{"id":39082,"date":"2019-10-31T22:27:45","date_gmt":"2019-10-31T19:27:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/polnotsennaya-multiarendnost-v-zimbra-ose-s-pomoshhyu-zextras-admin\/"},"modified":"2019-10-31T22:27:45","modified_gmt":"2019-10-31T19:27:45","slug":"polnotsennaya-multiarendnost-v-zimbra-ose-s-pomoshhyu-zextras-admin","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polnotsennaya-multiarendnost-v-zimbra-ose-s-pomoshhyu-zextras-admin","title":{"rendered":"Full multi-tenancy in Zimbra OSE with Zextras Admin","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Multitenancy is currently one of the most effective models for providing IT services. A single instance of an application running on one server infrastructure, but accessible to multiple users and organizations, allows for the maximum reduction of the cost of providing IT services while achieving the highest quality. The architecture of Zimbra Collaboration Suite Open-Source Edition was originally built on the concept of multitenancy. As a result, multiple mail accounts can be created within a single installation of Zimbra OSE. domains<\/a>, and its users won't even suspect each other's existence.<\/p>\n

This is precisely why Zimbra Collaboration Suite Open-Source Edition is an excellent choice for groups of companies and holdings that need to provide each entity with mail on its own domain without wanting to spend a lot of money on these purposes. Zimbra Collaboration Suite Open-Source Edition could also be suitable for SaaS providers offering access to corporate email and collaboration tools, were it not for two significant limitations: the lack of simple and understandable administrative tools for delegating administrative powers and for enforcing domain restrictions in the Open-Source version of Zimbra. In other words, Zimbra OSE only has an API for implementing these functions, while there are no special console commands or options in the web administrator console. To overcome these limitations, Zextras has developed a special add-on, Zextras Admin, which is part of the Zextras Suite Pro extensions. Let's take a look at how Zextras Admin can transform the free Zimbra OSE into a perfectly suitable solution for SaaS providers.<\/p>\n

\"Full
\n<\/a><\/noindex>
\nIn addition to the main administrator account, Zimbra Collaboration Suite Open-Source Edition supports the creation of other administrator accounts; however, each created administrator will have the same level of authority as the original administrator. Using the built-in feature to restrict administrator rights to a single domain in Zimbra OSE via the API is extremely difficult. As a result, this becomes a significant limitation, preventing the SaaS provider from transferring domain management into the hands of the client, who would then handle their own administration. This, in turn, means that all corporate email administration tasks, such as creating new and deleting old mailboxes and creating passwords for them, must be handled by the SaaS provider themselves. Besides the obvious increase in the cost of providing the service, this also poses enormous information security risks.<\/p>\n

This problem can be resolved by the Zextras Admin extension, which enables the segmentation of administrative privileges in Zimbra OSE. With this extension, the system administrator can create an unlimited number of new administrators and restrict their rights as needed. For instance, they can appoint their assistant as the administrator over certain domains if they are unable to handle requests from all clients themselves. This will help improve response times to client requests, ensure additional information security, and enhance the quality of administrator work.<\/p>\n

They can also appoint a user from one of the domains as an administrator, limiting their authority to just that domain, or add junior administrators who can reset passwords or create new accounts for users within their domains while not having access to the content of employees' mailboxes. This will foster the creation of a self-service system, allowing the enterprise to manage its provided email domain independently. Such an approach is not only safe and convenient for the enterprise but also allows the SaaS provider to significantly reduce the cost of service delivery.<\/p>\n

It's noteworthy that all of this is done using a few commands in the administration console. Let's verify this by creating an administrator for the domain mail.company.ru. To make the user admin@company.ru the administrator of the domain mail.company.ru, it is enough to enter the command\u00a0zxsuite admin doAddDelegationSettings admin@company.ru mail.company.ru viewMail true<\/b>. After this, the user admin@company.ru will become the administrator of their domain and will be able to view the emails of other users.\u00a0<\/p>\n

In addition to creating the main administrator, let's turn one of the managers into a junior administrator using the command\u00a0zxsuite admin doAddDelegationSettings manager@company.ru mail.company.ru viewMail false<\/b>. Unlike the main administrator, the junior administrator will not be able to view employees' emails, but will be able to perform other operations, such as creating and deleting mailboxes. This can be very useful at times when the main administrator does not have time to carry out routine operations.<\/p>\n

Zextras Admin also provides the option to edit permissions. For instance, if the main administrator goes on vacation, the manager can temporarily take over their duties. To allow the manager to view employees' emails, simply use the command\u00a0zxsuite admin doEditDelegationSettings manager@company.ru mail.company.ru viewMail true<\/b>, and then, when the main administrator returns from vacation, the manager can again be made a junior administrator. Users can also be stripped of administrative rights using the command\u00a0zxsuite admin doRemoveDelegationSettings manager@company.ru mail.company.ru<\/b>.<\/p>\n

\"Full
\n
\nIt is also important that all the aforementioned functions are duplicated in the Zimbra web administration console. As a result, managing the company's domain becomes accessible even to those employees who have little experience with the command line. Additionally, having a graphical interface for these settings reduces the training time for the employee who will administer the domain.<\/p>\n

