G Suite education provisioning odd error

[KK20]

I am in the process of provisioning G Suite Education. I have created our GSuite education tenant with our domain vanity name. This domain is verified and all good to go. Since we run onsite AD with ADFS and sync to Azure (free A plan) I thought I would use GCDS first. Downloaded the app, set it up and away it went - all the users, groups and OU that I specified int he search and filters worked. Saved the XML, closed and reopened to make sure the token was still "authorised".

 

Removed all the users (except the admins), removed groups and OU so I could test again.

 

Moved onto using the "sync-cmd" command with a view to automating the process. gave sync-cmd -a -c and away it went before failing. Logs show that the process gets everything from the domain then attempts to import into GSuite. For every user account I get:

 

[2020-06-16 18:20:31,885+0100] [pool-857-thread-17] [ERROR] [plugin.google.ApiaryRetryPolicy] Retry attempts exhausted for Creating User @.co.uk, with attempt # 0
[2020-06-16 18:20:31,885+0100] [pool-857-thread-17] [ERROR] [plugin.google.ApiaryRetryPolicy] Last encountered exception: com.google.api.client.googleapis.json.GoogleJsonResponseException: 400 Bad Request
{
 "code" : 400,
 "errors" : [ {
   "domain" : "global",
   "message" : "Invalid Input: primary_user_email",
   "reason" : "invalid"
 } ],
 "message" : "Invalid Input: primary_user_email"
}

 

the @.co.uk was correct in each case and theoretically the same as when the GCDS updated - this was the log entry for the GCDS:

 

New user 123: "@.co.uk"
Org "Staff"
Non-address primary key "xxxxxxxxxxxxx"
Given name "xxxxxxx"
Family name "xxxxxxx"
SHA1 password
0 aliases

 

But this wasnt the end of the story. I thought "why not get Azure to do all the lifting for me?" So I went through the MS documentation for linking the GSuite app as a provisioning app. Guess what? Same error from Azure!

 

Failed to create User '@.co.uk' in G Suite; Error: Message: Message: The remote server returned an error: (400) Bad Request. Web Response: { "error": { "errors": [ { "domain": "global", "reason": "invalid", "message": "Invalid Input: primary_user_email" } ], "code": 400, "message": "Invalid Input: primary_user_email" } }

 

The only hint I get from the azure error is the "domain: Global" portion. Surely that should be "my" domain? But I cannot see anywhere this would be set.

 

Finally, I thought "perhaps I have borked things" so I ran the GCDS from config-manager.exe - lo and behold everything provisioned! Im pulling my hair out, how can the GCDS work but the sync_cmd not? Why does Azure give the same error as the sync_cmd?

[gh5000]

Try Google support. Admin console then the question mark. I'm not sure if GCDS is something they will directly support but worth a try.

[paulkerton]

Have you ran the error log through the G Suite Toolbox?

 

https://toolbox.googleapps.com/apps/main/

 

Log Analyzer and Log Analyzer 2 should help you.

The email attribute in AD needs to be populated with the full address of the user, or at least in a consistent format that you can use GCDS to alter the address to suit your format. Any alias that you'd like users to have go into proxyAddress fields, and GCDS will strip the smtp: part from the beginning of the email address automatically.

I went to one place where the email field was populated with [email protected] instead of the domain name they wanted in G Suite. I had to configure GCDS to replace the domain names in LDAP email addresses.

[KK20]

It seems that this is because our license is still a trial. This has limited our user count. I simply have to wait until google approves the school.

[KK20]

A follow up. School approved, Sync happened without issue. SSO works and whilst I dont have an education upgrade license to enrol my test chromebook, I can at least log in and the "per user" settings I had put in are working now (filter root cert, specific wifi etc).