• Choose language: RU EN DE ES

Synchronizing Bitrix24 with Active Directory. Problems and solutions

This material is of relevance for synchronizing self-hosted Bitrix24 with Active Directory and LDAP.

The article is long, so let us start with the conclusion. We often have to solve the task of synchronizing Active Directory with Bitrix24. The tools needed are available, but some additional setups are required. This article is about fine-tuning methods and solving problems related to such informational exchange.  

We will consider a specific example. Our customer is a large production company. There is a configured domain controller and Active Directory with a list of users.   

The task is to transfer users to Bitrix24 and set up synchronization. For the purpose of synchronizing information from the user fields and during user deactivation in Active Directory, it was deactivated in Bitrix24.

The self-hosted Bitrix24 version has a standard module for this task - “AD/LDAP integration”.

Prior to synchronization, this module needs to be installed or updated.

It is possible to set up periodic synchronization. The basic setup makes it possible to define periodicity only in hours. We set synchronization for every hour. It makes sense to increase this time to 24 hours after portal setup is complete, as Active Directory data normally seldom change.

Important! The synchronization itself occurs only after user authentication at the portal. If the user has not visited the portal, it is necessary to press ‘Activate’ in the user list to enforce synchronization. Otherwise, the user will not be synchronized until they enter the portal.

The module can transfer the company structure, which can be set up in the admin panel in the server settings.

You can decide yourself whether you need it or not. If the company structure in Active Directory is not correct or has features which are not needed in Bitrix24, it makes sense not to transfer the structure.  

In our case, it was decided not to use the current company structure found in AD and to separate the AD structure and Bitrix24. The downside of this solution is that changes to the structure have to be made in two places.

Attention! Bitrix24 considers Active Directory data as priority data. If the data in the fields are not the same, the value in the Bitrix24 field is replaced by the Active Directory field value.

Difficulties in integrating Bitrix24 and Active Directory

Difficulty 1. Joint setup of filters ‘Field Setup -> User Filter’ and ‘Groups -> Groups marked below do not take part in user import’.

These two parameters are in conflict:

Field Setup -> User Filter:

Groups -> Groups marked below do not take part in user import:

Putting settings in both fields results in a conflict, and users are not imported.

Solution: Use the user filter only.

When the active filter from Active Directory had been put into the user filter field, it all started to work.   (&(&(objectClass=user)(objectCategory=PERSON))(memberof=CN=BitrixCorpUser,CN=Builtin,DC=department1,DC=loc))

Difficulty 2. Synchronizing the Active Directory server time and Bitrix24 time.

When the server was created, no time was assigned in the settings, so imported users remained inactive without manual activation. There is no synchronization date in the list of users.  Without manual editing, these users have no rights and can neither enter the portal nor synchronize. This is due to the server settings.

Solution:

Change the MySQL parameter value ‘explicit_defaults_for_timestamp’ to ‘Off’.

Perform website check.

Difficulty 3. Conflict between two copies of the same user.

If the login and email of a user from Active Directory are not the same as the login of that user, who registered manually in Bitrix24 earlier, there are two account copies for the same person at the portal. It is necessary to deactivate the account registered earlier and transfer all of its tasks to the user account imported from Active Directory.

Solution: make the user imported from Active Directory the main user and transfer all current tasks to that user, then fire the ‘copy’.

Correct synchronization was possible only for the upper folder of Active Directory, whereas the subfolders were ignored.

The subfolders were ignored because we had not transferred the company structure. If the structure is transferred, synchronization will work for subfolders too. If the structure is not transferred, upper folder synchronization is only possible.

Solution: All users were transferred to one folder, and synchronization was performed from that folder. Since we had decided against transferring the structure, that was the only solution.

Difficulty 4. Synchronizing a First Name and Surname copy in a different language.

Since that was an international company, the main first name and surname were given in English. But inside Bitrix24, it would be convenient to see names in local languages – English, Spanish, French, German, etc.

Solution: Additional First Name (RU) and Surname (RU) were added and synchronized using the ExtensionAttribute1 и ExtensionAttribute2 attributes. It is not recommended to use standard Bitrix24 fields to solve this task, as they are used in quite unexpected places. For example, it is impossible to use a patronymic as standard Full Name in Russian, because when being synchronized with iPhone the iPhone user became Ivanov Ivanov Ivan Ivanovich Ivan.  

Difficulty 5. Transferring large images from Active Directory to Bitrix24.

The problem is the basic AD limitations. The image size is limited to 95x95 pixels and 100 kilobytes maximum.   

