LDAP/Active Directory - Revision history

Jab at 22:41, 25 September 2018

2018-09-25T22:41:10Z

← Older revision		Revision as of 16:41, 25 September 2018
Line 33:		Line 33:

	XMission strongly recommends testing functionality. To do this the customer should make a test domain and verify it works as expected. Testing authentication is critical. Once testing has completed XMission recreate the settings on the real customer domain and re-verify.		XMission strongly recommends testing functionality. To do this the customer should make a test domain and verify it works as expected. Testing authentication is critical. Once testing has completed XMission recreate the settings on the real customer domain and re-verify.

			[[Category: Zimbra]]

John at 20:45, 28 August 2017

2017-08-28T20:45:05Z

← Older revision		Revision as of 14:45, 28 August 2017
Line 20:		Line 20:
	** Reference: https://xkcd.com/936/		** Reference: https://xkcd.com/936/
	* Customer agrees to mandatory password changes for all accounts at least once yearly. [ ] Yes [ ] No		* Customer agrees to mandatory password changes for all accounts at least once yearly. [ ] Yes [ ] No
	* External LDAP customers ~~accepts~~ that XMission will not monitor password aging ~~and understand risks involved~~. [ ] Yes [ ] No		* External LDAP customers accept that XMission will not monitor password aging. [ ] Yes [ ] No

	Please use https://secrets.xmission.com to share sensitive information.		Please use https://secrets.xmission.com to share sensitive information.

John at 20:44, 28 August 2017

2017-08-28T20:44:17Z

← Older revision		Revision as of 14:44, 28 August 2017
Line 17:		Line 17:
	** This can be temporary for the purposes of configuring AD, no need to reveal credentials for real users.		** This can be temporary for the purposes of configuring AD, no need to reveal credentials for real users.
	* Customer firewall must allow traffic from 166.70.13.0/24 (mail subnet where XMission Zimbra lives) to the above server/port. Has this been completed? [ ] Yes [ ] No		* Customer firewall must allow traffic from 166.70.13.0/24 (mail subnet where XMission Zimbra lives) to the above server/port. Has this been completed? [ ] Yes [ ] No
			* Customer confirms secure password or passphrase requirements. [ ] Yes [ ] No
			** Reference: https://xkcd.com/936/
			* Customer agrees to mandatory password changes for all accounts at least once yearly. [ ] Yes [ ] No
			* External LDAP customers accepts that XMission will not monitor password aging and understand risks involved. [ ] Yes [ ] No

	Please use https://secrets.xmission.com to share ~~any~~ sensitive ~~data~~		Please use https://secrets.xmission.com to share sensitive information.

	Notes:		Notes:
Line 28:		Line 32:
	Testing:		Testing:

	XMission strongly ~~recommend~~ testing functionality. To do this the customer should make a test domain and verify ~~functionality~~. Testing authentication is critical. Once testing has completed we recreate the settings on the real customer domain and re-verify.		XMission strongly recommends testing functionality. To do this the customer should make a test domain and verify it works as expected. Testing authentication is critical. Once testing has completed XMission recreate the settings on the real customer domain and re-verify.

John: Created page with "XMission hosted Zimbra LDAP/Active Directory Integration General information: Any Zimbra domain hosted by XMission can have either authentication or GAL synchronization conn..."

2016-01-21T13:07:24Z

Created page with "XMission hosted Zimbra LDAP/Active Directory Integration General information: Any Zimbra domain hosted by XMission can have either authentication or GAL synchronization conn..."

New page

XMission hosted Zimbra LDAP/Active Directory Integration

General information:

Any Zimbra domain hosted by XMission can have either authentication or GAL synchronization connected to an external LDAP or ActiveDirectory (AD) server. These are two independent features (external auth, external gal sync), but share most of the same configuration. Customers commonly want both.

Requirements:

This is what is required to configure external authentication and external GAL sync for XMission hosted Zimbra domains:
* Confirm XMission will authenticate against customer ActiveDirectory. [ ] Yes [ ] No
* Confirm XMission will get the GAL from customerActiveDirectory. [ ] Yes [ ] No
* Provide customer ActiveDirectory server name(s) and port (3269 is the default AD port)
* SSL must be enabled.
* What is the customer ActiveDirectory domain name.
* Provide customer ActiveDirectory bind domain name / password.
* Customer to provide username/password to test authentication against.
** This can be temporary for the purposes of configuring AD, no need to reveal credentials for real users.
* Customer firewall must allow traffic from 166.70.13.0/24 (mail subnet where XMission Zimbra lives) to the above server/port. Has this been completed? [ ] Yes [ ] No

Please use https://secrets.xmission.com to share any sensitive data

Notes:

* The GAL can be synchronized to *both* LDAP/AD and the normal internal Zimbra if desired. This can be useful for distribution lists that aren't in AD.

* For the GAL sync, XMission will default to a filter of (mail=*) and a search base derived from the AD domain name (ie dc=customerdomain,dc=local if the domain is customerdomain.local), but these values can be changed if needed.

Testing:

XMission strongly recommend testing functionality. To do this the customer should make a test domain and verify functionality. Testing authentication is critical. Once testing has completed we recreate the settings on the real customer domain and re-verify.