Abuur toos ah oo akoonnada AD gudaha Zimbra Collaboration Suite

Mid ka mid ah maqaaladeenii hore waxaan u sheegnay ku saabsan sida aad saaxiibbo u yeelan karto inta u dhaxaysa Zimbra iyo MS Active Directory, kaas oo ay isticmaalaan shirkadaha Ruushku intooda badan si ay u maamulaan xisaabaadka isticmaalaha. Gudaha, waxaan ku soo jeedinay isticmaalayaasha Zimbra inay isticmaalaan habka ugu fudud uguna badbaado badan si ay u abuuraan sanduuqyada boostada ee Zimbra iyadoo lagu salaynayo xogta AD ee loo yaqaan LAZY Mode. Habkan hawlgalka ah wuxuu kuu ogolaanayaa inaad si toos ah u abuurto isticmaale Zimbra cusub oo wata magaca isticmaale iyo furaha AD isla markaaba aad gasho macmiilka shabakadda Zimbra markii ugu horeysay. Si kastaba ha ahaatee, mahadsanid doodda ka soo baxday faallooyinka, waxay caddaatay in dhammaan maamulayaasha aysan ku habboonayn habkan si toos ah u habeynaya isticmaalayaasha Zimbra ee AD. Sidaa darteed, hadda waxaan ka hadli doonaa hab kale oo otomaatig ah abuurista xisaabaadka isticmaalaha iyadoo lagu salaynayo xogta AD ee loo yaqaan EAGER Mode.

Habka caajiska ah iyo HORUMARKA ayaa ku kala duwan hababka ay u abuuraan xisaabaad cusub. Haddii ay dhacdo LAZY nidaamku wuxuu sugayaa isticmaaluhu inuu galo macmiilka shabakadda Zimbra si loo abuuro isticmaale cusub, markaa kiiska EAGER nidaamku wuxuu si joogto ah u doortaa server-ka AD muuqaalka isticmaaleyaasha cusub, iyo, haddii jawaabtu tahay mid dhab ah, waxay si madax-banaan u abuurtaa hal akoon oo cusub oo ku salaysan xogta ay bixiso Hagaha Active. Farqiga u muuqda mid aan muhiim ahayn ayaa laga yaabaa inuu ka dhigo isticmaalka Habka LAZY gebi ahaanba mid aan la aqbali karin tiro maareeyayaal IT ah.

Mid ka mid ah kiis noocaas ah wuxuu noqon karaa mamnuucid toos ah isticmaalka macmiilka shabakadda Zimbra. Sababta tani waxay noqon kartaa badbaadinta awoodda xisaabinta serverka (marka la isticmaalayo macmiilka shabakadda, server leh Zimbra wuxuu siin karaa adeeg tayo sare leh 2500 isticmaalayaasha, iyo marka la isticmaalayo macaamiisha desktop iyo mobilada ilaa 5-6 kun isticmaale), ama shirkad siyaasadda ammaanka ee si toos ah u mamnuucaysa isticmaalka shabakadda - macmiilka ku shaqeeya boostada. Maqnaanshaha macmiilka webka ayaa ka dhigaysa mid aan suurtagal ahayn in la isticmaalo Habka LAZY, kaas oo ka shaqeeya kaliya, taas oo macnaheedu yahay in maamulayaasha IT-ga ee ganacsiyada noocaas ah aysan haysan wax ikhtiyaar ah oo aan ahayn isticmaalka EAGER Mode.

Marka hore, waxaan u baahan doonaa inaan ku xirno AD sidii LDAP dibadda ah ilaa Zimbra. Si tan loo sameeyo, aad konsole maamulka, kaas oo ku yaala at mail.company.ru:7071/zimbraAdmin/, ka dibna dooro shayga ku yaal dhinaca bidix reserved, ka dibna cutubka hoose domains. Liiska domain-yo Hadda waxaan u baahanahay inaan doorano midka aan isticmaali doono iyadoo lala kaashanayo AD, adigoo midig-gujinaya domain-ka la doortay, dooro shayga "Habee Xaqiijinta". Taas ka dib, wada hadal qaabeynta LDAP dibadda ah ayaa ka soo muuqan doona shaashadda, kaas oo aan geli doono dhammaan xogta lagama maarmaanka ah si loogu daro Zimbra iyo AD.

