Configuring Nucleus User Sync - Configuring Nucleus User Sync - You must configure Nucleus User Sync to enable Content Intelligence to enforce Alfresco user mappings and correct permissions in search results. - Alfresco - Alfresco CIC Connector - Alfresco/Alfresco-CIC-Connector/1.0/Alfresco-CIC-Connector/Install/Installing-Using-Docker-Compose/Configuring-the-Docker-Compose-File/Configuring-Nucleus-User-Sync - 1.0

You must configure Nucleus User Sync to enable Content Intelligence to enforce Alfresco user mappings and correct permissions in search results.

Nucleus User Sync synchronises Alfresco users, groups, and group memberships with the Content Intelligence identity system on a scheduled basis. Without this synchronisation, Knowledge Discovery cannot determine which documents each user is permitted to access, and search results may expose content to unauthorised users.

Nucleus User Sync runs as a scheduled cron job. You can configure the schedule by setting the cron expression, for example with the SYNC_CRON_EXPRESSION environment variable. You can also manually trigger synchronization by sending a POST request to the /sync/trigger endpoint.

To configure Nucleus User Sync:

In the docker-compose.yml file, locate the nucleus-sync service section.

Under the environment section of the nucleus-sync service, configure the following required settings, replacing each placeholder with the value for your environment:

environment:
      SERVER_PORT: 8081
      SYNC_ENABLED: true
      SYNC_CRON_EXPRESSION: "0 0 */2 * * ?"
      AUTH_ALFRESCO_TYPE: basic
      ALFRESCO_USER_NAME: admin
      ALFRESCO_PASSWORD: admin
      AUTH_HX_TYPE: oauth2
      HX_CLIENT_ID: [add-your-client-id]
      HX_CLIENT_SECRET: [add-your-client-secret]
      HX_TOKEN_URI: [add-nucleus-iam-origin]/idp/connect/token
      ALFRESCO_BASE_URL: http://alfresco:8080/alfresco/api/-default-/public/alfresco/versions/1
      NUCLEUS_IDP_BASE_URL: [add-nucleus-iam-origin]
      NUCLEUS_BASE_URL: https://auth.dev.app.hyland.com
      NUCLEUS_SYSTEM_ID: [add-your-system-id]

The placeholders represent the following:

Placeholder	Description
[add-your-client-id]	The client ID of the Content Intelligence environment. For example: sc-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx
[add-your-client-secret]	The client secret of the Content Intelligence environment.
[add-nucleus-iam-origin]	The OAuth 2.0 token endpoint URL used to obtain an access token for Content Intelligence. For example: https://auth.staging.app.hyland.com/idp/connect/token.
[add-your-system-id]	The unique Nucleus System Environment ID that identifies a specific environment. For example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

The following table describes all available settings in detail.

Setting	Description
SERVER_PORT	The port on which the Nucleus User Sync REST API listens.
SYNC_ENABLED	When true (default), synchronisation of users, groups, and group memberships runs automatically on the schedule defined by SYNC_CRON_EXPRESSION. When false, scheduled synchronisation is disabled and synchronisation must be triggered manually by sending a POST request to the /sync/trigger endpoint. Default: true
SYNC_CRON_EXPRESSION	A Spring cron expression that defines when scheduled synchronisation runs. The default value (0 0 /2 * ?) runs synchronisation every two hours. Adjust this value based on how frequently users and groups change in your Alfresco repository. For example, set 0 0 0 * * ? to run once daily at midnight. Default: 0 0 /2 * ?
AUTH_ALFRESCO_TYPE	The authentication method used when making REST API calls to Alfresco Content Services. Default: basic
ALFRESCO_USER_NAME	The username of an Alfresco user with read access to the REST API.
ALFRESCO_PASSWORD	The password for the Alfresco user.
AUTH_HX_TYPE	The authentication method used to obtain an access token for Content Intelligence. Default: oauth2.
HX_CLIENT_ID	The Client ID of the Client of Hx Configured Client environment. For example: sc-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx
HX_CLIENT_SECRET	The client secret of the Client of HX IAM Configured Client whose Client ID is given.
HX_TOKEN_URI	The OAuth 2.0 token endpoint URL used to obtain an access token for Content Intelligence. For example: https://auth.staging.app.hyland.com/idp/connect/token.
ALFRESCO_BASE_URL	The base URL of the Alfresco Public REST API, including the full versioned path. Default: http://alfresco:8080/alfresco/api/-default-/public/alfresco/versions/1.
NUCLEUS_IDP_BASE_URL	The base URL of the Content Intelligence identity provider, used to look up Nucleus IAM users during synchronisation of user mappings. Use the same [add-nucleus-iam-origin] hostname as HX_TOKEN_URI, without the /idp/connect/token path.
NUCLEUS_BASE_URL	The base URL of the Nucleus API for your Content Intelligence environment.
NUCLEUS_SYSTEM_ID	The UUID that uniquely identifies this Alfresco instance in Content Intelligence. Must match the APPLICATION_SOURCEID configured in the Live Ingester so that access controls are applied to the correct set of ingested documents.

