Skip to content

Commit e73ca90

Browse files
OpenPjOpenPj
committed
added LDAP properties file for activiti-app
1 parent 089f438 commit e73ca90

File tree

2 files changed

+253
-0
lines changed

2 files changed

+253
-0
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,5 +12,6 @@ USER root
1212
COPY logging/logback.xml $TOMCAT_DIR/lib
1313

1414
COPY properties/activiti-app.properties $TOMCAT_DIR/lib
15+
COPY properties/activiti-ldap.properties $TOMCAT_DIR/lib
1516

1617
COPY activiti-license/*.* $TOMCAT_DIR/lib/

‎properties/activiti-ldap.properties‎

Lines changed: 252 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,252 @@
1+
2+
# --------------------------
3+
# LDAP AUTHENTICATION CONFIG
4+
# --------------------------
5+
6+
# Note that this is AUTHENTICATION only, not synchronization.
7+
# For this to work properly, the LDAP synchronization (see below), needs to be
8+
# enabled and configured correctly (on one node).
9+
10+
ldap.authentication.enabled=false
11+
12+
# Set to false to allow for case insensitive logins. By default true if omitted or commented out.
13+
ldap.authentication.casesensitive=true
14+
15+
# Set this property to 'true' to allow for a fallback to database authentication (default is false).
16+
# This can be useful to have a 'system' user for example which does not represent
17+
# a real user (and is not in the LDAP user store), but can be used to eg. call the REST API.
18+
ldap.allow.database.authenticaion.fallback=false
19+
20+
21+
# Property to map the user id entered by the user in the login field to that passed through to LDAP.
22+
#
23+
# If the users are in a flat list (eg one organizational unit), it's easy, simply set the property
24+
# to a value, eg. uid={0},ou=users,dc=alfresco,dc=com
25+
# This is also the most performant way, as the LDAP bind can be done directly.
26+
#
27+
# However, if the users are in structured folders (organizational units for example), a direct pattern cannot be used.
28+
# In this case, leave the property either empty or comment it.
29+
# A query will be done using the ldap.synchronization.personQuery with the ldap.synchronization.userIdAttributeName
30+
# to find the user, and find it's dn. That dn will then be used to login.
31+
ldap.authentication.dnPattern=
32+
33+
# Uncomment when using Active directory
34+
#ldap.authentication.active-directory.enabled=true
35+
#ldap.authentication.active-directory.domain=alfresco.org
36+
#ldap.authentication.active-directory.rootDn=DC=alfresco,DC=com
37+
#ldap.authentication.active-directory.searchFilter=(&(objectClass=user)(userPrincipalName={0}))
38+
39+
40+
# ----------------------------
41+
# LDAP SYNCHRONIZATION CONFIG
42+
# ----------------------------
43+
44+
# Enables full synchronization. With full sync, all user/groups will be checked whether they are valid or not.
45+
# By default, runs at midnight, since this is quite a heavy operation.
46+
# Full synchronization is needed because a partial synchronization cannot detect deletes of groups/users.
47+
ldap.synchronization.full.enabled=false
48+
ldap.synchronization.full.cronExpression=0 0 0 * * ?
49+
50+
# Enabled differential synchronization. This will only check the users/groups which are changes since last sync.
51+
# A differential sync cannot detect deletes of users/groups. This is done by the full sync.
52+
ldap.synchronization.differential.enabled=false
53+
ldap.synchronization.differential.cronExpression=0 0 */4 * * ?
54+
55+
# Paging (default = no paging).
56+
# If enabled, default page size is 100
57+
ldap.synchronization.paging.enabled=false
58+
ldap.synchronization.paging.size=500
59+
60+
# Db batch sizes
61+
ldap.synchronization.db.insert.batch.size=100
62+
ldap.synchronization.db.query.batch.size=100
63+
64+
65+
# ----------------------
66+
# LDAP CONNECTION CONFIG
67+
# ----------------------
68+
69+
# The URL to connect to the LDAP server
70+
ldap.authentication.java.naming.provider.url=ldap://localhost:10389
71+
72+
# The default principal to use (only used for LDAP sync)
73+
ldap.synchronization.java.naming.security.principal=uid=admin,ou=system
74+
75+
# The password for the default principal (only used for LDAP sync)
76+
ldap.synchronization.java.naming.security.credentials=secret
77+
78+
