I have successfully incorporated LDAP authorisation into my site, so all the users except admin are now authenticated against the LDAP directory. I have also successfully configured the LDAP data so that the LDAP First name, Last name, Common name and e-mail all appear correctly when a user views his account.
What I can't do however is to use this LDAP data anywhere else.
The problem is that the LDAP user id is a code, not a user name, and I would like to be able to display the user's First name and Last name in a page using the PHP code Input Format. Trouble is, I just can't get at it! Here is the code that I am using:

global $user;
global $ldapdata_ldap, $ldap_attributes;
$user_details = print_r($user, TRUE);
print $user_details;
print '<br />';
print '<hr />';
$entry = $ldapdata_ldap->retrieveAttributes($user->ldap_dn);
$user_details = print_r($entry, TRUE);
print $user_details;
print '<br />';
print '<hr />';
print print_r($ldapdata_ldap,TRUE);
print '<br />';
print '<hr />';
print print_r($ldap_attributes,TRUE);

But when this executes, nothing comes back. I've also tried using ldapdata_load_user and ldapdata_load_profile, but these log an error message to say that the bind failed. And when I look at the globals they appear to be empty, because what I see is this:

LDAPInterface Object ( [connection] => [server] => [port] => 389 [tls] => [attr_filter] => ldapdata_attribute_filter [secretKey] => ) 
Array ( [givenName] => Array ( [0] => text [1] => textfield [2] => First Name [3] => 64 [4] => 64 ) [sn] => Array ( [0] => text [1] => textfield [2] => Last Name [3] => 64 [4] => 64 ) [cn] => Array ( [0] => text [1] => textfield [2] => Common Name [3] => 64 [4] => 64 ) [mail] => Array ( [0] => text [1] => textfield [2] => Email [3] => 64 [4] => 64 ) )

I would be grateful if somebody could help me out here... and actually, is there any reason why one should not modify the login so that it automatically adds the mapped LDAP attributes to the Drupal session user object?

Comments

martink’s picture

martink commented
Category: support » bug

Actually I think I have discovered a bug....
If you look at the ldapdata_user_login function in the LDAP data module, you will see these lines of code:

  if ((!$user->ldap_authentified) || ($mapping_type = LDAP_MAP_NOTHING)) { 
    return;
  }

This of course is the old trap... it looks so right... and yet the "=" sign does not mean "equals" in PHP. For that (as everyone knows) you use "==" like this:

  if ((!$user->ldap_authentified) || ($mapping_type == LDAP_MAP_NOTHING)) { 
    return;
  }

So in fact the rest of this function is never getting executed beyond this point because it always "returns". Moreover, inasfar as I understand the logic of LDAP data and this function in particular, it ought to be doing much more than it actually is - in fact it should not just save the e-mail address to userinfo, it should acquire all the mapped LDAP info and write this into userinfo....
It looks as if the function is a bit incomplete.

scafmac’s picture

scafmac commented
Priority: Normal » Minor

Hmm, interesting. That does appear to be a bug, but really it is probably irrelevant. As you mentioned and the comment indicates, the only thing the hook is supposed to do is save the email address. But the comment is outdated. There was a change to ldap integration a while ago that allowed for saving the email address to the Drupal DB on initial login.

So even though that change to ldap integration didn't have anything to do with ldap data, per say, it appears to have made this function call obsolete. Someone will have to take the time to confirm all that, but my sense is the immediate return is moot.

Now on to your real question - how to interact with the user's LDAP data. Use the profile module - http://www.google.com/search?q=access+profile+fields+site%3Adrupal.org

The profile module is how ldap data is available once a user is logged in.

martink’s picture

martink commented

Hmmmm.... Thanks for the pointer. Still, I don't quite see how the LDAP Integration works with the profile module. For one thing it has not created any new fields in the profile database (should it?) and when I go to look at "My account" it is quite obviously connecting to the LDAP to get the data I have configured there, given the response times.
Moreover I'm not certain that the call in ldapdata_user_login is obsolete - if you have configured the fields as read-only then it seems clear to me that you need to check them every time the user logs in and if necessary update the profile with new values, otherwise you could change the values in the LDAP and the old values would still appear in Drupal. So I would think the login process should go as follows:
1) Authorise against LDAP
2) Get the mapped fields from the LDAP
3) Update user settings and profile with mapped LDAP fields

scafmac’s picture

scafmac commented

I'll try to get back to this in more detail when I have a minute, but ldap integration works with the profile module via ldap data.

