# Zimbra configuration

## Prerequisites

The goal of this document is to configure Active Directory authentication for domain **addomain.example.com** in ZCS Zimbra and integrate it with ZI-ADPassword.

The configuration of AD authentication of the domain is according to the [https://wiki.zimbra.com/wiki/Configure\_authentication\_with\_Active\_Directory](https://wiki.zimbra.com/wiki/Configure_authentication_with_Active_Directory) .

Information needed:

- Active Directory administrator DN and passwords
- Active Directory address

## Domain configuration

At beginning create the domain **addomain.example.com**:

```
zmprov cd addomain.example.com
```

We configure Active Directory authentication:

```
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapBindDn '%u@addomain.local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBase 'CN=Users,DC=addomain,DC=local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBindDn 'CN=Administrator,CN=Users,DC=addomain,DC=local'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchBindPassword 'Administrator_password_in_AD'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapSearchFilter '(samaccountname=%u)'
 zmprov md adzimbraosedemo.int.intalio.pl zimbraAuthLdapURL 'ldaps://ad.addomain.local:636'
 
```

where:

- zimbraAuthLdapBindDn - LDAP bind dn for ldap auth mech
- zimbraAuthLdapSearchBase - LDAP search base for ldap auth mech
- zimbraAuthLdapSearchBindDn - LDAP search bind dn for ldap auth mech
- zimbraAuthLdapSearchBindPassword - LDAP search bind password for ldap auth mech
- zimbraAuthLdapSearchFilter - LDAP search filter for ldap auth mech
- zimbraAuthLdapURL - LDAP URL for ldap auth mech

## ZImlet configuration

In this step we configure custom authentication for addomain.example.com:

```
 zmprov md addomain.example.com zimbraAuthMech 'custom:ZIADPassword'
 zmprov md addomain.example.com zimbraPasswordChangeListener ZIADChangePassword
 
```

After this ZI-ADPassword takes control over the authentication process and password changing requests.

Install Active Directory server certificate on every mailbox:

```
/opt/zimbra/common/bin/keytool -import -alias adserwer -keystore /opt/zimbra/common/etc/java/cacerts -trustcacerts -file /tmp/ad_cert.crt
```

Restart all mailboxes:

```
zmmailboxdctl restart
```