Zimbra configuration

Prerequisites

The goal of this document is to configure Active Directory authentication for domain addomain.example.com in ZCS Zimbra and integrate it with ZI-ADPassword.

The configuration of AD authentication of the domain is according to the https://wiki.zimbra.com/wiki/Configure_authentication_with_Active_Directory .

Information needed:

• Active Directory administrator DN and passwords
• Active Directory address

Domain configuration

At beginning create the domain addomain.example.com:

zmprov cd addomain.example.com

We configure Active Directory authentication:

 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapBindDn '%u@addomain.local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBase 'CN=Users,DC=addomain,DC=local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBindDn 'CN=Administrator,CN=Users,DC=addomain,DC=local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBindPassword 'Administrator_password_in_AD'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchFilter '(samaccountname=%u)'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapURL 'ldaps://ad.addomain.local:636'
 

where:

• zimbraAuthLdapBindDn - LDAP bind dn for ldap auth mech
• zimbraAuthLdapSearchBase - LDAP search base for ldap auth mech
• zimbraAuthLdapSearchBindDn - LDAP search bind dn for ldap auth mech
• zimbraAuthLdapSearchBindPassword - LDAP search bind password for ldap auth mech
• zimbraAuthLdapSearchFilter - LDAP search filter for ldap auth mech
• zimbraAuthLdapURL - LDAP URL for ldap auth mech

ZImlet configuration

In this step we configure custom authentication for addomain.example.com:

 zmprov md addomain.example.com zimbraAuthMech 'custom:ZIADPassword'
 zmprov md addomain.example.com zimbraPasswordChangeListener ZIADChangePassword
 

After this ZI-ADPassword takes control over the authentication process and password changing requests.

Install Active Directory server certificate on every mailbox:

/opt/zimbra/common/bin/keytool -import -alias adserwer -keystore /opt/zimbra/common/etc/java/cacerts -trustcacerts -file /tmp/ad_cert.crt

Restart all mailboxes:

zmmailboxdctl restart