Exchange 2010 Free/Busy Interop

System Requirements

• Windows Server 2008 with SP2/ Windows Server 2008R2 with Exchange 2010 SP2. [Tested using Typical install of Exchange 2010]
• Zimbra Collaboration Suite 6.x or later.

Note:- In the following procedure we will consider '@exchange10.lab' the domain of the users on Exchange 2010 server and '@zimbra.lab' is the domain of the users on Zimbra server.

What we need from Exchange 2010 Server So We Can Configure Zimbra Server

• Create a service account on MS Exchange 2010 server, which will be used in configuring the Free/Busy Interop setting on ZCS server.
• Create a new user account that will be used for the Exchange Server Service Account; this user must be a member of the Local Administrators Group on the local server.
• Assign the following permissions to the account:
  • Act as part of the operating system.
  • Logon as a service.
  • Restore Files and Directories.
  • Assign the same password as the current service account.

Note:- Service account name that we will use during this procedure is 'Interop2010'.

• Ensure that this Service Account 'Interop2010' can update Exchange Free-Busy folder. You may do this by using the following EMS Command:-

[PS] C:\> add-publicfolderclientpermission -identity "\NON_IPM_SUBTREE\SCHEDULE+ FREE BUSY\EX:/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)" –user interop2010 -accessrights owner

• Make sure your server have a commercial certificate or if a self-signed certificate is installed on your server you need to export the CA ROOT certificate from Exchange server.
  • In case of commercial certificate, no need to export anything as ROOT certificate of commercial certificate will be deployed on Zimbra server.
  • In case of Self-Signed certificate deployed on your server you need to export the CA ROOT certificate and import it on Zimbra Server so Zimbra Server can identify the Certificate. For that you need to do following steps:-
    • On Exchange server, Go to Start->Run->mmc
    • On the popup windows go to File->Add/Remove Snap-in...
    • Select Certificates from Available Snap-in and click on Add.
    • On the popup window select 'Computer account' and click Next->Next->OK
    • Certificate(Local Computer) will be added in MMC. Now, expand Certificate->Personal->Certificates and you will see a root CA certificate on right side.
    • Select the certificate, right click->export and proceed with exporting of certificate, make sure you export the certificate in 'DER encoded binary x.509(.CER)' format.

Note:- You will have to copy this exported .CER file to Zimbra server, you can use WinSCP for this or you can use any other medium to copy this file to Zimbra Server.

• 'legacyExchangeDN' attribute value, which we will need to configure Free/Busy interop on Zimbra Server, Use the ADSIEDIT tools on the AD/Exchange server find this. You may find out the legacyExchangeDN by following this method.
  • On the AD/Exchange Server, click START > Run > Type adsiedit.msc
  • Select your Domain’s Node and expand the tree until you reach the node “CN=Users”. Now expand this node to find the container “CN=<Your Service Account Name>” (e.g. “CN=interop2010”).
  • Right click this container and select “Properties” to open the properties screen.
  • Scroll down on the Popup window to locate the legacyExchangeDN attribute. Click on “Edit”
  • From the “String Attribute Editor” window obtain (copy) the part of the string appearing before “/cn=Recipients/cn=interop2010”. The copied string should look something like “/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)”.
  • Close all the windows, keep in mind not to modify any attribute values appearing in the ADSIEDIT Interface.

Note:- Keep the string safe; we will use it further down to configure the Zimbra System.