However, the complexity of delegating administrator rights is not the only serious limitation in Zimbra OSE. In addition, the built-in capability to set limits on the number of mailboxes for domains, as well as limits on the space they occupy, is only implemented through the API. Without such limits, it will be difficult for the system administrator to plan the necessary volume of storage in mail repositories. The absence of such constraints also means the inability to introduce pricing plans. The Zextras Admin extension is capable of removing this limitation. Thanks to its feature Domain Limits<\/b>, this extension allows limiting certain domains both by the number of mailboxes and by the space used by these mailboxes.\u00a0<\/p>\n

Suppose a company using the domain mail.company.ru has purchased a plan that allows it to have no more than 50 mailboxes and occupy no more than 25 gigabytes on the hard disk of the mail repository. It would make sense to limit this domain to 50 users, each of whom would receive a mailbox of 512 megabytes; however, in reality, such limits do not suit all employees of the company. For example, while a simple manager might suffice with a mailbox size of 100 megabytes, sales department employees, who are always actively communicating, might need more than one gigabyte. Therefore, it would be logical for the company to impose one restriction for managers and another for sales and support staff. This can be achieved by dividing employees into groups, which in Zimbra OSE are called Class of Service<\/b>, and then setting corresponding limits for each group.\u00a0<\/p>\n

For this, the main administrator just needs to enter the command\u00a0zxsuite admin setDomainSettings mail.company.ru account_limit 50 domain_account_quota 1gb cos_limits managers:40,sales:10<\/b>As a result, a limit of 50 accounts for the domain was introduced, with a maximum mailbox size of 1 gigabyte, as well as the division of mailboxes into two different groups. After this, an artificial limit of 384 megabytes can be set for 40 users in the 'Managers' group, while the 'Sales' group will maintain the 1 gigabyte limit. Thus, even when fully filled, the mailboxes under the domain mail.company.ru will not occupy more than 25 gigabytes.\u00a0<\/p>\n

\"Full
\n
\nAll of the above functionality is also available in the Zextras Suite web administration console, allowing the domain administrator to make necessary changes quickly and conveniently without spending much time on training.<\/p>\n

To ensure maximum transparency in the interaction between the SaaS provider and the client, Zextras Admin maintains logs of all actions performed by delegated administrators, which can be viewed directly from the Zimbra OSE administration console. On the first of each month, Zextras Admin also generates a monthly report on the activities of all administrators, including all necessary data, such as failed login attempts and attempts to exceed the established domain limits.\u00a0<\/p>\n

Thus, Zextras Admin transforms the Zimbra Collaboration Suite Open-Source Edition into a solution ideally suited for SaaS providers. Thanks to extremely low licensing costs and a multi-tenant architecture with self-service capabilities, this solution enables ISPs to reduce the cost of service delivery, make their business more profitable, and consequently, more competitive.<\/p>\n

The safety alphabet in Kubernetes: authentication, authorization, auditing
\n
Source: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041c\u0443\u043b\u044c\u0442\u0438\u0430\u0440\u0435\u043d\u0434\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0418\u0422-\u0443\u0441\u043b\u0443\u0433. \u0415\u0434\u0438\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0437\u0430\u043f\u0443\u0449\u0435\u043d\u043d\u044b\u0439 \u043d\u0430 \u043e\u0434\u043d\u043e\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043d\u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0438 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u0439, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0441\u0435\u0431\u0435\u0441\u0442\u043e\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0418\u0422-\u0443\u0441\u043b\u0443\u0433 \u0438 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0438\u0445 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0430. \u0412 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0443 Zimbra Collaboration Suite Open-Source Edition \u0431\u044b\u043b\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0437\u0430\u043b\u043e\u0436\u0435\u043d\u0430 \u0438\u0434\u0435\u044f \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0440\u0435\u043d\u0434\u043d\u043e\u0441\u0442\u0438. \u0411\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u044d\u0442\u043e\u043c\u0443, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":29325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-39082","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Full-fledged multi-tenancy in Zimbra OSE with Zextras Admin | ProHoster","description":"Multi-tenancy is currently one of the most effective models for providing IT services.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polnotsennaya-multiarendnost-v-zimbra-ose-s-pomoshhyu-zextras-admin","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u0430\u044f \u043c\u0443\u043b\u044c\u0442\u0438\u0430\u0440\u0435\u043d\u0434\u043d\u043e\u0441\u0442\u044c \u0432 Zimbra OSE \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Zextras Admin | ProHoster","og:description":"\u041c\u0443\u043b\u044c\u0442\u0438\u0430\u0440\u0435\u043d\u0434\u043d\u043e\u0441\u0442\u044c \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0441\u0430\u043c\u044b\u0445 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0418\u0422-\u0443\u0441\u043b\u0443\u0433.","og:url":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/polnotsennaya-multiarendnost-v-zimbra-ose-s-pomoshhyu-zextras-admin","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:27:45+00:00","article:modified_time":"2019-10-31T19:27:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"39082","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-11 11:18:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 00:57:30","updated":"2026-02-11 11:18:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/39082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=39082"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/39082\/revisions"}],"predecessor-version":[{"id":160528,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/39082\/revisions\/160528"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/29325"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=39082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=39082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=39082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}