Solution: An additional ‘jpegPhoto’ field was added to Active Directory. The size is also limited to 100 kilobytes, but the jpg type will ensure maximum compression. It is not recommended to upload photos larger than 300x300 pixels because Bitrix24 has a limitation of 300x300 pixels for output profile photos, so photos with greater resolution will be oversized.

Note: Match between user fields and LDAP attributes.

Here are some details for developers and administrators.

The method used is $arSyncFields.

The following information is inserted into the Bitrix fields:

"EMAIL" => Array("NAME" => GetMessage("LDAP_FIELD_EMAIIL"), "AD"=>"mail", "LDAP"=>"email"),

At the array entrance, where the first parameter is mandatory, it is the translation of the field name called up by the GetMessage function, the second parameter is not mandatory – it is the field name from AD, the third parameter is not mandatory – it is the field name from LDAP. If the fields are matched, information is taken from them. If the field is empty, no synchronization will take place.  

Field matching table

Bitrix24

Translation (RU) /

Translation ID for function GetMessage

AD

LDAP

Special features

ACTIVE

User active /

LDAP_FIELD_ACTIVE

UserAccountControl&2

UserAccountControl&2


EMAIL

E-Mail /

LDAP_FIELD_EMAIIL

mail

email


NAME

Name /

LDAP_FIELD_NAME

givenName

cn


LAST_NAME

Surname /

LDAP_FIELD_LAST_NAME

sn

sn


SECOND_NAME

Patronymic /

LDAP_FIELD_SECOND_NAME




PERSONAL_GENDER

Sex /

LDAP_FIELD_GENDER



only M or F

PERSONAL_BIRTHDAY

Date of birth /

LDAP_FIELD_BIRTHDAY



DOB format -  01.01.1997 (day.month.year)

PERSONAL_PROFESSION

Profession /

LDAP_FIELD_PROF




PERSONAL_PHOTO

Photo /

LDAP_FIELD_PHOTO

thumbnailPhoto

jpegPhoto

Image size - no more than 100 kilobytes

PERSONAL_WWW

WWW-page /

LDAP_FIELD_WWW

wWWHomePage



PERSONAL_ICQ

ICQ (no translation)




PERSONAL_PHONE

Phone /

LDAP_FIELD_PHONE

homePhone



PERSONAL_FAX

Fax /

LDAP_FIELD_FAX




PERSONAL_MOBILE

Mobile /

LDAP_FIELD_MOB

mobile



PERSONAL_PAGER

Pager /

LDAP_FIELD_PAGER




PERSONAL_STREET

Street, building /

LDAP_FIELD_STREET

streetAddress



PERSONAL_MAILBOX

Mailbox /

LDAP_FIELD_MAILBOX

postOfficeBox



PERSONAL_CITY

City /

LDAP_FIELD_CITY

l



PERSONAL_STATE

Region / Territory /

LDAP_FIELD_STATE

st



PERSONAL_ZIP

Zip code /

LDAP_FIELD_ZIP

postalCode



PERSONAL_COUNTRY

Country /

LDAP_FIELD_COUNTRY

c



WORK_COMPANY

Company name /

LDAP_FIELD_COMPANY

company



WORK_DEPARTMENT

Division / Department /

LDAP_FIELD_DEP

department



WORK_POSITION

Position /

LDAP_FIELD_POS

title



WORK_PHONE

Phone /

LDAP_FIELD_WORK_PHONE

telephoneNumber



WORK_FAX

Fax /

LDAP_FIELD_WORK_FAX

facsimileTelephoneNumber



WORK_PAGER

Pager /

LDAP_FIELD_WORK_PAGER




ADMIN_NOTES

Administrator’s notes /

LDAP_FIELD_ADMIN_NOTES

description



Conclusions regarding informational exchange between Active Directory and Bitrix

Synchronization can work, but it requires additional settings and sometimes maintenance work.  

There is no sufficient information in the documentation, so it is necessary to study problems ‘on the spot’ and set up a lot of parameters (User Filter, Matching User Fields and LDAP attributes, Filter for Groups of Users, Tree Root (base DN)).

Nevertheless, it is a very useful tool for large companies.

Correct operation of the basic module synchronization functionality is ensured only in case of installation on new Bitrix24. When it is to be installed on Bitrix24 which already has previously invited users, a lot of problems arise. They can be solved, but it would be wise to avoid them.    

INTERVOLGA recommends using synchronization when installing new portals.

All synchronization work has been performed to the customer’s satisfaction. If you need to set up synchronization of Bitrix24 and Active Directory, our company will be happy to help you solve this problem.

The labor content of synchronization with Active Directory is from 10 hours.