AWS Directory Service and msExchRequireAuthToSendTo ldap attribute

Question

We are using AWS directory service in our company to manage user identities (we want to have all our core infra in the cloud with site to site VPNs between offices and AWS).

We are also using office 365 with their hosted Exchange as a part of our o365 plan. Users, groups etc are being synchronized from our Amazon AD into Azure AD for o365.

Now, when i create a distribution group inside our own AD, there is no possibility to specify whether i want to allow external senders to send mail to it. I don't have Exchange installed and I can't modify my AD's schema, because it is a hosted service and I don't have the "Enterprise Admins" or "Schema Admins" permission. So I can't even run Exchange setup.exe with the option to modify AD schema only.

Office365 doesn't allow me to change that setting with their web admin, because the group is synchronized from the remote domain and i shouldn't be modifying it locally.

However, AWS supports extending your AD schema with their own web GUI, but they require an LDIF file to do that. I would like to use this to add the msExchRequireAuthToSendTo manually, so that it would get synchronized to the Azure AD.

The only problem is I can't find such ldif anywhere, neither can i find all the required meta-attributes (such as OID) of that attribute for everything to work properly.

What is the easiest way to get that attribute into my AWS Active Directory?

Answer 1

You're best option would be to use an LDIF file as required by Amazon. You may not be able to find the specific LDIF anywhere, but the details of the attribute (including the attributeID - not the OID) can be found here.

But instead of using that information to create your own, I would recommend using Microsoft's own LDIF file to complete the task. Admittedly, it's not as if you can just search for it on their website.

If you think about it, Exchange Server installation media needs to contain all of the appropriate materials to install Exchange from scratch in a new forest, so even the latest quarterly update (Exchange Server 2016 CU8 released today, coincidentally) should have this information. As would every version of installation media of Exchange Server since at least 2003.

I already have a copy of the media, and will see if I can get it attached for your reference, but if you have an older copy of Exchange installation media, you will find that you actually already have that information - and you may even consider adding a few more well known Exchange attributes to your hosted forest, while you're at it.

---

Edit: The schema modification is contained in several of the LDIF files included in the Exchange Server installation media - after extraction, you can find it in the following four files; all files contain the same information:

.\setup\data\postexchange2000_schema0.ldf
.\setup\data\postwindows2003_schema27.ldf
.\setup\data\schema36.ldf
.\setup\data\schemaadam.ldf

dn: CN=ms-Exch-RequireAuthToSendTo,<SchemaContainerDN>
changetype: ntdsSchemaAdd
adminDescription: ms-Exch-RequireAuthToSendTo
adminDisplayName: ms-Exch-RequireAuthToSendTo
attributeID: 1.2.840.113556.1.4.5062
attributeSecurityGuid:: iYopH5jeuEe1zVcq1T0mfg==
attributeSyntax: 2.5.5.8
isMemberOfPartialAttributeSet: TRUE
isSingleValued: TRUE
lDAPDisplayName: msExchRequireAuthToSendTo
name: ms-Exch-RequireAuthToSendTo
oMSyntax: 1
objectCategory: CN=Attribute-Schema,<SchemaContainerDN>
objectClass: attributeSchema
schemaIdGuid:: O+sz9Vv3s0+y+wjNU3qE0Q==
searchFlags: 0