Set up your sync with Configuration Manager

On the General Settings page, specify what you intend to synchronize from your LDAP server. Select one or more from:

• Organizational units
• User accounts
• Groups
• User profiles
• Shared contacts
• Calendar resources
• Licenses

On the Google Apps Configuration page of Configuration Manager, enter your Google Apps domain connection information.

Click the tabs to enter the following information:

• Connection settings: If you check the Replace domain names in LDAP email addresses box, all LDAP email addresses are changed to match the domain listed in the Domain Name field.

  Authorizing access using OAuth:

  1. Click Authorize Now to set up your authorization settings and create a verification code.
  2. Click Sign In to open a browser window and sign into your Google Apps domain with your super administrator username and password.
  3. Copy the token that is displayed.
  4. Enter the token in the Verification Code field and click Validate.
• Proxy settings: Provide any necessary network proxy settings here. If your server doesn't require a proxy to connect to the Internet, skip this tab.
• Exclusion rules: Use exclusion rules to preserve information in your Google Apps domain that isn’t in your LDAP system (for example, users that are only in Google Apps). See more about using exclusion rules.

On the LDAP Configuration page of Configuration Manager, enter your LDAP server information. After you configure the LDAP authentication settings, click Test Connection. Configuration Manager connects to your LDAP server and attempts to sign in to verify the settings you entered.

If you selected OpenLDAP or Active Directory^® as your LDAP server, click Use defaults at the bottom of every configuration page to quickly set up the sync with default parameter. You can then customize them to your needs.

For detail on the LDAP Configuration fields in Configuration Manager, see LDAP connection settings.

On the Org Units page of Configuration Manager, specify how your LDAP organizational units correspond to organizational units in your Google Apps domain.

Click the tabs to enter the following information:

• LDAP Org Unit mappings: Add mappings for top-level organizational units in your LDAP server. GADS maps suborganizations on your LDAP directory server to Google Apps organizational units with the same name.

  If you check the Do not create or delete Google Organizations box, organizational units will not be synchronized from the LDAP server. You can still specify which users go in which organizational units in the user account rules.

  To add an organizational unit mapping rule:

  1. Click Add mapping.
  2. Specify the following:
     • (LDAP) DN: The Distinguished Name (DN) on your LDAP directory server to map.
     • (Google Apps) Name: The name of the org unit in Google Apps to map.
  The easiest way to map your LDAP organizational unit structure to your Google Apps domain without any changes is to create a mapping from your root LDAP organizational unit (usually, your Base DN) to "/" (the root organization in Google Apps). GADS will map users to suborganizations on your Google Apps domain using the same organizational unit structure in your LDAP server. Note that you still need to create search rules to ensure that GADS creates the suborganizations in the Google Apps domain.
• Search rules: Specify the organizational units to import and synchronize using  LDAP query notation. You can modify your search rule with an exclusion rule.
• Exclusion Rules: If you have any organizational units on your LDAP directory server that match your search rules but you don't want them added to your Google Apps domain, add an exclusion rule. See more about using exclusion rules.

Example: An LDAP directory server has an organizational hierarchy split between two office locations: Melbourne and Detroit. The Google Apps org unit hierarchy will match the same hierarchy:

• First Rule:
  • (LDAP) DN: ou=melbourne,dc=ad,dc=example,dc=com
  • (Google Apps) Name: Melbourne
• Second Rule:
  • (LDAP) DN: ou=detroit,dc=ad,dc=example,dc=com
  • (Google Apps) Name: Detroit

On the User Accounts page of Configuration Manager, specify how GADS generates your LDAP user list.

Important: You must add at least one user rule before running a synchronization. Even if you use GADS to only sync groups, a user rule must be specified, or the synchronization will fail.

Click the tabs to enter the following information:

• User attributes: Specify what attributes GADS will use when generating the LDAP user list.
• Additional users attributes: Enter optional LDAP attributes (such as passwords) that you can use to import additional information about your Google Apps users.
• Search rules: Specify what users to import and synchronize using LDAP query notation. You can modify your search rule with an exclusion rule.
• User exclusion rules: If you have users on your LDAP directory server that match your search rules but you don't want them added to your Google Apps domain, add an exclusion rule. See more about using exclusion rules.

Note: If you've added a secondary domain, you can use GADS to sync users within that domain. To sync a user to your secondary domain, ensure the user's mail address in your LDAP server matches your secondary domain name. GADS creates the user in the Google Apps domain using your secondary domain as the primary mail address.

For detail on the User Accounts fields in Configuration Manager, see User attribute settings. You can also find more info on Additional user attributes and User search rules.

On the Groups page of Configuration Manager, sync the mailing lists on your LDAP server to Google Groups. The default settings of the Group can't be changed, however, you can change the Group settings once the Group is created.

Click the tabs to enter the following information:

• Search rules: Specify what groups to import and synchronize using LDAP query notation. You can modify your search rule with an exclusion rule.
• Exclusion rules: If you have any entries in your LDAP server that match a mail-list rule, but should not be treated as a mailing list (for example, internal mailing lists that do not have outside email addresses), list them here. See more about using exclusion rules.

For detail on the Group search rules fields in Configuration Manager, see Group search rules and Group search rules (Prefix-Suffix).

Are you using Groups for Business?

