4.8 KiB
LDAP synchronisation
This script brings a complete synchronization of user accounts and groups from an external LDAP server.
Zimbra (OSE) supports autoprovisioning, but this feature only takes care of user accounts creation. Several other scripts can be found, nut noone of them implemented what I need, so I wrote this one.
The goals are :
- Do not only provision accounts, but update them if needed (eg : name changed)
- Support AD, OpenLDAP, or any custom LDAP schema
- Synchronize LDAP groups into distribution lists in Zimbra, preserving memberships
- Lock Zimbra accounts when the corresponding LDAP accounts are removed (or not matching the filter anymore)
- Handle email alias defined in LDAP, and translate them into aliases in Zimbra
- Allow objects (aliase, distribution list) to be created directly in Zimbra. Objects coming from LDAP are synchronized, including alias previously defined in LDAP which aren't anymore are removed from Zimbra. But aliases defined directly in Zimbra won't be touched. Same is true for distribution lists. So you can mix LDAP defined and Zimbra defined configuration
Configuration
The configuration is stored in a single file in YAML format. The script will look for a config at /opt/zimbra/conf/ldap_sync.yml or trhe one specified in the --config argument.
The config has two main section :
- general : settings which affects all domains, mainly to configure email notification in case of error
- domains : list of domain to sync, and the settings for each of them
The general section looks like
general:
notify:
from: zimbra@example.org
to: admin@acme-corp.biz
Foreach each domain you defined, you can configure 4 sections :
- ldap : defined where and how to connect to the external LDAP server
- users : define how to search for users in the external LDAP, and which attributes will be mapped to which one in Zimbra
- groups : define how to search for groups in external LDAP, and which attributes will be mapped to which one in Zimbra
- zimbra : define some settings about how the script should behave for this domain (eg, should it create the domain if missing, should it autoconfigure external authentication etc.)
In most case, the configuration can be minimal, as defaults values are provided. You just have to set the LDAP server, bind DN and password (if applicable), and the schema. The schema can be ad, rfc2307 or rfc2307bis. If one of these schema is specified, adapted defaults values will be used
Here are some examples of domains definition :
domains:
# A simple example, against and AD style directory
# Note that this example has no groups definition, and so,
# groups won't be synchronized to distribution lists
acme-corp.biz:
ldap:
servers:
- ldap://dc1.acme-corp.biz:389
- ldap://dc2.acme-corp.biz:389
start_tls: True
bind_dn: CN=Zimbra,CN=Users,DC=acme-corp,DC=biz
bind_pass: 'Sup3rS3cret.P@ssPhr4se'
schema: ad
users:
base: OU=CN=Users,DC=acme-corp,DC=biz
# Another simple example, against OpenLDAP using rfc2307bis schema
corp2.com:
ldap:
servers:
- ldap://ldap.corp2.com
schema: rfc2307bis
users:
base: ou=people,dc=corp2,dc=com
filter: '(memberOf=cn=mail_users,ou=Groups,dc=corp2,dc=com)'
groups:
base: ou=groups,dc=corp2,dc=com
# A more complete example, which shows all the available settings
corp3.net:
ldap:
servers:
- ldap://ldap1.corp3.net:389
- ldap://ldap3.corp3.net:389
start_tls: True
bind_dn: CN=Zimbra,OU=Apps,DC=corp3,DC=net
bind_pass: 'p@ssw0rd'
schema: ad
type: ad
users:
base: OU=People,DC=corp3,DC=net
filter: '(&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Role_Mail,OU=Roles,DC=corp3,DC=net)(mail=*))'
key: sAMAccountName
mail_attr: mail
alias_attr: otherMailbox
attr_map:
displayName: displayName
description: description
cn: cn
sn: sn
givenName: givenName
telephoneNumber: telephoneNumber
homePhone: homePhone
mobile: mobile
streetAddress: street
l: l
st: st
co: co
title: title
company: company
groups:
base: OU=Groups,DC=corp3,DC=net
filter: (objectClass=group)
key: cn
members_attr: member
members_as_dn: True
mail_attr: mail
alias_attr: null
attr_map:
displayName: displayName
description: description
zimbra:
create_if_missing: False
setup_ldap_auth: True
Command line
Once a configuration file is ready, the script can be called with the following command line arguments :
- --config : path to the config file (defaults to /opt/zimbra/conf/ldap_sync.yml)
- --quiet : will not print anything except errors
- --verbose : prints aditional info during the sync