Google Cloud Directory Sync enables administrators to synchronize users, groups and other data from an Active Directory/LDAP service to their Google Cloud domain directory. To enable the automated removal of accounts, you must be running release 4.7.12, updated on May 3rd, 2021.
Next, under General Settings, you must check the licenses option to enable this function and add the item to the list of available options to configure.
Next, begin the configuration of the Licenses option by populating the email address attribute field. For Active Directory, the default value will be “mail”.
NOTE: It is critical to understand that you must be able to write a single ldap query for each license. When you build a query and assign a license, the process removes that SKU from the list and will not allow you to build a second query for the same SKU. There is a 1:1 relationship between SKU and ldap query.
(&(objectClass=person)(mail=*)(memberof=CN=Students-ALL,OU=Groups,OU=Students,OU=Accounts,DC=ad,DC=sps-k12,DC=com))
We take this information and create an ldap license rule in GCDS. Click on “Add Rule”, cut and paste your preformatted ldap query like the one above into the ldap query field, select “Assign licenses to Google domain users”, select the SKU that you want to assign and then check the box “Remove this license from the Google domain users that don’t match this rule”. The screen will look like this:
Before you click OK to save this and put it into effect, make sure that you select “Test LDAP Query” to see if you get any students that match your ldap search. The results should look like this:
For my staff, I have a group for teachers in each building or grade band, so my ldap search query is more complex. I need it to be true if you are in any of four groups, so the query would be:
(&(objectClass=person)(mail=*)(|(memberof=CN=Teachers-PS,OU=Groups,OU=Staff,OU=Accounts,DC=ad,DC=sps-k12,DC=com)(memberof=CN=Teachers-ES,OU=Groups,OU=Staff,OU=Accounts,DC=ad,DC=sps-k12,DC=com)(memberof=CN=Teachers-MS,OU=Groups,OU=Staff,OU=Accounts,DC=ad,DC=sps-k12,DC=com)(memberof=CN=Teachers-HS,OU=Groups,OU=Staff,OU=Accounts,DC=ad,DC=sps-k12,DC=com))
We take this information and create an ldap license rule in GCDS. Click on “Add Rule”, cut and paste your preformatted ldap query like the one above into the ldap query field, select “Assign licenses to Google domain users”, select the SKU that you want to assign and then check the box “Remove this license from the Google domain users that don’t match this rule”. The screen will look like this:
And then when we test the query, the results should look like this:
NOTE: If your search results return no users, check the ldap base dn on your ldap configuration page. This search doesn’t have the option to specify its own base dn, so it will use the one defined on the ldap page.
Finally, to see what this would do to your production environment; you must ALWAYS preview the changes first. Go to the sync tab, check “Clear cache” and then click “Simulate sync”. You will get a preview window with results that will look something like this:
I personally have an additional process where I download all users from google and cross-reference this list against current assigned licenses to be sure that I am getting exactly the results that I want. Once I have done that, I can move this .xml file into production use.
