Groups not syncing from LDAP | Community
Skip to main content
R
ramgopalm545617
Level 4
February 8, 2019
Question

Groups not syncing from LDAP

  • February 8, 2019
  • 3 replies
  • 2744 views

Hi,

we have recently changed the naming convention of the groups and now we see that the groups are not syncing from the LDAP, it is throwing warning saying that it is not able to recognize the whither it is a user or a group.

PFB configurations and error as well.

PID = org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider

  BundleLocation = Unbound

  adminPool.lookupOnValidate = false

  adminPool.maxActive = 8

  bind.dn = uid=appaem,ou=applicationids,ou=people,ou=intranet,dc=********,dc=com

  bind.password = XXXXXXXX

  customattributes = []

  group.baseDN = ou=groups,ou=intranet,dc=*******,dc=com

  group.extraFilter = (cn=AEM-EDAM-*-INT)

  group.makeDnPath = false

  group.memberAttribute = uniquemember

  group.nameAttribute = cn

  group.objectclass = [groupOfUniqueNames]

  host.name = ovdtest.******.com

  host.noCertCheck = true

  host.port = 636

  host.ssl = true

  host.tls = false

  provider.name = ovdidp

  searchTimeout = 60s

  service.pid = org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider

  useUidForExtId = false

  user.baseDN = ou=intranet,dc=********,dc=com

  user.extraFilter = (hmdynmemberof=AEM-EDAM-HHA-EVERYONE-INT)

  user.idAttribute = uid

  user.makeDnPath = false

  user.objectclass = [inetorgperson]

  userPool.lookupOnValidate = false

  userPool.maxActive = 8

Error log warning:

08.02.2019 01:03:57.940 *INFO* [qtp382561098-125692] org.apache.jackrabbit.oak.spi.security.authentication.external.impl.jmx.Delegatee synced DefaultSyncedIdentity{id='lid****', ref=ExternalIdentityRef{id='uid=lid****,ou=people,ou=intranet,dc=********,dc=com', providerName='ovdidp'}, isGroup=false, lastSynced=1549605837675}

08.02.2019 01:03:57.947 *WARN* [qtp382561098-125692] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider referenced identity is neither user or group: cn=AEM-EDAM-HHA-USERS-INT,ou=groups,ou=intranet,dc=********,dc=com;ovdidp

08.02.2019 01:03:57.947 *WARN* [qtp382561098-125692] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext No external group found for ref 'cn=AEM-EDAM-HHA-USERS-INT,ou=groups,ou=intranet,dc=********,dc=com;ovdidp'.

08.02.2019 01:03:57.952 *WARN* [qtp382561098-125692] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider referenced identity is neither user or group: cn=AEM-EDAM-HHA-ADMINS-INT,ou=groups,ou=intranet,dc=********,dc=com;ovdidp

08.02.2019 01:03:57.952 *WARN* [qtp382561098-125692] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext No external group found for ref 'cn=AEM-EDAM-HHA-ADMINS-INT,ou=groups,ou=intranet,dc=********,dc=com;ovdidp'

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

3 replies

Gaurav-Behl
Gaurav-Behl
Level 10
February 8, 2019

Check this snippet for error details -

Entry entry = connection.lookup(ref.getId(), "*");

  if (entry == null) {

  return null;

  } else if (entry.hasObjectClass(config.getUserConfig().getObjectClasses())) {

  return createUser(entry, null);

  } else if (entry.hasObjectClass(config.getGroupConfig().getObjectClasses())) {

  return createGroup(entry, null);

  } else {

  log.warn("referenced identity is neither user or group: {}", ref.getString());

  return null;

  }

source - https://svn.apache.org/repos/asf/jackrabbit/oak/branches/1.0/oak-auth-ldap/src/main/java/org/apache/jackrabbit/oak/secur…

I assume that you would have to create a fresh config with the updated group name.

https://helpx.adobe.com/experience-manager/using/configuring-aem6-apache-directory-service.html

R
ramgopalm545617Author
Level 4
February 12, 2019

I have deleted all the configs and manually recreated all the configurations, but still not able to sync the newly created groups.

I have tried with he property 'group.extraFilter = (cn=AEM-*-INT)', in this scenario, it is giving the below input. I think it is able to sync the other groups, but when the 'group.extraFilter = (cn=AEM-EDAM-*-INT)', it is not able to sync the groups, do you think that there is an issue with groups creation.

12.02.2019 05:52:43.655 *INFO* [qtp1538804081-3219] com.adobe.granite.security.user.internal.audit.AuditGroupAction User 'lid***' was added to the group 'AEM-EHS-WORKFLOWUSERS-INT'

12.02.2019 05:52:43.658 *INFO* [qtp1538804081-3219] com.adobe.granite.security.user.internal.audit.AuditGroupAction User 'lid***' was added to the group 'AEM-EHS-ADMINS-INT'

12.02.2019 05:52:43.659 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider referenced identity is neither user or group: cn=AEM-EDAM-HHA-EDITORS-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp

12.02.2019 05:52:43.659 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext No external group found for ref 'cn=AEM-EDAM-HHA-EDITORS-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp'.

12.02.2019 05:52:43.660 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider referenced identity is neither user or group: cn=AEM-EDAM-HHA-READ-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp

12.02.2019 05:52:43.660 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext No external group found for ref 'cn=AEM-EDAM-HHA-READ-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp'.

12.02.2019 05:52:43.661 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.security.authentication.ldap.impl.LdapIdentityProvider referenced identity is neither user or group: cn=AEM-EDAM-HHA-USERS-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp

12.02.2019 05:52:43.661 *WARN* [qtp1538804081-3219] org.apache.jackrabbit.oak.spi.security.authentication.external.basic.DefaultSyncContext No external group found for ref 'cn=AEM-EDAM-HHA-USERS-INT,ou=groups,ou=intranet,dc=highmark,dc=com;ovdidp'.

Gaurav-Behl
Gaurav-Behl
Level 10
February 12, 2019

Not sure, you may want to validate each step of this tutorial against your configurations. That's a better way to rule out any wrong configurations for that group -

GitHub - Adobe-Marketing-Cloud/aem-ldap-tutorial

Configuring LDAP with AEM 6

Terms & ConditionsAccessibility statement

Loading footer...