Syncing users to Gsuite

[timbo343]

I've set up a our school to sync to google GSuite however when i'm running the sync, the logs are telling me the the majority of users

 

"Error while creating user user@....."

 

It would seem that a handfull of staff users have been created but that's it.

 

Can someone help me on this. The Azure Sync was a very very pain free setup and sync!

[IrritableTech]

Are you using Google Cloud Directory Sync or GADS? Have you checked the log files in c:\PF\Google Cloud Directory Sync?

 

Oh and have you been properly upgraded to Edu? How long have you had an account for? There are user limits until your application is fully approved.

Edited June 13, 2018 by IrritableTech

[timbo343]

Are you using Google Cloud Directory Sync or GADS? Have you checked the log files in c:\PF\Google Cloud Directory Sync?

 

Oh and have you been properly upgraded to Edu? How long have you had an account for? There are user limits until your application is fully approved.

 

We are using Google Cloud Directory Sync (4.5.7). Should i be using GADS?

 

Where are the logs stored in Program Files\GCDS? Should there be a file or folder called logs?

 

We had an email confirmation from Google Edu asking us to get the Head to authorise our Google Edu account. Once i got the head to send an email we got the following back:

"Welcome to G Suite for Education! We reviewed your application and are excited to upgrade your domain. I’m including a selection of resources to help guide your implementation."

[IrritableTech]

We are using Google Cloud Directory Sync (4.5.7). Should i be using GADS?

Where are the logs stored in Program Files\GCDS? Should there be a file or folder called logs?

We had an email confirmation from Google Edu asking us to get the Head to authorise our Google Edu account. Once i got the head to send an email we got the following back:

"Welcome to G Suite for Education! We reviewed your application and are excited to upgrade your domain. I’m including a selection of resources to help guide your implementation."

 

GADS (Google Active Directory Sync) was the previous name for Google Cloud Directory Sync. You should find some files in "PF\Google Cloud Directory Sync" called error.log and output.log that may help explain the issue, or in the logging tab of GCDS you should see where the scds_sync log is held. Hopefully one of them will give you a better error to go on.

 

If you've still got some limitations to your account I think it shows up in the Company profile section of the Admin Console.

[timbo343]

Found the logs, thank you. They are in the user's profile and the logs are the same as what is emailed to me.

 

I cant see any limitations in the Company Profile - it all looks as it should, well i cannot compare it to any others as i havent seen any other schools. Organisation type is set to Primary / Secondary Education.

 

Do i need to accept the data processing and Gsuite cloud identity policies before it will work?

[fiza]

The sync log should tell you why the accounts were not created or at least give some indication. If you can post up screenshots of your GCDS User Accounts setup screens (User attributes, Addtional User Attributes, Search Rules & Exclusion Rules) might help diagnose the issue.

[timbo343]

Do this help?

 

[2018-06-13 10:14:56,141] [swingWorker-pool-2-thread-4] [iNFO] [sync.agent.FullSyncAgent] Applying computed changes to service.

[2018-06-13 10:14:58,684] [swingWorker-pool-2-thread-4] [iNFO] [plugin.google.LocalAndRemoteKeyStore] 0 Non-Address Primary Key mapping(s) retrieved.

[2018-06-13 10:15:00,652] [pool-15757-thread-1] [ERROR] [plugin.google.ApiaryRetryPolicy] Retry attempts exhausted for Creating User ********@*****.co.uk, with attempt # 0

[2018-06-13 10:15:00,652] [pool-15757-thread-1] [ERROR] [plugin.google.ApiaryRetryPolicy] Last encountered exception: com.google.api.client.googleapis.json.GoogleJsonResponseException: 404 Not Found

{

"code" : 404,

"errors" : [ {

"domain" : "global",

"message" : "Domain not found.",

"reason" : "notFound"

} ],

"message" : "Domain not found."

}

[fiza]

Does the GCDS actually create some users but fail on others?

[timbo343]

It's creates 20 staff users and thats it. When i get back to my desk i will post the user attributes screen as requested

[fiza]

Are you duplicating your AD structure in G Suite? Have you got your AD OUs mapped to G Suite OUs? Where are the 20 users located in AD and G Suite that it does create?

[timbo343]

The sync log should tell you why the accounts were not created or at least give some indication. If you can post up screenshots of your GCDS User Accounts setup screens (User attributes, Addtional User Attributes, Search Rules & Exclusion Rules) might help diagnose the issue.

 

[timbo343]

Are you duplicating your AD structure in G Suite? Have you got your AD OUs mapped to G Suite OUs? Where are the 20 users located in AD and G Suite that it does create?

 

So, the 20 users it has created, are in the top level domain and not located in the folder structure in GSuite. It has created a folder tree but not all of it and added a few of our email service accounts which is what is supposed to have done but that's it.

