Zimbra + External AD : Automatically Create Mailboxes Zimbra with Eager Mode Auto-Provisioning

Home » Zimbra » Zimbra + External AD : Automatically Create Mailboxes Zimbra with Eager Mode Auto-Provisioning
Zimbra 34 Comments

Previously, we have been configuring how to integration external AD with Zimbra as center of authentications of users. although we have been configuring authentication to external AD, we still need to create mailboxes in Zimbra manually. if you want to automatically create mailboxes in Zimbra which authentication to external AD, you can use the Zimbra Auto-Provisioning.

Zimbra Auto-Provisioning divided become 2 mode. Eager mode and Lazy mode. If using eager mode, zimbra will check users of external AD every certain times (example every 1 minutes) and create mailboxes Zimbra. if using lazy mode, Zimbra will not create mailboxes until users of external AD login via webmail and Zimbra will automatically create mailboxes for that users.

in this section, i will configure how to using eager mode auto-provisioning. Create file with name autoprovision.zmp on folder /srv/

vi /srv/autoprovision.zmp

fill with the following line

md imanudin.net zimbraAutoProvAccountNameMap "sAMAccountName"
md imanudin.net zimbraAutoProvAttrMap "sn=sn"
md imanudin.net +zimbraAutoProvAttrMap "description=description"
md imanudin.net +zimbraAutoProvAttrMap "cn=displayName"
md imanudin.net +zimbraAutoProvAttrMap "givenName=givenName"
md imanudin.net zimbraAutoProvBatchSize "20"
md imanudin.net zimbraAutoProvLdapAdminBindDn "cn=Administrator,cn=users,dc=imanudin,dc=net"
md imanudin.net zimbraAutoProvLdapAdminBindPassword "VerySecret123"
md imanudin.net zimbraAutoProvLdapBindDn "cn=Administrator,cn=users,dc=imanudin,dc=net"
md imanudin.net zimbraAutoProvLdapSearchBase "dc=imanudin,dc=net"
md imanudin.net zimbraAutoProvLdapSearchFilter "(&(ObjectCategory=person))"
md imanudin.net zimbraAutoProvLdapURL "ldap://192.168.1.102:389"
md imanudin.net zimbraAutoProvMode "EAGER"
md imanudin.net zimbraAutoProvNotificationBody "Your account has been auto provisioned. Your email address is ${ACCOUNT_ADDRESS}."
md imanudin.net zimbraAutoProvNotificationFromAddress "admin@imanudin.net"
md imanudin.net zimbraAutoProvNotificationSubject "New account auto provisioned"
ms mail.imanudin.net zimbraAutoProvPollingInterval "1m"
ms mail.imanudin.net zimbraAutoProvScheduledDomains "imanudin.net"

INFORMATION

imanudin.net = domain name on Zimbra
BatchSize = maximum create mailboxes at one-time process
LdapAdminBindDn/LdapBindDn = user Administrator at Active Directory/Samba4
LdapAdminBindPassword = password user Administrator
LdapSearchBase = attribute search AD/Samba4
LdapSearchFilter = attribute search filter results of LdapSearchBase
LdapURL = server external AD/Samba4
PollingInterval = time at one-time process
ScheduledDomains = domain name to be automated create mailboxes

After above file has been created, run the following command as Zimbra

su - zimbra
zmprov < /srv/autoprovision.zmp

Please check process automatically create mailboxes at /opt/zimbra/log/mailbox.log. Please check also mailboxes which has been created at Zimbra Admin | Manage.

Good luck and hopefully useful 😀

34 thoughts on - Zimbra + External AD : Automatically Create Mailboxes Zimbra with Eager Mode Auto-Provisioning

