Success with Drupal 5 / LDAP / ActiveDirectory

I've seen a lot of posts from people with issues and questions regarding getting Drupal to work with LDAP and ActiveDirectory. I recently go intranet application working, so I thought I'd share my experience. I also saw a couple of requests for deployment examples, so I hope this helps.

Integrating Drupal with your organization's existing LDAP directory infrastructure allows your users to log onto your Drupal site using their existing account names and passwords. They don't have to create another account and have yet another password to remember.

My set up is Drupal 5.1.x on Fedora Core 5, Apache 2 & PHP 5.1. My directory server is ActiveDirectory. I downloaded and installed the 5.1.x version of the ldap_integration module. I am not using the LDAP groups support.

After installing the module, go to the ldapauth config page and add a server entry for your network's directory server:

Server Settings

The Name field is just a name you select for this entry - it can be anything you like.

The LDAP server field is the domain name (or less desirably the IP address) of your LDAP server. In many Windows environments, this will be your domain controller.

The LDAP port is usually 389 unless your administrator has changed it.

TLS encryption usually does not need to be used, but your environment may be different.

Leave Store passwords in encrypted form unchecked for now.

Login Procedure

In my case, I do not plan to allow users to interact with their LDAP information from the Drupal site, so I elected to check Do not store user's passwords during sessions - this is more secure.

Also in my case, I want to use LDAP for all user management, so I checked LDAP directory only for user look up.

Your organization's Base DN is usually going to be something like "dc=companyname,dc=com". Examples:

dc=mycompany,dc=com
dc=engineering,dc=mycompany,dc=com
dc=mynetwork,dc=net

For ActiveDirectory, the UserName attribute is usually "sAMAccountName".

Advanced Configuration

ActiveDirectory usually does not permit anonymous searches. You will need to supply a DN (distinguished name) and password that Drupal will use to perform its look ups. You should create a dedicated account with a non-expiring password for this purpose or change your AD's configuration accordingly. For testing purposes, you can use your own username and password.

The DN is usually an email-formatted address "username@somecompany.com" or a Windows-style domain\username "MYDOMAIN\username". The email style form is probably best, but both will work.

Save the configuration. Now users should be able to log into your site using their existing network id / password.

Logging in

Note: Drupal will always use it's internal user database for authenticating the original admin user, so if this user account name is currently set to the same name as your Windows account name, I recommend changing it.

Your users should be able to enter their normal network login name (e.g. "bsmith") and password into the Drupal login fields and immediately login. The ldap_integration module will automatically create a Drupal user entry for them. You can use this entry to manage role/group memberships.

Tweaking

The 5.1.x ldap_auth module has an issue with email addresses. When it creates a Drupal user for someone who logs in with their LDAP credentials, it populates their email address with their DN instead. The user can go back and edit it later, but I wanted this to happen automatically, so I tweaked the code a little to do this.

In the module source code, there is a note saying the ldapdata module will take care of this, but the ldapdata module is not present in the 5.1.x version of ldap_integration. The fix for this is trivial, though:

In modules/ldap_integration/ldapauth.module at about line 659, I commented out the following lines:

/*    	
      $dn = _ldapauth_login2dn($login_string);
      
      // Register this new user.
      // Changes to this user_save():
      //   1. 'pass' => in "LDAP then Drupal" mode, actual password
      //                is written. In "LDAP only" mode, a random
      //                password is set
      if (variable_get('ldap_login_process', LDAP_FIRST_LDAP) == LDAP_FIRST_LDAP) {
        $pass = user_password(20);
      }
      //   2. 'mail' => we cannot access the LDAP info from here, so
      //                we just write anything as e-mail address. If
      //                ldapdata module is enabled, it will write the
      //                right value upon login
      $mail = $dn;
      //   3. 'init' => same. BTW: what's the use of this field?
*/

And then replaced them with:

/* KM: hack to get correct email address without ldapdata */
$ldap_user = _ldapauth_user_lookup($login_string);
if ($user) {
    $dn = $ldap_user['dn'];
    if ($ldap_user['mail'])
        $mail = $ldap_user['mail'][0];
    else
        $mail = $dn;
}

Now email addresses are populated correctly.