If your domain is using the Groups for Business service, users can create their own groups in your domain. These groups are controlled by your users, rather than by the Administrator. 

GADS automatically detects these groups and won't delete or overwrite them. If a group with the same email address exists in your LDAP directory, GADS applies non-destructive changes, such as updating the name, description, and adding new members, but it won't remove members you have removed from the LDAP directory. The only way to change a group from user-created to an Admin console group is to delete it then recreate it via the Admin console.

On the User Profiles page of Configuration Manager, specify the profile information for users. User profiles contain extended information about users, such as a phone number and job title.

Click the tabs to enter the following information:

• User profile attributes: Specify what attributes GADS will use when generating the LDAP user profiles.
• Search rules: Specify what user profile information to import and synchronize using LDAP query notation. You can modify your search rule with an exclusion rule.
• Exclusion rules: If you have any user profiles on your LDAP directory server that match your search rules but should not be added to your Google Apps domain, add an exclusion rule. See more about using exclusion rules.

For detail on the User Accounts fields in Configuration Manager, see User profile attributes.

On the Shared Contacts page of Configuration Manager, set up the synchronization for Shared Contacts which contains information about contacts, such as name, email address, phone number, and title. Shared Contacts corresponds to a Global Address List (GAL) in Microsoft Active Directory and other directory servers.

Important: It can take up to 24 hours for Shared Contacts to synchronize and appear.

Click the tabs to enter the following information:

• Shared contact attributes: Specify what attributes GADS will use when generating the LDAP shared contacts.
• Search rules: Specify what contacts to import and synchronize using LDAP query notation. You can modify your search rule with an exclusion rule.
• Exclusion rules: If you have any contacts on your LDAP directory server that match your search rules but should not be added to your Google Apps domain, add an exclusion rule. See more about using exclusion rules.

Learn more about troubleshooting issues with syncing Shared Contacts.

For detail on the Shared Contacts fields in Configuration Manager, see Shared Contacts attributes.

On the Calendar Resources page of Configuration Manager, specify how GADS generates your LDAP calendar resources.

• Calendar resource attribute: Specify what attributes GADS will use when generating the LDAP calendar resources.

  Important: GADS does not sync a Calendar Resource attribute that contains spaces or characters such as the at sign (@) or colon (:). For more information on calendar resource naming, see Developing a naming strategy for your calendar resources

• Search rules: Specify what calendar resources to import and synchronize using LDAP query notation. You can modify your search rule with an exclusion rule.
• Exclusion rules: If you have any calendar resources on your LDAP directory server that match your search rules but should not be added to your Google Apps domain, add an exclusion rule. See more about using exclusion rules.

For detail on the Calendar Resources fields in Configuration Manager, see Calendar Resource attributes.

By default Google Apps for Work auto assigns licenses to Google Apps user accounts when users are created in the domain. If you have purchased different product SKUs for your domain, such as Google Apps for Work and Google Apps Unlimited, you may want to disable auto license assignment and use the GADS license synchronization feature to manage licenses for your Google Apps user accounts.

On the Licenses page of Configuration Manager, set up the GADS license synchronization for users in your Google Apps domain:

• Email address attribute: Specify what attribute GADS will use as the email address mapping between the LDAP user account and the Google Apps user.
• To add an LDAP license rule: 
  • Click Add Rule
  • From the License drop-down menu select the license SKU you want to apply to the users specified by the license rule.
  • In the LDAP query field, specify what users on LDAP directory should be assigned the license using LDAP query notation.
    You can only configure one license rule per license SKU

    Example: (&(objectclass=user)(objectcategory=person)(memberof=CN=Group_1,CN=Users,DC=Domain,DC=com)) 

  • (Optional) Check the Remove this license from Google Apps users that don’t match this rule box to remove licenses for all users in the Google Apps domain that don’t match this license rule.

    Note: If you check this box, GADS removes the license for all users in the Google Apps domain that don’t match the rule. If your LDAP configuration isn’t properly defined this may result in removing licenses for a large set of users in the domain. Ensure your configuration is correctly defined before using this feature.

  • Select one of the following options:
    • OK to add the rule and return to the LDAP license rules screen
    • Apply to add the rule and begin another LDAP license rule
    • Cancel to cancel the rule
    • Test LDAP query to test the validity of the LDAP license query. 

Supported product IDs and SKUs:

On the Notifications page of Configuration Manager, specify details about your mail server and who should be notified by email following a sync.

Every time a synchronization occurs, GADS sends out a notification to one or more email addresses that you specify in the To addresses field. Click Add after each address is entered.

Click Test Notification to send a test message to the addresses you listed.

For detail on the Notifications fields in Configuration Manager, see Notification attributes.

For detail on the Logging fields in Configuration Manager, see Logging settings.

Click Simulate sync to test your settings. During simulation, Configuration Manager will:

• Connect to your Google Apps domain and generate a list of users, groups, and shared contacts.
• Connect to your LDAP directory server and generate a list of users, groups, and shared contacts.
• Generate a list of differences.
• Log all events.

If the simulation is successful, Configuration Manager generates a Proposed Change Report that shows what changes would have been made to your Google Apps user list.

Note: Running a simulated synchronization does not update or change your LDAP server data or your users accounts in Google Apps. The simulation is only for checking and testing purposes.

When you are confident that the configuration is correct, click Sync & apply changes to initiate the synchronization.