A Zimbra server extension to change Active Directory passwords from the Zimbra web client.
The original project by Antonio Messina (firstname.lastname@example.org) https://github.com/xMAnton/ADPassword this version is tested on Zimbra 8.8.15 patch 5 and Windows 2016. Zimbra 9 patch 14 and Windows 2019.
I recommend the cli install from below.
To get the jar follow the instruction below: https://github.com/Zimbra-Community/ADPassword#installation-via-the-cli
External LDAP account for Authentication. The DN from zimbraAuthLdapExternalDn will then be used.
Please note: ADPassword does not honor password history (https://blogs.technet.microsoft.com/fieldcoding/2013/01/09/resetting-passwords-honoring-password-history-or-whats-happening-under-the-hood-when-changing-resetting-passwords/)
If you use the same SSL certificate on your AD as on Zimbra there is a good change you can skip this step. If you already use your AD server for external auth, you can probably skip this as well. If you are not sure, configure your domain to auth against AD first before installing this extension. As of Zimbra 8.8.15 you MUST configure your AD server by it's DNS FQDN, you cannot use the change password extension by using the IP of your AD. This is because Java only proceeds if the SSL certificate matches the domain name in the configuration. (zimbraAuthLdapURL must be a domain, example of self signed windows cert:
zmprov md barrydegraaff.tk zimbraAuthLdapURL "ldaps://WIN-M7ME1BSBTRY.barrydegraaff.tk:636")
You can get any ldaps ssl certificate by using OpenSSL: openssl s_client -connect servername:port, copy paste the cert from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- and put it in a file on your server. Then import using above commands.
Please note some users reported that on recent Zimbra versions you must use a DNS domain name to connect to the AD server, using IP addresses no longer works and is not secure SSL/TLS.
Review your LDAP configuration in the commands below and then copy-paste them:
mkdir -p /opt/zimbra/lib/ext/adpassword wget https://github.com/Zimbra-Community/ADPassword/releases/download/0.0.7/ADPassword.jar -O /opt/zimbra/lib/ext/adpassword/adPassword.jar su zimbra zmprov md domain.ext zimbraAuthLdapBindDn "%email@example.com" zmprov md domain.ext zimbraAuthLdapSearchBase "CN=Users,DC=DOMAIN,DC=EXT" zmprov md domain.ext zimbraAuthLdapSearchBindDn "CN=serviceAccount,CN=Users,DC=DOMAIN,DC=EXT" zmprov md domain.ext zimbraAuthLdapSearchBindPassword "your-password-here" zmprov md domain.ext zimbraAuthLdapSearchFilter "(samaccountname=%u)" zmprov md domain.ext zimbraAuthLdapURL "ldaps://ad-server-dns-name:636" zmprov md domain.ext zimbraExternalGroupLdapSearchBase "CN=Users,DC=DOMAIN,DC=EXT" zmprov md domain.ext zimbraExternalGroupLdapSearchFilter "(samaccountname=%u)" zmprov md domain.ext zimbraAuthMech "ad" zmprov md domain.ext zimbraAuthMechAdmin "ad" zmprov md domain.ext zimbraPasswordChangeListener ADPassword zmprov gd domain.ext | grep -i ldap | grep -v Gal zmprov gd domain.ext | grep -i zimbraPasswordChangeListener zmprov md domain.ext zimbraAuthFallbackToLocal FALSE zmcontrol restart
zmprov mcf zimbraChangePasswordURL https://your-zimbra-server.com/h/changepass?skin=harmony
zimbraAuthFallbackToLocal to TRUE you can skip AD password update, which allows creating a mailbox
without a corresponding user using Zimbra password backend. If you require this, it's recommended to enable it
only after successfully testing a password update against AD.
ADPassword also supports Zentyal as directory server, please check the wiki for configuration details.
Do a password change while you run the following command:
tail -f /opt/zimbra/log/zmmailboxd.out
You should find ADPassword messages passing by explaining what's going on.
Verify your configuration:
zmprov gd domain.ext | grep -i ldap | grep -v Gal
Wrong bind DN: LDAP: error code 34 - 0000208F: NameErr: DSID-03100225, problem 2006 (BAD_NAME) Forgot to set zimbraAuthLdapSearchFilter or other required attribute: A network service error has occurred system failure: java.lang.NullPointerException
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
|Rating||( 3 ratings )|
|Categories||Business , Mail|
|Compatibility||ZCS 8.8.x , ZCS 9.0.x|
|License||Apache License v2.0|
|Updated||5 days, 19 hours ago|
By: wobonfim on on 12/19/18 for version 0.0.4
Thanks for your job.!!! i'm using Zentyal, and i can't change the password, appear a message "permission denied"could you help me? i'm using the zimbra 8.8 . tks
Zentyal support is explained here: https://github.com/Zimbra-Community/ADPassword/wiki/Support-for-Zentyal
Replied on 2/7/20
By: rlipski on on 1/18/17 for version 0.0.1
The plugin works but only for zimbraAuthLdapSearchBase that is set. So basically, as long as the users are located in the following search base:
OU=TestDomain,DC=Test,DC=local as set in the zimbraAuthLdapSearchBase then it will find the user and reset the password.
However, I have multiple sub-ous that are setup. So if i have users in the following ou under that above search base (zimbraAuthLdapSearchBase "OU=TestDomain,DC=Test,DC=local ")
It will say permission denied in the password reset dialog. After debugging the log, i found that it is searching for that user in the search base despite the fact that they are located under another OU under that search base hence why they cannot find the user for password reset. Not sure if there is a way to work around this, but other than that it works great. But, currently i can only use one OU of Users. I also confirmed this by changing the search base to that OU to test what I had thought and it will reset only the users in that search base that is set.
That is correct, multiple OU's are not supported.
Replied on 4/7/17
By: ajcody on on 12/23/16 for version 0.0.1