In one of our previous articles about how to 'friend' Zimbra and MS Active Directory, which is used in most Russian enterprises for user account management. In that article, we suggested that Zimbra users take advantage of the simplest and safest method for creating mailboxes in Zimbra based on AD data called LAZY Mode. This mode allows for automatically creating a new Zimbra user with a name and password from AD at the moment of their first login to the Zimbra web client. However, due to the discussion that arose in the comments, it became clear that this method of automatic configuration from AD does not suit all Zimbra administrators. Therefore, we will now describe an alternative method for automating user account creation based on AD data called EAGER Mode.
LAZY and EAGER Modes differ in their approaches to creating new accounts. In the case of LAZY, the system waits for the user to log into the Zimbra web client to create a new user, while in EAGER mode, the system periodically polls the AD server for new users and, upon receiving a positive response, automatically creates a new account based on the data provided by Active Directory. This seemingly minor difference can make the use of LAZY Mode completely unacceptable for a number of IT managers.
One such case might be a direct prohibition on using the Zimbra web client. The reason for this could be the conservation of server computing resources (when using the web client, the Zimbra server can provide quality service for 2,500 users, whereas with desktop and mobile clients, it can support up to 5,000-6,000 users), or an enterprise security policy that explicitly prohibits using the web client for email. The absence of the web client makes it impossible to use LAZY Mode, which only works within it, leaving IT managers at such enterprises with no choice but to use EAGER Mode.
First, we need to connect AD as an external LDAP to Zimbra. To do this, access the administration console located at mail.company.ru:7071/zimbraAdmin/, and then select Configure, followed by the sub-item Domains. In the list, domains now you need to select the one that we will use in conjunction with AD, and by right-clicking on the selected domain, choose "Configure Authentication". After this, a dialog for configuring the external LDAP will appear, where we will enter all necessary data to integrate Zimbra with AD.
After entering all the necessary data, we should create a configuration file, for example, touch ~/Documents/autoprov.cfg, into which we will enter a series of commands to activate the auto-configuration of accounts from AD in EAGER Mode. Unlike LAZY Mode, where the setup process is quite simple and all configurations can be entered as commands in the CLI, in the case of EAGER Mode, it's better to play it safe and keep all configurations in a separate file. This will make it easier to make changes if something goes wrong.
So, after creating the file ~/Documents/autoprov.cfg, you should write the following lines, adapting them to your infrastructure:
md company.ru zimbraAutoProvAccountNameMap "samAccountName"
md company.ru +zimbraAutoProvAttrMap description=description
md company.ru +zimbraAutoProvAttrMap displayName=displayName
md company.ru +zimbraAutoProvAttrMap givenName=givenName
md company.ru +zimbraAutoProvAttrMap cn=cn
md company.ru +zimbraAutoProvAttrMap sn=sn
md company.ru zimbraAutoProvAuthMech LDAP
md company.ru zimbraAutoProvBatchSize 40
md company.ru zimbraAutoProvLdapAdminBindDn "CN=Administrator,CN=Users,DC=company,DC=ru"
md company.ru zimbraAutoProvLdapAdminBindPassword *********
md company.ru zimbraAutoProvLdapBindDn "Administrator@company.ru"
md company.ru zimbraAutoProvLdapSearchBase "CN=Users,dc=company,dc=ru"
md company.ru zimbraAutoProvLdapSearchFilter "(cn=%u)"
md company.ru zimbraAutoProvLdapURL "ldap://192.168.0.1:389"
md company.ru zimbraAutoProvMode EAGER
md company.ru zimbraAutoProvNotificationBody "Your account has been automatically created. Your email address is ${ACCOUNT_ADDRESS}."
md company.ru zimbraAutoProvNotificationFromAddress Administrator@company.ru
md company.ru zimbraAutoProvNotificationSubject "A new account has been created automatically"
ms mail.company.ru zimbraAutoProvPollingInterval "1m"
ms mail.company.ru +zimbraAutoProvScheduledDomains "company.ru"Thanks to these settings, we make the Zimbra server contact Active Directory every minute to check for new users in the database. If new users are found, an account will be created for them and a welcome message will be sent.
After all changes in the file have been saved, it will be necessary to apply the settings in it using the command zmprov < ~/Documents/autoprov.cfg. All changes made will take effect immediately, and there should be no need to restart the server.
In the event that the auto-provisioning of accounts from AD in EAGER Mode works, the file /opt/zimbra/log/mailbox.log will display the progress of the account auto-provisioning as follows:
[AutoProvision] [] autoprov - Auto provisioning accounts on domain company.ru
[AutoProvision] [] autoprov - 1 external LDAP entries returned as search result
[AutoProvision] [] autoprov - auto creating account in EAGER mode: example@company.ru, dn="CN=example,OU=zimbrausers,DC=company,DC=ru"However, if the auto-provisioning of accounts is not working, the issue is most likely on the AD server side. In this case, it is necessary to look at the error code that occurs. Here are the most common ones:
525 — User not found
52e — Invalid credentials
530 — No permission to log in at this time
531 — No permission to log in from this computer
532 — Password expiration
533 — Account action stopped
534 — User does not have sufficient rights to log in from this computer
701 — Account expiration
773 — User must reset password
775 — Account action temporarily restricted
8350 — Invalid Distinguished Name format
Source: habr.com