Steps To Do On Zimbra Server To Configure Free/Busy Interop So Zimbra Users Can View Free/Busy Information Of Exchange 2010 server User

You can configure Free/Busy interop on Zimbra Server using Admin Console OR using Command Line, we will cover both below

• First way using Admin Console:-
  • Login to Admin Console using Global Administrator and go to Global Settings->Free/Busy Interop tab.
    • Here you will have to fill the data in each field:-
    • Microsoft Exchange Server URL : This is the web URL to the Exchange Web Services (e.g https://exchange-server/ews/exchange.asmx)
    • Microsoft Exchange Authorization Scheme: Select Basic from the dropdown menu, currently we only support 'Basic' Authentication with Exchange 2010.
    • Microsoft Exchange Server Type: Select EWS from the dropdown menu, as we are configuring the Free/Busy Interop for Exchange 2010 we need 'EWS', 'WebDAV' is not supported on Exchange 2010.
    • Microsoft Exchange User Name and Password: This is the user credentials of service account that we created on Exchange server i.e interop2010@exchange10.lab.
    • O and OU used in legacyExchangeDN attribute: Value of this will be the value copied from legacyExchangeDN attribute value, which must be like /o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT).
    • Save the setting, and then click on Check Settings to confirm if the settings are working or not, you must see Check OK.
  • Now, if your Exchange server is running on Self-Signed Certificate then you will get SSL_HANDSHAKE_FAILED error when you click on Check Settings, for this you will have to deploy the CA ROOT Certificate on Zimbra server.
  • We have already exported the CA ROOT Certificate in Step 2 in 'Steps To Do On Exchange 2010 Server' section, and had copied that on Zimbra server say on '/root' folder.
  • You need to deploy this using following command, you will also need to restart Zimbra MailboxD service so the CA is recognized using and then check the settings using 'Check Setting' button:-

# cd /root
# /opt/zimbra/bin/zmcertmgr addcacert exchange.cer
# su - zimbra
$ zmmailboxdctl restart

were exchange.cer is the certificate that we exported from Exchange server.

• Second way using Command Line:-

$ zmprov mcf zimbraFreebusyExchangeURL 'https://exchange-server/EWS/exchange.asmx' \
zimbraFreebusyExchangeAuthUsername 'interop2010@exchange10.lab' zimbraFreebusyExchangeAuthPassword '<password>' \
zimbraFreebusyExchangeAuthScheme 'basic' zimbraFreebusyExchangeServerType 'ews' \
zimbraFreebusyExchangeUserOrg '/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)'

Note:- There is no way to test the setting in command line as we can do in GUI, so once you issue the command, to test the settings you will have to go to the Admin Console->Global Settings->Free/Busy Interop and click on Check Settings.

At this point, login to Zimbra Web Client and create a event and add one exchange user in the attendee list and you must be able to see the free/busy information of that Exchange user.

Steps To Do On Exchange 2010 Server So Exchange Users Can View Free/Busy Information Of Zimbra Server User

• Make Exchange 2010 server aware of the presence of “Public Folders” in the Zimbra domain. You may do this by using the following EMS Command:-

[PS] C:\> Add-AvailabilityAddressSpace -forestname zimbra.lab -accessmethod publicfolder

• Create a "Zimbra" OU in Active Directory. Make sure all your Zimbra users are created as “Exchange 2010 Mail Contact Objects” in this OU. As a BEST PRACTICE, to reduce the risk of a collision in namespace a suffix can be added to denote a Zimbra account (i.e. “_zimbra”). You may create a this user by using the following EMS Command:

[PS] C:\> New-MailContact -ExternalEmailAddress 'SMTP:user@zimbra.lab' -Name 'user_zimbra' -Alias 'user_zimbra' -OrganizationalUnit 'exchange10.lab/Zimbra' -FirstName 'user_zimbra' -Initials  -LastName 

• For each of the mail-contact objects that you create here, set one of the available/not-set “Exchange Extension Attributes (extensionAttribute1 to extensionAttribute15)” to an optional tag (say “_zimbra”).
  • On the AD/Exchange Server, click START > Run > Type adsiedit.msc
  • Select your Domain’s Node and expand the tree until you reach the node “CN=Zimbra”. Now expand this node to find the container “CN=user_zimbra”.
  • Right click this container and select “Properties” to open the properties screen.
  • Scroll down on the Popup window to locate the extensionAttribute1 attribute. Click on “Edit”
  • Under Value field you will see <not set>, delete that and enter '_zimbra' and click 'OK' to set this value.
  • As you have opened this property window also locate 'legacyExchangeDN' attribute and make sure the value is something like '/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=use_zimbra', sometime you may see some value at the end of 'cn=user_zimbra', something like '/cn=user_zimbra 13b' or something else, edit and make sure the the value is only '/o=First Organization/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=use_zimbra'
  • Close all the windows and close ADSIEdit.msc.

