Hi, I Just installed alfresco 5.0d and have zimbra running on another server. I'd configure authentication for Alfresco against the Zimbra LDAP and it works fine for a while, but after some time (like 30 minutes) it stop working.
On my alfresco.log i can see a timeout exception, but the weird thing is that it work for a while and if i restart my alfresco it get back for some more time, can anyone helpme?
This is the exception i get:
2015-08-03 16:46:17,417 DEBUG [org.alfresco.repo.security.authentication.ldap.LDAPAuthenticationComponentImpl][http-apr-80-exec-2] Failed to authenticate user "some.user@boos.com.co"'ou=people,dc=boos,dc=com,dc=co' at com.sun.jndi.ldap.Connection.readReply(Connection.java:478) at com.sun.jndi.ldap.LdapClient.getSearchReply(LdapClient.java:640) at com.sun.jndi.ldap.LdapClient.search(LdapClient.java:563) at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1985) at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1844) at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1769) at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1786) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentDirContext.java:418) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:396) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(PartialCompositeDirContext.java:378) at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:286) at org.alfresco.repo.security.sync.ldap.LDAPUserRegistry.resolveDistinguishedName(LDAPUserRegistry.java:962)
And This is my /opt/alfresco/tomcat/shared/classes/alfresco/extension/subsystems/Authentication/ldap/ldapBoos/ldap-authentication.properties (the server, user and password are ok on the original file):
# This flag enables use of this LDAP subsystem for authentication. It may be # that this subsytem should only be used for synchronization,in which case # this flag should be set to false. ldap.authentication.active=true # # This properties file brings together the common options for LDAP authentication rather than editing the bean definitions # ldap.authentication.allowGuestLogin=false # How to map the user id entered by the user to that passed through to LDAP # - simple # -this must be a DN and would be something like # uid=%s,ou=People,dc=company,dc=com # - digest # - usually pass through what is entered # %s # If not set, an LDAP query involving ldap.synchronization.personQuery and ldap.synchronization.userIdAttributeName will # be performed to resolve the DN dynamically. This allows directories to be structured and doesn't require the user ID to # appear in the DN. ldap.authentication.userNameFormat= # The LDAP context factory to use ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory # The URL to connect to the LDAP server ldap.authentication.java.naming.provider.url=ldap://myserver.boos.com.co:389 # The authentication mechanism to use for password validation ldap.authentication.java.naming.security.authentication=simple # Escape commas entered by the user at bind time # Useful when using simple authentication and the CN is part of the DN and contains commas ldap.authentication.escapeCommasInBind=false # Escape commas entered by the user when setting the authenticated user # Useful when using simple authentication and the CN is part of the DN and contains commas, and the escaped \, is # pulled in as part of an LDAP sync # If this option is set to true it will break the default home folder provider as space names can not contain \ ldap.authentication.escapeCommasInUid=false # Comma separated list of user names who should be considered administrators by default #ldap.authentication.defaultAdministratorUserNames=some.user@boos.com.co # This flag enables use of this LDAP subsystem for user and group # synchronization. It may be that this subsytem should only be used for # authentication, in which case this flag should be set to false. ldap.synchronization.active=true # The authentication mechanism to use for synchronization ldap.synchronization.java.naming.security.authentication=simple # The default principal to use (only used for LDAP sync) ldap.synchronization.java.naming.security.principal=uid\=zimbra,cn\=admins,cn\=zimbra # The password for the default principal (only used for LDAP sync) ldap.synchronization.java.naming.security.credentials=XXXXXXXX # If positive, this property indicates that RFC 2696 paged results should be # used to split query results into batches of the specified size. This # overcomes any size limits imposed by the LDAP server. ldap.synchronization.queryBatchSize=0 # If positive, this property indicates that range retrieval should be used to fetch # multi-valued attributes (such as member) in batches of the specified size. # Overcomes any size limits imposed by Active Directory. ldap.synchronization.attributeBatchSize=0 # The query to select all objects that represent the groups to import. ldap.synchronization.groupQuery=(objectclass\=zimbraDistributionList) # The query to select objects that represent the groups to import that have changed since a certain time. ldap.synchronization.groupDifferentialQuery=(&(objectclass\=zimbraDistributionList)(!(modifyTimestamp< \={0}))) # The query to select all objects that represent the users to import. ldap.synchronization.personQuery=(objectClass\=organizationalPerson) # The query to select objects that represent the users to import that have changed since a certain time. ldap.synchronization.personDifferentialQuery=(&(objectclass\=organizationalPerson)(!(modifyTimestamp<\={0}))) # The group search base restricts the LDAP group query to a sub section of tree on the LDAP server. ldap.synchronization.groupSearchBase=cn\=groups,dc\=boos,dc\=com,dc\=co # The user search base restricts the LDAP user query to a sub section of tree on the LDAP server. ldap.synchronization.userSearchBase=ou\=people,dc\=boos,dc\=com,dc\=co # The name of the operational attribute recording the last update time for a group or user. ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp # The timestamp format. Unfortunately, this varies between directory servers. ldap.synchronization.timestampFormat=yyyyMMddHHmmss'Z' # The attribute name on people objects found in LDAP to use as the uid in Alfresco ldap.synchronization.userIdAttributeName=mail # The attribute on person objects in LDAP to map to the first name property in Alfresco ldap.synchronization.userFirstNameAttributeName=givenName # The attribute on person objects in LDAP to map to the last name property in Alfresco ldap.synchronization.userLastNameAttributeName=sn # The attribute on person objects in LDAP to map to the email property in Alfresco ldap.synchronization.userEmailAttributeName=mail # The attribute on person objects in LDAP to map to the organizational id property in Alfresco ldap.synchronization.userOrganizationalIdAttributeName=cn # The default home folder provider to use for people created via LDAP import ldap.synchronization.defaultHomeFolderProvider=userHomesHomeFolderProvider # The attribute on LDAP group objects to map to the authority name property in Alfresco ldap.synchronization.groupIdAttributeName=mail # The attribute on LDAP group objects to map to the authority display name property in Alfresco ldap.synchronization.groupDisplayNameAttributeName=mail # The group type in LDAP ldap.synchronization.groupType=zimbraDistributionList # The person type in LDAP ldap.synchronization.personType=organizationalPerson # The attribute in LDAP on group objects that defines the DN for its members ldap.synchronization.groupMemberAttributeName=zimbraMailForwardingAddress # If true progress estimation is enabled. When enabled, the user query has to be run twice in order to count entries. ldap.synchronization.enableProgressEstimation=true # Requests timeout, in miliseconds, use 0 for none (default) ldap.authentication.java.naming.read.timeout=10000 # Cada cuanto sincroniza? synchronization.import.cron=0 1 * * * ? # Sincronizar al iniciar synchronization.syncOnStartup=true