider as space names can not contain ldap.authentication.escapeCommasInUid=false# Comma separated list of user names who should be considered administrators by defaultldap.authentication.defaultAdministratorUserNames=administrator# This flag enables use of this LDAP subsystem for user and group# synchronization. It may be that this subsytem should only be used for# authentication, in which case this flag should be set to false.ldap.synchronization.active=true# The authentication mechanism to use for synchronizationldap.synchronization.java.naming.security.authentication=simple# The default principal to bind with (only used for LDAP sync). This should be a UPN or DNldap.synchronization.java.naming.security.principal=administrator@domain.local# The password for the default principal (only used for LDAP sync)ldap.synchronization.java.naming.security.credentials=password# If positive, this property indicates that RFC 2696 paged results should be# used to split query results into batches of the specified size. This# overcomes any size limits imposed by the LDAP server.ldap.synchronization.queryBatchSize=1000# If positive, this property indicates that range retrieval should be used to fetch# multi-valued attributes (such as member) in batches of the specified size.# Overcomes any size limits imposed by Active Directory.ldap.synchronization.attributeBatchSize=1000# The query to select all objects that represent the groups to import.ldap.synchronization.groupQuery=(objectclass\=group)# The query to select objects that represent the groups to import that have changed since a certain time.ldap.synchronization.groupDifferentialQuery=(&(objectclass\=group)(!(modifyTimestamp<\={0})))# The query to select all objects that represent the users to import.ldap.synchronization.personQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))# The query to select objects that represent the users to import that have changed since a certain time.ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(modifyTimestamp<\={0})))# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.ldap.synchronization.groupSearchBase=DC\=Domain,DC\=local# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.ldap.synchronization.userSearchBase=DC\=Domain,DC\=local# The name of the operational attribute recording the last update time for a group or user.ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp# The timestamp format. Unfortunately, this varies between directory servers.ldap.synchronization.timestampFormat=yyyyMMddHHmmss'.0Z'# The attribute name on people objects found in LDAP to use as the uid in Alfrescoldap.synchronization.userIdAttributeName=sAMAccountName# The attribute on person objects in LDAP to map to the first name property in Alfrescoldap.synchronization.userFirstNameAttributeName=givenName# The attribute on person objects in LDAP to map to the last name property in Alfrescoldap.synchronization.userLastNameAttributeName=sn# The attribute on person objects in LDAP to map to the email property in Alfrescoldap.synchronization.userEmailAttributeName=mail# The attribute on person objects in LDAP to map to the organizational id property in Alfrescoldap.synchronization.userOrganizationalIdAttributeName=company# The default home folder provider to use for people created via LDAP importldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider# The attribute on LDAP group objects to map to the authority name property in Alfrescoldap.synchronization.groupIdAttributeName=cn# The attribute on LDAP group objects to map to the authority display name property in Alfrescoldap.synchronization.groupDisplayNameAttributeName=displayName# The group type in LDAPldap.synchronization.groupType=group# The person type in LDAPldap.synchronization.personType=user# The attribute in LDAP on group objects that defines the DN for its membersldap.synchronization.groupMemberAttributeName=member# If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries.ldap.synchronization.enableProgressEstimation=true
