Description
This article provides steps for setting up synchronization in Jamf School with Google LDAP. Once this is complete you can sync with Google LDAP to:
Look up and populate user information from the directory service for inventory purposes.
Add Jamf School user accounts or groups from the directory service.
Require users to log in during mobile device setup using their LDAP directory accounts.
Base the scope of remote management tasks on users or groups from the directory service.
Adding the LDAP Client App in Google Admin Console
Log in to admin.google.com with a user that is a super admin.
Under Apps > LDAP click Add Client.
Provide a name and add desired Access Permissions settings: verify user credentials, read user information, read group information.
Click ADD LDAP CLIENT.
A certificate is created. Click Download certificate and then click CONTINUE TO CLIENT DETAILS.
Under Service status, select ON for everyone and click Save.
Under Authentication, click GENERATE CREDENTIALS.
Leave this tab open and continue with the steps below in Jamf School.
Adding Google LDAP to Jamf School for Synchronizing
In Jamf School go to Organization > Settings and click Synchronization.
Set the Synchronization Method to LDAP.
For LDAP Server/Port enter
ldap.google.comand 636.Leave the Directory type as Microsoft Active Directory.
For the Username and Password fields, use the access credentials generated previously in the Google Admin Console.
Note - Jamf School will redact these credentials. It's expected the password field will be blank after saving. If you need to update this in the future, you can generate new credentials in the Google Admin Console and then update the information in Jamf School.
Under Base DN, fill in the distinguished name for your domain. For example,
CN=Username,DC=example,DC=com.Ensure spelling is correct.
Under Mapping of LDAP Parameters, set Username to
uid.For more information, see Secure LDAP Schema.
Under the Advanced section:
Uncheck the box for Enable paging.
Configure recursive groups, delete removed users/groups as you desire.
Check the box for Authenticate using a client certificate.
We do not need to check the box for Authenticate using the root certificate.
Unzip the certificate downloaded from Google above. Add the crt file to the Custom certificate box. Add the .key file to the Custom Key box.
Click Upload certificate and key.
Click Save in the bottom-right corner.
Scroll up and click Test Connection (right above the Mapping of LDAP parameters to Jamf School heading).
Click Retrieve OUs and set your mappings for students, teachers, and groups.
Click Save again.
Refresh your page.
Click Test Sync Configuration. You will see the users and groups found.
Set the Automatic synchronization settings and optional mapping parameters if desired. Click Save after making any changes.
After you save any changes, refresh your page before retrying the Test Sync Configuration.
Bringing Over Google LDAP Users into Jamf School
In Jamf School go to Users > Users and click Sync users.
Validate that the expected users now show under Users > Users.
Validate that the expected groups now show under Users > Groups.