Source
r/k12sysadmin•
ZeroAccess

How do you provision accounts and have all of the passwords in sync? I usually go AD to Google, but I'd like to go Google to AD this year.

In a normal year we have every kid use a domain PC and login with a generic account to change their password, which then syncs to Google. Our O365 syncs with AD, but we barely use it, it just exists - I don't think we have the right licensing for anything fancy.

Next year we'd like to bring the new students in early to pick up chromebooks, login to their chromebooks to change their passwords, and then have that sync back to AD. Is this possible? I only want it the first time, then I can continue using GAPS once they are in school to go from AD to Google instead.

Posted May 20, 2021, 12:52 PM UTC

2143
belt-plus-suspenders•

Not possible; Google does not recognized AD's 'password must change at next logon' flag and can't write back to AD.

We have on-prem AD and also use O365 and Google with GSPS (or whatever it's called today).

We sync from AD to Google and AD to O365. We send students to the O365 password reset portal (https://login.microsoftonline.com), which forces students to change their password at logon and syncs back to AD, then to Google. I created a simple Kiosk app for this webpage, so nobody has to log into a device first. You could also do a Guest Session and force open the browser to Microsoft's login site.

Alternatively, in the past we've provided temp passwords (based on a formula so they're unique) and the students are required to change it by a given date in the future.

9
js312Tech Director•

I'm in the process of doing this (once MS actually assigns the licenses I own to my O365), and the kiosk app for password resets is a great idea!

1
[deleted]•

[deleted]

1
belt-plus-suspenders•

Essentially, yes. I used the 'Chrome App Builder". Steps are here.

The caveat is that in order to publish an app, you must own or at least be able to verify the domain where the app (more specifically, the URL to the app) points. So you can't publish an app that's a direct link to a Microsoft page, for example.

To get around that, I host a redirect for the app on our website.

So for example, I create an app that points to www.school.org/password-reset.html

On the web server, I create 'password-reset.html' file that's a simple redirect to the intended destination. Like this:

<HTML> <HEAD> <META HTTP-EQUIV="refresh" CONTENT="0;URL=https://whatever.url.you.want"> </HEAD> </HTML>

These apps are only published privately within our domain. I'm sure they would get taken down quickly if they were public. Also worth noting that Chrome apps will be going away in the near future, so there's that.

1
[deleted]•

[deleted]

1
belt-plus-suspenders•

They're moving to what they call Progressive Web Apps (PWA).

1
cardinal1977•

Our workflow is SIS>AD>Google. I also have not found a way to go from google to AD.

I outsourced to a 3rd party app/service, we default to a password based on initials and id #. The teachers have a password portal to look up students and reset to that default. We also run a batch reset the week before school. I dont have anything to do with passwords anymore.

The app writes to AD and then google password sync takes it from there. Now that we are 1to1 chromebooks, they are looking at writing directly to google.

5
bex-ac•

Our MIS/SIS automatically provisons our Google users for us so I've been trying to see if i get my Google users into AD with little luck.

Most places prompt you to move to using GCPW to login to windows, but we have other software that uses AD authentication so it we need the users in AD anyway.

I think i found a powershell script somewhere that uses GAM to get the Google usernames into AD but this can't get the passwords or keep them in sync.

I have thought about the O365 hybrid solution, getting the Google users into O365 and then propogating into our local AD, but I don't think that's possible either and we only have the free licencing.

I'd be VERY interested to know if you get anywhere with this!

3
[deleted]•

[deleted]

1
jay0lee•

There is no method to push the Google password down to AD. What you'd need is a web service that handles password changes for users and syncs the new password to both Google and AD. There are various self service password tools that should be capable of this or with a bit of scripting you can roll your own.

3
[deleted]•

[deleted]

3
ScurroNetwork Administrator•

handles password changes for users and syncs the new password to both Google and AD.

I use office 365 authentication passthrough along with Google password sync.

I tell users offsite to change their password via office.com. Because the authentication is passthrough, the exchange happens on our local AD servers which is then caught by the Google password sync.

2
[deleted]•

[deleted]

1
ScurroNetwork Administrator•

You have to have it set up as authentication passthrough. Basically office 365 uses your AD servers for authentication instead of Microsoft's. Because of this, any password changes will be picked up by Google's password sync if you have it installed on your AD servers.

