Page 1 of 2 12 LastLast
Results 1 to 10 of 12

Thread: Why can't Zimbra get users from AD

  1. #1
    lmnau is offline Member
    Join Date
    Jul 2007
    Posts
    10
    Rep Power
    8

    Default Why can't Zimbra get users from AD

    FOR THE SECOND TIME!!!!!!!!!!!!!!!!!!!

    Can anybody give me a succinct instruction set for how to get Zimbra to get its users from AD?

    I've already got all the users and their email addresses in AD. Zimbra and the Mac are authenticating and binding perfectly to the AD. What's the point if I have to type in all the users into Zimbra; again.

    Documentation on this is virtually non-existent. There is a bit that says “The External LDAP and External Active Directory authentication methods attempt to bind to the specified LDAP server, using the supplied user name and password. These method can be used if the email environment uses Microsoft Active Directory directory services for authentication and the Zimbra-LDAP directory services for all other Zimbra-related transactions. This requires that users exist in both OpenLDAP and in the Active Directory servers.”

    So if I read this right, Zimbra CAN’T interrogate AD for a user list or extract %email from the AD schema?

  2. #2
    phoenix is online now Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,569
    Rep Power
    57

    Default

    Quote Originally Posted by lmnau View Post
    FOR THE SECOND TIME!!!!!!!!!!!!!!!!!!!
    Your first attempt didn't sem to make but there's no need to shout.

    Quote Originally Posted by lmnau View Post
    Can anybody give me a succinct instruction set for how to get Zimbra to get its users from AD?

    I've already got all the users and their email addresses in AD. Zimbra and the Mac are authenticating and binding perfectly to the AD. What's the point if I have to type in all the users into Zimbra; again.

    Documentation on this is virtually non-existent. There is a bit that says “The External LDAP and External Active Directory authentication methods attempt to bind to the specified LDAP server, using the supplied user name and password. These method can be used if the email environment uses Microsoft Active Directory directory services for authentication and the Zimbra-LDAP directory services for all other Zimbra-related transactions. This requires that users exist in both OpenLDAP and in the Active Directory servers.”

    So if I read this right, Zimbra CAN’T interrogate AD for a user list or extract %email from the AD schema?
    Are you trying to use AD without having your users provisioned in Zimbra? If you are, that doesn't work. You must have the uers in your Zimbra server, you can Authenticate against an AD server if you like.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  3. #3
    mmorse's Avatar
    mmorse is offline Moderator
    Join Date
    May 2006
    Location
    USA
    Posts
    6,242
    Rep Power
    21

    Default

    That section your referring to is for authentication.
    And it's directly in the directions/note you quoted:
    "This requires that users exist in both OpenLDAP[zimbra] and in the Active Directory servers.”
    If you have exchange, I would recommend using the migration wizard; it will:
    -Create the user account on the Zimbra server
    -Import mail messages, attachments, calendars, and contacts

    Methods:
    First, is to use the ZCS Exchange Migration Wizard:
    -hit the downloads icon on the left hand side of the admin console.
    Then read: http://zimbra.com/docs/ne/latest/migration_wizard_for_exchange_installation_guide/

    Notes:
    -Be sure to change HKCU\Software\ZCSMigWiz\MaxAttachSizeMB to something larger than 10MB if desired.
    -Also, your zimbraFileUploadMaxSize & zimbraMtaMaxMessageSize (settable via the zcs admin console). Set zimbraMtaMaxMessageSize 10% larger than the zimbraFileUploadMaxSize.
    Say both are set to 10MB (and you tell everyone they can send 10MB attachments):
    An email with a 9MB attachment and 100KB message body text. The attachment may be less than the 10MB zimbraFileUploadMaxSize, and so it'll get accepted by the file upload system. But when it's converted into a MIME message it ends up base64-encoded. Then add 100K of regular body text, and the resulting message (say 10.3MB or so) is then handed off to postfix, which checks zimbraMtaMaxMessageSize and promptly rejects the message if it's over the limit of 10MB.
    Of course set zimbraMtaMaxMessageSize even larger if you want to allow emails with multiple large attachments.
    Also, there's a spamassassin setting to not scan/spend cpu resources on really large messages that are over x value in size - adjust accordingly.