Exchange configuration part is over at this point, now we need to make sure Zimbra Server is ready to POST Free/Busy Information in Exchange 2010 Servers Public Folder so Exchange can pick it up and display when user do a Free/Busy lookup.

What we need from Zimbra Server So Exchange 2010 Server Users Can View Free/Busy Information Of Zimbra Server Users

• On Zimbra Server, we need to do only one setting and that is adding an attribute 'zimbraForeignPrincipal' for each user, value of this attribute must be the user name of a contact that exists on Exchange Server. In 'Steps To Do On Exchange 2010 Server So Exchange Users Can View Free/Busy Information Of Zimbra Server User' section above we created a mail contact for each Zimbra user, which is 'user_zimbra', we need to use this value to configure 'zimbraForeignPrincipal' attribute on Zimbra server, you can do this using following command:-

$ zmprov ma user@zimbra.lab zimbraForeignPrincipal ad:user_zimbra

Once you set this attribute for a user, ask user to create one appointment in his mailbox from Zimbra Web Client and look at /opt/zimbra/log/mailbox.log. You'll see a request made to a URL that looks like this:- http://<exchange URL>/public/NON_IPM_SUBTREE/SCHEDULE%2B%20FREE%20BUSY/EX:_xF8FF_o=First%20Organization_xF8FF_ou=First%20Administrative%20Group/USER-_xF8FF_cn=RECIPIENTS_xF8FF_cn=user_zimbra.EML

This line means that the Free/Busy information for the user is posted on Exchange 2010 Server in Public Folder and can be viewed on Exchange Server when you invite 'user_zimbra' contact in attendee list.

'user_zimbra' is a contact on Exchange Server who's mail address is 'user@zimbra.lab'.

Configure GAL On Zimbra and Exchange Server So Users On Both Server Can Easily Locate And Add The Attendees While Creating Appointment

• For Exchange Server there is nothing to configure as we have already created a Mail Contact for each Zimbra User in AD and that will be visible when you check GAL while adding Attendees in appointment.

• For Zimbra Server we will have to configure External GAL so that users can locate Exchange Users and add then as an attendee in appointment.

Please See

Zimbra Tech Center

Certified

Exchange 2010 Free/Busy Interop

Gal Sync Account

 - This article is a Work in Progress, and may be unfinished or missing sections.

Description

Enabling a GAL sync account will permit browsing and paging of the global address list when selecting contacts during message composition with the Zimbra web client. Contact data from Zimbra's internal GAL and external sources can be synced to the account. The galsync account is a resource account and does not consume a Zimbra license.

To setup an account properly for sync, there must be

• A GAL sync account
• An internal or external datasource on the GAL sync account.

Setting Up Internal GAL Sync

For the internal setup, the internal datasource is automatically created when using the following steps.

Admin Console

1. In the server admin console, select a domain for GAL sync under "Domains".
2. Click "Configure GAL".
3. Set "GAL mode:" "Internal".
4. Enter a value for "Most results returned by GAL Search".
5. Enter a new account name for "GAL sync account name".
6. Set "Datasource" name to InternalGAL.
7. Enter a GAL polling interval. The GAL polling interval is the time between syncs to the internal LDAP.
8. Next, then Finish.
9. To force sync, go to the CLI and use zmgsautil

zmgsautil forceSync -a galsync@domain.com -n InternalGAL

Command Line

ZCS 8

ZCS 8 adds the server (-s) option to designate which Zimbra mailstore where the GAL sync account will reside. This argument is required. Each mailstore in the environment can have at most one GAL sync account per domain.

