Extract email address and groups from an LDAP directory

I chose to bypass the user_register setting because I get an error if I try to log in a user who doesn't have a drupal account (user_register is disabled, cas_authmap false, cas_hijack_user true) :

* warning: array_keys() [function.array-keys]: The first argument should be an array in /web/drupal/modules/user/user.module on line 361.
* warning: implode() [function.implode]: Bad arguments. in /web/drupal/modules/user/user.module on line 361.
* user warning: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ')' at line 1 query: SELECT DISTINCT(p.perm) FROM role r INNER JOIN permission p ON p.rid = r.rid WHERE r.rid IN () in /web/drupal/includes/database.mysql.inc on line 172.

I worked on this problem, and I managed to solve like this :

Change :

     // try to log into Drupal
     if($cas_authmap) { // users are coming from Drupal; no need to use the external_load and the authmap
         $user = user_load(array("name" => $cas_name));
     } else {
         // users are external; use authmap table for associating external users
        $user = user_external_load($cas_name);
        if (!$user->uid && variable_get('cas_hijack_user',0))
        {
          $user = user_load(array("name" => $cas_name));
          if ($user->uid)
            user_set_authmaps($user,array('authname_cas' => $cas_name));
        }
     }

To :

     // try to log into Drupal
     if($cas_authmap) { // users are coming from Drupal; no need to use the external_load and the authmap
         $user = user_load(array("name" => $cas_name));
     } else {
         // users are external; use authmap table for associating external users
        $user = user_external_load($cas_name);
        if (!$user->uid && variable_get('cas_hijack_user',0))
        {
          $user = user_load(array("name" => $cas_name));
          if ($user->uid)
            user_set_authmaps($user,array('authname_cas' => $cas_name));
          else
          {
            session_destroy();
            $user = drupal_anonymous_user();
          }
        }
     }

As you can see, I forced the user to be considered as anonymous if there's no account to hijack and it now works well (it also still works if auto-registration is enabled). Without this, the $user variable was containing "0" at the end of the cas_init() function (if auto-registration was disabled), which I guess Drupal didn't like very much. I also called the session_destroy() function so that the CAS login is not kept in session (we can't log out of Drupal to flush it we're not logged in).

However, it might still confuse the user because there's no message telling him why he's not logged in on Drupal, and I didn't manage to display one.

This means that my little trick to force auto-registration is not needed anymore. Indeed, I think a cas_user_register setting (idenpendent from user_register) would be great, and I'm ready to implement it and generate a new patch (my previous patches were against the latest module stable release, but i'm now working with the HEAD revision).

Concerning the group/email stuff, I also think the best solution would be to call a hook instead of directly calling Ldapauth/Ldapgroup functions, but the LDAP integration module doesn't seem to be really "hookable" at the moment. It would be great we could just call some sort of update_user_data() and update_user_group_memberships() when needed, and Drupal would forward this to the right module (not necessarily the LDAP integration module), but I have no idea how it can be done at the moment.

Here's a new patch against the HEAD version (i moved a bit the drupal_anonymous_user() stuff I talked about before)

CHANGES :
- Added a cas_user_register parameter (drupal account creation upon successful CAS login, user_register independent)
- LDAP groups -> Drupal roles mapping (using ldapgroups module)
- Changed "cas settings" label to "CAS settings"
- User email LDAP extraction (using ldapauth module)
- "Login" string translation (wasn't encapsulated in t())
- No more error if user didn't have a Drupal account and auto-creation was disabled

Damn, I attached the wrong patch, sorry.