GADS exclude OU from sync

[rickjames]

Howdy, I think I'm being a duh-duh kind of idiot here

 

We have an OU structure like this

 

OU=KS-Users,DC=camelot,DC=local

 

Within KS-Users we have KS-Administrators, KS-Staff, KS-Pupils blahblahblah. We have a KS-Parents one in there that we really don't need to sync. I've setup (or at least think I have) an exclusion rule in the 'Org Units' tab then all the parents (about 500 of them) are syncing to the root OU instead.

 

Again I'm sure I'm being stupid, but what on Earth am I doing wrong?

[caffrey]

Do you have Exclusion Type ORGUNIT_DN Match type EXACT and the Rule is your OU path ?

 

*edit*

 

you can get the proper path by right clicking the OU container in AD users and computers, attribute editor and use the distinguishedName attribute (just click edit then copy and paste into GADS)

Edited April 17, 2015 by caffrey

[rickjames]

Ah cheers, will take a look at that now and pray it works...

[rickjames]

Just checked and yup, path is definitely correct! But like I say instead of excluding the OU altogether it puts them all in our GAPPS root OU. Have I got to add an exclusion rule alongside each tab ie GAPPS Configurarion/Org Units/User Accounts/Groups/User Profiles etc?

[caffrey]

No, it should be just the Org units - typical exclusion rules looks like this :-

 

 

Example here excludes the movie OU we have

 

You can also have exclusion rules inder the google apps configuration, this excludes OUs that are created in the GAFE admin panel that aren't related to your local domain.

 

Other than that - it should work - nothing in the logs ?

[rickjames]

Can't seem to see anything odd looking in the logs, like I say it just shifts them to our root OU which here seems to be ""

 

[caffrey]

Odd, I think I had similar issues until I got the LDAP path correct, is your base DN set correctly under LDAP Configuration ? e.g. ours is "OU=Network Users,OU="your ou" Top Level OU,DC="your DC"

[rickjames]

OU=KS-Users, DC=camelot, DC=local is our base DN, running a test comes back all fine and good?

 

Argh doing my head in.

[caffrey]

Maybe worth trying the distinguishedName of the OU container as the baseDN ? As that's what ours is set to

[rickjames]

That is the distinguishedName of the OU container above?

[caffrey]

Strange then, I remember having similar issues back in the day when I first set it up about 2 years ago, now it's set up I'm scared to touch it!

 

Seems odd that your's just says "KS-Parents" whereas ours says "Delete Organization(s) - 1 total "***/*** Top Level OU/Network Users/Staff Users/Test Staff OU" eg has the OU path

 

*edit*

 

Do you have the LDAP org unit mappings set ? and the search rules ?

Edited April 22, 2015 by caffrey

[rickjames]

Both seem right?

[caffrey]

That's not how ours is set up, the org unit description attribute is "description" not "name" BaseDN like yours is blank, in the mappings I don't use "" I use different google apps names (e.g. Student users) to keep staff and students apart e.g LDAP DN :OU=Student Users,OU=Network Users,OU=*** Top Level OU,DC=*** Google apps name - Student Users

[DMcCoy]

You can exclude the OU from being created, you cannot exclude the users within being created with this rule

 

User Search Rules

 

"

Note: You cannot create an LDAP rule to exclude a specific OU in your LDAP directory. Instead, limit the LDAP administrator authority on your LDAP directory server, removing access to any OUs on your LDAP directory server that you do not want to synchronize."

[caffrey]

That's user accounts, you can exclude OU's under Org units , seems the google documentation is quite conflicting Org Unit Exclusion Rules

[DMcCoy]

You can, and it will exclude the OU object. The user accounts are created with user search, which selects all users that can be seen from the search root with the specified filter. It does not use the OU criteria for this.

 

OUs creates OUs based on the filter

Users on User filter

Groups on groups filter.

 

The processes aren't linked in any way, because Google are Google and management tools aren't exciting to make. I've spent some time on this before I found the note, and the only way to stop the user creation from an OU below the root of the search is to deny access to the objects in AD from the GADS user.

[caffrey]

You're right, my mistake - it's been a while since I set this up - here's my original post http://www.edugeek.net/forums/cloud-services/109466-google-apps-gads-sync-exclusions.html

 

if the KS-Parents don't need email remove the mail attribute from AD

[rickjames]

The parents mail attribute is their own personal email address, the whole reason we have KS-Parents really is to do with our VLE. Just totally forgotten now it might be a Groups thing, we have a KS-Sec-Parents security group along with the others.

 

edit: actually no thats fine, that security group doesn't have a mail attribute

Edited April 23, 2015 by rickjames

[rickjames]

CRACKED IT, or so I think. Had to sort the search rules out in user accounts so its only allows users with our email address, so (&(objectCategory=person)(objectClass=user)(mail=*knightsbridgeschool.com*))

 

Run a simulated sync and it deletes all the users ie parents without it, so happy days (maybe)

[caffrey]

Good to know, glad you sorted it - takes a while to get it how you like it then you daren't touch it ever again!