Ka dib markaad gasho dhammaan xogta lagama maarmaanka ah, waa inaad abuurtaa faylka qaabeynta, tusaale ahaan taabo ~/Documents/autoprov.cfg, kaas oo aan geli doono amarro taxane ah oo ay tahay in la geliyo si loo dhaqaajiyo habaynta xisaabaadka ee AD ee EAGER Mode. Si ka duwan sida LAZY Mode, halkaasoo habka dejinta uu yahay mid aad u fudud oo dhammaan goobaha loo geli karo amar ahaan CLI, xaaladda EAGER Mode way fiicantahay in la ciyaaro oo lagu kaydiyo dhammaan goobaha fayl gaar ah. Tani waxay sahlaysaa in isbedel lagu sameeyo haddii ay wax si lama filaan ah u khaldamaan.

Markaa kadib abuurista faylka ~/Documents/autoprov.cfg, waa inaad gelisaa sadarradan soo socda, adigoo hore ula jaanqaaday kaabayaashaaga:

md company.ru zimbraAutoProvAccountNameMap "samAccountName"
md company.ru +zimbraAutoProvAttrMap description=description
md company.ru +zimbraAutoProvAttrMap displayName=displayName
md company.ru +zimbraAutoProvAttrMap givenName=givenName
md company.ru +zimbraAutoProvAttrMap cn=cn
md company.ru +zimbraAutoProvAttrMap sn=sn
md company.ru zimbraAutoProvAuthMech LDAP
md company.ru zimbraAutoProvBatchSize 40
md company.ru zimbraAutoProvLdapAdminBindDn "CN=Administrator,CN=Users,DC=company,DC=ru"
md company.ru zimbraAutoProvLdapAdminBindPassword *********
md company.ru zimbraAutoProvLdapBindDn "Administrator@company.ru"
md company.ru zimbraAutoProvLdapSearchBase "CN=Users,dc=company,dc=ru"
md company.ru zimbraAutoProvLdapSearchFilter "(cn=%u)"
md company.ru zimbraAutoProvLdapURL "ldap://192.168.0.1:389"
md company.ru zimbraAutoProvMode EAGER
md company.ru zimbraAutoProvNotificationBody "Ваша учетная запись была создана автоматически. Адрес вашей электронной почты ${ACCOUNT_ADDRESS}."
md company.ru zimbraAutoProvNotificationFromAddress Administrator@company.ru
md company.ru zimbraAutoProvNotificationSubject "Новая учетная запись была создана автоматически"
ms mail.company.ru zimbraAutoProvPollingInterval "1m"
ms mail.company.ru +zimbraAutoProvScheduledDomains "company.ru"

Waad ku mahadsan tahay goobahan, waxaan ku qasbinaa server-ka Zimbra inuu la xiriiro AD daqiiqad kasta oo aan helno macluumaadka ku saabsan muuqaalka isticmaalayaasha cusub ee database-ka, iyo haddii la ogaado, u samee xisaab iyaga oo u dir fariin soo dhaweyn ah.

Ka dib marka dhammaan isbeddelada faylka la keydiyo, waxaad u baahan doontaa inaad ku dhaqdo goobaha lagu qeexay adigoo isticmaalaya amarka zmprov </b>Documents/autoprov.cfg. Dhammaan isbeddellada la sameeyay waxay isla markiiba shaqayn doonaan; ma jirto baahi loo qabo in dib loo bilaabo server-ka.

Haddii si toos ah u habeynta xisaabaadka AD ee EAGER Mode uu shaqeeyo, faylka ku jira /opt/zimbra/log/mailbox.log Horumarka samaynta akoonka si toos ah ayaa loo soo bandhigi doonaa qaabkan soo socda:

[AutoProvision] [] autoprov - Auto provisioning accounts on domain company.ru
[AutoProvision] [] autoprov - 1 external LDAP entries returned as search result
[AutoProvision] [] autoprov - auto creating account in EAGER mode: example@company.ru, dn="CN=example,OU=zimbrausers,DC=company,DC=ru"

Haddii otomaatig-habeynta xisaabaadka aysan shaqeyn, markaa dhibaatadu waxay u badan tahay dhinaca server-ka AD. Xaaladdan oo kale, waxaad u baahan tahay inaad eegto koodhka qaladka ee dhacaya. Waxaan soo bandhigeynaa kuwa ugu caansan:

525 - Isticmaalaha lama helin
52e - Aqoonsi aan sax ahayn
530 - Ma jiro fasax lagu galo wakhtigan
531 - Ma haysatid fasax aad ka soo gasho kombiyuutarkan
532 — Password-ku wuu dhacay
533 - Akoonka waa la hakiyay
534 - Isticmaaluhu ma haysto xuquuq ku filan oo uu ku galo kombiyuutarkan
701 - Koontadu way dhacday
773 - Isticmaaluhu waa inuu dib u dajiyaa erayga sirta ah
775 — ansaxnimada akoonku si ku meel gaar ah ayey u xaddidan tahay
8350 - qaab Magac Sharafeed aan sax ahayn

Source: www.habr.com