  1. start by defining a profile field for each ldap data field you want to store from ldap on the profile admin page - <url>/admin/user/profile
  2. then navigate to the ldap data admin page: <uri>/admin/settings/ldapdata/ & select the appropriate ldap server
  3. At the top of the ldap admin / server page, select what type of data mapping you want - read, read/write, or none in the Drupal - LDAP Fields mapping fieldset. For each profile field defined in step one, enter the ldap attribute name

After doing that, and removing the function name I mentioned above, no other mapping is required in the code. Now your ldap data field are loaded into those profile fields on login & if the mapping is read/write, they are updated in ldap on user update.

After all that, you have access to those fields in the same way you would access profile fields.

micahw156’s picture

micahw156
he/him/his
commented

I think this kinda sounds more like a documentation issue. It seems to me that using profile fields to display things would be the more consistent approach to Drupal as a whole.

scafmac, would you like me to roll a quick patch for the typo in #1?

scafmac’s picture

scafmac commented

Thanks, but I don't think so. I want to examine it & see if it is necessary... As I mentioned, this section probably has not been looked at since the email address lookup on login was added, so it might be moot, but I haven't had a chance to really evaluate that.

If you would like to help by doing some docs - that would rock.

mtndan’s picture

mtndan commented

Greetings,

Per the instructions, I've commented out the ldapdata_user_login function and the lines on line 65:

//case 'login':
// ldapdata_user_login($user);
// break;

I'm still not seeing any of my data show up in the profile fields.

Any help would be appreciated.

scafmac’s picture

scafmac commented

mtndan,

I'm sorry to say I mixed up my directions. You shouldn't comment out that section of the case statement. I'm at a conference and a little distracted by the conference and responding to a couple of issues - sorry about that.

Is your ldap server configured to allow anonymousing binding? If not you'll have to make sure to set the proper credentials under the advanced configuration on the ldapdata admin page. Also check the drupal log & the server log immediately after an attempted login. Post any errors on that.

Also what ldap & web server configuration are you using? Have you setup the advanced configuration settings on the ldapdata admin pages?

mtndan’s picture

mtndan commented

That's ok.

So, we did create a special user with lookup credentials and configured said user on the admin page. I'm not seeing any errors in drupal or the server log upon login. Login and auth works fine, it's just viewing the extra attributes in the profile fields....

Other ideas?

martink’s picture

martink commented

Thanks to your help I have managed to get this to work. I followed the instructions, added the fields to the profile and associated them with LDAP fields and it is ok.
Here is the code I use to get at some fields:

$user_profile = profile_view_profile($user);
print '<br />';
print 'Nom - ' . $user_profile['LDAP']['profile_ldap_cn']['value'];
print '<br />';
print 'SAGES - ' . $user_profile['LDAP']['profile_sages']['value'];

However I think there is still something confusing that needs tidying up. When you go to the LDAP Data configuration page, as well as the declared profile fields you also get some standard fields proposed at the bottom of the page under "Attribute visibility and access control", including in particular the "common name". So in fact in order to use the "common name" I have had to declare it in the profile instead of just ticking the box.
It looks as if there is an "old" mechanism which is being replaced by a "new" but the old has not been completely removed.

micahw156’s picture

micahw156
he/him/his
commented
Component: Code » Documentation
Assigned: Unassigned » micahw156
Category: bug » support

@martink, I think you might be right about this being a mix of the "old" mechanism vs the new, but I think it's more complicated than that. IIRC, when I first played around with the ldap* modules, you had to define all of the fields you wanted to use by hacking ldapdata.conf.php, and it wasn't as easy to tie LDAP data to profile fields. From the looks of things, that's still the case if you want to write some of this data back to the LDAP database. At least that's what is implied by the selector at the top of the configuration page.

