Learn more about Configuration Manager options

Server type

The type of LDAP server you are synchronizing. Make sure to select the correct type for your LDAP server. GCDS interacts with each type of server slightly differently.

Connection type

Host name

Enter the domain name or IP address of your LDAP directory server.

Examples: ad.example.com or 10.22.1.1.

Port

Authentication type

The authentication method for your LDAP server

If your LDAP server allows anonymous connections and you want to connect anonymously, select Anonymous. Otherwise, select Simple.

Authorized user

Enter the user who will connect to the server. The user should have permission to read all objects and perform LDAP search queries.

If your LDAP directory server requires a domain for login, include the domain for the user as well.

Example: admin1

Password

Enter the password for the authorized user. Passwords are stored in an encrypted format.

Example: swordfishX23

Base DN

Enter the Base DN for the subtree to synchronize. Don't include spaces between commas. If you don’t know the Base DN, consult your LDAP administrator or check an LDAP browser.

If you leave this field empty, all domains in the forest are searched.  

Example: ou=test,ou=sales,ou=melbourne,dc=ad,dc=example,dc=com

SMTP Relay Host

The SMTP mail server to use for notifications. GCDS uses this mail server as a relay host.

Example:

• 127.0.0.1
• smtp.gmail.com

Use SMTP with TLS

Check the box to use SMTP with TLS (required with smtp.gmail.com).

Supported TLS versions—1.0, 1.1, and 1.2 (supported from GCDS version 4.7.6 onwards).

If the SMTP server requires a username and password for authentication, enter the username and password here.

Example:

User Name: admin@solarmora.comPassword: ud6rTYX2!

From address

Enter the from address for the notification mail. Recipients see this address as the notification sender.

Example: admin@solarmora.com

To addresses (recipients)

Notifications are sent to all addresses on this list. To enter multiple addresses, click Addafter each email address. 

Depending on your mail server settings, GCDS might be unable to send mail to external email addresses. Click Test Notificationto confirm that mail is sent correctly.

Example: dirsync-admins@solarmora.com

Use attachment

Check the box to receive the sync report as an attachment to the email. Uncheck the box to receive the report in the body of the email.

Compress attachment

Check the box to receive the sync report compressed in ZIP file format.

(Optional) Do not include in notifications

Limit the information sent in notification emails. You can choose to exclude: 

• Extra details–For example, a list of excluded objects.
• Warnings–Warning messages.
• Errors–Error messages.

Subject Prefix

Enter a string that is added to the start of the notification email's subject line.

File name

Enter the directory and file name to use for the log file or click Browseto browse your file system.

Example: sync.log

Optionally, you can add the placeholder #{timestamp}to the file name. The placeholder is replaced by an actual timestamp (for example, 20190501-104023) in each execution before the log file is saved to the disk.

If you use the placeholder, GCDS generates a new log file every time it runs a simulation or sync. If a log is older than 30 days, it's deleted.

Example: sync.#{timestamp}.log

If you run a sync at 2019-05-01 at 10:40:23am, the log file is named sync.20190501-104023.log.

Log level

The level of detail of the log. Select from the following options:

• FATAL—Only logs fatal operations.
• ERROR—Logs errors and fatal operations.
• WARN—Logs warnings, errors and fatal operations.
• INFO—Logs summary information.
• DEBUG— Logs more extensive details.
• TRACE—Logs all possible details.

The level of detail is cumulative; each level includes all the details of previous levels (for example, ERROR includes all ERROR and FATAL messages).

Maximum log size

The maximum size of the log file, in megabytes.

The maximum log size includes all the backup files plus the current file. The number of back up files is determined by the log file count attribute (see below).

To calculate the maximum size of a log file use < maximum log size > / (< log file count > + 1)

Example: 500

The number of log files that are saved to the disk. The default is 10.

Note: This setting can only be modified in the configuration file within the tag <logFileCount>.

Email address attribute

The LDAP attribute that contains a user’s primary email address. The default is mail.

Example: mail

Enable invalid characters replacement

Invalid character replacement

If you check the box, spaces and invalid characters in an email address are replaced with the string specified in the Invalid character replacementfield.

