After my previous patch I was able to have ldap account creation on Drupal account creation from the admin interface (add user).

But when I try to delete the account the ldap entry is NOT deleted although the " Delete LDAP entry when the corresponding Drupal Account is deleted. This only applies when the LDAP entry was provisioned by Drupal by the LDAP User module." option is checked

On top of that, Now when I try to log on with the newly created user weird things happen.

I have this in the logs :

uu : Previously authenticated in mixed mode or uid=1

LDAP entry on server cas.techartserv.com not synched because error. username=uu, uid=103

LDAP Server ldap_modify(cn=uu,ou=users,dc=xxx,dc=com) in LdapServer::modifyLdapEntry() Error Server ID = cas.xxx.com, LDAP Err No: 64 LDAP Err Message: Naming violation

The LDAP system logs show the cn attribute is missing in the ldap_modify call, I need to trace the call.

But the cherry on the cake is this :
"uu : not used because it is set to be applied only to ldap authenticated users. uu is not ldap authenticated."

So I suspect some flag is not set about the used being "LDAP tied" or maybe the chain of failures end up the normal flow to not be followed.


But I can't see in the user account any flag or place to see that, how can I see that a user is backed up in ladp ? The flag the admin have seems not to be visible when editing the account.
Is this by design ?

Has anybody got LDAP sync working ? Creation, login, edition of account data, of passwords and user renaming ? or not ?

Comments

Annakan’s picture

Annakan commented
Assigned: Unassigned » Annakan
Status: Active » Closed (fixed)

Ok I crown myself stupid on this one.

The first problem about ldap_modify was caused by my incomplete solution of issue #1989018: LDAP User: Drupal to LDAP provisionning not working (invalid syntax) because of bad formated attribute array, the modify code needed change (and in fact simplification), I'll update my patch in that issue.

The second one was what I think is a bad message caused by a feature, I was in "mixed mode" on the Authentication tab (section "Allowable Authentications" ) and this nearly disable LDAP since it auth first through Drupal and only if that fails through LDAP. I tend to think the reverse would be more useful but there might be use cases for this, I don't know.

Sync is still a trouble for some fields thoughts (the ones that touches the DN) and group syncing is not working for me but I'll further investigate and open another issue if needed.