10 Replies Last post: Oct 29, 2007 11:41 AM by Johnny Wetlaufer  
tjpile   5 posts since
Apr 19, 2007
Currently Being Moderated

Apr 19, 2007 3:48 PM

Active Directory Security Groups Not Showing Up As OpenFire Groups.

I''m so sorry if this has been posted before, but I feel like I''ve done my due diligence and read enough posts to think the answer to my problem isn''t listed.

Stats:

Ubuntu Linux 2.6.x kernel.

Sun JRE 6 (1.6.0)

OpenFire 3.3.0

MySQL5 DB

AD Integration

server home: /opt/openfire

 

I have been able to get Active Directory authentication working with no problem.  My issue is with groups.  I want to configure OpenFire to pull Active Directory security groups living in a specific OU and use those security groups as the "Groups" in the OpenFire system.  This would allow me to populate instant messaging groups with users via Active Directory.

 

In my groups summary in the OpenFire admin console, I see no groups.  But I do have a security group in that OU in Active Directory.  It has a few users in it.  If I specifically search for the security groups name, I don''t see the group listed but my total groups changes from 0 to 1.

 

My AD setup (Win2K3):

 

mydomain.local (DC=mydomain,DC=local)

----My Enterprise (CN=My Enterprise,DC=mydomain,DC=local)

----


IM Groups (CN=IM Groups,OU=My Enterprise,DC=mydomain,DC=local)

----


My Test Group (CN=My Test Group,OU=IM Groups,OU=My Enterprise,DC=mydomain,DC=local)

----


My Office (CN=My Office,OU=My Enterprise,DC=mydomain,DC=local)

----


Users (CN=Users,OU=My Office,OU=My Enterprise,DC=mydomain,DC=local)

----


My Test Account (CN=My Test Account,OU=Users,OU=My Office,OU=My Enterprise,DC=mydomain,DC=local)

----


Another Office (CN=Another Office,OU=My Enterprise,DC=mydomain,DC=local)

----


Users (CN=Users,OU=Another Office,OU=My Enterprise,DC=mydomain,DC=local)

 

My Test Group is an Active Directory security group populated with a few Active Directory users from the Users OU.

My Test Account is an Active Directory user that is a member of the My Test Group Active Directory security group.

 

My XML config file:

 

<?xml version="1.0" encoding="UTF-8"?>

<jive>

<adminConsole>

<port>9090</port> 

<securePort>9091</securePort>

</adminConsole> 

<admin>

<authorizedUsernames>myADAccount</authorizedUsernames>

</admin> 

<locale>en</locale> 

<connectionProvider>

<className>org.jivesoftware.database.DefaultConnectionProvider</classNa me>

</connectionProvider> 

<database>

<defaultProvider>

<driver>com.mysql.jdbc.Driver</driver> 

<serverURL>jdbc:mysql://xxx.xxx.xxx.xxx:3306/openfire</serverURL>&nb sp;

<username>mySQLAccount</username> 

<password>mySQLPassword</password> 

<minConnections>5</minConnections> 

<maxConnections>15</maxConnections> 

<connectionTimeout>1.0</connectionTimeout>

</defaultProvider>

</database> 

<ldap>

<host>domaincontroller.mydomain.local</host> 

<port>389</port> 

<baseDN>OU=My Enterprise,DC=mydomain,DC=local</baseDN> 

<adminDN>CN=Administrator,OU=My Company Management Accounts,OU=My Company Contacts,OU=My Company Address Lists,DC=mydomain,DC=local</adminDN> 

<adminPassword>domainAdminPassword</adminPassword> 

<connectionPoolEnabled>true</connectionPoolEnabled> 

<sslEnabled>false</sslEnabled> 

<ldapDebugEnabled>false</ldapDebugEnabled> 

<autoFollowReferrals>false</autoFollowReferrals> 

<usernameField>sAMAccountName</usernameField> 

<searchFilter>(objectClass=organizationalPerson)</searchFilter>&nbsp ;

<vcard-mapping><![CDATA[

<vCard xmlns="vcard-temp">

<N>

<GIVEN></GIVEN>

</N>

<EMAIL>

<INTERNET/>

<USERID></USERID>

</EMAIL>

<FN></FN>

<ADR>

<HOME/>

<STREET></STREET>

<PCODE></PCODE>

<CTRY></CTRY> </ADR> <ADR> <WORK/> <STREET></STREET> <LOCALITY></LOCALITY> <REGION></REGION> <PCODE></PCODE> <CTRY></CTRY>

