User and Group Synchronization

User and Group Synchronization
Prev	Chapter 10. System Management	Next

One of the most important parts of managing the system is to configure the User and Group synchronization options. PaperCut NG synchronizes user and group information from the Windows Active Directory (or Windows Domain). This simplifies the administration of the system by avoiding the need to manage a separate database of users and groups. If a user is added to the domain or is removed from a group then PaperCut NG will automatically synchronize this information without any intervention from the administrator. For example:

Jason configures PaperCut NG to assign an initial credit of $10 to users that are members of the "Students" windows security group.
At the start of the new school year Jason, the system administrator, has just added 100 new students to the Windows Active Directory.
Jason also adds all the users to the "Students" Windows security group.
When PaperCut NG next synchronizes with the Active Directory, the 100 new users are added to PaperCut and automatically assigned the $10 of initial credit. This was done automatically without any additional work by Jason.

Synchronization Options

The synchronization options are located on the Options->User/Group Sync tab. There are three options to select:

Sync Source - this selects where the users/groups should be imported from. (Active Directory, Windows NT Domain, LDAP, or Custom provider).
Import from Group - allows to import from a subset of users
Delete old users when syncing - deletes users from PaperCut NG if the user no longer exists.

Figure 10.1. User/group synchronization options

The "Sync Source" allows the choice between either "Active Directory" or "Windows Standard". If the PaperCut NG server is a member of an Active Directory domain it is recommended to use this option. The advantages over the "Windows Standard" include:

Allows using Active Directory organizational units.
Supports the nested groups for simplified user management.
Allows importing of users from other trusted Active Directory domains.

PaperCut NG automatically re-syncs the user and group information each night, however the sync process can also be initiated manually. To initiate a manual sync:

Navigate to the Options → User/Group sync tab.
Press the Synchronize Now button.
The sync process will start and a status window will open showing the status of the sync process.

Figure 10.2. Progress of a user/group synchronization process

Tip

By default, the Active Directory user source will import all users, including those that are disabled. It is possible to change this behaviour using an advanced config entry. To do this:

Navigate to the Options tab.
Press the Config Editor (Advanced) action on the left.
Find the user-source.config-arg property.
Change the value to enabled-users-only .
Press the Update button next to the config property.

Take care when changing this option if you temporarily disable user accounts for disciplinary or other reasons. If you do this, performing a user sync will cause disabled users to be deleted if you also have the Delete old users when syncing option enabled.

Important

The group membership is automatically synchronized nightly to ensure that group-based operations (like quota allocation) operate as expected.

However, the users are not automatically synchronized, so if many users have been added to your Active Directory, it is recommended that you perform a manual user/group sync operation. Alternatively a full user and group synchronization can be automated as a nightly task by scheduling a script to run the appropriate server-command command. More information on using the server-command can be found in Appendix A, Tools (Advanced).

Using LDAP for user synchronization

LDAP (Lightweight Directory Access Protocol) directories usually store information about user and groups in an organization. One of the most common uses of LDAP is to provide single sign-on on a network that comprises multiple platforms and applications. When a network consists of only Windows computers, then an Active Directory domain can be used. But when there is a mix of Windows, Apple and Linux machines then LDAP can provided the single source of user, group and authentication information. (It is worth noting that both Active Directory and Novell eDirectory implement the LDAP protocol).

PaperCut NG can use an LDAP directory for user authentication and as a source of user and group information. LDAP can either be enabled at installation time, or by changing the user source option in Options → User/Group sync. When enabling LDAP, a number of configuration settings must be specified to allow the application to connect to the LDAP server. Please ask your LDAP administrator what values to use for the various options:

LDAP Server Type - Determines which LDAP fields are used to get user and group information.
LDAP Host address - The hostname or IP address of the LDAP server.
Use SSL - Indicates if an encrypted SSL connection should be used to connect to the LDAP server. The LDAP server requires SSL support to be enabled and should accept connections on the standard LDAPS port 636.
Base DN - This is the Base DN of the LDAP server. This is the equivalent of the "suffix" config setting of the OpenLDAP server. For example, if the domain hosted by the LDAP server is "domain.com" then the Base DN might be DC=domain,DC=com. The format of the Base DN can differ significantly depending on configuration. Some examples:
```
    DC=myschool,DC=edu,DC=au
    DC=myorganization,DC=com
    OU=OrgUnit,DC=domain,DC=com
    DC=local
                        
```
Admin DN - The DN of the user who has permission to connect to and query the LDAP server. This is typically an administrative user, although it can be a user that has full read access to the LDAP server. An example of the DN of the Administrator user on a Windows AD domain "domain.com", would be CN=Administrator,CN=Users,DC=domain,DC=com. The exact format of the DN depends on the LDAP server. Some examples:
- Windows Active Directory: CN=Administrator,CN=Users,DC=domain,DC=com
- Windows Active Directory (in organizational unit): CN=administrator,OU=OrgUnit,DC=domain,DC=com
- Mac OpenDirectory: uid=admin,CN=users,DC=domain,DC=com
- Unix Open LDAP: uid=root,DC=domain,DC=com, or uid=ldapadmin,DC=domain,DC=com
Admin password - The password for the above user.

PaperCut NG supports the following server types:

Novell eDirectory
Microsoft Active Directory
Unix/NIS

However, it is easy to support other server types by adjusting the LDAP fields PaperCut NG searches. This is discussed in Appendix C, Advanced LDAP Configuration.