I have setup the LDAP Data module to link a profile field to an LDAP user attribute. When a user tries to save a change to this field the user sees a "The changes have been saved." message but if show php errors is enabled I see the following error: "warning: ldap_modify() [function.ldap-modify]: Modify: Insufficient access in /var/www/html/website/sites/all/modules/ldap_integration/includes/LDAPInterface.inc on line 260."

I looked in the directory server logs and find that Drupal is trying to update the attribute value using anonymous access. This is not permitted and thus gives a permission error. In the LDAP data module it states that "When reading/editing attributes, this module logs on to the LDAP directory using the user's DN/pass pair. However, many LDAP setups do not allow their users to edit attributes.". We do allow our users to edit some of their attributes and it works from the command line. The problem here seems to be Drupal never binds to the server using the users DN/pass pair when updating an attributes value. I tried setting an admin DN in the advanced configuration and that worked but its not something we want to do. We would prefer to use the users DN/pass for logging reasons.

Here is a (sanitized) snip from my directory server logs:

[18/Aug/2009:11:49:49 -0700] conn=104 fd=68 slot=68 connection from 192.168.1.1 to 192.168.1.2
[18/Aug/2009:11:49:49 -0700] conn=104 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[18/Aug/2009:11:49:49 -0700] conn=104 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[18/Aug/2009:11:49:49 -0700] conn=104 SSL 256-bit AES
[18/Aug/2009:11:49:49 -0700] conn=104 op=1 BIND dn="" method=128 version=3
[18/Aug/2009:11:49:49 -0700] conn=104 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[18/Aug/2009:11:49:49 -0700] conn=104 op=2 SRCH base="uid=username,ou=People, dc=example, dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[18/Aug/2009:11:49:49 -0700] conn=104 op=2 RESULT err=0 tag=101 nentries=1 etime=0
[18/Aug/2009:11:49:49 -0700] conn=104 op=3 UNBIND
[18/Aug/2009:11:49:49 -0700] conn=104 op=3 fd=68 closed - U1
[18/Aug/2009:11:49:49 -0700] conn=105 fd=69 slot=69 connection from 192.168.1.1 to 192.168.1.2
[18/Aug/2009:11:49:49 -0700] conn=105 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[18/Aug/2009:11:49:49 -0700] conn=105 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[18/Aug/2009:11:49:49 -0700] conn=105 SSL 256-bit AES
[18/Aug/2009:11:49:49 -0700] conn=105 op=1 BIND dn="" method=128 version=3
[18/Aug/2009:11:49:49 -0700] conn=105 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[18/Aug/2009:11:49:49 -0700] conn=105 op=2 MOD dn="uid=username,ou=People, dc=example, dc=com"
[18/Aug/2009:11:49:49 -0700] conn=105 op=2 RESULT err=50 tag=103 nentries=0 etime=0 csn=4a8af7cd000000010000
[18/Aug/2009:11:49:49 -0700] conn=105 op=3 UNBIND
[18/Aug/2009:11:49:49 -0700] conn=105 op=3 fd=69 closed - U1
[18/Aug/2009:11:49:50 -0700] conn=106 fd=68 slot=68 connection from 192.168.1.1 to 192.168.1.2
[18/Aug/2009:11:49:50 -0700] conn=106 op=0 EXT oid="1.3.6.1.4.1.1466.20037" name="startTLS"
[18/Aug/2009:11:49:50 -0700] conn=106 op=0 RESULT err=0 tag=120 nentries=0 etime=0
[18/Aug/2009:11:49:50 -0700] conn=106 SSL 256-bit AES
[18/Aug/2009:11:49:50 -0700] conn=106 op=1 BIND dn="" method=128 version=3
[18/Aug/2009:11:49:50 -0700] conn=106 op=1 RESULT err=0 tag=97 nentries=0 etime=0 dn=""
[18/Aug/2009:11:49:50 -0700] conn=106 op=2 SRCH base="uid=username,ou=People, dc=example, dc=com" scope=0 filter="(objectClass=*)" attrs=ALL
[18/Aug/2009:11:49:50 -0700] conn=106 op=2 RESULT err=0 tag=101 nentries=1 etime=0
[18/Aug/2009:11:49:50 -0700] conn=106 op=3 UNBIND
[18/Aug/2009:11:49:50 -0700] conn=106 op=3 fd=68 closed - U1

Comments

miglius’s picture

miglius commented
Status: Active » Postponed (maintainer needs more info)
Issue tags: -ldap, -ldapdata_mappings

Do you have a "Do not store users' passwords during sessions" checkbox checked under the ldapauth settings "Security options" fieldset?

It should be unchecked if you want ldapdata to bind with user's credentials.

vincetingey’s picture

vincetingey commented

Hello,

Sorry for the late reply to this.. I seem to of missed it. I really wish there was an email notification option with these issues.

Yes I did have the "Do not store users passwords during sessions" checkbox checked. I also really wish there was some better documentation on this module that would explain that this option also prevents binding using the users credentials.

johnbarclay’s picture

johnbarclay commented
Status: Postponed (maintainer needs more info) » Closed (works as designed)