ADMS

[Kelvin Maine]

Good Morning

Appreciate the feedback regarding the transition from KDMS to ADMS. As of the beginning of Term Three this service has become our responsibility.

Last week we released the 1.0.18.1 patch which fixed some of the outstanding bugs that had been identified. Barring any critical issues, this will be the last release of this version of the software and we will continue to support it for free in 2016. We are doing this as a continuation of the understanding whereby the product was provided by KAMAR at no cost. This version will exist unsupported after 2016.

Going forward for 2017, we have plans for new version (v2) where new features and feature requests will be considered and implemented. This will be released in December and pricing will be available shortly for budgeting. This will include all bug fixes, support and future releases as well as supporting the continued developments and improvement of the product.

All bug and feature requests for v2 will be documented and publicly available on the Bugs and Features page in our Help Centre. For future updates about features and new releases please add your name to this mailing list.

We are dedicated to improving this service and making it the best it can be for all NZ schools. If you would like support, all the existing documentation for v1 is available on our Help Centre or you can email us at he...@ited.co.nz.

Regards,

Kelvin Maine
ITed Services Limited

e: kel...@ited.co.nz
w: www.ited.co.nz 
p: +64 27 4786 528

[Alistair Baird]

First of all, you could fix the Bugs and Features page to actually load a form (in Google Chrome) we can fill in before we are asked to rate it....

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Alistair Baird

IT Manager

St Peters College 

p 06 354 4198

m 021 990 259

e bai...@stpeterspn.school.nz

[Landyn Frisby]

What you are saying here does not seem to fit in with what Kamar are saying? 

https://www.kamar.nz/105606

As part of this agreement, ITed will:

• Maintain and develop the Directory Management Service
• Continue to provide the software at no cost to KAMAR schools
• Provide support for the service at their standard support rates

Additionally the pricing seems rather steep when you consider how much Kamar does and its pricing. It does not seem to be based on standard ITED pricing but rather a per student license fee. 

Anyone paying for this service, anyone see it being worth the cost? Does Kamar know about this? It feels like schools are being held to ransom here any pay vast sums for a service that has always been included. It would be more cost effective to simply pay a developer to write our own program! (we have done it before).

[Andrew Godfrey]

We are still using version 1 which continues to work well.

Andrew Godfrey  |  Network Manager

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

[Landyn Frisby]

As are we, I see Kamar just changed the wording on their site (probably after reading this) to;

• Continue to provide the existing version 1.8 software at no cost to KAMAR schools

So I can see the day when Kamar will change something which will break 1.8 and then schools will be forced to pay just to get the service to sync again. seems legit....

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

[Grant Saul]

We were using Kdms, but started getting errors and incomplete syncs without explanation. In the end we felt that we were left with an unsupported product and therefore did not have much option but to switch over to ADMS.

Regards

Grant Saul

Westlake Boys High School

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Landyn Frisby]

It would be nice if this service used a documented API. My point of view is this agreement with ITED does seem rather anti competitive

You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/U23LTJKp_nA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Kind Regards,

Landyn Frisby

ICT Systems Engineer

[Sheldon Lendrum]

From what I understand ADMS uses the well documented KAMAR Directory Service.
From what I've seen there are a few options from Kdms, Adms, isometric solutions have a service called bridge or on this mail list some roll your own Php scripts when we have used/customised in a 2000+ student school.

Your paying for a supported/updated service in ADMS, or there are other options. I don't see that as anti competitive...

[Jake Wills]

I've written an open source alternative on PHP... it doesn't do anything with passwords, but does sync all users, groups and create new users.
https://github.com/mathsnz/ADSync
Feel free to take and adapt as needed

[Landyn Frisby]

apologies for my comments. Seems everything is in order and good to see some open source development going on. Thanks Kent for addressing this.

--
You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/U23LTJKp_nA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Simon Wright]

I had been using my own powershell script to fully manage the student account life cycle, which uses the xml output form Kamars directory services API.

I'm now using my own service written in C# which does the same thing and have been beta testing for the past couple of terms which included the roll over at the start of the year and all went well.

At the moment it only works off a full sync and not the individual updates, there are a few other issues i need to work on, but otherwise its working very reliably.

I'm no seasoned programmer and with limited time to spend on it, its been slow going. I do hope to have it to a releasable version later this year for anyone willing to try it.

Regards
Simon Wright
ICT Manager

Best for boys through the right learning
2 Arthur Street, Dunedin, 9016, New Zealand p: 03 477 5527 | f: 03 477 5468 | c: 021 773 229 | w: obhs.school.nz

Respect - Whakaute | Courage - Toa | Honour - Hōnore | Perseverance - Manawanui | Excellence - Hiranga

On 3 April 2017 at 08:40, Landyn Frisby <lfr...@jameshargest.school.nz> wrote:

apologies for my comments. Seems everything is in order and good to see some open source development going on. Thanks Kent for addressing this.

