Ṣiṣẹda awọn akọọlẹ laifọwọyi lati AD ni Zimbra Collaboration Suite

Ninu ọkan ninu awọn nkan wa ti tẹlẹ a sọ nipa bii o ṣe le “ṣe ọrẹ” Zimbra ati MS Active Directory, eyiti o lo ni ọpọlọpọ awọn ile-iṣẹ Russia lati ṣakoso awọn akọọlẹ olumulo. Ninu rẹ, a daba pe awọn olumulo Zimbra lo anfani ti ọna ti o rọrun julọ ati aabo julọ lati ṣẹda awọn apoti ifiweranṣẹ ni Zimbra da lori data lati AD ti a pe ni Ipo LAZY. Ipo iṣiṣẹ yii ngbanilaaye lati ṣẹda olumulo Zimbra tuntun laifọwọyi pẹlu orukọ olumulo ati ọrọ igbaniwọle lati AD ni akoko iwọle akọkọ rẹ si Onibara Wẹẹbu Zimbra. Sibẹsibẹ, o ṣeun si ijiroro ti o ṣafihan ninu awọn asọye, o han gbangba pe kii ṣe gbogbo awọn alabojuto dara fun ọna yii ti atunto awọn olumulo Zimbra lati AD. Nitorinaa, ni bayi a yoo sọrọ nipa ọna yiyan lati ṣe adaṣe adaṣe ti awọn akọọlẹ olumulo ti o da lori data lati AD ti a pe ni Ipo EAGER.

ỌLỌDE ati Ipo EAGER yatọ ni awọn isunmọ wọn si ṣiṣẹda awọn akọọlẹ tuntun. Ti o ba wa ni ọran LAZY eto naa nduro fun olumulo lati tẹ alabara wẹẹbu Zimbra lati ṣẹda olumulo tuntun, lẹhinna ninu ọran EAGER eto naa lorekore dibo olupin pẹlu AD fun awọn olumulo tuntun, ati, ti idahun ba jẹ bẹẹni, o ṣẹda titun kan lori akọọlẹ tirẹ ti o da lori data ti a pese nipasẹ Active Directory. Iyatọ ti o dabi ẹnipe ko ṣe pataki le jẹ ki lilo Ipo LAZY patapata jẹ itẹwẹgba fun nọmba awọn alakoso IT.

Ọkan ninu awọn ọran wọnyi le jẹ wiwọle taara lori lilo alabara wẹẹbu Zimbra. Idi fun eyi le jẹ awọn ifowopamọ agbara iširo olupin (nigbati o nlo alabara wẹẹbu kan, olupin pẹlu Zimbra le pese iṣẹ didara fun awọn olumulo 2500, ati nigba lilo tabili tabili ati awọn alabara alagbeka to awọn olumulo 5-6 ẹgbẹrun), tabi aabo ile-iṣẹ kan. eto imulo ti o taara ewọ awọn lilo ti awọn ayelujara -client fun iṣẹ pẹlu meeli. Aini alabara wẹẹbu kan ni abajade ni ailagbara lati lo Ipo LAZY, eyiti o ṣiṣẹ ninu rẹ nikan, eyiti o tumọ si pe awọn alakoso IT ti iru awọn ile-iṣẹ ko ni yiyan bikoṣe lati lo Ipo EAGER.

Ni akọkọ, a nilo lati sopọ AD bi LDAP ita si Zimbra. Lati ṣe eyi, lọ si console iṣakoso, eyiti o wa ni mail.company.ru:7071/zimbraAdmin/, lẹhinna yan ohun kan ni apa osi tunto, ati ki o subparagraph ibugbe. Lori akojọ доменов Nisinsinyi a nilo lati yan eyi ti a yoo lo ni apapo pẹlu AD ati, nipa titẹ-ọtun lori agbegbe ti a yan, yan ohun kan naa "Ṣe atunto Ijeri". Lẹhin iyẹn, ibaraẹnisọrọ atunto LDAP ita yoo han loju iboju, ninu eyiti a yoo tẹ gbogbo data pataki fun iṣọpọ Zimbra pẹlu AD.

Lẹhin titẹ gbogbo data pataki, o yẹ ki o ṣẹda faili iṣeto ni, fun apẹẹrẹ ifọwọkan ~/Documents/autoprover.cfg, ninu eyiti a yoo tẹ lẹsẹsẹ awọn aṣẹ ti o gbọdọ wa ni titẹ lati mu atunto adaṣe ti awọn akọọlẹ ṣiṣẹ lati AD ni Ipo EAGER. Ko dabi Ipo LAZY, nibiti ilana iṣeto ti rọrun pupọ ati pe gbogbo awọn eto le wa ni titẹ bi awọn aṣẹ ni CLI, ninu ọran ti Ipo EAGER o dara lati mu ṣiṣẹ lailewu ati tọju gbogbo awọn eto ni faili lọtọ. Eyi yoo jẹ ki o rọrun lati ṣe awọn ayipada si wọn bi ohun kan ba ṣẹlẹ lojiji.

