Can't get LDAP Groups to work... UNTIL NOW!!! THANKS Kreaper!

Thanks for the reminder about logs. Nothing in the Drupal logs, but the Apache log file explained that I had screwed up in my editing of the ldapgroups.conf.php file. Fixed that, so no more blank page. But the mappings I have added are still not turning up in the /admin/user/roles list. I am a bit confused about the ldapgroups.conf.php file, it states "Note: Uncommenting this function will limit the groups -> roles conversion to ONLY those groups that are specified in the function." I never uncommented anything in this file, but its default form was uncommented. The only changes I have made, after the mappings did not show up with the settings in admin/settings/ldapgroups/edit/domainLDAP by adding "memberOf" to the "Groups are specified by LDAP attributes" text box, was to add the mapping to the AD security groups. I have included a sample of my entire ldapgroups.conf.php file below:

<?php
// $Id: ldapgroups.conf.php,v 1.7 2007/03/03 03:23:56 scafmac Exp $

//   Interesting constants that admins would want to mess with

//   The module automatically decides names for the Drupal roles
//    based in the names of the LDAP groups. For example:
//   - LDAP group: Admins => Drupal role: Admins
//   - LDAP group: ou=Underlings,dc=myorg,dc=mytld => Drupal role: Underlings
//   However, if this is not enough, this name mapping can be refined
//   by altering this array. Some examples are given.


$GLOBALS['ldap_group_role_mappings'] = array(
  // LDAP group => Drupal role
  
  // make sure the last group->role mapping does NOT have a trailing comma (,)
  'CN=Domain Users,OU=Security Groups,OU=three,DC=two,DC=one' => 'Domain Users',
  'CN=IT,OU=Security Groups,OU=Security Groups,DC=two,DC=one' => 'IT'
  
);

// Note: Uncommenting this function will limit the groups -> roles conversion to ONLY those groups that are 
// specified in the function. 

function ldapgroups_roles_filter($groups) { 
  global $ldap_group_role_mappings; 
  $roles = array(); 
  // this should take the roles array, pass it thru the filters and send a NEW set of roles back the filter 
  foreach ( $groups as $group ) { 
    foreach ($ldap_group_role_mappings as $approved_group => $approved_role) {
       // must strip spaces ?
       $group_stripped = preg_replace('/\s+/', '', $group);
       $approved_group_stripped = preg_replace('/\s+/', '', $approved_group);       
      if (strcasecmp($approved_group_stripped, $group_stripped) == 0) {
        // this role is specified -- grant
	   $roles[] = $approved_role;
      }
    }
  }
  return $roles;
}
?>

Thanks

whoops, just noticed I repeated a group on my sample file... this is how it was meant to read

'CN=Domain Users,OU=Security Groups,OU=three,DC=two,DC=one' => 'Domain Users',
'CN=IT,OU=Security Groups,OU=three,DC=two,DC=one' => 'IT'

It appears to be working now. I think what was happening is that I was making changes and expecting them to turn up immediately. If the role didn't show up, I would try something else... I think that it actually takes a bit of time for the roles to propagate through the system. They are showing up now.
Thanks for the help!

Ok... Sorry to be such a pain... BUT, it actually is NOT working. The two groups, it turns out, were added manually in the roles. So I am still having trouble getting AD Security Groups mapping to Drupal Roles. So, back to begging for help!
Thanks

I have also tried to connect using 'Groups are specified by LDAP attributes' set to 'memberOf'. But that didn't get any role mappings either.

Thanks a ton! I seem to have it working now. Though I still have a question... But first I'll explain my GIANT id10t error...

I was trying to do this while logged in as the first Drupal user, the top admin, who is not part of the AD! *Sigh*.

Once I gave myself admin rights and then logged in as a myself on our network, and I used your debugging line tip (thanks!), I could then see all the various groups I belonged to. So that told me it was working. However, the AD Security Groups are not showing up in the Drupal Admininster Roles section until I add the DN in the ldapgroups.conf.php file. Then it works like a charm.

This may very well be exactly as it is suppose to work, but my understanding was that the ldapgroups.conf.php file was more of a filter. If it was left untouched, then the AD Security Groups would map automatically to the Roles page. Did I read this wrong, or is there still something I can do that won't require me editing ldapgroups.conf.php (not that that is or would be a problem, just curious if I have everything functioning correctly).

Here is some more descriptive info about our AD set up and what I have done to link Drupal to it:

The following are the Base DNs I am using in the LDAP Integration login settings text box:

OU=Users,OU=sub2,DC=TLD,DC=internal
OU=Security Groups,OU=sub2,DC=TLD,DC=internal
OU=Service Accounts,OU=sub2,DC=TLD,DC=internal

Our AD structure is like so:

-TLD
-- OU=sub1
-- OU=sub2
--- OU=Security Groups
---- CN=IT
---- CN=Users
---- etc
--- OU=Users
--- OU=Service Accounts
-- OU=sub3
-- OU=sub4
-- etc

Currently, we want to give access to only those users in the OU "sub2", so the values I have been trying arise from the following distinguished names:

CN=IT,OU=Security Groups,OU=sub2,DC=TLD,DC=internal
CN=Users,OU=Security Groups,OU=sub2,DC=TLD,DC=internal
CN=Users Name,OU=Users,OU=sub2,DC=TLD,DC=internal

For the users group, the value holding the DN is 'memberOf'
For the security groups, the value is 'member'.

To map our Security Groups and lists I have checked the "Groups are specified by LDAP attributes" and enter the "Attribute Name" as "memberOf".
I also checking "Groups exist as LDAP entries where a multivalued attribute contains the members' CNs" and entering
OU=Security Groups,OU=sub2,DC=TLD,DC=internal and using "member" in the "Attribute holding group members".

Thanks again

Can someone check the ldapgroups.conf.php file in the module. I just downloaded the LDAP Integration module from the Drupal web site, extracted it, and checked the stock file and the filter functions are not commented out. When I commented out the whole thing, then everything fell into place. I have been opening the file with the text editor Notepad ++ on a Windows 2003 server, so unless it is somehow removing the comments, the file's functions are uncommented.
Thanks again for the help Kreaper and Scafmac.