 

In GCDS i have got OUs, User Accounts, Groups and User Profiles ticked to Sync.

 

I have a fair few exclusion rules set so specific OUs don't get carried over to Gsuite.

 

I've just removed a line from the Org Units > Search results and now if i click on test sync it's pulling in all OUs. Surely Google can make a better product than this?!

[fiza]

Couple of things not sure if they will solve your issue or not.

 

You have sync passwords for new and existing users but dont specify a password attribute.

On the search rules page what have you got as your Rule?

 

We have

 

(&(objectCategory=person)(objectClass=user)(mail=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

[fiza]

So, the 20 users it has created, are in the top level domain and not located in the folder structure in GSuite. It has created a folder tree but not all of it and added a few of our email service accounts which is what is supposed to have done but that's it.

 

In GCDS i have got OUs, User Accounts, Groups and User Profiles ticked to Sync.

 

I have a fair few exclusion rules set so specific OUs don't get carried over to Gsuite.

 

I've just removed a line from the Org Units > Search results and now if i click on test sync it's pulling in all OUs. Surely Google can make a better product than this?!

What have you put in as your Base DN for Org Units in GCDS? We point the Base DN to our Users OU in AD and then replicate the structure under the users OU into G Suite. We tick "Do not create or delete Google Organisations, but move users between existing organisations as specified in the User Sync Rules"

[timbo343]

Couple of things not sure if they will solve your issue or not.

 

You have sync passwords for new and existing users but dont specify a password attribute.

On the search rules page what have you got as your Rule?

 

We have

 

I'm not too fussed about the passwords at this point in time, i just want the users to come across.

[fiza]

I'm not too fussed about the passwords at this point in time, i just want the users to come across.

Fair enough. Please check the other things I suggested.

 

If you make a change in AD to one of the users that does get created and then simulate a sync does GCDS see the modification?

Is there something about these users that is different to the other users you are trying to create? Are they in a different OU in AD?

[timbo343]

Couple of things not sure if they will solve your issue or not.

 

You have sync passwords for new and existing users but dont specify a password attribute.

On the search rules page what have you got as your Rule?

 

We have

 

What have you put in as your Base DN for Org Units in GCDS? We point the Base DN to our Users OU in AD and then replicate the structure under the users OU into G Suite. We tick "Do not create or delete Google Organisations, but move users between existing organisations as specified in the User Sync Rules"

 

The base DN for Org units is dc=shs,dc=com as we have an administrators as a separate OU away from SHS Users. I'm wanting to sync SHS users for now. My exclusions seem to be working

[fiza]

The base DN for Org units is dc=shs,dc=com as we have an administrators as a separate OU away from SHS Users. I'm wanting to sync SHS users for now. My exclusions seem to be working

So according to that screenshot GCDS is looking at an OU called "Email Homepage" and looking for users and OUs under that.

 

Is that correct?

[snagrat]

Is you Google account authorised yet for Education?

 

20 or 25 is the maximum users you can have on until it is approved.

[fiza]

Is you Google account authorised yet for Education?

 

20 or 25 is the maximum users you can have on until it is approved.

 

Following on from that post you can see if you are authorised under Billing.

 

[timbo343]

So an update on this and after speaking to a Network Manager Friend who shared a few screenshots with me i've managed to get the Google OUs replicated to match my AD and it's brought in the staff accounts. Google users only shows 20 lines per page

 

I've cleared the Cache in GCDS which might have helped things.

 

The billing is as shown that @fiza has shown.

 

I'm now going to try and get the student accounts to come over.

[fiza]

So an update on this and after speaking to a Network Manager Friend who shared a few screenshots with me i've managed to get the Google OUs replicated to match my AD and it's brought in the staff accounts. Google users only shows 20 lines per page

 

I've cleared the Cache in GCDS which might have helped things.

 

The billing is as shown that @fiza has shown.

 

I'm now going to try and get the student accounts to come over.

So which bits were different on your GCDS?

[timbo343]

Honestly i'm not sure. I've removed the tick from Org Units > LDAP Org Unit Mappings and removed all entries from this area.

 

Org Units > Search results has the default entry listed.

 

Org Units > Exclusion Rules are all working but i don't understand why some need Exact and others need Substring.

 

User Accounts > Search results - ive removed all configured options in here and left the default value.

 

User Accounts > Exclusion Rules - nothing configured in here.

 

Groups > Search Results and Exclusion Rules - these are left as default

 

User Profiles - left these alone.

 

The only issue i have now is getting the students and their groups in as we have a subdomain for students so their email addresses are [email protected].

 

When importing these into GSuite, we are saying domain not available. How do i go about getting subdomain users into Gsuite?

[timbo343]

All students now in Gsuite as the subdomain has been added.

[timbo343]

Some of our users have additional email addresses in the ProxyAddresses field in AD Attributes. Is there a way to sync these across to GSuite?