Adobe Sync Utility for AD > Google

[JRA]

Morning all, story time...

 

Arrived at a (quite lovely) new place who are a Google school and I assumed had GCDS doing the AD > Google sync. I didn't have much to go on but GCDS was proposing changes that never went away, would appear to create some accounts but never quite clear all what was pending in a test sync. A scheduled task ran it against the current .xml file and didn't run quite right, with a 0xFF in task scheduler.

 

After much to and fro with Google (who were also quite lovely) they on their end determined that "Adobe" were creating the accounts and running some sort of sync to Google.

 

Now I know of (in a limited sense) there is an Adobe utility that can do this, I think for the sake of making linked Adobe IDs. But oh my word trying to find a human being to talk this over with at Adobe is near impossible without endless amounts of Adobe portal experience sign in registration ad nauseum with info I plain don't have here.

 

I guess what I'm asking (finally) is does anyone out there manage their AD > Google sync with any Adobe LDAP-ish system? And is willing to get the sock puppets and crayons out and walk me through it a bit?

 

Thanks all.

[dhicks]

Now I know of (in a limited sense) there is an Adobe utility that can do this, I think for the sake of making linked Adobe IDs.

 

If I understand correctly, Adobe requires a sync process (of some kind) from Active Directory / Google Workspace to create Adobe IDs that users (pupils and/or staff) can then log in to with the usual log-in-with-Google process. This holds for free accounts as well as paid, so you can have your pupils access Adobe Spark and various other stuff for free via their Google Workspace login, you just have to figure out the sync process. You'd think Adobe would just let you go "My domain is myschool.sch.uk, please let any users with that domain log in", but the process seems to be more complex than that - it's been on my to-do list to take a look at for a while but, like you, I've not managed to get my head around it yet. Sorry, that doesn't really answer any question you've asked, but at least you know there's someone stuck on the same thing - if anyone answers it'll help both of us :-)

[JRA]

If I understand correctly, Adobe requires a sync process (of some kind) from Active Directory / Google Workspace to create Adobe IDs that users (pupils and/or staff) can then log in to with the usual log-in-with-Google process. This holds for free accounts as well as paid, so you can have your pupils access Adobe Spark and various other stuff for free via their Google Workspace login, you just have to figure out the sync process. You'd think Adobe would just let you go "My domain is myschool.sch.uk, please let any users with that domain log in", but the process seems to be more complex than that - it's been on my to-do list to take a look at for a while but, like you, I've not managed to get my head around it yet. Sorry, that doesn't really answer any question you've asked, but at least you know there's someone stuck on the same thing - if anyone answers it'll help both of us :-)

I have a web genius bar opportunity with an Adobe customer support experience facilitator or something like that Friday so if I get any news I'll fill you in. Cheers.

[Manny-Tech]

I use the Adobe User Sync Tool to populate all my users / groups into Adobe Admin Console from AD. I won't like, it was pain in the backside to get setup initially but once it's done it maintains itself. I then use ADFS to SSO straight to Adobe. From what I understand you want to do this: https://helpx.adobe.com/in/enterprise/using/add-google-sync.html to populate users into Adobe from Google and then https://helpx.adobe.com/in/enterprise/using/setup-sso-google.html to setup the federation with Google.

[JRA]

Ah right right, thanks. Gosh it's useful to have some names and some process thanks much.

 

What my issue seems to be though is Google are seeing the gmail users created by Adobe and (as far as they're saying) not by GCDS.

 

Do you know what sort of Adobe utility might be doing that?

 

I'll check those links after lunch also thanks for that.

[Manny-Tech]

I don't see how that is possible, or why you would do that for Google accounts. Are you sure it hasn't just been misinterpreted? Have you created a user in Adobe and then observed whether it gets sync'd to Google?

[JRA]

I don't see how that is possible, or why you would do that for Google accounts. Are you sure it hasn't just been misinterpreted? Have you created a user in Adobe and then observed whether it gets sync'd to Google?

Yeah the whole thing is rather odd. Believe me I wouldn't want to either, just inherited something that has passed out of knowledge and un-picking a few of the undocumented bits at the new place.

 

I had as I say *heard* Adobe had something that'd do this, and literally the following is from Google:

 

According to the investigation the users are getting created apparently by an auto-provision feature with a third party called Adobe, since those users are being created by this tool, GCDS won't be creating them, you can find more information about this on this help center article: https://support.google.com/a/answer/9291789

 

It's all rather odd but I'm kinda closer than I was before you folks came along so thanks much both.

[dhicks]

the users are getting created apparently by an auto-provision feature with a third party called Adobe

 

"a third party called Adobe" sounds a little odd, as if the support person hasn't heard of them before. Could you have another tool somewhere creating users - a left-over locally-hosted script of some sort, or maybe SalamanderSoft's system, or some other third party system?

[JRA]

I mean very much certainly "could" have yes. It doesn't look like either of the DCs though have anything else in task scheduler, which is where I've done some rummaging.

 

There's lots that isn't adding up obvs, but once Friday meeting is done I should have a bit more of a clue. I hope lol.

[JRA]

Rummaging this morning I'm convinced they're not right in this being an Adobe utility doing it. I am certain GCDS is running ok but for all the world looks like some odd exclusion rules I didn't spot on first dissection of things, and Google and myself between us led each other down some rabbit holes.

 

What I don't get though is why some users, who should be hitting exclusion rules in GCDS are still showing up in proposed changes for the test sync, and why task scheduler seems to let this run on it's schedule but still gives me a 0xFF when it runs.

 

Carrying on digging but I'm grateful for all the assistance/sanity!