zmgsautil createAccount -a galsync@domain.com -n InternalGAL --domain domain.com \ 
-s server.name -t zimbra -f _InternalGAL
zmgsautil forceSync -a galsync@domain.com -n InternalGAL

ZCS 6/7

zmgsautil createAccount -a galsync@domain.com -n InternalGAL --domain domain.com -t zimbra -f _InternalGAL
zmgsautil forceSync -a galsync@domain.com -n InternalGAL

Setting Up External GAL Sync

Every domain in the Zimbra installation can have a single Active Directory or external LDAP GAL configuration. The first external datasource for the galsync account will use the external LDAP or Active Directory GAL configuration. Additional datasources require the configuration for the external source to be within the datasource itself. For example, consider this external GAL configuration for AD:

## Get Domain
zmprov gd domain.com | grep -i gal
zimbraGalLdapBindDn: CN=galsync, OU=Service Accounts, OU=Servers, DC=Corp, DC=domain, DC=com
zimbraGalLdapBindPassword: thePassword
zimbraGalLdapFilter: ad
zimbraGalLdapPageSize: 1000
zimbraGalLdapSearchBase: DC=Corp, DC=domain, DC=com
zimbraGalLdapURL: ldap://ds1.corp.domain.com:3268
zimbraGalMaxResults: 100
zimbraGalMode: both
zimbraGalSyncInternalSearchBase: DOMAIN

## Get Datasource 
zmprov gds galsync@domain.com
# name ActiveDirectoryGAL
# type gal
objectClass: zimbraDataSource
objectClass: zimbraGalDataSource
zimbraCreateTimestamp: 20090728211318Z
zimbraDataSourceEnabled: TRUE
zimbraDataSourceFolderId: 257
zimbraDataSourceId: 4c94f205-43fb-4706-a13b-8ce64eadde4e
zimbraDataSourceName: ActiveDirectoryGAL
zimbraDataSourcePollingInterval: 1d
zimbraDataSourceType: gal
zimbraGalLastFailedSyncTimestamp: 20090818071009Z
zimbraGalLastSuccessfulSyncTimestamp: 20090925155938Z
zimbraGalStatus: enabled
zimbraGalType: ldap

The ActiveDirectoryGAL datasource uses the GAL configuration stored in the domain's GAL configuration attributes.

Admin Console

1. Specify "GAL mode:" as one of "External" or "Both".
2. Choose a datasource name. E.g., ActiveDirectoryGAL or ExternalGAL.
3. Enter a polling interval.
4. Specify "Server type" and configure the the rest of the external GAL settings.

Command Line

If the external GAL was configured on the command line, or is already configured without a datasource, zmgsautil can be used to setup the external LDAP datasource. If the galsync account is being created for the first time and external GAL is configured, the datasource will be setup with the zmgsautil createAccount command.

ZCS 8

ZCS 8 adds the required server (-s) option. Each mailstore server can have at most one GAL sync account.

zmgsautil createAccount -a galsync@domain.com -n ExternalGAL --domain domain \
-s mailstore.server.name -t ldap -f _ExternalGAL

ZCS 6/7

zmgsautil createAccount -a galsync@domain.com -n ExternalGAL --domain domain -t ldap -f _ExternalGAL

Adding Additional Datasources

Additional datasources are configured with the zmgsautil tool and the createAccount sub command. This creates an additional datasource on the galsync account and does not overwrite the account. Specific values for the datasource URL, bind DN, bind password and search base are then provisioned with zmprov.

• Retrieve current datasources for the galsync account.

