When an individual user (not yet registered in CRX) attempts to login, CRX authenticates against LDAP and if authentication is successful then that user is synchronized with CRX. So, How to force synchronization of LDAP users with CRX so that rights can be assigned before the user first tries to login?
From CQ 5.5 service pack update [1] onwards the CRX that provides the ldap functionality is an OSGi service. The LDAP is registered in the OSGi Service Registry as MBean service. This MBean is available in the JMX Console which exposes the ldap attributes and operations. The operation that can be performed are listed at [0]. Some of the ways to achieve synchronization of the user are
Manual synchronization of users using felix console
Using CURL
Create JMX client that uses LDAP MBean
Below is Sample jmx client code that prints list of Orphaned Users
import javax.management.DynamicMBean;
import java.util.Hashtable;
import javax.management.MBeanServerConnection;
import javax.management.MBeanServerInvocationHandler;
import javax.management.ObjectName;
import javax.management.remote.JMXConnectorFactory;
import javax.management.remote.JMXServiceURL;
public class LDAPSampleClient {
public static void main(String[] args) throws Exception{
String userid = "admin";
String password = "admin";
String serverUrl = "service:jmx:rmi:///jndi/rmi://localhost:9000/jmxrmi";
String OBJECT_NAME = "com.adobe.granite.ldap:host=localhost,port=389,type=Tools";
String[] buffer = new String[] { userid, password };
Hashtable<String, String[]> attributes = new Hashtable<String, String[]>();
attributes.put("jmx.remote.credentials", (String[]) buffer);
MBeanServerConnection server = (MBeanServerConnection) JMXConnectorFactory.connect(new JMXServiceURL(serverUrl), attributes).getMBeanServerConnection();
ObjectName name = new ObjectName(OBJECT_NAME);
LDAPUserMBean ldap = (LDAPUserMBean) MBeanServerInvocationHandler.newProxyInstance(server, name, LDAPUserMBean.class,false);
for(String user : ldap.listOrphanedUsers()) {
System.out.println(user);
}
}
public static interface LDAPUserMBean extends DynamicMBean {
public String[] listOrphanedUsers();
public String[] syncUsers(String[] users);
public void syncAllUsers();
public void syncUser(String user);
public void syncOrphanedUsers();
public void purgeOrphanedUsers();
}
}
[0]
[1] http://dev.day.com/packageshare/packages/public/day/cq550/update/cq-update-pkg.html
Note:- If you have taken out LDAP config OR LDAP is not configured, Then Mbean will not be visible in the JMX console.
CRX 2.3
Sign in to your account