English
Italian
The Alfresco Synchronization Subsystem is responsible for the synchronization of Alfresco with all the user registries (LDAP servers). When you enable the synchronization functionality for the user registry export, if you have wrongly included the built-in user Guest of the LDAP server into the Alfresco local repository, you may struggle with the error “The Guest user cannot be deleted”:
USE CASE
Suppose you have configured Alfresco to interact with a Microsoft Active Directory server which includes the built-in Guest user. Here is what could happen.
Step 1 – The LDAP subsystem for user registry export functions is enabled and all users and groups of the AD server are added/updated locally in the Alfresco repository when the subsystem starts up for the first time.
Step 2 – The query to select all objects that represent the users to export, points to an element of the AD tree which includes the bulit-in Guest user:
ldap.synchronization.active=true ldap.synchronization.groupSearchBase=dc\=testad,dc\=com ldap.synchronization.userSearchBase=dc\=testad,dc\=com
Step 3 – The Guest AD user is locally updated in Alfresco and considered a real LDAP user.
Step 4 – A scheduled job triggers synchronization in differential with removals mode every 24 hours (by default).
Step 5 – Change the Distinguished Name for the user query and configure an element of the AD tree that no longer includes the Guest user.
Step 6 – When a differential sync with removals is performed, the error “The Guest user cannot be deleted” could occur.
ldap.synchronization.groupSearchBase=ou\=MilanoUO,dc\=testad,dc\=com ldap.synchronization.userSearchBase=ou\=MilanoUO,dc\=testad,dc\=com
SOLUTION 1
### Exclude always the Guest user from the person query ldap.synchronization.personQuery=(&(objectclass\=user)(!(cn\=Guest))(userAccountControl\:1.2.840.113556.1.4.803\:\=512)) ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(!(cn\=Guest))(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
SOLUTION 2
### Restrict the LDAP user query to a sub section of tree on the LDAP server where the Guest user will never be included ldap.synchronization.groupSearchBase=ou\=MyNoGuestUnit,dc\=testad,dc\=com ldap.synchronization.userSearchBase=ou\=MyNoGuestUnit,dc\=testad,dc\=com
SOLUTION 3
### Disable user removals. If false, then no sync job will be allowed to delete users or groups synchronization.allowDeletions=false
SOLUTION 4
### The sub section of tree on the LDAP server includes always the Guest user ldap.synchronization.groupSearchBase=ou\=MilanoUO,dc\=testad,dc\=com ldap.synchronization.userSearchBase=ou\=MilanoUO,dc\=testad,dc\=com
hi,
have Alfresco community 4.2.f installed in Windows Server 2008 R2 and syncronized very well with AD, but I have an error in afresco.log file every every day at midnight
——————————————–
... Failed to process entry "Guest".org.alfresco.error.AlfrescoRuntimeException: 09301582 The Guest user cannot be deleted.
...
Synchronization,Category=directory,id1=ldap-ad1,id2=7 Authority Deletion: 1 error(s) detected. Last error from entry "Guest"
org.alfresco.error.AlfrescoRuntimeException: 09301582 The Guest user cannot be deleted.
——————————————–
So I have do this modification as you mentioded in your article but nothing was happened. and I still got the same error,
### Disable user removals. If false, then no sync job will be allowed to delete users or groups
synchronization.allowDeletions=false
# The query to select all objects that represent the users to import.
ldap.synchronization.personQuery=(&(objectclass\=user)(!(cn=Guest))(userAccountControl\:1.2.840.113556.1.4.803\:\=512))
# The query to select objects that represent the users to import that have changed since a certain time.
ldap.synchronization.personDifferentialQuery=(&(objectclass\=user)(!(cn=Guest))(userAccountControl\:1.2.840.113556.1.4.803\:\=512)(!(whenChanged<\={0})))
——————————————————————————-
Hi Hedi,
make sure you’ve configured the ” synchronization.allowDeletions” property in the alfresco-global.properties file.
About the two other properties, If you have already imported the Guest user into the Alfresco repository, there is no way to force its deletion (Alfresco has a own builtin Guest user that can not be removed).
So, use only the synchronization.allowDeletions=false in the alfresco-global.properties.
Alternatively, you can create a Guest user into the DN of your AD server, below which you run the user queries (see the userSearchBase property) .
Giuseppe