Zimbra AD password change plugin installation

From Notes_Wiki

Home > CentOS > CentOS 6.x > Zimbra AD password change plugin installation

If an organization uses AD for its user account management, then it may choose to authenticate users for mail via AD. In such cases default "Change password" option provided by Zimbra does not results into password change on AD server. To allow changing of AD password via Zimbra change password, we can install an AD password change plugin in Zimbra. To install the plugin use following steps:


Exporting CA certificate from AD for importing into Zimbra

  1. Login into AD server
  2. From run start "mmc" to obtain console window
  3. In mmc file menu choose "Add span-in" option
  4. Choose span-in of type certificate and click ok.
  5. In the following popup-screen choose type as Personal computer
  6. From the mmc console Expand Certificate -> Personal computer tree
  7. Choose CA certificate among various certificates shown. Please note that these steps assume that AD is already setup to operate over LDAPS. To learn how to configure AD over LDAPS refer Setup AD to respond to LDAP queries over LDAPS protocol
  8. Right click CA certificate and from "All Tasks" choose export
  9. In export pop-up window chose certificate export type as DER with extension cer so that it can be imported into java keystore.
  10. Copy the exported cer certificate to Zimbra server


Install Zimbra AD Password change plugin

  1. Download AD password change plugin from https://www.zimbra.org/extend/items/view/adpassword
  2. As root, create the /opt/zimbra/lib/ext/adpassword directory
  3. As root, copy downloaded adPassword.jar into /opt/zimbra/lib/ext/adpassword/
  4. As root, import the DER domain controller certificate into the trusted keystore 
    /opt/zimbra/java/jre/bin/keytool -import -keystore /opt/zimbra/java/jre/lib/security/cacerts -file <ca-certificate.cer>
    Keystore default password is changeit
  5. Restart Zimbra using 'su - zimbra -c "zmcontrol restart"' command.


Configure domain to authenticate via AD with AD password change plugin

  1. Open the Zimbra Administration console
  2. Right click domain and choose "configure Authentication"
  3. Select External LDAP as authentication mechanism. Note that we are choosing 'External LDAP' and not 'External AD', although Zimbra is connected to AD server and not to an LDAP server.
  4. Type the LDAP URL and check Use SSL
  5. Type 'samaccountname=%u' in the LDAP filter field
  6. Specify 'cn=users,dc=SERVER,dc=EXT' in the LDAP search base field
  7. Check Use DN/Password to bind to external server
  8. Enter the Bind DN cn=Administrator,cn=users,dc=SERVER,dc=EXT and its password
  9. If Test passes successfully, then click Finish
  10. Again in Zimbra Administrative console right click on domain and choose "Edit"
  11. Under "Authentication" assign the new change password listener ADPassword

Note old password continues to work for another 15 min in some cases. 'This plugin was found to work sometimes and in other cases it simply did not work. Reason why plugin did not work in a few installations is not clear.


Refer:



Home > CentOS > CentOS 6.x > Zimbra AD password change plugin installation

Retrieved from "http://www.sbarjatiya.com/notes_wiki/index.php?title=Zimbra_AD_password_change_plugin_installation&oldid=6489"