If you check the box but leave the field blank, GCDS removes spaces and invalid characters from the address.

Example

The email address on the LDAP server isx y\z@example.com.

• If you add an underscore (_) to the  Invalid characters replacementfield, GCDS converts the email address to x_y_z@example.com.
• If the Invalid characters replacement field is left blank, GCDS converts the email address to xyz@example.com.

(Optional) Unique identifier attribute

An LDAP attribute that contains a unique identifier for every user entity on your LDAP server. Providing this value enables GCDS to detect when users are renamed on your LDAP server and sync those changes to your Google domain. This field is optional, but recommended.

Example: objectGUID

(Optional) Alias address attributes

One or more attributes used to hold alias addresses. These addresses will be added to your Google domain as nicknames of the primary address listed in the email address attribute field. Enter the address and click Add. 

Example: proxyAddresses

If this field is empty, any alias associated with the Google user profile isn't removed following a GCDS sync. The alias can still be managed in Google.

Google domain users deletion/suspension policy

Options for deleting and suspending users. 

• Delete only active Google Domain users not found in LDAP (suspended users are retained)—Active users in your Google domain are deleted if they aren't in your LDAP server. Suspended users are not altered. This is the default setting.
• Delete active and suspended users not found in LDAP—All users in your Google domain are deleted if they aren't in your LDAP server, including suspended users.
• Suspend Google users not found in LDAP, instead of deleting them—Active users in your Google domain are suspended if they are not in your LDAP server. Suspended users are not altered.
• Don’t suspend or delete Google domain users not found in LDAP—No users in your Google domain are suspended or deleted (unless you have a search rule that’s set to suspend users).

Don’t suspend or delete Google admins not found in LDAP

If checked (the default option), GCDS is prevented from suspending or deleting administrator accounts found in your Google domain that don’t exist in the LDAP server.

(Optional) Unique identifier attribute

This field allows you to specify an LDAP attribute that serves as a unique identifier for user entities on your LDAP server. When you provide this attribute, GCDS can monitor changes to user email addresses on your LDAP server. This ensures that when a user email is updated, GCDS can synchronize the changes with your Google domain without deleting the existing user and creating a new one with the updated email address. 

If you set this field, GCDS automatically creates a new mapping file with the following name in the home directory: nonAddressKeyMappingsFilePath.tsv

To change the name or location of this file, update the following tag in the XML configuration file:  <nonAddressKeyMappingsFilePath> 

This field is optional; however, using it is recommended.

Example: objectGUID

Given Name Attribute(s)

An LDAP attribute that contains each user's given name (in the English language, this is usually the first name), which is synchronized with the user’s name in your Google domain.

You can also use multiple attributes for the given name. If you use multiple attributes, place each attribute field name in square brackets.

Examples: givenName,[cn]-[ou]

Family Name Attribute(s)

An LDAP attribute that contains each user's family name (in the English language, this is usually the last name), which is synchronized with the user's name in your Google domain.

Examples: surname, [cn]-[ou]

Display Name Attribute(s)

An LDAP attribute that contains each user's display name.

Example: displayName

Synchronize Passwords

Indicates which passwords GCDS synchronizes. If you're using Active Directory or HCL Domino, see the note following in Password Encryption Method. Select one of the following:

• Only for new users—When GCDS creates a new user, it synchronizes that user's password. Existing passwords are not synced. Use this option if you want your users to manage their passwords in your Google domain. Note: If you are using a temporary or onetime password for new users, use this option.
• For new and existing users—GCDS always synchronizes all user passwords. Existing passwords in your Google domain are overwritten. This option is appropriate for managing user passwords on your LDAP server, but it is less efficient than the Only changed passwordsoption.
• Only changed passwords—GCDS only synchronizes passwords that changed since your previous sync. We recommend this option if you want to manage user passwords on your LDAP server. Note: If you use this option, you must also provide a value for the Password timestamp attribute.

Password Attribute

An LDAP attribute that contains each user's password. If you set this attribute, your users' Google passwords are synchronized to match their LDAP passwords. This field supports string or binary attributes.