On Mon, Apr 3, 2017 at 8:16 AM, Jake Wills <jake....@kc.school.nz> wrote:

I've written an open source alternative on PHP... it doesn't do anything with passwords, but does sync all users, groups and create new users.
https://github.com/mathsnz/ADSync
Feel free to take and adapt as needed

--
You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/U23LTJKp_nA/unsubscribe.

To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Kind Regards,

Landyn Frisby

ICT Systems Engineer

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

DISCLAIMER
This e-mail is intended for the addressee only and may contain information which is subject to legal privilege. This e-mail message and accompanying data may contain information that is confidential and subject to privilege. Its contents are not necessarily the official view Otago Boys’ High School or communication of the Otago Boys’ High School. If you are not the intended recipient you must not use, disclose, copy or distribute this e-mail or any information in, or attached to it. If you have received this e-mail in error, please contact the sender immediately or return the original message to Otago Boys’ High School by e-mail, and destroy any copies. Otago Boys’ High School does not accept any liability for changes made to this e-mail or attachments after sending.

[Jake Wills]

We would be keen to try out... and happy to help with code to get it working on partial updates if you would like?

Let me know :)

[Daniel Lewis]

Thanks Jake, thought I'd let you know we have been using your base code for a couple of weeks now.  I have modified it to suit us and added in passwords so that students can change their AD/Google password from the kamar web portal.

Daniel, AGGS

[Jake Wills]

Nice... could you share back and I'll update the code on GitHub

Kind Regards,

Jake Wills

co-HOD Mathematics, Head of e-Learning

Kāpiti College

Margaret Road, Raumati Beach 5032

04 902 5121 - 021 061 5390

--

[Kevin Whelan]

Does that mean that kamar will then display/reveal the students password

[Simon Wright]

No, as when a student or parent changes their password via the portal (if enabled), kamar just shows a typical series of dots and says that it was changed by the user.

From here all you can do is generate a new one, should they have forgotten it.

Regards
Simon Wright
ICT Manager

Best for boys through the right learning
2 Arthur Street, Dunedin, 9016, New Zealand p: 03 477 5527 | f: 03 477 5468 | c: 021 773 229 | w: obhs.school.nz

Respect - Whakaute | Courage - Toa | Honour - Hōnore | Perseverance - Manawanui | Excellence - Hiranga

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Kevin Whelan]

weird , when I click on the dots it reveals the password which could be kind of handy when wanting to test network logons etc.
So this is still a one way sync from kamar out, you are managing your network AD passwords from kamar, students can't change their passwords on a network machine through the gui or from office365?

[Jake Wills]

The change password is built into the portal... enabled under Configure - Security...

You can also import passwords into KAMAR

So in *theory* could set up something that took the passwords when they changed and put them into KAMAR so can be viewed... might be worth doing... 

Or we could ask Kent nicely if we can have a push into KAMAR system for the passwords rather than reverse engineering a system involving importing or capturing API pushes.

Kind Regards,

Jake Wills

co-HOD Mathematics, Head of e-Learning

Kāpiti College

Margaret Road, Raumati Beach 5032

04 902 5121 - 021 061 5390

--
You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/U23LTJKp_nA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsub...@googlegroups.com.

[Simon Wright]

Ha, good luck with that, ive asked Kent several times to the point he stopped responding to my emails about it.

I have a tool which captures the password changes the same way google password sync does, just need to do processing around it and an entry point to push in kamar.

Kevin: For us the kamar password is only used in AD as the initial password for the account when created. We currently don't do any further syncing of the password into AD.

Office 365 is sync'd with AD via the Azure sync tool.

Yes, students can their password on a network computer.

Regards
Simon Wright
ICT Manager

Best for boys through the right learning

2 Arthur Street, Dunedin, 9016, New Zealand p: 03 477 5527 | f: 03 477 5468 | c: 021 773 229 | w: obhs.school.nz

Respect - Whakaute | Courage - Toa | Honour - Hōnore | Perseverance - Manawanui | Excellence - Hiranga

To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Kevin Whelan]

Kevin: For us the kamar password is only used in AD as the initial password for the account when created. We currently don't do any further syncing of the password into AD.

Office 365 is sync'd with AD via the Azure sync tool.