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-pta

It should come with the licenses you get with education.

2
[deleted]•

[deleted]

1
FloppyDumpsterSysadmin For Fun (K-12)•

I don't think this is possible. Last I checked, there's no way to retrieve passwords from Google in any format.

Our setup goes SIS --(daily csv export)--> Webapp --(API/LDAPS)--> GSuite|O365|AD.
The webapp is a custom one that I wrote that serves as an account management hub for our tech department and our users.

2
hightechcoordTech Dir•

SIS > AD > Google and Azure

2
csoupbos•

We were looking to do this exact scenario and implemented it at the start of this year using Azure AD and SAML SSO. We distribute Chromebooks to students and they sign in and change their password right at the Chromebook sign in screen through SAML.

In essence, we create all accounts in on prem AD via a Powershell script (pulling from SIS). Google Directory Sync creates the student accounts in Google Workspace, Azure AD Connect creates the accounts in M365. We use Azure as the SAML IDP and Google as an SP. Requires an Azure AD P1 license or higher (included with M365 A3 licenses).

2
Peally23•

Just force their passwords to be something known and have the staff distribute the passwords to the students after you provide a CSV. Having them set their own seems like a big time waster.

I believe Google to AD is possible as I've looked into it before, but it was a clusterfuck compared to the simplicity of AD to Google so I dropped the idea quite rapidly.

1
[deleted]•

[deleted]

2
Rykas•

Speaking from experience it works nicely. Our entire student body has fixed passwords we set.

The first half is a word, our district, the second half is their individual lunch code. A code everyone knows not to share to begin with. Now everyone has a unique and strong password that no one wants to share.

Our lives are easier for it, teachers appreciate knowing it and knowing they can figure it out easily enough since they typically forget we share an up to date master spreadsheet with them.

What's your first few days each school year look like? A mile long line of kids that forgot their password over the summer? That was crippling for our small team and now we don't have that issue.

2
[deleted]•

[deleted]

3
Rykas•

Dang Gina, your administration wants to give them more freedom!? XD ours is currently discussing taking away email from an entire building lel

I'm with you I wouldn't store it in the SIS either. We use the Employee ID field in AD for just the number part. Then with the help from powershell we piece all the info together from SIS and AD to make a spreadsheet.

Took me awhile to come around to the idea as well. I came from IT in corporate America where such a thought would have been grounds for firing let alone laughed and mocked at. But in the education sector, I've found some of those worries aren't actually worth it. Communication and expectations are key when delivering such a solution. The kids understand big brother is watching and they also understand that if they log on with each others accounts to screw around they also get in trouble. Sharing passwords means giving away your parents money they gave you for lunch. The idea has a built in safety net honestly.

Privacy - they're kids, yes they deserve it. But in a public setting such as this it is more of a privilege. Do you have systems to monitor their activities like Bark? Or if you're google you have the vault. We're not digging unless there's a reason to. First and foremost they are here to learn and grow and have some fun along the way. But with some monitoring, no?

Security - student accounts should be so locked down that this should never be a worry. Even if the passwords are known or shared its to an account that can't even open command prompt or traverse file explorer. And even with your efforts on security, how many times have you seen a sticky note taped down on a laptop with account information, or to a monitor, or my favorite written on a white board >.<

Hopefully this helps broham, wishing you the best in whatever decision you guys make.

1
CaliCanadian67•

We use a provisioning service, but are changing that to make changes easier and quicker, that creates our AD/GWorkspace accounts. We also use ClassLink as a front end for our apps and that allows us to have users, including students, to reset their AD password which rolls to Google since that is what most of the teaching occurs thru now anyway.

Our lower grades don’t change their passwords but we do allow 6-8 to and with a high school on the horizon, they will as well. The self-reset is new, took some time to tweak, but has worked a treat since.

1
TwistedHelixis•

In the UK we have a few tools that provision users from our MIS

I am in the process of looking at https://locker.co.uk/

It takes the users from our MIS and then creates accounts + passwords in both Google & AD, along with groups and also creates Google Classrooms for the pupils and teachers. It can do more but that is all we need.

1
Skippyde•

Another vendor to look at is Salamander. They offer quite a few things.

2