Directory service

The Directory Service page of the web admin UI syncs users, groups and domains from Zimbra's built-in OpenLDAP. Use this page to verify the connection parameters and diagnose why a synchronization fails or returns no accounts.

For the general configuration walkthrough see the Directory service page.

Recommended connection settings

Use the read-only Postfix application account - it can read all account attributes the sync needs, but no password hashes or auth tokens.

Example for the mail domain example.com on the Zimbra host mail.example.com:

Field	Value
Host	mail.example.com
Port	389
Bind DN	uid=zmpostfix,cn=appaccts,cn=zimbra
Password	on the Zimbra host: zmlocalconfig -s -m nokey ldap_postfix_password
Base DN	dc=example,dc=com (the mail domain with each dot as a dc= part)

All zmlocalconfig and zmprov commands run on the Zimbra server as the zimbra user (sudo su - zimbra).

1. Get the bind password

sudo su - zimbra
zmlocalconfig -s -m nokey ldap_postfix_password

Copy the printed value into the Password field of the directory service configuration.

2. Discover the mail domains

Each Zimbra mail domain maps to a base DN: the domain example.com becomes dc=example,dc=com. List the domains:

zmprov gad

3. Verify with ldapsearch

Verify that the bind works and the base DN returns accounts. Run it from the host where MSH Zimbra Rules is installed - if the services run on a separate machine this also proves port 389 is reachable through the firewall:

ldapsearch -x -H ldap://mail.example.com:389 -D "uid=zmpostfix,cn=appaccts,cn=zimbra" \
  -w "<ldap_postfix_password>" -b "dc=example,dc=com" "(objectClass=zimbraAccount)" mail displayName

• If the command lists your accounts, the same parameters will work on the Directory Service page.
• ldap_bind: Invalid credentials (49) - wrong bind DN or password; re-read the password with the zmlocalconfig command above.
• Can't contact LDAP server (-1) - wrong host or port, or a firewall blocks port 389 between the application host and the Zimbra LDAP server.
• Zero results with a successful bind - wrong base DN; check the domain spelling and the dc= mapping with zmprov gad.

Notes

• The account listing includes Zimbra system accounts (admin@, galsync@, spam.*, ham.*, virus-quarantine.*). This is expected.
• The zmpostfix account cannot read zimbraAccountStatus, so a custom user filter like (zimbraAccountStatus=active) matches nothing under this bind. Do not filter on that attribute.
• Full-privilege alternative: bind DN uid=zimbra,cn=admins,cn=zimbra with the password from zmlocalconfig -s -m nokey zimbra_ldap_password. This is Zimbra's LDAP root account - avoid it unless the read-only account is not enough.

Additional resources

• Directory service - configuring the synchronization in the web admin UI
• Logs - where the application logs the synchronization steps