Yes, students can their password on a network computer.

thanks that's the same with us basically, there just doesn't seem to any point to add to the users confusion by enabling kamar passwords unless its fully synced.

 currently a password can be reset from a networked machine or from BYOD using the microsoft password reset portal and it works everywhere except the portal which is a pretty minor frustration
maybe oneday when kamar finally runs in a browser

I'm still trying to find the best way of enabling new students each year, currently they have to sign on once to a network machine to choose their AD password first which then enables 802.1x signon for BYOD, office 365 and thereby the password reset portal and every other SSO that is linked.
Haven't come up with a way to enable the whole process to be done on the BYOD device as yet, Temp Open hotspot would get around the 802.1x issue  and get them online but doesn't solve the password problem and that still requires another network change by end user back to 802.1x

[Alistair Baird]

We use Kamar as source of truth for passwords, because the teachers can look up the student's password. If if needs changing, they come see me and I generate or with a bribe, change it to something more meaningful to them, it then updates AD immediately for network logon and wifi, and via SSO is also immediately their new GAFE password.

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

--

Alistair Baird

IT Manager

St Peters College 

p 06 354 4198

m 021 482 937

e bai...@stpeterspn.school.nz

[Daniel Lewis]

I am using shell_exec dsmod to set the password (primitive but works).  For kamar to send the password the receiver needs to be https.  Password is sent as a base64 encoded string (thanks kamar for your help here).

I have attached my version of the process.php file.  We had an existing set of users in AD so I removed a lot from the process.php file to suit our conditions - just the basics - will look to add back in year level groups/subject groups/staff etc.  I have commented on most of my additions but the following are the basics:

get the following info from the json file:

$password=$student['password'];

$resetpassword=$student['resetpassword'];

$networkaccess=$student['networkaccess'];

$accountdisabled=$student['accountdisabled'];

$leavingdate=$student['leavingdate'];

basically act on the settings sent above - I use the company field for feedback in AD.

if ($accountdisabled==1) {

//aggs - account is disabled - update company field and disable account

echo "Disable user ".$cn." \r\n";

$info=array();

$info["useraccountcontrol"] = 514;

$info["company"] = "Disabled ".date("Y-m-d H:i");

if($live=='yes') {ldap_mod_replace($ldapconn, $dn, $info);}

}

if ($networkaccess==0) {

//aggs - contract not signed - update company field and disable account

echo "Disable user ".$cn." \r\n";

$info=array();

$info["useraccountcontrol"] = 514;

$info["company"] = "Agreement ".date("Y-m-d H:i");

if($live=='yes') {ldap_mod_replace($ldapconn, $dn, $info);}

}

if (($accountdisabled==0) && ($networkaccess==1)) {

//aggs - all good, enable account

echo "Enable user ".$cn." \r\n";

$info=array();

$info["useraccountcontrol"] = 512;

$info["company"] = "OK ".date("Y-m-d H:i");

if($live=='yes') {ldap_mod_replace($ldapconn, $dn, $info);}

}

if($resetpassword==1) {

//aggs - reset password (as this is using shell the account running process.php will need permissions)

echo 'EXECUTE: dsmod user "'.$dn.'" -pwd '.base64_decode($password).' -mustchpwd no -pwdneverexpires yes';

echo " \r\n";

if($live=='yes') { 

$output = shell_exec('dsmod user "'.$dn.'" -pwd '.base64_decode($password).' -mustchpwd no -pwdneverexpires yes'); 

echo $output."\r\n";

}

}

if (strlen($leavingdate)==8) {

//aggs - kamar only sends this info out once when a student is first changed to a leaver so need to act on it (i.e not in the over night file)

echo "Has left ".$cn." \r\n";

$info=array();

$info["company"] = "Leaver ".date("Y-m-d H:i");

$info["useraccountcontrol"] = 514;

//aggs - alternative to disabling account is to set the expiration date to expire in X days (not tested)

// $disableddate = date('Ymd', strtotime($leavingdate. ' + 5 days'));

// $info["accountexpirationdate"] = $disableddate;

if($live=='yes') {ldap_mod_replace($ldapconn, $dn, $info);}

}

My additions are not too smart but they suit our needs.  Thanks again for providing the template.

[Daniel Lewis]

Although you can't (or at least I can't - not sure if I want to) reveal it once they have changed it - it is still sent through to ADSync/ADMS (at that stage I could choose to capture it if needed).  The only problems I have had was when a student sets the password to something that the portal accepts but AD complexity rules do not.  

[Sheldon Lendrum]

Daniel, 

What complexity does AD require that the Portal doesn't? 

I was just working on that section in the portal today and would be happy to extend it further to remove that Issue. 

Regards

Sheldon Lendrum

Owner / Director

she...@inboxdesign.co.nz
http://www.inboxdesign.co.nz
ph. +64 7 281 1600 ( Tauranga )
ph.: +64 9 282 4600 ( Auckland )

Follow us on Facebook, Twitter and our Blog.