Example: CustomPassword1

Password Timestamp Attribute

An LDAP attribute that contains a timestamp indicating the last time a user’s password was changed. Your LDAP server updates this attribute whenever a user changes their password. Use this field only if you select the Only changed passwordsoption for the Synchronize Passwordsfield. This field supports string attributes.

Example: PasswordChangedTime

Password Encryption Method

The encryption algorithm that the password attribute uses. Select one of the following:

• SHA1–Passwords in your LDAP directory server hashed using unsalted SHA1.
• MD5–Passwords in your LDAP directory server hashed using unsalted MD5.
• Base64–Passwords in your LDAP directory server use Base64 encoding.
• Plaintext–Passwords in your LDAP directory server are not encrypted. GCDS reads the password attribute as unencrypted text, then immediately encrypts the password using SHA1 encryption and synchronizes with your Google domain.

Note: GCDS never saves, logs, or transmits passwords unencrypted. If passwords in your LDAP directory are Base64-encoded or plaintext, GCDS immediately encrypts them with SHA1 encryption and synchronizes them with your Google domain. Simulate sync and full sync logs show the password as a SHA1 password.

Use this field only if you also specify a Password Attribute. If you leave the Password Attributefield blank, when you save and reload, the configuration resets to the default of SHA1. Note that some password encoding formats aren't supported. Check your LDAP directory server with a directory browser to find or change your password encryption.

By default, Active Directory and HCL Domino directory servers don't store passwords in any of these formats. Consider setting a default password for new users and requiring users to change passwords on first login.

Force New Users to Change Password

If checked, new users must change passwords the first time they sign in to their Google account. Doing so allows you to set an initial password, either from an LDAP attribute or by specifying a default password for new users that the user must change the first time they sign in.

Use this option if you set an attribute in one of these fields:

• In the Password Attributefield, but it's only a temporary or one-time password
• In the Default password for new usersfield

Note: If your users don't manage their Google password, for example, if you're using  Password Sync or single sign-on (SSO), we recommend that you don't turn on this setting.

Default Password for New Users

Enter a text string that serves as the default password for all new users. If the user does not have a password in the password attribute, GCDS uses the default password.

Important: If you enter a default password here, be sure to check the Force new users to change passwordbox so that users don't retain the default password.

Example: swordfishX2!

Generated Password Length

The length, in characters, of randomly generated passwords. A password is randomly generated for a user if their password is not found on your LDAP server and you haven't specified a default password.

Place users in the following Google domain Org Unit

Specify which Google organizational unit should contain users that match this rule. If the organizational unit specified doesn't exist, GCDS adds the users to the root level organizational unit in your Google domain.

This option only appears if you have enabled Organizational Unitson the General Settingspage.

Options include:

• Org Unit based on Org Units Mappings and DN—Add users to the unit that maps to the user’s DN on your LDAP server. This is based on your Org Mappings and shows in the LDAP User Sync list as [ derived].
• Org Unit Name—Add all users that match this rule to the same Google organizational unit. Specify the organizational unit in the text field.

  Example: Users

• Org Unit name defined by this LDAP attribute—Add each user to the organizational unit with the name specified in an attribute on your LDAP directory server. Enter the attribute in the text field.

  Example: extensionAttribute11

Suspend these users in Google domain

Suspend all users that match this LDAP user sync rule.

Notes:

• GCDS suspends or deletes users that already exist in your Google domain based on the GCDS User Account Deletion/Suspending policy setting.
• Users in your domain that you have suspended are reenabled by GCDS if they match a search rule that doesn't have suspend usersenabled.
• This feature is commonly used to stage user accounts in the domain. The new users are created in a suspended state. If you are importing active users with this rule, leave this unchecked.

For details on these fields, see Use LDAP queries to collect data for a sync

Primary email

LDAP attribute that contains a user’s primary mail address. This is usually the same as the primary mail address listed in the LDAP Userssection.

Job title

LDAP attribute that contains the user’s job title at their primary work organization. 

Company name

LDAP attribute that contains the user’s company name of their primary work organization. 

Assistant’s DN

LDAP attribute that contains the LDAP Distinguished Name (DN) of the user’s assistant.

Manager’s DN

LDAP attribute that contains the LDAP DN of the user’s direct manager.

