Help with GADS setup, user import

[Rgillis]

Hello, I have begun using GADS to move users from our Active Directory into GAFE. I was able to get started and I can run a test import and I can see all the staff members, since one of the search rules is looking for email addresses. I can't seem to make the search rules find students. I go into the user accounts, search rules and I have been trying to add this rule to get students who are a member of this security group

(&(objectCategory=user)(memberof=CN=Example-Students,OU=Security Groups,OU=LPSD Groups,DC=example,DC=k12,DC=co,DC=us))

 

 

and I get the error message "FAILURE : Failed to execute query because the object at Base DN: "OU=Example Groups,DC=Example,DC=k12,DC=co,DC=us" is missing or inaccessible. I left the base DN blank, and I have tried the full DN with the OU of the security group, both don't work.

 

 

This isn't making sense to me, as there is an OU with the name under the base DN of DC=example, DC=k12,DC=co,DC=us. I can successfully connect with this base DN on the LDAP configuration tab. I feel like I am missing a big concept that is not here to make this work.

 

I don't know a lot about LDAP queries or GADS, but I think I am missing something in maybe the org units tab that I need to make this user search work.

I wanted to not mess with the org units tab, as I wanted a mostly 1-1 import, with some exclusions to take care of odds and ends. I think I have some exclusions working, to keep disabled and test users from the import.

I would be happy to post more details, but I don't yet know what is relevant and what is not to my problem.

Thank you for taking the time to read this.

 

 

UPDATE: I found out part of the issue. We don't have student email right now so the query that was looking for the AD "mail" attribute didn't see that with students and was not importing them. I changed that to "user Principal name" and it's a start.

Edited March 2, 2015 by Rgillis

[fiza]

I am having a similar issue in that we don't have email addresses recorded for students in Active Directory. I have tried using "userPrincipleName" as the Email Address Attribute but I get 0 accounts when I run the simulated sync.

 

Any ideas?

 

Update : Just after I posted I worked it out. I had changed the User Attribute in GADs but forgot to change it in the Search Rules filter.

It has picked up my users now.

Edited May 1, 2015 by fiza

[fiza]

Ok - spoke too soon. When I run the actual sync it creates the users but gives them weird logins ;

 

mtrhb2hpbefazg9tywlulnz5bmvycy5oawxsaw5nzg9ulnnjac51aw@gafe.domain

 

What am I doing wrong?

[Rgillis]

I figured out my issue, here is what I did.

I was using user Principal name, but GADS wants to use the AD mail attribute. So I went to the OU for the students and selected all of them. Then I right clicked on an account and selected the mail box. I typed in "%[email protected]" and it populated that field for me. I then re-ran GADS and users were being created with the format we wanted.

 

I also wanted to post my search rule, as the example AD search syntax in the GADS admin guide was not working for me.

This is the user account search rule I have and it works.

I selected the first option "Place users in the following Google Apps Org unit -> Org Unit based on Org Units and DN" and the scope is set to Sub-tree

I left the base DN blank.

I think I had the object class incorrect, it was user and now it says objectCategory=person, but I made a lot of changes until it was working.

I think populating the mail attribute and fixing the query was what did the trick for me.

 

 

 

(&(objectClass=person) (memberOf=CN=GoogleAppsUsers, OU=Security Groups, OU=MyDomain Groups, DC=MYDomain,DC=k12,DC=co,DC=us))

 

 

One last note, we are not doing student email this year, but the mail attribute was to generate the login / user name that we wanted.

[Rgillis]

On the user accounts tab, under additional user attributes, what are you using for the Given Name and Family Name attributes? Also, if you are using anything other than the Mail attribute on the first User tab, this is what the account/ email address in Google will be.

It looks like you have the Object GUID set as that email address attribute to me.

Try the AD trick to fill in the mail attribute (even if students will not have mail, which is done at the org level within the admin console BTW) and then make sure you have "mail" as the email address attribute under the user accounts tab and that might fix it.

[fiza]

On the user accounts tab, under additional user attributes, what are you using for the Given Name and Family Name attributes? Also, if you are using anything other than the Mail attribute on the first User tab, this is what the account/ email address in Google will be.

It looks like you have the Object GUID set as that email address attribute to me.

Try the AD trick to fill in the mail attribute (even if students will not have mail, which is done at the org level within the admin console BTW) and then make sure you have "mail" as the email address attribute under the user accounts tab and that might fix it.

 

I am using givenName and sn

[Rgillis]

What are you using for the email address attribute?

[fiza]

One other issue I have is that although the users get created (albeit with weird email addresses) I can only create them at a top level OU. I cant create under it ie Year 7

 

I have this structure;

 

Domain

----- Administrators

-----Staff

-----Students

------ Year 7

------- Year 8

------ Year 9

------ etc

[fiza]

Added in the student emails on a couple of accounts and now in the simulation I get the right names. It still wont create them in the sub organisation of Year 7 in GAFE.

[Rgillis]

You need to make sure "sub tree" is the scope for the user account search rule instead of one level or object. You can also make explicit search rules that start at year 7 or whatever if you prefer.(&(objectClass=person)(memberOf=CN=Year7, OU=Domain, OU=)...etc

[Rgillis]

Also, make sure you set your org unit mappings under the org unit tab.You need to have both the org unit get imported from AD and hence created in Google, then the user search rule has to be looking at the OU with the user in it. Your user search could be right, but if the org units are not correct then GADS won't place them in the org.

 

here is one example of the Org unit

 

LDAP DN OU=Staff,OU=MyDomain Users,DC=MyDomain,DC=k12,DC=co,DC=us

Google Apps Name My Domain Staff

 

I did one for students too.

Then under search rules it's dead simple.

Scope is sub-tree, rule is (objectClass=organizationalUnit), base DN is blank and "Org unit description attribute " is description.

 

Then I had to build like 20 exclusion rules to make sure users we don't want in google don't come in.

Example, Exclude type Org Unit DN, match type is exact, rule is "OU=Disabled,OU=Staff,OU=My Domian Users,DC=MyDomain,DC=k12,DC=co,DC=us"

[fiza]

@Rgillis - copied your code from post above and substituted my details. Accounts get created with the right names but at the root of my Google domain. Not in Year 7 where I want them.