Hi Martin,
welcome to Apache Syncope.
Which version / distribution are you running?
See my replies embedded below.
Regards.
On 25/06/2017 18:48, Böhmer, Martin wrote:
Hi,
I have setup an LDAP connector and LDAP resource that successfully
propagates changes to users and groups when changes are performed via
the console UI. So, I am able to consistently create, update and
delete users and groups in Syncope and LDAP. When I set/change a
user’s password via the console UI, it gets propagated to LDAP as
expected by an UPDATE propagation task.
However, when I log into the enduser interface and change the
password, it gets updated in Syncopes internal database, but not in
LDAP. Inspecting the propagation tasks afterwards reveals that the
change in the enduser UI has created a DELETE action for some strange
reason.
I have replicated your case with 2.0.4-SNAPSHOT (by using the sample
ApacheDS LDAP resource available) and opened
https://issues.apache.org/jira/browse/SYNCOPE-1125
As mentioned in the reference guide and earlier posts, I already made
sure Syncope’s property ‘password.cipher.algorithm’ is set to the same
algorithm as specified in the LDAP connector. Both are set to ‘SSHA’.
Console log and core log do not show any errors.
Aligning the cipher algorithms is only needed when pulling or pushing
password values as binary objects, and this only occurs during pull or
push task execution.
Setting password via Admin Console or Enduser UI instead does not
require such alignment, as the cleartext value is passed along with the
REST invocation.
What I am doing wrong? What configuration may be wrong or missing?
I would greatly appreciate any hints on what configuration is required
to propagate the password change from the enduser interface to LDAP!
My LDAP server is OpenLDAP on Ubuntu 16.04 LTS.
Best regards,
Martin
PS: The result of the password not being propagated is that I am now
able to log into the enduser interface using both the password stored
in Syncopes internal DB and the (old) password still present in LDAP…
This is not possible unless you have defined an Account Policy [1] with
LDAP for pass-through authentication [2].
[1] https://syncope.apache.org/docs/reference-guide.html#policies-account
[2]
https://syncope.apache.org/docs/reference-guide.html#pass-through-authentication
--
Francesco Chicchiriccò
Tirasa - Open Source Excellence
http://www.tirasa.net/
Member at The Apache Software Foundation
Syncope, Cocoon, Olingo, CXF, OpenJPA, PonyMail
http://home.apache.org/~ilgrosso/