# The authentication mechanism to use for synchronization
79+
#ldap.synchronization.java.naming.security.authentication=simple
80+
81+
# LDAPS truststore configuration properties
82+
#ldap.authentication.truststore.path=
83+
#ldap.authentication.truststore.passphrase=
84+
#ldap.authentication.truststore.type=
85+
# Set to 'ssl' to enable truststore configuration via subsystem's properties
86+
#ldap.authentication.java.naming.security.protocol=ssl
87+
88+
# The LDAP context factory to use
89+
#ldap.authentication.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
90+
91+
# Requests timeout, in miliseconds, use 0 for none (default)
92+
#ldap.authentication.java.naming.read.timeout=0
93+
94+
# See http://docs.oracle.com/javase/jndi/tutorial/ldap/referral/jndi.html
95+
#ldap.synchronization.java.naming.referral=follow
96+
97+
98+
99+
# -----------
100+
# USER CONFIG
101+
# -----------
102+
103+
# The user search base restricts the LDAP user query to a sub section of tree on the LDAP server.
104+
ldap.synchronization.userSearchBase=ou=users,dc=alfresco,dc=com
105+
106+
# The query to select all objects that represent the users to import.
107+
# Active Directory example: (&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
108+
ldap.synchronization.personQuery=(objectclass\=inetOrgPerson)
109+
110+
# The query to select objects that represent the users to import that have changed since a certain time.
111+
# Active Directory example: (&(objectclass\=user)(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged<\={0})))
112+
ldap.synchronization.personDifferentialQuery=(&(objectclass\=inetOrgPerson)(!(modifyTimestamp<\={0})))
113+
114+
# The attribute name on people objects found in LDAP to use as the login id in Activiti. Needs to be unique and cannot change!
115+
ldap.synchronization.userIdAttributeName=uid
116+
117+
# The attribute on person objects in LDAP to map to the first name property of a user
118+
ldap.synchronization.userFirstNameAttributeName=givenName
119+
120+
# The attribute on person objects in LDAP to map to the last name property of a user
121+
ldap.synchronization.userLastNameAttributeName=sn
122+
123+
# The attribute on person objects in LDAP to map to the email property of a user
124+
ldap.synchronization.userEmailAttributeName=mail
125+
126+
# The person type in LDAP
127+
# Active Directory: user
128+
ldap.synchronization.userType=inetOrgPerson
129+
130+
# Set the dn of the people that need to be made tenant admin (one tenant). Delimit multiple entries with ;, cause we can't use a comma of course. Note: no trimming of spaces will be applied
131+
ldap.synchronization.tenantAdminDn=uid=admin,ou=users,dc=alfresco,dc=com
132+
133+
# Set the dn of the people that need to be made tenant manager (multiple tenants). Delimit multiple entries with ;, cause we can't use a comma of course. Note: no trimming of spaces will be applied
134+
ldap.synchronization.tenantManagerDn=uid=admin,ou=users,dc=alfresco,dc=com
135+
136+
# Set true if users outside userSearchBase should be synchronized (members of the groups found in groupSearchBase). Default: true
137+
ldap.synchronization.syncAdditionalUsers=true
138+
139+
# ------------
140+
# GROUP CONFIG
141+
# ------------
142+
143+
# The group search base restricts the LDAP group query to a sub section of tree on the LDAP server.
144+
ldap.synchronization.groupSearchBase=ou=groups,dc=alfresco,dc=com
145+
146+
# The query to select all objects that represent the groups to import.
147+
# Active Directory example: (objectclass\=group)
148+
ldap.synchronization.groupQuery=(objectclass\=groupOfNames)
149+
150+
# The query to select objects that represent the groups to import that have changed since a certain time.
151+
# Active Directory example: (&(objectclass\=group)(!(whenChanged<\={0})))
152+
ldap.synchronization.groupDifferentialQuery=(&(objectclass\=groupOfNames)(!(modifyTimestamp<\={0})))
153+
154+
# The attribute on LDAP group objects to map to the authority name property in Alfresco
155+
ldap.synchronization.groupIdAttributeName=cn
156+
157+
# The attribute in LDAP on group objects that defines the DN for its members
158+
ldap.synchronization.groupMemberAttributeName=member
159+
160+
# LDAP Range (default = no range).
161+