I haven't read through the documentation on this in a long time, and haven't yet wanted to write data back to LDAP, so I'd have to read through it again to see if it's lacking. I'd say that in general, where Drupal docs need some work is that they explain how to do things, but don't always give a good overview of sequence or providing example scenarios to describe which parameters are needed and which can be ignored. That's not a criticism, just an observation. scafmac challenged me in #6 to try to help with the docs, and it's on my list, though I might not get to it right away. I'll need to understand how it all works before I can do that, of course.

When checked, the fields at the bottom of the config screen show up in the LDAP attributes section of the user's profile page whether user profile fields are configured for them or not. I'm not sure if it would be easy to display these anywhere else or not. I'm not sure if LDAP data mapped to profile fields on the config screen without being specified in ldapdata.conf.php can be written back to the database.

Another issue is that cn, uid and sAMAccountName can all be used as the indentifier, depending on which database is being used. Mapping of cn can get confusing because of this.

So, here are the parts that I hope to tackle. I'll start by reviewing the existing documentation, which I haven't done yet. Some of these things might be ok already, so I'm just listing what I want to check:

  • When and why to edit ldapdata.conf.php.
  • The differences between the fields expressly mentioned in ldapdata.conf.php and mappings to profile fields on the ldapdata settings page.
  • If possible, how to display LDAP data using php without mapping profile fields. Presumably this would require the fields to be specified in ldapdata.conf.php. Would the checkboxes on the ldapdata settings page need to be checked, or is that only for profile page display, etc, etc.
  • Show some specific examples of desired configurations. I can do eDirectory here, and maybe AD, but may also solicit other examples when the time comes.
  • Discuss how to address issues that arise when the unique identifier (cn, uid, sAMAccountName) change from configuration to configuration.

    • It might be a couple of weeks before I can actually get much progress on this, but I've gone ahead and assigned this to myself for now.

    @martink, please review my list against your recent experience with the existing documentation and comment. Anyone else can, too, but I know you've just been through this.

    Micah

    Fuseboxer’s picture

    Fuseboxer commented

    I have followed these instructions very carefully, but I still cannot get LDAP attributes to be mapped into profile fields. For clarity, I have done the following:

    1. Installed the LDAP Integration Module.
    2. Configured settings for LDAP Integration and LDAP Data
    3. I have created 2 profile fields: profile_givenName => givenName, and profile_sn => sn (first and last names) in group called 'LDAP Attributes'.
    4. Users can login (and thereby create an account) with their LDAP credentials. The e-mail address is mapped from LDAP to the Drupal database. However, their givenName and sn attributes are NOT present in the 'My Account' page.

    I have NOT modified the 'ldapauth.conf.php' template, nor have I modified any of the .module files.

    I have tried connecting with an LDAP service account using both the short DN "myserviceaccount" and a fully qualified DN of "CN=myserviceaccount,OU=Service Accounts,OU=Special Accounts,DC=myorg,DC=myedu". (Both seem to work BTW as users can still log in properly.)

    Thanks in advance for any assistance. I'm new to Drupal and just looking for a solution.

    wvd_vegt’s picture

    wvd_vegt commented

    Hi,

    I did not see any LDAP info at all. But when i deleted the AD test user and logged in as the test user again (recreating the account) I suddenly have some extra info on the user view

    LDAP attributes

    First Name
    Last Name
    Common Name
    Department <==added this one myself in ldapdate.conf.php.
    Email

    But still no values...

    Logged in as Admin I see the correct DN:

    LDAP dn
    CN=Wim van der Vegt,CN=Users,DC=otec-dev,DC=pwo,DC=ou,DC=nl

    micahw156’s picture

    micahw156
    he/him/his
    commented
    Assigned: micahw156 » Unassigned
    Status: Active » Closed (won't fix)

    Drupal 5 has reached end of life, so I am closing all D5 issues in my list. If this issue still applies with Version 6.x or later, please reopen this issue with correct version tag.