Department

LDAP attribute that contains the user’s department at their primary work organization. 

Office location

LDAP attribute that contains the user’s office location at their primary work organization. 

Cost center

LDAP attribute that contains the user’s cost center information at their primary work organization.

Building ID

LDAP attribute that contains the ID of the building where the user works. This can also be set to "Working remotely" if the user doesn't have a primary office building.

Admins can also let users set their own locations. For details, see  Let users change their photo and profile information .

Floor Name

LDAP attribute that contains the specific floor the user works on.

Employee ids

LDAP attribute that contains a user’s Employee ID number.

Additional email

LDAP attribute that contains user’s additional email addresses. You can enter more than one value into this field.

Note:This field only supports the synchronization of addresses using the Workemail type.

Websites

LDAP attribute that contains the user’s website URLs. You can enter more than one value into this field.

Valid URLs are checked against the following regular expression:

^((((https?|ftps?|gopher|telnet|nntp)://)|(mailto:|news:))(%[0-9A-Fa-f]{2}|[-()_.!~*';/?:@&=+$,A-Za-z0-9])+)([).!';/?:,][[:blank:]])?$]]>

Invalid URLs are skipped.

Recovery email

LDAP attribute that contains the user’s recovery email address.

Recovery phone

LDAP attribute that contains the user’s recovery phone. The phone number must be in the E.164 international standard, starting with the plus sign (+).

The attribute can be set as an expression by using square brackets. This allows you to include additional characters.

Examples:

• +[ ldap-attribute ]—Prepends a plus sign to the value of the attribute.
• +41[ ldap-attribute ]—Prepends a plus sign and country code to the value of the attribute.

Work phone numbers

LDAP attribute that contains a user’s work phone number.

Home phone numbers

LDAP attribute that contains a user’s home phone number.

Fax phone numbers

LDAP attribute that contains a user’s fax number.

Mobile phone numbers

LDAP attribute that contains a user’s personal mobile phone number.

Work mobile phone numbers

LDAP attribute that contains a user’s work mobile phone number.

Assistant’s Number

LDAP attribute that contains a work phone number for a user’s assistant.

Street Address

LDAP attribute that contains the street address portion of a user’s primary work address.

P.O. Box

LDAP attribute that contains the P.O. Box of a user’s primary work address.

City

LDAP attribute that contains the city of a user’s primary work address.

State/Province

LDAP attribute that contains the state or province of a user’s primary work address.

ZIP/Postal Code

LDAP attribute that contains the ZIP code or postal code of a user’s primary work address.

Country/Region

LDAP attribute that contains the country or region of a user’s primary work address.

POSIX UID

LDAP attribute that contains the Portable Operating System Interface (POSIX) compliant user ID.

POSIX GID

LDAP attribute that contains the POSIX compliant group ID.

POSIX username

LDAP attribute that contains the username of the account.

POSIX home directory

LDAP attribute that contains the path to the home directory for the account.

Group email address—Prefix

Text to add at the beginning of a mailing list’s email address when creating the corresponding group email address.

Example: groups-

Group email address—Suffix

Text to add at the end of a mailing list's email address when creating the corresponding group email address.

Example: -list

Enable invalid characters replacement

Invalid character replacement

If you check the box, spaces and invalid characters in an email address are replaced with the string specified in the Invalid character replacementfield.

If you check the box but leave the field blank, GCDS removes spaces and invalid characters from the address.

Example

The email address on the LDAP server isx y\z@example.com.

• If you add an underscore (_) to the  Invalid characters replacementfield, GCDS converts the email address to x_y_z@example.com.
• If the Invalid characters replacement field is left blank, GCDS converts the email address to xyz@example.com.

Member email address—Prefix

Text to add at the beginning of each mailing list member’s email address when creating the corresponding group member email address.

Member email address—Suffix

Text to add at the end of each mailing list member’s email address when creating the corresponding group member email address.

Owner email address—Prefix

Text to add at the beginning of each mailing list owner's email address when creating the corresponding group owner email address.

Owner email address—Suffix

Text to add at the end of each mailing list owner's email address when creating the corresponding group owner email address.