  • hi i have zimbra 8.6 and the file zmp give me some errors.
    [zimbra@zim srv]$ zmprov < /srv/autoprovision.zmp
    [4] 10491
    bash: lt: command not found
    /srv/autoprovision.zmp: line 1: md: command not found
    /srv/autoprovision.zmp: line 2: md: command not found
    /srv/autoprovision.zmp: line 3: md: command not found
    /srv/autoprovision.zmp: line 4: md: command not found
    /srv/autoprovision.zmp: line 5: md: command not found
    /srv/autoprovision.zmp: line 6: md: command not found
    /srv/autoprovision.zmp: line 7: md: command not found
    /srv/autoprovision.zmp: line 8: md: command not found
    /srv/autoprovision.zmp: line 9: md: command not found
    /srv/autoprovision.zmp: line 10: md: command not found
    /srv/autoprovision.zmp: line 11: md: command not found
    /srv/autoprovision.zmp: line 12: md: command not found
    /srv/autoprovision.zmp: line 13: md: command not found
    /srv/autoprovision.zmp: line 14: md: command not found
    /srv/autoprovision.zmp: line 15: md: command not found
    /srv/autoprovision.zmp: line 16: md: command not found
    /srv/autoprovision.zmp: line 17: ms: command not found
    /srv/autoprovision.zmp: line 18: ms: command not found

    • sorry, but i fixed.
      i have to insert the command zmprov and then
      in mode prov> i paste everything.
      thanks so much!..
      only one thing, if i want to give email access for only a few members of a group.
      for example if i want to give access to the members of group executive but not the rest of domain user in the ou “users”
      ¿how it be?

      • Hi Santiago,

        Glad to hear that for fixed your problem :D.

        Did you mean want to autoprov with spesific groups? if yes, you can modify this attribute : zimbraAutoProvLdapSearchFilter and adjust with your environment

  • Hi, When I execute the below command, I am facing the below error:
    [zimbra@zimbra root]$ zmprov < /srv/autoprovision.zmp
    [1] 25034
    bash: lt: command not found
    /srv/autoprovision.zmp: line 1: md: command not found
    /srv/autoprovision.zmp: line 2: md: command not found
    /srv/autoprovision.zmp: line 3: md: command not found
    /srv/autoprovision.zmp: line 4: md: command not found
    /srv/autoprovision.zmp: line 5: md: command not found
    /srv/autoprovision.zmp: line 6: md: command not found
    /srv/autoprovision.zmp: line 7: md: command not found
    /srv/autoprovision.zmp: line 8: md: command not found
    /srv/autoprovision.zmp: line 9: md: command not found
    /srv/autoprovision.zmp: line 10: md: command not found
    /srv/autoprovision.zmp: line 11: md: command not found
    /srv/autoprovision.zmp: line 12: md: command not found
    /srv/autoprovision.zmp: line 13: md: command not found
    /srv/autoprovision.zmp: line 14: md: command not found
    /srv/autoprovision.zmp: line 15: md: command not found
    /srv/autoprovision.zmp: line 16: md: command not found
    /srv/autoprovision.zmp: line 17: ms: command not found
    /srv/autoprovision.zmp: line 18: ms: command not found

    • Hi Shiva,

      Could you please give me more information about error or something else on the log? you can check the log in /opt/zimbra/log/mailbox.log

  • Hi Iman,
    Thanks for supporting me,
    When I Sync zimbra with AD, when I create a new users in that domain, I am not getting the password field to give password to the user. And the users that are created in zimbra are not showing in AD.
    Please suggest me.

  • Hi friend.

    I have this query:

    zimbraAutoProvLdapSearchFilter “(&(sAMAccountName=*)(objectClass=user)(givenName=*)(memberOf=cn=Zimbra_Intranet,ou=ZIMBRA,ou=Grupos,dc=hmsc,dc=com,dc=br))”

    But this create user only if I create and put new user in “ZIMBRA” OU
    If I add old users to “Zimbra_Intranet” group, whitout changing the OU, the account cannot auto create.

    What might be happening?

    Thanks

    • Hi Julio,

      Are you could view all users with search filter like that? please try run the following command on Your Zimbra whether users can views/filter or not :

      /opt/zimbra/bin/ldapsearch -LLL -x -h IP-of-AD -p 389 -D “cn=Administrator,cn=users,dc=yourdomain,dc=com” -w “password-administrator-AD” -b “(&(sAMAccountName=*)(objectClass=user)(givenName=*)(memberOf=cn=Zimbra_Intranet,ou=ZIMBRA,ou=Grupos,dc=hmsc,dc=com,dc=br))”

      • Hello, I’m having a problem similar to Julio’s, but my search via ldap search is returning me the value I want, which is the user within the specific group. When I play inside the filter in zimbra, it does not fetch the user, I do not know what else to do.

