Skip to main content

Directory service

The Directory Service page syncs users, groups and domains from Zimbra's built-in OpenLDAP. Once synced, users and groups become available throughout the application - you can use them when defining rule conditions to match messages by sender or recipient, and their attributes fill the placeholders in signature templates.

The sync is multi-domain: every mail domain found in the directory is imported, together with its users and groups. The results are browsable on the Domains page.

Aliases are imported as well, from the zimbraMailAlias attribute, for accounts and for distribution lists alike, and are listed on the user's and the list's page. Account aliases let the Message sender and Message recipient conditions match a message sent to or from an alias as if it used the primary address. List aliases work the same way for the Group option of both conditions, which matches a message addressed to, or sent from, the list itself.

The Directory Service page, with host, port, bind DN, password and discovery base DN fields

Connection settings​

Use the read-only Postfix application account that Zimbra creates for its own MTA - it can read all account attributes the sync needs, but no password hashes or auth tokens.

Recommended configuration (example for the mail domain ubuntu.lan on the Zimbra host mx.ubuntu.lan):

FieldValue
Hostmx.ubuntu.lan
Port389
Bind DNuid=zmpostfix,cn=appaccts,cn=zimbra
Passwordon the Zimbra host: zmlocalconfig -s -m nokey ldap_postfix_password
Discovery Base DNleave empty, or dc=ubuntu,dc=lan
Use SSL (LDAPS)enable only if your LDAP server requires it (switches the port to 636)

Discovery Base DN is optional. When it is empty, the sync starts from the LDAP root DSE and discovers all mail domains automatically; the base DN of each domain is auto-detected. Set it only when you want to restrict the sync to a single subtree - a mail domain example.com maps to the base DN dc=example,dc=com (each dot becomes a dc= part).

info

The zmpostfix account cannot read the account's photo attribute, so it is not enough if you want to use the {photo} template variable - synced users will have no photo. Use the full-privilege alternative instead if you need photos:

  • Bind DN: uid=zimbra,cn=admins,cn=zimbra
  • Password: on the Zimbra host: zmlocalconfig -s -m nokey zimbra_ldap_password

This is Zimbra's LDAP root account - avoid it unless the read-only account is not enough.

All zmlocalconfig and zmprov commands run on the Zimbra server as the zimbra user (sudo su - zimbra).

Buttons​

  • Save Settings - store the connection settings.
  • Test Connection - verify the settings connect and bind successfully before saving.
  • Sync - save the settings and run a synchronization. The result shows how many domains, users and groups were synced.

Automatic sync​

In addition to the Sync button, the directory sync also runs on its own twice a day, at 00:00 and 12:00 server local time, so the cached domains, users and groups do not go stale between manual runs. A scheduled run is skipped while no host is configured. If the directory server cannot be reached when a run is due, the attempt is logged and not retried - the next attempt is simply the next scheduled time.

Verifying the connection manually​

List the mail domains known to Zimbra (each domain example.com maps to base DN dc=example,dc=com):

zmprov gad

Verify the bind and the base DN return accounts. Run it remotely from another host if you also want to prove that port 389 is reachable through the firewall:

ldapsearch -x -H ldap://mx.ubuntu.lan:389 -D "uid=zmpostfix,cn=appaccts,cn=zimbra" \
  -w "<ldap_postfix_password>" -b "dc=ubuntu,dc=lan" "(objectClass=zimbraAccount)" mail displayName

Notes​

  • The synced account listing includes Zimbra system accounts (admin@, galsync@, spam.*, ham.*, virus-quarantine.*).
  • The zmpostfix account cannot read zimbraAccountStatus, so filtering on (zimbraAccountStatus=active) matches nothing under this bind.

Additional resources​