Nitorina lẹhin ṣiṣẹda faili naa ~/Documents/autoprover.cfg, o yẹ ki o tẹ awọn ila wọnyi sinu rẹ, ti o ti ṣe atunṣe wọn tẹlẹ si awọn amayederun rẹ:

md company.ru zimbraAutoProvAccountNameMap "samAccountName"
md company.ru +zimbraAutoProvAttrMap description=description
md company.ru +zimbraAutoProvAttrMap displayName=displayName
md company.ru +zimbraAutoProvAttrMap givenName=givenName
md company.ru +zimbraAutoProvAttrMap cn=cn
md company.ru +zimbraAutoProvAttrMap sn=sn
md company.ru zimbraAutoProvAuthMech LDAP
md company.ru zimbraAutoProvBatchSize 40
md company.ru zimbraAutoProvLdapAdminBindDn "CN=Administrator,CN=Users,DC=company,DC=ru"
md company.ru zimbraAutoProvLdapAdminBindPassword *********
md company.ru zimbraAutoProvLdapBindDn "Administrator@company.ru"
md company.ru zimbraAutoProvLdapSearchBase "CN=Users,dc=company,dc=ru"
md company.ru zimbraAutoProvLdapSearchFilter "(cn=%u)"
md company.ru zimbraAutoProvLdapURL "ldap://192.168.0.1:389"
md company.ru zimbraAutoProvMode EAGER
md company.ru zimbraAutoProvNotificationBody "Ваша учетная запись была создана автоматически. Адрес вашей электронной почты ${ACCOUNT_ADDRESS}."
md company.ru zimbraAutoProvNotificationFromAddress Administrator@company.ru
md company.ru zimbraAutoProvNotificationSubject "Новая учетная запись была создана автоматически"
ms mail.company.ru zimbraAutoProvPollingInterval "1m"
ms mail.company.ru +zimbraAutoProvScheduledDomains "company.ru"

Ṣeun si awọn eto wọnyi, a fi agbara mu olupin Zimbra lati kan si AD ni iṣẹju kọọkan ati gba alaye nipa irisi awọn olumulo tuntun ninu ibi ipamọ data, ati pe ti wọn ba rii, ṣẹda akọọlẹ kan fun wọn ki o firanṣẹ ifiranṣẹ kaabọ kan.

Lẹhin gbogbo awọn ayipada ninu faili ti wa ni fipamọ, yoo jẹ pataki lati lo awọn eto ti a sọ pato ninu rẹ nipa lilo aṣẹ naa zmprov <~/Documents/autoprov.cfg. Gbogbo awọn ayipada ti a ṣe yoo ṣiṣẹ lẹsẹkẹsẹ, ko yẹ ki o jẹ iwulo lati tun olupin naa bẹrẹ.

Ni iṣẹlẹ ti atunto aifọwọyi ti awọn akọọlẹ lati AD si Ipo EAGER ṣiṣẹ, ninu faili naa /opt/zimbra/log/mailbox.log Ilọsiwaju ti iṣeto atunto akọọlẹ yoo han ni fọọmu atẹle:

[AutoProvision] [] autoprov - Auto provisioning accounts on domain company.ru
[AutoProvision] [] autoprov - 1 external LDAP entries returned as search result
[AutoProvision] [] autoprov - auto creating account in EAGER mode: example@company.ru, dn="CN=example,OU=zimbrausers,DC=company,DC=ru"

Ti atunto aifọwọyi ti awọn akọọlẹ ko ṣiṣẹ, lẹhinna iṣoro naa ṣee ṣe julọ ni ẹgbẹ olupin AD. Ni idi eyi, o nilo lati wo koodu aṣiṣe ti o waye. A ṣafihan awọn wọpọ julọ ninu wọn:

525 - Olumulo ko ri
52e - Awọn iwe-ẹri ti ko tọ
530 - Ko si igbanilaaye lati tẹ ni akoko yii
531 - Ko si igbanilaaye lati buwolu wọle lati kọnputa yii
532 - Ọrọigbaniwọle ti pari
533 - Account duro
534 - Olumulo ko ni awọn ẹtọ to lati wọle lati kọnputa yii
701 - Akọọlẹ ti pari
773 - Olumulo gbọdọ tun ọrọ igbaniwọle to
775 - Account ni ihamọ fun igba die
8350 - ọna kika Orukọ Iyatọ ti ko tọ

orisun: www.habr.com