    Second, is to export the contents of the MS Exchange folders to a .pst file and import them using the Zimbra PST Import Wizard.
    -again see the downloads section of your admin console for the PST import wizard

    A third option, if you use outlook & plan on using the outlook connector (or just outlook in general):
    -export the MS Exchange data to a .pst file, and restore it once the Zimbra profile is created for a corresponding Zimbra user either through the ZCS Connector for Outlook (or through regular outlook IMAP).
    -if you are using the NE/trial, again see the downloads section for the outlook connector

    A fourth method:
    -imapsync for mail: User Migration - Imapsync- ZimbraWiki
    -then for cal(.ical)/contacts(.csv) there's manual uploads or curl.
    Also see:
    Bulk Provisioning - ZimbraWiki
    Zmprov - ZimbraWiki
    Zmprov Examples - ZimbraWiki

    Also, if you plan to run both systems at the same time see the Split Domain - ZimbraWiki doc.
    Last edited by mmorse; 09-03-2007 at 09:12 PM. Reason: broke up sections/methods better

  4. #4
    lmnau is offline Member
    Join Date
    Jul 2007
    Posts
    10
    Rep Power
    8

    Default

    OK.

    I didn't mention Exchange for a reason; it isn't installed... it isn't even in the equation, so don't refer me to Exchange issues.

    I guess you don't have many tools for AD on linux systems, but I've got lots of applications that including ADSI edit that can interrogate the AD schema, and get a user list. Are you saying that Zimbra doesn't do this, and I have no way of importing a userlist and attributes from an AD tree into the accounts setup?

    How about importing a userlist from OS X Server's OpenLDAP directory???

    Have a look at a Win.app call ADManager or for LDAP look at pwsync and see how they do it, but that still doesn't tell me how to get the users into Zimbra accounts with the appropriate info. I don't have time to figure these things out, but I don't see Zimbra becoming a strong corporate contender until there is a solution for this.

  5. #5
    mmorse's Avatar
    mmorse is offline Moderator
    Join Date
    May 2006
    Location
    USA
    Posts
    6,242
    Rep Power
    21

    Default

    Very sorry that I assumed you were using exchange, once you mention AD I start assuming a windows setup, and it's better that you get too much information then not enough. (ok well most of the time -till you get information overload)

    Maybe some zimbra employees will jump in with AD migration tips, but please realize that zimbra employees do not have to use the forums.
    We (whether it's zimbra employees, moderators and even regular users like dijichi2 & dirk) all try to answer as many questions as possible, even though we are very busy with our own primary jobs first. We can't research every last problem-we have our own IT departments to support.
    That being said zimbra doesn't abandon the fourms, their actually a very good source for enhancement/idea generation, & when suddenly lots of people have the same issue, we know there's a possible bug somewhere.

    You do know that if your using the NE trial you have installation support...fire off an email to support@zimbra.com

    Your welcome to open a RFE (request for enhancement) in bugzilla for better automatic Active Directory account provisioning.
    (Be sure to search it first, as someone may already have one open.) I know the LDAP one is: Bug 7235 - Auto Provision New Accounts with External LDAP

    If you we're talking about AdventNet's ADManager, I've used their stuff before-but it's not open source...used to moderate in the OpManager forums back when the company was just starting to take off big time. (think they now own zoho)
    (hm don't remember what my login was-can only find one of my other ones AdventNet :MCode: profile)

    The authentication section isn't designed to provision users, your most likely going to be using zmprov commands to do the account creation.

    In AD can you right click the folders of the user you want to export>csv file.

    (the below is shortened from this: Bulk Provisioning - ZimbraWiki )

    -remove extraneous columns

    The following is a simple perl script to take a CSV file and turn it into the correct zmprov commands-obviously change the variables to the actual fields you use in your CSV file.

    #!/usr/bin/perl

    while (<>) {
    chomp;

    my ($email, $password, $first, $last) = split(/\,/, $_, 4);
    print qq{ca $email $password\n};
    print qq{ma $email givenName "$first"\n};
    print qq{ma $email sn "$last"\n};
    print qq{ma $email displayName "$first $last"\n};
    print qq{\n};
    }

    I would use ‘’ for the passwords so that it would use the external auth. (Seeing as passwords probably won't be in this csv list & you said earlier that your auth section is working properly.)