Remote Support: Team Viewer Windows or Mac

On Wed, Apr 12, 2017 at 9:48 AM, Daniel Lewis <dan...@revell.co.nz> wrote:

Although you can't (or at least I can't - not sure if I want to) reveal it once they have changed it - it is still sent through to ADSync/ADMS (at that stage I could choose to capture it if needed).  The only problems I have had was when a student sets the password to something that the portal accepts but AD complexity rules do not.  

--
You received this message because you are subscribed to a topic in the Google Groups "Techies for schools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/techies-for-schools/U23LTJKp_nA/unsubscribe.
To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsub...@googlegroups.com.

[Daniel Lewis]

Apologies - the problem I mentioned was actually from a staff member setting the students password poorly in the kamar front end.

AD complexity rules that may not be considered on the portal?

"Not contain the user's account name or parts of the user's full name that exceed two consecutive characters"

haven't tested this so it may be covered.

[Jake Wills]

Thanks Daniel... I've made a couple of tweaks and have put it on github now

https://github.com/mathsnz/ADSync/

Kind Regards,

Jake Wills

co-HOD Mathematics, Head of e-Learning

Kāpiti College

Margaret Road, Raumati Beach 5032

04 902 5121 - 021 061 5390

--

[Simon Wright]

Just curious to those sync'ing their ADs with any tool/script if you are sync'ing staff beyond just groups (i.e. class groups).

Are you using these tools to actually create/update/remove staff accounts like you do with students?

Personally i only sync groups and don't really see a need for a sync to tool manage staff the same way a student gets 'managed'.

Thoughts/comments?

Regards
Simon Wright
ICT Manager

Best for boys through the right learning
2 Arthur Street, Dunedin, 9016, New Zealand p: 03 477 5527 | f: 03 477 5468 | c: 021 773 229 | w: obhs.school.nz

Respect - Whakaute | Courage - Toa | Honour - Hōnore | Perseverance - Manawanui | Excellence - Hiranga

To unsubscribe from this group and all its topics, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

[Jake Wills]

We only sync student details and staff groups... all other staff changes are done manually.

[Alistair Baird]

We setup staff independently of Kamar and have separate staff groups. We sync them all to Google though.

--

You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Simon Wright]

Cheers for the replies, i hope i can get a few more, but it's my thinking that i'm not alone with managing staff outside of a sync tool.

Regards
Simon Wright
ICT Manager

Best for boys through the right learning
2 Arthur Street, Dunedin, 9016, New Zealand p: 03 477 5527 | f: 03 477 5468 | c: 021 773 229 | w: obhs.school.nz

Respect - Whakaute | Courage - Toa | Honour - Hōnore | Perseverance - Manawanui | Excellence - Hiranga

On 24 April 2017 at 21:19, Alistair Baird <bai...@stpeterspn.school.nz> wrote:

We setup staff independently of Kamar and have separate staff groups. We sync them all to Google though.

On Monday, 24 April 2017, Jake Wills <jake....@kc.school.nz> wrote:

We only sync student details and staff groups... all other staff changes are done manually.

Kind Regards,

Jake Wills

co-HOD Mathematics, Head of e-Learning

Kāpiti College

Margaret Road, Raumati Beach 5032

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Alistair Baird

IT Manager

St Peters College 

p 06 354 4198

m 021 482 937

e bai...@stpeterspn.school.nz

--
You received this message because you are subscribed to the Google Groups "Techies for schools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsub...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Andrew Godfrey]

We don't sync staff details from Kamar but use Kamar to specify which groups they are a part of (class groups). eDir is our master for staff accounts.

We also use a manual process for creating student eDir accounts from the Kamar data so that a human casts their eye over the changes before they are implemented.

I do just let the AD/azure/O365 accounts get managed by ADMS/KDMS as those accounts aren't as important as they are seldom used and can easily be recreated if required.

Andrew Godfrey  |  Network Manager

To unsubscribe from this group and stop receiving emails from it, send an email to techies-for-schools+unsubscribe...@googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

DISCLAIMER
This e-mail is intended for the addressee only and may contain information which is subject to legal privilege. This e-mail message and accompanying data may contain information that is confidential and subject to privilege. Its contents are not necessarily the official view Otago Boys’ High School or communication of the Otago Boys’ High School. If you are not the intended recipient you must not use, disclose, copy or distribute this e-mail or any information in, or attached to it. If you have received this e-mail in error, please contact the sender immediately or return the original message to Otago Boys’ High School by e-mail, and destroy any copies. Otago Boys’ High School does not accept any liability for changes made to this e-mail or attachments after sending.