  • When you use Zentyal as Active Directory, you must use the “CN = Domain Administrator, CN = users, dc = domain, DC = local”

  • Hi Iman,
    I configured LAZY mode of auto provisioning and when I try to use it, I am getting the below error in mailbox.log:

    2015-05-21 12:42:32,288 INFO [qtp509886383-295:http://127.0.0.1:8080/service/soap/AuthRequest%5D [oip=192.168.10.66;ua=zclient/8.5.0_GA_3042;] autoprov – unable to authenticate abc@bcits.co.in for auto provisioning
    com.zimbra.cs.account.AccountServiceException$AuthFailedServiceException: authentication failed for []
    ExceptionId:qtp509886383-295:http://127.0.0.1:8080/service/soap/AuthRequest:1432192352288:a10d45054c36c059
    Code:account.AUTH_FAILED
    at com.zimbra.cs.account.AccountServiceException$AuthFailedServiceException.AUTH_FAILED(AccountServiceException.java:142)
    at com.zimbra.cs.account.ldap.LdapProvis…….
    Caused by: com.zimbra.cs.account.AccountServiceException$AuthFailedServiceException: authentication failed for [N/A]
    ExceptionId:qtp509886383-295:http://127.0.0.1:8080/service/soap/AuthRequest:1432192352288:a10d45054c36c059
    Code:account.AUTH_FAILED
    at com.zimbra.cs.account.AccountServiceException$AuthFailedServiceException.AUTH_FAILED(AccountServiceException.java:154)
    at com.zimbra.cs.account.ldap.LdapProvisioning.ldapAuthenticate(LdapProvisioning.java:5138)

    How do I know what I have configured incorrectly (I am pretty sure about the credentials). My auto provisioning configurations are:

    md onlinebcits.com zimbraAutoProvMode “LAZY”
    md onlinebcits.com zimbraAutoProvLdapURL “ldap://192.168.10.230:389”
    md onlinebcits.com zimbraAutoProvLdapAdminBindDn “cn=Directory Manager”
    md onlinebcits.com zimbraAutoProvLdapAdminBindPassword “xxxxx”
    md onlinebcits.com zimbraAutoProvLdapSearchFilter “%u”
    md onlinebcits.com zimbraAutoProvLdapSearchBase “dc=bcits,dc=co,dc=in”
    md onlinebcits.com zimbraAutoProvLdapBindDn “uid=%u”
    md onlinebcits.com zimbraAutoProvNotificationBody “Your account has been auto provisioned. Your email address is ${ACCOUNT_ADDRESS}.”
    md onlinebcits.com zimbraAutoProvNotificationFromAddress “admin@onlinebcits.com”
    md onlinebcits.com zimbraAutoProvNotificationSubject “New account auto provisioned”

    Also, the log shows that auto provisioning is being happening only for certain accounts, any idea why it is not happening for all the accounts? (I am using zcs 8.5.0).

    Regards,
    Seenu.

    • hi Seenu,

      I am not yet try if using LDAP/OpenLDAP. I will try in my environment and update the progress

  • I have one question.

    When the account is automatically created, it uses the AD password.

    The option to enable the fallback in case of AD failure, but I would have to set the password manually .

    Is there a way to password fallback be the same synchronized password AD ?

  • Great work Iman… I got this message when I try to execute the
    3] 8548
    Usage: lt `parameters’ [versionkey]
    computes the n-point one-loop integrals
    n depends on `parameters’:
    n = 1: m
    n = 2: p m1 m2
    n = 3: p1 p2 p1p2 m1 m2 m3
    n = 4: p1 p2 p3 p4 p1p2 p2p3 m1 m2 m3 m4
    n = 5: p1 p2 p3 p4 p5 p1p2 p2p3 p3p4 p4p5 p5p1 m1 m2 m3 m4 m5
    versionkey can be one of:
    0 = compute version a (same as no versionkey)
    1 = compute version b
    2 = compute a and b, compare, return a
    3 = compute a and b, compare, return b
    -su: /srv/autoprovision.zmp: Permission denied
    zimbra@pms:~$ zmprov < /srv/autoprovision.zmp
    -su: /srv/autoprovision.zmp: Permission denied

  • Hi Iman,
    Thanks for your great article.
    but i have one query about how to change zimbra active directory webmail password.

  • Hello, I have successfully configured the auto-provisioning, I would now like to be able to automatically remove them from Zimbra as I delete them in my active directory.

LEAVE A COMMENT