    This would assign everyone to the default COS (class of service), if you wanted to organize it during import, put the cos names in the csv file, then lookup the valid COS ID ahead of time or like this:
    my $cosid = `su - zimbra -c 'zmprov gc Default |grep zimbraId:'`;
    $cosid =~ s/zimbraId:\s*|\s*$//g;
    Then add:
    print qq{ma $email zimbraCOSid "$cosid"\n};

    Anteos seems to manage his fully through AD & may have some tips:
    Quote Originally Posted by anteos View Post
    Zimbra doesn't support user and group creation through AD, but you can write small scripts to synchronize the users on Zimbra against AD. We made it with users (created, locked, deleted), groups, shared calendars and distribution lists fully managed through AD.
    That being said I'm sure your under pressure to get this setup or switch from another solution etc. I understand, I've been there, & I know that if you have a large # of accounts ahead of you that it probably looks to be a daunting task to create all the accounts. I hope you can find a batch account provisioning method that suits your situation; Zmprov will be your friend.
    Last edited by mmorse; 09-17-2007 at 09:53 PM.

  6. #6
    h4inf is offline Starter Member
    Join Date
    Oct 2007
    Location
    Melbourne, Australia
    Posts
    1
    Rep Power
    7

    Post AD Integrated auto account addition would be ace!

    Bug 7235 pretty much covers this.

    We have just installed Zimbra and are disappointed to learn this has yet to be implemented. We are just testing right now but intend to upgrade to a paid supported license if we can get it working nicely for January 2008.

    I work at a school and we have kids coming and going all the time, not to mention about 700 accounts, so this is absolutely necessary to keep on top of things, which is absolutely not possible if manual account addition is required.

    A lot of what is required is already in place - you can already set up a class of service which defines all the custom settings for a user. Part of the AD Auto Add component could be simply to assign a COS for certain OU's or AD Groups perhaps... I'm sure this would be quite useful for a number of people and make Zimbra easier to integrate into existing setups.

    Some open source software we utilise called Moodle implements AD Integration, whereby on the first login it will check with AD if the account credentials are valid, and if yes, then it creates a local account in it's own database and logs the user in. It also grabs all of their details from AD and puts them into its own database, such as name, contact details, etc.

    A periodic check to see if users still exist would be quite useful, although I am guessing that if a user in AD was disabled or deleted, then when Zimbra tried to auth their credentials, this would fail anyway - unless it caches the password? The main advantage would be keeping the server clean and clearing up old email etc.

    Just some thoughts

    Cheers,

    Paul.

  7. #7
    dgamez's Avatar
    dgamez is offline Senior Member
    Join Date
    Oct 2005
    Location
    Madrid - Spain
    Posts
    59
    Rep Power
    9

    Default

    Hi Phoenix; in relation with your post on 09-03-2007:

    "Are you trying to use AD without having your users provisioned in Zimbra? If you are, that doesn't work. You must have the uers in your Zimbra server, you can Authenticate against an AD server if you like."

    Is it still like that on actual ZCS 5.0.16 ?
    - dgamez -

    Netnovation Vzla, S.A.
    Zimbra VAR

    Caracas - Venezuela

  8. #8
    Klug's Avatar
    Klug is offline Moderator
    Join Date
    Mar 2006
    Location
    Beaucaire, France
    Posts
    2,316
    Rep Power
    13

    Default

    Yes.

    There's no automagically provisioning system for ZCS to "pick" the users into the AD and create them into ZCS.

  9. #9
    phoenix is online now Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    23,569
    Rep Power
    57

    Default

    There is an RFE in bugzilla (when it's back up) for that feature.
    Regards


    Bill


    Acompli: A new adventure for Co-Founder KevinH.

  10. #10
    dgamez's Avatar
    dgamez is offline Senior Member
    Join Date
    Oct 2005
    Location
    Madrid - Spain
    Posts
    59
    Rep Power
    9

    Lightbulb Active Directory Export then Import from ZCS

    This helped me a lot with this (Microsoft) issue!

    CSVDE -f Export examples user accounts from Active Directory to spreadheet
    - dgamez -

    Netnovation Vzla, S.A.
    Zimbra VAR

    Caracas - Venezuela

Page 1 of 2 12 LastLast

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. Replies: 26
    Last Post: 04-19-2011, 09:24 AM
  2. Replies: 31
    Last Post: 12-15-2007, 09:05 PM
  3. huge log size
    By rmvg in forum Administrators
    Replies: 5
    Last Post: 01-02-2007, 10:39 AM
  4. Services stopped working
    By lilwong in forum Administrators
    Replies: 4
    Last Post: 08-15-2006, 09:19 AM
  5. Zimbra Processor Output
    By UltraFlux in forum Installation
    Replies: 3
    Last Post: 02-01-2006, 08:23 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •