GCDS (Google Cloud Directory Sync)

Google Cloud Compute Infrastructure
1

Hello,

Can you please help and guide me to answer my Question will be very thankful to you

1). I want to know Does GCDS (Google Cloud Directory Sync) provide User authentication & authorization on GCP or it is done on On-premises Active Directory ?

2). If On-premise is Down GCDS will work or not means GCDS will provide User authentication & authorization ?

3). As GCDS is providing synchronize services i.e. User, Groups, User profiles, Shared contacts etc. so Does GCDS provide AD local Computer sync or not to GCP ?

2

  1. By itself, no it does not, GCDS is a synchronisation tool that replicates identity configuration into Cloud Identity. See: https://support.google.com/a/answer/106368?hl=en - You can then use Cloud Identity to perform authentication directly in the cloud using password sync (see: https://support.google.com/a/topic/2611858?hl=en&ref_topic=7293935). Or you can optionally use it in conjunction with Single Sign On with Active Active Directory Federation Services (or other 3rd party IdP) if you need, see: https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction

  2. If on premises access to active directory is down then GCDS will no longer be able to synchronise changes into Cloud Identity - for example group membership changes. If you are using Cloud Identity directly for authentication, then authentication should continue to work. If however you have federated with ADFS for SSO, then if connectivity to ADFS is interrupted then at this point authentication would be interrupted also.

  3. I am not 100% clear on this question, do you mean AD computer objects? In which case, no, these are not replicated as they are not relevant in Cloud Identity, see here to see what is replicated: https://support.google.com/a/answer/6120130?hl=en&ref_topic=2679497

2 Likes
3

Hi Alexmore,

So many thanks for your kind reply and for replying to all my questions professionally and with reference i am so satisfied with your answer.

Regarding my Last Question, you correctly understand i was asking about AD computer objects that it is also transfer from On-Premises to GCP, So it means that GCDS doesn’t transfer all AD computer objects from On-premises to Google Cloud ?

abrarbilalkhan_3-1655990134116.png
abrarbilalkhan_3-1655990134116.png604Ă—280 17 KB

4

So if GCDS doesn’t transfer all AD computer objects from On-premises to Google Cloud then what is the alternative solution ?, we have a lot of AD computer objects on our On-premises so what is the solution to transfer it to GCP ?, if we cannot transfer our AD computer objects from On-premises to Google Cloud then it will be very hard to implement our GCP solution, kindly please guide how we can transfer all our AD computer objects from On-premises to Google Cloud ???

5

I also want to know Do GCDS also transfer Windows Server GPO to GCP ?

6

I understand from your point that GCDS is a synchronization tool it doesn’t provide User authentication & authorization on GCP side for User authentication & authorization on GCP it is only provided by Cloud Identity ???

7

2.) As you told If on-premises access to the active directory is down then GCDS will no longer be able to synchronize changes,

i). Suppose we are using User authentication & authorization from our AD On-premises and we have an Additional Domain Controller as well so when our AD in our on-premises is down then please guide me what will be the alternative solution who will do User authentication & authorization.

ii). Secondly Suppose if our AD On-premises is done and we don’t have an Additional Domain Controller as well and in our On-premise all Users were connected to AD if AD is down and there is no User authentication & authorization due to this all Users are sitting to access the services then what do you suggest after AD is down who can we make the decision of User authentication & authorization so that our work doesn’t distrub ?

8

Hi am trying to configure gcds with password sync , gcds sync is working fine. But password sync is not working while checking the logs its waiting for password update

Note: we are not using service account , am using mu account since am domain admin