# If enabled, default range size is 1000.
162+
# This is an Active Directory attribute
163+
# and should be used when there are groups with more than
164+
# 1000 members for AD on Windows Server 2000 or
165+
# 1500 members for AD on Windows Server 2003+
166+
# see https://msdn.microsoft.com/en-us/library/ms676302(VS.85).aspx
167+
ldap.synchronization.groupMemberRangeEnabled=false
168+
ldap.synchronization.groupMemberRangeSize=1500
169+
170+
# The group type in LDAP
171+
# Active Directory: group
172+
ldap.synchronization.groupType=groupOfNames
173+
174+
175+
176+
# ------------------------
177+
# GENERIC ATTRIBUTE CONFIG
178+
# ------------------------
179+
180+
# The dn of an entry.
181+
ldap.synchronization.distinguishedNameAttributeName=dn
182+
183+
# The name of the operational attribute recording the last update time for a group or user.
184+
# Active Directory: whenChanged
185+
ldap.synchronization.modifyTimestampAttributeName=modifyTimestamp
186+
187+
# The name of the operational attribute recording the create time for a group or user.
188+
# Active Directory: whenCreated
189+
ldap.synchronization.createTimestampAttributeName=createTimestamp
190+
191+
# The timestamp format. Unfortunately, this varies between directory servers.
192+
# Active Directory: yyyyMMddHHmmss'.0Z'
193+
ldap.synchronization.timestampFormat=yyyyMMddHHmmss.SSS'Z'
194+
195+
# The timestamp format locale language. 'en' by default. Follows the java.util.Locale semantics.
196+
ldap.synchronization.timestampFormat.locale.language=en
197+
198+
# The timestamp format locale country. 'GB' by default. Follows the java.util.Locale semantics.
199+
ldap.synchronization.timestampFormat.locale.country=GB
200+
201+
# The timestamp format timezone. 'GMT' by default. Folloez the java.text.SimpleDateFormat semantics.
202+
ldap.synchronization.timestampFormat.timezone=GMT
203+
204+
205+
# -----------------------
206+
# LDAP CONNECTION POOLING
207+
# -----------------------
208+
209+
# Options=
210+
# nothing filled in: no connection pooling
211+
# 'jdk': use the default jdk pooling mechanism
212+
# 'spring': use the spring ldap connection pooling facilities. These can be configured further below
213+
#ldap.synchronization.pooling.type=spring
214+
215+
# Following settings follow the semantics of org.springframework.ldap.pool.factory.PoolingContextSource
216+
#ldap.synchronization.pooling.minIdle=0
217+
#ldap.synchronization.pooling.maxIdle=8
218+
#ldap.synchronization.pooling.maxActive=0
219+
#ldap.synchronization.pooling.maxTotal=-1
220+
#ldap.synchronization.pooling.maxWait=-1
221+
# Options for exhausted action: fail | block | grow
222+
#ldap.synchronization.pooling.whenExhaustedAction=block
223+
#ldap.synchronization.pooling.testOnBorrow=false
224+
#ldap.synchronization.pooling.testOnReturn=false
225+
#ldap.synchronization.pooling.testWhileIdle=false
226+
#ldap.synchronization.pooling.timeBetweenEvictionRunsMillis=-1
227+
#ldap.synchronization.pooling.minEvictableIdleTimeMillis=1800000
228+
#ldap.synchronization.pooling.numTestsPerEvictionRun=3
229+
230+
# Connection pool validation (see http://docs.spring.io/spring-ldap/docs/2.0.2.RELEASE/reference/#pooling for semantics)
231+
# Used when any of the testXXX above are set to true
232+
#ldap.synchronization.pooling.validation.base=
233+
#ldap.synchronization.pooling.validation.filter=
234+
# Search control: object, oneLevel, subTree
235+
#ldap.synchronization.pooling.validation.searchControlsRefs=
236+
237+
#---------------------------
238+
# KERBEROS SSO CONFIGURATION
239+
#---------------------------
240+
241+
kerberos.authentication.enabled=false
242+
#kerberos.authentication.principal=HTTP/test.alfresco.local
243+
#kerberos.authentication.keytab=C:/alfresco/alfrescohttp.keytab
244+
kerberos.authentication.krb5.conf=C:/Windows/krb5.ini
245+
246+
#kerberos.allow.ldap.authentication.fallback=false
247+
#kerberos.allow.database.authentication.fallback=false
248+
249+
# Set to true if you use the short form (samAccountName) of your AD username to log in to Windows rather than the full UPN
250+
#kerberos.allow.samAccountName.authentication=true
251+
# Following line must be set to true when Kerberos enabled
252+
#security.authentication.use-externalid=true

0 commit comments

Comments
 (0)