Directory Sync FAQ

 

This page is for Directory Sync. If you’re using Google Cloud Directory Sync (GCDS), go to GCDS. Directory Sync is currently in public beta.

Below are common questions about setting up and running a sync with Directory Sync.

Expand all  |  Collapse all

Should I move from Google Cloud Directory Sync to Directory Sync?

If you're syncing only users and groups, Directory Sync might satisfy your requirements.

If you're syncing objects in addition to users and groups (for example, Google Workspace licenses or shared contacts), you could consider using Directory Sync for the user and group sync and use GCDS for the other objects. However, if you're syncing both users and groups, you must use the same sync tool for both.

Review Compare Directory Sync with GCDS for more information.

Can I use Directory Sync for a user & group sync and GCDS for syncing shared contacts?

Yes. You can use Directory Sync to sync users and groups and GCDS to sync other objects, such as shared contacts. We always recommend using one tool to sync users and groups.

Can I create the VPC access connector in a separate project?

To simplify network configuration, we recommend that you create the Virtual Private Cloud (VPC) access connector in the same project as Cloud VPN or Cloud Interconnect. If you want to create the VPC access connector in a different project, use Shared VPC. For more information, go to Shared VPC overview.

Can I rename an LDAP group?

Yes, you can change the name of an LDAP group. You need to take some extra steps if you have run a sync after adding the group in the User scope section of Directory Sync with the Suspend user in Google box checked. In this scenario, follow the instructions below to change the group name.

Note: If the scenario above doesn’t apply to your setup, you can rename the LDAP group without any additional steps.

  1. Disable the sync.

    For details, go to Activate or deactivate a sync.

  2. On the Directory details page, next to User sync, click Edit "".
  3. Enter the new group name and save the sync configuration.
  4. In your LDAP directory, rename the group.
  5. In Directory Sync, under User Scope, remove the old group name and save the sync configuration.
How do I format the Base DN when setting up a sync?

Your LDAP server uses the Base DN as the starting point when searching for directory objects, such as users and groups. The narrower the scope of the Base DN, the better it performs when searching.

Examples

Type of Base DN search Example Notes
Specify the top-level Base DN dc=example, dc=com Searches all objects in the directory. Search performance can be low.
Specify an organizational unit ou=sales, dc=example, dc=com

Searches for all objects under an organizational unit.  

Specify a users’ search

cn=Users, dc=example, dc=com

Searches all users in the directory.

We recommend you use objectClass and objectQuery attributes to further narrow down your query. For details, go to Filter on objectCategory and objectClass. 

Related topics

How can I improve search performance with my LDAP queries?

To improve search performance:

  • Base DN–Adjust the base DN to make it as specific as possible. For example, if your users or groups are in an organizational unit hierarchy, use the search query to point to the parent of the hierarchy instead of the root organizational unit. Doing so ensures the LDAP search occurs in the specific organizational unit hierarchy instead of the entire directory.
  • Scope–Consider the hierarchy level that is included in your LDAP query." "

    In this example, your organization unit hierarchy is divided into regions (1st level) and countries (2nd level). If your users and groups are in the APAC organizational unit, set the scope of the LDAP query as One-level so that the query searches only the APAC unit (and not its 2nd level units). If you want to include the 2nd level organizational units in the search, set the scope to Sub-tree

Related topics


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
false
false
true
73010
false
false