Is this normal G Suite Password Sync behaviour?

[snagrat]

I have GSDS and GSPS setup. It generally works fine. I have one issue with it though.

 

When creating a new user the initial password does not sync to Google. I wait for my GSDS to sync (every 2 hours schedule task) and then I need to reset the password in AD for it to work.

 

Is this normal? I though that after installing GCPS that Google could intercept and read the password that was being set.

[FN-GM]

I think that is correct, it will only pickup the passwords when they are reset.

[jmak]

That's how it's supposed to work...

 

From their "how it works" page:

 

In Active Directory, passwords are stored as write-only. They can't be read through any interface, such as LDAP. Therefore, conventional synchronization methods (for example,Google Cloud Directory Sync) can't access them. The only way to read passwords is to capture them when they are set or changed.[/Quote]

 

More details: https://support.google.com/a/answer/2920764?hl=en&ref_topic=4497963

 

It's the design intention in AD that the passwords can't be accessed by anything else.

[snagrat]

Yes but I am setting them.

 

Or does it not work because at the time of being set the account doesn’t exist in Google?

[caffrey]

Yes but I am setting them.

 

Or does it not work because at the time of being set the account doesn’t exist in Google?

 

Yes that,

 

I usually create accounts in AD, do a manual sync with GADS then reset the password in AD, or just give the account out with the temporary password with the option to change password on first login

[derf]

Just to echo the others, that is how it works, which is why I set up a SAML server for authenticating using domain credentials. It has the benefit on making a nice login for the chromebooks so the primary pupils have the same login procedure as they do on the w10 laptops and desktops.

[ADMaster]

There is a password filter dll sha1hexfltr that will put an sha1 hashed version of the password in the division field. Point GCDS at this field, and your initial password will sync.

You will also need to alter the permissions so users cannot read the attribute.

https://angrytechnician.wordpress.com/2011/05/04/securing-your-google-apps-sha1-password-hashes/

 

[snagrat]

There is a password filter dll sha1hexfltr that will put an sha1 hashed version of the password in the division field. Point GCDS at this field, and your initial password will sync.

You will also need to alter the permissions so users cannot read the attribute.

https://angrytechnician.wordpress.com/2011/05/04/securing-your-google-apps-sha1-password-hashes/

 

 

Obviously an old write up. It still works on the latest Google sync tools today?

[ADMaster]

Yes, I've been using it for years. Even on my 2016 DC. However it appears the link to sha1hexfltr is dead, which is what I use. The hashing-password-filter is still available for download, but I can't comment on its use.

Another solution I used before sha1hexfltr is Passwd HK I paired it with gam to sync passwords. It had problems with special characters so I've not used that since GAPS came along.

 

Another option that may work for you is to use the same initial password for everyone. I think GADS has an option to set the password to a static value on user creation. If you then use that password when you create the AD user, you will be at the same end result.