## Get Datasource 
zmprov gds galsync@domain.com
# name ActiveDirectoryGAL
# type gal
objectClass: zimbraDataSource
objectClass: zimbraGalDataSource
zimbraCreateTimestamp: 20090728211318Z
zimbraDataSourceEnabled: TRUE
zimbraDataSourceFolderId: 257
zimbraDataSourceId: 4c94f205-43fb-4706-a13b-8ce64eadde4e
zimbraDataSourceName: ActiveDirectoryGAL
zimbraDataSourcePollingInterval: 1d
zimbraDataSourceType: gal
zimbraGalLastFailedSyncTimestamp: 20090818071009Z
zimbraGalLastSuccessfulSyncTimestamp: 20090925155938Z
zimbraGalStatus: enabled
zimbraGalType: ldap

• Optionally create a new contact folder in the galsync account to store the GAL with zmmailbox.

zmmailbox -z -m galsync@domain.com createFolder --view contact /_AnotherGAL
257

• Add new datasource with zmgsautil addDataSource.

zmgsautil addDataSource -a galsync@domain.com -n AnotherGAL --domain domain.com -t ldap -f _AnotherGAL -p 1d

• Configure the newly created AnotherGAL datasource with the proper server and authentication credentials. Not performing this step will result in the datasource inheriting the GAL configuration from the domain.

zmprov mds galsync@domain.com AnotherGAL \
zimbraGalSyncLdapBindDn uid=zimbra,cn=admins,cn=zimbra \
zimbraGalSyncLdapBindPassword thePassword \
zimbraGalSyncLdapFilter '(&(mail=*)(zimbraAccountStatus=active)(!(zimbraHideInGAL=TRUE)))' \
zimbraGalSyncLdapSearchBase dc=anotherdomain,dc=com \
zimbraGalSyncLdapURL ldap://ldap.anotherdomain.com:389 \

• Finally, show all datasources for the galsync account.

zmprov gds galsync@domain.com 
# name ActiveDirectoryGAL
# type gal
objectClass: zimbraDataSource
objectClass: zimbraGalDataSource
zimbraCreateTimestamp: 20090728211318Z
zimbraDataSourceEnabled: TRUE
zimbraDataSourceFolderId: 257
zimbraDataSourceId: 4c94f205-43fb-4706-a13b-8ce64eadde4e
zimbraDataSourceName: ActiveDirectoryGAL
zimbraDataSourcePollingInterval: 1d
zimbraDataSourceType: gal
zimbraGalLastFailedSyncTimestamp: 20090818071009Z
zimbraGalLastSuccessfulSyncTimestamp: 20090925155938Z
zimbraGalStatus: enabled
zimbraGalType: ldap

# name AnotherGAL
# type gal
objectClass: zimbraDataSource
objectClass: zimbraGalDataSource
zimbraCreateTimestamp: 20090729085331Z
zimbraDataSourceEnabled: TRUE
zimbraDataSourceFolderId: 25212
zimbraDataSourceId: 1fb50a98-7168-4ade-98e0-fccd414047a2
zimbraDataSourceName: AnotherGAL
zimbraDataSourcePollingInterval: 1d
zimbraDataSourceType: gal
zimbraGalLastSuccessfulSyncTimestamp: 20090925124604Z
zimbraGalStatus: enabled
zimbraGalSyncLdapBindDn: uid=zimbra,cn=admins,cn=zimbra
zimbraGalSyncLdapBindPassword: thePassword
zimbraGalSyncLdapFilter: (&(mail=*)(zimbraAccountStatus=active)(!(zimbraHideInGAL=TRUE)))
zimbraGalSyncLdapPageSize: 100
zimbraGalSyncLdapSearchBase: dc=anotherdomain,dc=com
zimbraGalSyncLdapURL: ldap://ldap.anotherdomain.com:389
zimbraGalType: ldap

The server providing data to the AnotherGAL datasource just happens to be an external Zimbra server, but could be any other LDAP or AD. Be sure to use zimbraGALType ldap and not zimbra if the external LDAP is Zimbra. The zimbra GAL type is reserved for the internal GAL only.