</ADR>

<TEL>

<HOME/>

<VOICE/>

<NUMBER></NUMBER>

</TEL>

<TEL>

<HOME/>

<CELL/>

<NUMBER></NUMBER> </TEL> <TEL> <WORK/> <VOICE/> <NUMBER></NUMBER> </TEL> <TEL> <WORK/> <CELL/> <NUMBER></NUMBER>

</TEL>

<TEL>

<WORK/>

<FAX/>

<NUMBER></NUMBER>

</TEL>

<TEL>

<WORK/>

<PAGER/>

<NUMBER></NUMBER>

</TEL>

<TITLE></TITLE>

<ORG>

<ORGUNIT></ORGUNIT>

</ORG>

</vCard>]]></vcard-mapping> 

<nameField>cn</nameField> 

<emailField>mail</emailField> 

<groupNameField>cn</groupNameField> 

<groupMemberField>member</groupMemberField> 

<groupDescriptionField>description</groupDescriptionField> 

<posixMode>false</posixMode> 

<groupSearchFilter><![CDATA[($(objectClass=group)(memberOf=CN=IM Groups,OU=My Enterprise,DC=mydomain,DC=local))]]></groupSearchFilter>

</ldap> 

<provider>

<vcard>

<className>org.jivesoftware.openfire.ldap.LdapVCardProvider</className& gt;

</vcard> 

<user>

<className>org.jivesoftware.openfire.ldap.LdapUserProvider</className&g t;

</user> 

<auth>

<className>org.jivesoftware.openfire.ldap.LdapAuthProvider</className&g t;

</auth> 

<group>

<className>org.jivesoftware.openfire.ldap.LdapGroupProvider</className& gt;

</group>

</provider> 

<setup>true</setup>

</jive>

 

The server runs fine.  Users can login and instant message one another.  MySQL connection is fine as I can see data populating the tables.  I''ve cleared the caches and restarted the server daemon.  Nothing works.  The only thing that is screwy is the groups.  Can anyone help me out?

 

Thanks in advance!

papawu Bronze 133 posts since
Mar 13, 2007
Currently Being Moderated
Apr 19, 2007 7:17 PM in response to: tjpile
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

The way I have it setup, is that I have a group called "wildfire" i

have all my users and my department groups as members of the "wildfire"

group. Each user is a member of a department group. Below is my AD LDAP

settings

 

Base DN: dc=company,dc=local

 

Username Field: sAMAccountName

Userfilter: ((objectCategory=Person)(memberOf=CN=wildfire,ou=company Security Groups,DC=company,DC=local))

 

Group Field: cn

Member Field: member

Description Field: description

Group Search Filter: (&(objectClass=Group)(memberOf=CN=wildfire,ou=company Security Groups,DC=company,DC=local))

 

 

 

To have contacts automatically show up on login, I had to share each

group to all the users. You do this by logging into the admin console

and clicking on the "user/groups" tab and then click on "Group Summary"

on the left menu.

 

 

papawu Bronze 133 posts since
Mar 13, 2007
Currently Being Moderated
Apr 20, 2007 7:07 AM in response to: tjpile
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

I don''t think you can filter by OU''s.

 

Ben Willcox Bronze 44 posts since
Mar 28, 2006
Currently Being Moderated
Apr 23, 2007 4:13 AM in response to: tjpile
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

Hello tjpile, I have the same setup which used to work ok in Wildfire. upgrading to openfire seems to have broken this (see http://www.igniterealtime.org/forum/thread.jspa?threadID=26029&tstart=25) so its probably not something you are doing wrong, but a problem with Openfire. I''m hoping someone will read the other thread and hopefully this will get fixed!

I''ve reverted back to Wildfire 3.0.1 for now.

 

Ben

Ben Willcox Bronze 44 posts since
Mar 28, 2006
Currently Being Moderated
Apr 24, 2007 2:51 AM in response to: tjpile
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

According to the Support page we are supposed to report bugs in the forums. Normally the developers are pretty good about reading the forums and picking these up, so I hope this will be solved soon!

 

Cheers,

Ben

Ben Willcox Bronze 44 posts since
Mar 28, 2006
Currently Being Moderated
Jun 7, 2007 3:32 AM in response to: tjpile
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

I decided to have another go with Openfire 3.3.0 and I''ve now got this working OK. In Active Directory I have users in various groups, named departments-it, departments-accounts etc etc, and these are then grouped within Wildfire/Spark. The problem appears to have been with the groupSearchFilter field.

In Wildfire, the groupSearchFilter was as follows:

]]><![CDATA[(&(member=)(objectClass=group)(sAMAccountName=departments-*))]]> However, after upgrading to Openfire, the groups were not listed in the Group Summary page, although it did show that there were the correct number of groups, and when I did a search on that screen it showed that two pages of results were there, but no content on each results page! Anyway, after some experimenting I changed the groupSearchFilter to this: ]]>

 

and it now works as before.

 

Cheers,

Ben

Johnny Wetlaufer Bronze 2 posts since
Apr 8, 2006
Currently Being Moderated
Oct 29, 2007 11:41 AM in response to: Ben Willcox
Re: Active Directory Security Groups Not Showing Up As OpenFire Groups.

benwillcox, thank you, thankyou! I had the same problem with groups migrating from Wildfire to Openfire. Group count was there, but no groups listed. Your solution worked!

More Like This

  • Retrieving data ...