+ Post New Thread
Results 1 to 4 of 4
Cloud Services Thread, Setting up Google Apps - Syncing with AD questions in Technical; Evening all, I'm looking ahead but am going to be introducing Google Apps into my secondary school over the next ...
  1. #1

    Join Date
    Jul 2007
    Location
    West Sussex
    Posts
    268
    Thank Post
    35
    Thanked 11 Times in 11 Posts
    Rep Power
    17

    Question Setting up Google Apps - Syncing with AD questions

    Evening all,

    I'm looking ahead but am going to be introducing Google Apps into my secondary school over the next few months.
    I've just started to read up on it and watch webinars etc.

    I'm running AD and am planning on using the Google directory sync tool to sync between Active Directory and Google.

    Question 1: Do users in Active directory have to have an attribute set under email address in order to populate google apps? I think that's what the guy was saying in the webinar was needed but my users don't have anything written in AD for the email address. Will this be a problem or will all my users create ok and then get their gmail address?

    Question 2: What's the easiest way to sync the passwords between AD and Google. I'm planning on disabling the users ability to change the password in Google but want it so that when their password is changed in AD it syncs to Google. From what I understand Google Directory sync tool is unable to read the encrypted passwords from AD?

    My big plan is actually to have single sign on setup so that when they login to Windows it automatically signs them into Google Apps, has anyone had any problems achieving this?

    Many thanks
    Dan

  2. #2


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,033 Times in 813 Posts
    Rep Power
    341
    1). We populate the mail attribute along with other attributes that we map to give them email aliases.
    In google the username is the email address.
    2) We don't sync passwords with AD. Instead we use a single sign on method (a commercial one provided by SSOEasy). There are others available, including opensource things like simplesamlphp and shibboleth. Big plus here is you can SSO with moodle etc too. The only time you will need passwords in google is if you want to use IMAP email (for iphones etc). In this case SSOEasy provide a nice method to set passwords in google.

    Quote Originally Posted by IT_Man_Dan View Post
    My big plan is actually to have single sign on setup so that when they login to Windows it automatically signs them into Google Apps, has anyone had any problems achieving this?
    I can't think how you can do this with passwords in Google. I may be wrong though. I would approach this by using a single sign on method that I described in 2) then using NTLM to pass through to that authentication. It is worth giving SAML 2.0 and SAML 1.1 Enterprise SSO Software - SSO Easy and email and see if they can do this. We chose not to bother with NTLM as we have lots of non-domain computers.


    Also - when you first sync - be very careful to exclude your admin account from the sync otherwise you can lock out the admin account. I managed to do it :/ but google fixed it pretty quick for me.

  3. 3 Thanks to CyberNerd:

    alttab (11th July 2012), chinesewhispers (16th July 2012), IT_Man_Dan (11th July 2012)

  4. #3

    Join Date
    Jul 2007
    Location
    West Sussex
    Posts
    268
    Thank Post
    35
    Thanked 11 Times in 11 Posts
    Rep Power
    17
    Ok thanks.

    So if I just populate all my users email attribute with %username%@mydomain.co.uk that should give them the username as we want it with Google.

    That's interesting about SSOEasy, I'll have to have a read about that. I take it that means that when they open google it just auto signs them into google apps? Does it work for things like the Google talk and everything? I just want it to be as simple as possible for the end users. You said about SSOEasy providing a good way to set passwords in google, is it able to replicate the password set in AD? I'm just thinking about when the users want to log in to Google offsite.

  5. #4


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,033 Times in 813 Posts
    Rep Power
    341
    Quote Originally Posted by IT_Man_Dan View Post
    Ok thanks.

    So if I just populate all my users email attribute with %username%@mydomain.co.uk that should give them the username as we want it with Google.
    yep

    Quote Originally Posted by IT_Man_Dan View Post
    That's interesting about SSOEasy, I'll have to have a read about that. I take it that means that when they open google it just auto signs them into google apps?
    Ours just provides a login url that we host ourselves. I think it is worth asking them if they could do NTLM pass-through for an internal site though.

    Quote Originally Posted by IT_Man_Dan View Post
    Does it work for things like the Google talk and everything? I just want it to be as simple as possible for the end users
    .
    It works for most google services. Last time I looked it didn't work for the picasa app (but did work for picasa web) and didn't work for imap.

    Quote Originally Posted by IT_Man_Dan View Post

    You said about SSOEasy providing a good way to set passwords in google, is it able to replicate the password set in AD? I'm just thinking about when the users want to log in to Google offsite.
    It doesn't replicate the AD password. We provide people the link to update their google password if they need IMAP etc services. Users login from home via a website that you host - your internet connection and server hosting the SSOEasy is a point of failure here.



SHARE:
+ Post New Thread

Similar Threads

  1. Google Apps sync with Active Directory?
    By googlemad in forum How do you do....it?
    Replies: 3
    Last Post: 3rd April 2012, 03:23 PM
  2. Setting up win2008r2 hyper-v network card question.
    By edutech4schools in forum Windows Server 2008 R2
    Replies: 3
    Last Post: 6th March 2012, 11:21 AM
  3. Setting up home wireless network with MAC and PC..?
    By tosca925 in forum General Chat
    Replies: 6
    Last Post: 21st November 2011, 05:39 PM
  4. Google Apps Sync for Microsoft Outlook
    By cbsc in forum Internet Related/Filtering/Firewall
    Replies: 3
    Last Post: 17th June 2011, 11:36 AM
  5. Open Directory Sync with AD
    By binky in forum General Chat
    Replies: 0
    Last Post: 5th June 2009, 09:48 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •