Prepare your LDAP directory server and data

When you're ready to set up and configure GADS, it will be quicker and easier to if you collect an LDAP inventory first.

Collect the following information:

• The host name or IP address of your LDAP server.
  Note: GADS can only synchronize with one LDAP server.
• Your network access, proxy servers, and outbound connections.
• The name and password of an account on your LDAP server with "read" and "execute" permissions. If you want to limit the users and groups you have to synchronize, you can set up an LDAP administrator with limited permissions on your directory server.
• Confirmation that your chosen LDAP server directory has full access to all needed resources.

If you have multiple LDAP directories, consider doing the following:

• Consolidate: If you are using multiple directories, consolidate your LDAP server data into a single directory. GADS can only get data from a single LDAP directory.
• Test the global catalog: If you have multiple Microsoft^® Active Directory domains, a global catalog may help with your synchronization, but only if the catalog is set up with proper replication. If you want to try using a global catalog, be sure to test the catalog thoroughly before relying on it.

Use an LDAP browser to collect the following information about your LDAP server and structure:

• LDAP base distinguished name (DN): GADS uses the base DN as the top level for all LDAP queries. If your LDAP directory server includes groups that you do not want to sync, use a base DN that doesn’t include these groups. Becuse GADS searches for users and groups from the base DN, specify a base DN on a level that includes the users and groups you want to synchronize.

  Note: You can use multiple base DNs in a configuration so that means you can specify a separate base DN for each synchronization rule.

• LDAP structure information: You need to know which LDAP attributes have important information, such as groups that contain users and other resources you want to sync. Look through your LDAP directory structure using an LDAP browser and examine some sample users and other resources to identify the LDAP attributes.

• Identify users: Get a list of your organization's current users and identify which ones you want to synchronize with the Google Apps domain.
  Watch a video on working with users in Microsoft Active Directory
• Identify mail-enabled groups: Identify mail-enabled groups that operate as mailing lists, not security groups, to synchronize with the Google Apps domain. You can also set the Google Apps domain to allow users to create and manage their own groups. User-managed groups are not affected by synchronization.
• Consider name and password guidelines to ensure that your directory doesn't contain unsupported characters. For details, see Name and password guidelines. 
• (Optional) Populate a password attribute: If you are using a password field in GADS, create a custom attribute in your LDAP directory for Google Apps users and populate the attribute with a password setting. For details, see Synchronizing passwords.
• (Optional) Set naming conventions: Identify any email naming conventions you want to use and update users to fit the conventions. 

To simplify your LDAP queries, make your transition to the Google Apps domain clear and visible, and possibly bypass any complications with your existing LDAP directory structure, you should mark all Google Apps users in the LDAP directory before you set up a synchronization.

You can mark the users you plan to synchronize with with a descriptive name, such as GoogleAppsUsers. Then, after synchronizations are set up and running correctly, you can mark active Google Apps users with a different name, such as GoogleAppsActiveUsers.

You can mark Google Apps users in an LDAP directory by:

• Organizational unit: Set up an organizational unit and move Google Apps users into the unit.
• Group: Create a new group in the LDAP directory and add Google Apps users as members of the group.
• Custom attribute: Create a custom attribute for your users and set the attribute for new users.

You can then configure GADS to synchronize based on organizational unit, group, or custom attribute, and activate new Google Apps users by updating your LDAP server.