External Contacts From Active Directory

Multiple datasources can be specified for external contacts which contain email addresses with domains not homed on any Zimbra servers; e.g., vendor accounts, outside affiliates, etc. As of this time of writing, external contacts for GAL can only be managed by external datasources. See bug 29697.

zmgsautil createAccount -a galsync@domain.com -n ExternalContactsGAL --domain domain.com -t ldap -p 1d
zmprov mds galsync@domain.com ExternalContactsGAL \
> zimbraGalSyncLdapBindDn zimbra@corp.domain.com \
> zimbraGalSyncLdapBindPassword thePassword \
> zimbraGalSyncLdapFilter "(&(objectClass=contact)(mail=*))" \
> zimbraGalSyncLdapSearchBase dc=corp,dc=domain,dc=com \
> zimbraGalSyncLdapURL ldap://ds1.corp.domain.com:3268 \

Troubleshooting

GAL paging or external GAL sync is not functioning with multiple datasources

Verify zimbraDataSourceEnabled is not FALSE for any one datasource. If one datasource must be disabled, then it should be deleted.

GAL search skips the first external GAL DS in the galsync account

Make sure zimbraGALMode is set to both on the domain. Remember, the first external DS on the galsync account inherits the external GAL settings configured for the domain. See bug 41321.

zmprov md domain.com zimbraGALMode both

GAL contains duplicate entries

If multiple datasources are specified, galsync can grab duplicates if the search scope overlaps. Duplicates will not be reconciled. Open the galsync account from the admin console and find out which contact folders are holding the duplicated entry. Refine the search base on the datasource and force another sync with zmgsautil.

GAL does not contain all entries from Active Directory

Have a look at the mailNickname attribute in Active Directory for the missing entries. This attribute is required in the default AD filter in Zimbra. Please see Zimbra bug 11562. As a workaround, it is safe to remove the mailNickname requirement by designating zimbraGalLdapFilter on the domain or datasource.

Get the default for the AD search filter

zmprov gcf zimbraGalLdapFilterDef | grep ad:

Insert this value into zimbraGalLdapFilter for the domain or datasource

(&(|(displayName=*%s*)(cn=*%s*)(sn=*%s*)(givenName=*%s*)(mail=*%s*))(!(msExchHideFromAddressLists=TRUE))(|(&(objectCategory=person)(objectClass=user)(!(homeMDB=*))(!(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=user)(|(homeMDB=*)(msExchHomeServerName=*)))(&(objectCategory=person)(objectClass=contact))(objectCategory=group)(objectCategory=publicFolder)(objectCategory=msExchDynamicDistributionList)))

The above filter just omits the (mailnickname=*) portion of the default filter. Changing the default AD filter in global config is not recommended.

Also, make sure auto-complete works as expected. You may need to set zimbraGalAutoCompleteLdapFilter on the domain or GAL sync account datasource as well.

Unable to search for resources by site, building, etc.

This can happen if the GAL is external and resources are local.

• Make sure zimbraGalAlwaysIncludeLocalCalendarResources is TRUE. zimbraGalAlwaysIncludeLocalCalendarResources is a global and domain attribute.
• A force sync of the GalSync account is needed for this attribute to take effect (Ex: zmgsautil forceSync -a galsync@example.com -n InternalGAL)
• In some instances, the attribute mappings for searchable fields could be missing. Check for these attribute maps in the global and domain configuration:

zimbraGalLdapAttrMap: zimbraCalResBuilding=zimbraCalResBuilding
zimbraGalLdapAttrMap: zimbraCalResCapacity,msExchResourceCapacity=zimbraCalResCapacity
zimbraGalLdapAttrMap: zimbraCalResFloor=zimbraCalResFloor

• If something is missing, add the attribute map.

zmprov mcf +zimbraGalLdapAttrMap zimbraCalResBuilding=zimbraCalResBuilding

• Remove the target galsync datasource where resources reside.
• Delete the contact folder for the datasource from the galsync account.
• Create a new datasource for resources in the galsync account.
• Perform a full sync of the datasource.

References

Forums: GAL Browsing
Bug 29697 External (non-Zimbra) addresses in GAL IPhone Developers

Once you finish this step users in Exchange 2010 Server will be able to see Free/Busy Information of users residing on Zimbra Server and vice-a-verse.