Optional: Under the environment section of the nucleus-sync service, add and configure the following optional properties to control how Nucleus User Sync retries failed authentication requests to Nucleus IAM when obtaining an OAuth2 token:

environment:
    # HTTP client behaviour
    HTTP_CLIENT_TIMEOUT_MINUTES: 5
    HTTP_CLIENT_BUFFER_KB: 10240
    HTTP_CLIENT_RETRY_MAX_ATTEMPTS: 3
    HTTP_CLIENT_RETRY_INITIAL_DELAY_MS: 2000
    HTTP_CLIENT_RETRY_MULTIPLIER: 2
    HTTP_CLIENT_RETRY_MAX_DELAY_MS: 10000

The following table describes the available settings:

Setting	Description
HTTP_CLIENT_TIMEOUT_MINUTES	The maximum time to wait for a response from an HTTP request before timing out, in minutes. Default: 5
HTTP_CLIENT_BUFFER_KB	The maximum size in kilobytes of the in-memory buffer used when reading HTTP responses. Default: 10240
HTTP_CLIENT_RETRY_MAX_ATTEMPTS	The maximum number of times to retry a failed HTTP request. Default: 3
HTTP_CLIENT_RETRY_INITIAL_DELAY_MS	The time in milliseconds to wait before the first retry attempt after a failed HTTP request. Subsequent delays are calculated by multiplying this value by the multiplier. Default: 2000
HTTP_CLIENT_RETRY_MULTIPLIER	The multiplier applied between retry attempts. For example, with an initial delay of 2000ms and a multiplier of 2, the delays are 2000ms, 4000ms, 8000ms, and so on. The delay will not exceed the value set in max-delay-ms. Default: 2
HTTP_CLIENT_RETRY_MAX_DELAY_MS	The maximum time in milliseconds between retry attempts, regardless of how many retries have occurred or what the multiplier calculates. Default: 10000

Optional: Under the environment section of the nucleus-sync service, add and configure the following optional properties to control how Nucleus User Sync makes HTTP requests to Alfresco and Nucleus IAM:

environment:
    # Authentication retry behaviour
    AUTH_RETRY_ATTEMPTS: 3
    AUTH_RETRY_INITIAL_DELAY: 500
    AUTH_RETRY_DELAY_MULTIPLIER: 2

The following table describes the available settings:

Setting	Description
AUTH_RETRY_ATTEMPTS	The maximum retry attempts for authentication calls. Default: 3
AUTH_RETRY_INITIAL_DELAY	The time in milliseconds to wait before the first retry attempt after a failed authentication request. Subsequent delays are calculated by multiplying this value by the delay-multiplier. Default: 500
AUTH_RETRY_DELAY_MULTIPLIER	The multiplier applied between retry attempts. For example, with an initial delay of 500ms and a multiplier of 2, the delays are 500ms, 1000ms, 2000ms, and so on. Default: 2

Setting

Description

AUTH_RETRY_ATTEMPTS

The maximum retry attempts for authentication calls.

Default: 3

AUTH_RETRY_INITIAL_DELAY

The time in milliseconds to wait before the first retry attempt after a failed authentication request.

Subsequent delays are calculated by multiplying this value by the delay-multiplier.

Default: 500

AUTH_RETRY_DELAY_MULTIPLIER

The multiplier applied between retry attempts.

For example, with an initial delay of 500ms and a multiplier of 2, the delays are 500ms, 1000ms, 2000ms, and so on.

Default: 2

Optional: Under the environment section of the nucleus-sync service, add and configure the following optional properties to control how Nucleus User Sync fetches users and groups from Alfresco and manages the volume of work during a sync run:

environment:
    # Sync workload management
    ALFRESCO_SKIP_DISABLED_USER: true
    ALFRESCO_USR_GRP_FETCH_TIMEOUT: PT15M
    ALFRESCO_USR_GRP_MAX_REQUESTS: 50
    DELETE_BATCH_SIZE: 100

The following table describes the available settings:

Setting	Description
ALFRESCO_SKIP_DISABLED_USER	When set to true, disabled Alfresco users are excluded from the sync. Default: true
ALFRESCO_USR_GRP_FETCH_TIMEOUT	The maximum time in minutes to wait when fetching group data from Alfresco users. Default: PT15M
ALFRESCO_USR_GRP_MAX_REQUESTS	The maximum number of concurrent requests when retrieving user group data. Default: 50
DELETE_BATCH_SIZE	The maximum number of users removed per group-member delete request. Default: 100

Optional: Under the environment section of the nucleus-sync service, add and configure the LOGGING_LEVEL_ORG_ALFRESCO optional property to control the verbosity of log output produced by Nucleus User Sync:
```
environment:
    # Logging
    LOGGING_LEVEL_ORG_ALFRESCO: INFO
```
The setting sets the log level for all Alfresco classes within Nucleus User Sync. The following are accepted standard values:
- DEBUG
- INFO
- WARN
- ERROR
Save the docker-compose.yml file
Nucleus User Sync is configured to synchronise Alfresco users, groups, and group memberships with Content Intelligence on the defined schedule, enabling Knowledge Discovery to apply access controls correctly when users search and access content.
Configure the Knowledge Discovery link in Alfresco Digital Workspace. See Configuring the Knowledge Discovery Link in Alfresco Digital Workspace.