 | LDAP administration section and automatic user synchronization tool |
| Type | application |
| Category | |
| Developed by | Unknown |
| Rating | |
| License | Unknown |
Table of contents
Description
LDAP configuration section
This is simply a UI that exposes the LDAP configuration properties.
You can refer to http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Authentication#HLDAPAuthentication and http://platform.xwiki.org/xwiki/bin/view/AdminGuide/LDAPAuthenticationUseCases for more information about LDAP configuration in XWiki.
LDAP synchronization feature
Configuring the synchronization frequencies
The LDAP synchronization relies on the Scheduler Application. It bring two scheduler jobs :
- One is responsible to start a synchronization cycle. It's name in the scheduler job table is Start LDAP synchronization cycle. Its default cron configuration is 0 0 2 * * ?, which means every night at 2 A.M.
- The other one is responsible to execute batches of user account synchronization. It's name in the scheduler job table is Execute LDAP synchronization batch. It's default configuration is 0 0/5 * * * ?, meaning every five minutes.
You can change the frequency of execution of each of the two jobs to better fit your need. Don't forget to unschedule and reschedule the jobs you edit in order for the new settings to take effect. Also, don't forget that LDAP group members are cache, for 6 hours as a default setting (see the parameter xwiki.authentication.ldap.groupcache_expiration). If you have a synchronization frequency higher than the cache purge frequency, you will not see the synchronization effects as expected.
Other configuration options
| Option name | Description |
|---|---|
| Synchronize groups defined in the LDAP group mapping | If set to true, members from all groups defined in the XWiki <-> LDAP group mapping (parameter group_mapping) will be synchronized. |
| Other groups to synchronize | You might want to synchronize more groups than those defined in your group mapping. You can list them here, separated by a new line |
| Page to use for storing the list of accounts that remains to be synchronized | This parameter allows to set a custom page used as a marker of accounts that remains to be synchronized. You usually don't have to change this, and can leave it blank. |
| Page to use for writing the synchronization logs | You can precise which page should be used to log the details about synchronization operations. You usually don't have to change this, and can leave it blank. |
| Override the synchronization list when non empty | It is not recommended to activate this option. It allows to force starting a new synchronization cycle when its jobs triggers, but the previous cycle is not finished (some accounts are still listed to be synchronized) |
| Number of accounts to synchronize per bactch | Defines how many accounts should be synchronized per batch. It is recommended to have this number relatively low (in combination with the batch frequency) for the initial synchronization since all users will trigger an account creation. It can then be set to a higher value in cruse mode, since most users should not trigger an update anymore : only new users, users with update profile or group memberships will trigger an update |
Prerequisites & Installation Instructions
For the synchronization feature :
- You need to ensure the document XWiki.AdminLdapSyncSheet is saved by a user with programming access level
- You need to ensure the two scheduler jobs (namely XWiki.LdapFetchUsersToSynchronize and XWiki.SynchronizeLdapUsers) have sufficient rights (they should be saved by a user with programming access level) and are actually scheduled.
