Anybody syncing Google licenses with GADS via OU NOT Groups

[Jaan]

Google support have said they can't support me with this query.

 

Their support pages say you can assign licenses via a group or SYNC them via OU. The support page gives LDAP query examples to do this via Group but not OU.

 

Anybody out there using the SYNC to OU via Google Active Directory Sync method?

 

What LDAP query are you using?

 

Thanks!

[jthompson]

I hadn't even realised that you could assign licenses using GCDS.

 

For the licenses that we assign to our teaching staff users on Google, we are currently just auto-assigning them in "Google Admin > Billing > License settings > OU", so GCDS sync doesn't come into it, other than when it's placing users into OUs in the first place. I wonder if that's what Google support page is referring to? That doesn't automatically release licenses when users are moved out of that OU or suspended, however, so you'd have to manually release licenses from leavers' accounts.

[Steve21]

Isn’t the OU licensing the Google OU not AD OU?

 

You could turn it on in Google admin to auto license OUs or exclude some etc under Billing Subscriptions

 

I don’t think it meant LDAP style OUs unless I’ve missed that

 

Steve

[Jaan]

Our Ad structure matches that of our Google OU. I aware i can assign them via the Google admin panel onto the OUs. However from what i understand, i have to manually maintain the removal of licenses in the admin panel.

 

I'd prefer to just sync them via GDCS/GADS so that it can be assigned and removed automatically based on user OU location. It a bit more seamless..... however, it seems to have snowballed

 

I have contacted Google support who have said it's possible. However they only give Group sync LDAP example and not OUs ones. They said LDAP queries fall outside of their support.

 

 

You can use Google Cloud Directory Sync (GCDS) to automatically synchronize users, groups, and contacts so that the data in your Google Account matches the data in your LDAP server, such as Microsoft Active Directory. You can also use GCDS to sync licenses by user, OU, or group.

 

 

[shared] Provisioning Google Workspace for Education Paid Licenses - Updated

 

Source: https://docs.google.com/document/d/19kL60cDnsIyZ-sPzck37oEHIRZVYgdn1-yxm28wL2jw/edit#

[Jaan]

Here's the example page.

 

https://support.google.com/a/answer/6126589#zippy=%2Ccommon-ldap-queries%2Coptimizing-your-search-rules

[jthompson]

You'd need an LDAP query that returns only users from a particular OU, which I don't think is possible. Not without being able to specify a new base DN for the query, which you're not able to do in GCDS.

[Jaan]

My base DN:

 

OU=Users,OU=School Users & Computers,DC=domain,DC=net

 

each of my LDAP OU queries would be OU specific and fallen within the BASE DN

 

Edited April 21, 2022 by Jaan

[Jaan]

I've just found this article that suggests usings groups also syncs (adds/removes) licences. So i might as well use that as i already have groups with the memberships created.

 

https://amplifiedlabs.zendesk.com/hc/en-us/articles/1500011643062-Licensing-with-GCDS-GADS-

 

 

The below LDAP query pulls any users that are members of the defined group (and also ignores suspended accounts)

 

(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=GLS-GAFE-AllStaff,OU=Security Groups,OU=GAFETest,DC=testlab,DC=amplifiedit,DC=com)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

i'll give this a try

[timbo343]

We have started to do this and it makes it much easier to assign licenses.

 

We had to add the relevant Product IDs / SKU IDs / SKU Label which can be referenced from here: https://developers.google.com/admin-sdk/licensing/v1/how-tos/products

 

Our LDAP Query is:

 

(&(objectCategory=person)(objectClass=user)(department=staff)(mail=*@ourdomain))

 

as we only want to license our staff users. It took a bit of working out on what I wanted to filter by but it means if we want to take a license away from someone, for example if they leave, we can either remove the department reference or their email address and it will remove the license for the user.

 

[Jaan]

I've just added the below for applying our staff license.

 

(&(objectCategory=person)(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=ALL Staff,OU=Email Distribution,OU=School Users & Computers,DC=domain,DC=net)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))

 

This adds the license to anybody that is in the "all staff" email distribution group in the define location (also supports nested groups and ignores disabled accounts)

 

After simulating that sync, it seems to be working....... just need to apply it now.......... i'll have a brew first!

 

i'll not forget to tick the "Remove this license from the google domain users that don't match this rules" setion!

[jthompson]

I'd be interested in using GCDS to assign and release licenses according to AD group membership, but we would need it to be based on more than just one of the groups that we're syncing. That is, it can't be goverened by membership of a single group. Ideally I'd have a rule in GCDS for each group, rather than one rule to rule them all (less manageable), but I'll have to experiment to see whether it gets in a mess when the option to remove licenses is being used.

 

EDIT: it looks as though GCDS won't let you create more than one rule per SKU when using the remove option, so one big LDAP query it is.

Edited April 21, 2022 by jthompson

[Jaan]

I'd be interested in using GCDS to assign and release licenses according to AD group membership, but we would need it to be based on more than just one of the groups that we're syncing. That is, it can't be goverened by membership of a single group. Ideally I'd have a rule in GCDS for each group, rather than one rule to rule them all (less manageable), but I'll have to experiment to see whether it gets in a mess when the option to remove licenses is being used.

 

I can confirm this has worked for me.

 

It has assigned licenses based on AD Group membership. I have two Groups, All Students & All Staff. each group has a different license now assigned to them via GCDS.

 

Not sure how it will handle the removal on said license.

 

However, i have checked it to remove the license when the user fall out of scope.

 

EDIT: yeah you can't have a different query for a same license

Edited April 21, 2022 by Jaan