LDAP User: Support $account->name being different to the users login id thru use of Persistent and Unique User Attribute

I agree with the goal: keep usernames out of use when security policy dictates it.

What if the UserName attribute field in admin/config/people/ldap/servers/edit/ were allowed to take tokens as the "Email template" field does? This would take care of the derivation of the username.

The initial logon username part is fuzzy. unique_persistent_attr is often a big hex or int number or even a binary value. To get the user setup on initial login, there has to be a way to map the username they initially use to something queryable in ldap. I don't see a good way to do this except perhaps using email as a login. Email would only work if an "Email Template" was not configured. I don't like the idea of cross purposing unique_persistent_attr so it needs to be known by the user. Also keep in mind that the ldap user may never use ldap authentication to logon; they may simply be using ldap authorization or ldap profile so the link between a user and their ldap entry has to be deriveable even if they have never ldap authenticated.

Sounds good. This will just mean adding another fields and altering the UI directions a bit. I think AccountName attribute should default to AuthName if none is supplied. A patch would be appreciated as I'm working through some other issues now.

Thanks. Appreciate the thoroughness of the patch. It broke one of the simpletests, but it the error was in the simpletest so it worked out well.

I committed everything to 7.x-1.x-dev except the following. Also note there is no test coverage for this. I'm leaving this open until they are added. If you want to add them, they should go in ldap_authentication/tests/ldap_authentication.test

-------------------
1. I didn't understand the need to remove this line.

ldap_authentication/ldap_authentication.inc

@@ -202,7 +205,6 @@
if ($detailed_watchdog_log) {
watchdog('ldap_authentication', '%username : Drupal User Account not found and configuration is set to not create new accounts.', $watchdog_tokens, WATCHDOG_DEBUG);
}
- return FALSE; // don't bother authenticating if account doesn't exists and account creation not allowed
}

--------------------
2. In the schema for account_name_attr, I changed not null to FALSE, so it doesn't become a required field on the form and the database.

'account_name_attr' => array(
'form' => array(
'fieldset' => 'users',
'#type' => 'textfield',
'#size' => 30,
'#title' => t('AccountName attribute'),
'#description' => t('The attribute that holds the unique account name. Defaults to the same as the AuthName attribute.'),
),
'schema' => array(
'type' => 'varchar',
'length' => 255,
'not null' => FALSE,
'default' => '',
),
),

--------------------------------
3. one of the simpletests threw a warning, so I added && isset($drupal_user->uid) to the condition:

function _ldap_servers_get_user_ldap_data($drupal_user, $sid) {

if (is_object($drupal_user) && isset($drupal_user->uid) && $authname = db_query("SELECT authname FROM {authmap} WHERE uid = :uid AND module = 'ldap_authentication'", array(':uid' => $drupal_user->uid))->fetchColumn()) {
$drupal_username = $authname;
}

got it. I committed that line to 7.x-1.x-dev.

I also committed this to 7.x-2.x-dev. I'm leaving as needs work, because I suspect the following may need addtional work and it needs to be tested in 7.x-2.x also. (7.x-2.x-dev is unfunctional now so can't be tested).

ldapServer->deriveUsernameFromLdapEntry()

Moving and cross referencing to: #986806: LDAP User: Use Case: ldap attribute for deriving email or username is not unique, unalterable user attribute