LDAP Groups - LDAP group to Drupal role filtering does not work

Can you list your full ldap_auth and ldap_groups settings with names protected?

You posted:
Attribute holding group members: memberuid

This is where our setup, which is synching roles, differs from yours.

Under Groups by Attribute, I have checked:
Groups are specified by LDAP attributes

and under Attribute names (one per line):
we use:

memberOf

Perhaps this will help. Good luck!

I can confirm this works - I've been trying to do the same myself as well.
You need to set Groups Specified by LDAP attributes to True, and set the attribute to something appropriate ('memberOf' for AD).
You also need to set the mappings appropriately (cn=labitsupport,ou=groups,dc=example,dc=com|IT Support)

This has stumped me for ages, verta. Especially since it only works at first login and doesn't map at subsequent ones (which is a real pest).
Many thanks!

Perhaps we should suggest making this a documentation request, if it works for the OP?

I'm pretty sure I did something similar when I first installed the module.

We have the same setup here. Do you have the exact config info? Basically, we are trying to
add a user from LDAP and put them automatically into the Drupal role.

Thanks

My thought is to check the case of the spelling of every string in the paths and names of LDAP objects, as we had to match them exactly to get role sync to work.

Also watch out for spaces in strings like: "cn=labitsupport, ou=groups, dc=example, dc=com". We needed them.

The filtering is working fine for me.

1) means that you have Group by DN, group by attribute, or group by entry at admin/settings/ldap/ldapgroups/edit/N correct. this is the most difficult part for most people.
2) just means ldapgroups isn't pulling IT Support out of thin air or caching. Good to check this sort of thing when things are going sour ;)
3) probably means the filter isn't quite right. Here's how to debug it:

change the code below in ldapgroups.inc to the code below and login. You will see each of the filtered groups being compared to every group the user is mapped to. Something like the following. Just look and see where the comparison is going wrong.

group=Campus Accounts|mappings:
compare CN=ED IT NaG Staff,OU=PeopleGroups,OU=Education,DC=ad,DC=uiuc,DC=edu and Campus Accounts (no match)
compare Campus Accounts and Campus Accounts (match)
--------------------------------------------------------------------------------
group=CN=aces_ap,OU=directoryGroups,OU=ACES,DC=ad,DC=uiuc,DC=edu|mappings:
compare CN=ED IT NaG Staff,OU=PeopleGroups,OU=Education,DC=ad,DC=uiuc,DC=edu and CN=aces_ap,OU=directoryGroups,OU=ACES,DC=ad,DC=uiuc,DC=edu (no match)
compare Campus Accounts and CN=aces_ap,OU=directoryGroups,OU=ACES,DC=ad,DC=uiuc,DC=edu (no match)
.
.
.

function _ldapgroups_filter($account, $groups) {
  if (_ldapgroups_ldap_info($account, 'ldapgroups_mappings_filter') && count(_ldapgroups_ldap_info($account, 'ldapgroups_mappings') > 0)) {
    $groups_new = array();
    foreach ($groups as $group) {
      print "<hr/>group=$group|mappings:";
      foreach (_ldapgroups_ldap_info($account, 'ldapgroups_mappings') as $group_approved => $role) {
        print "<br/>compare $group_approved and $group ";
        if (strcasecmp($group_approved, $group) == 0) {
           print "(match)";
          $groups_new[] = $role;
        } else {
          print "(no match)";
        }
      }
    }
    $groups = $groups_new;
    die;
  }

  if ($code = _ldapgroups_ldap_info($account, 'ldapgroups_filter_php'))
    $groups = drupal_eval($code);

  return $groups;
}

Sorry to be a complete noob here, but when we add print statements such as this to ldapgroups.inc or other files, where can we see the output?

I modified my _ldapgroups_filter as above, and I don't see output anywhere.

Thanks in advance.

the print statements should go to the screen. a better approach than print is this:

- install the devel module
- give admin rights to it
- use the dpm() function for debugging. e.g. dpm($x), dpm('fail'), etc. the firebug extension for devel is also handy because this output goes to a window in the browser.

subscribe

I'm having the same problem as the original poster and I've read through the thread but I can't figure it out. In our case, when a user registers on the site they are automatically granted the 'authenticated user' role on the drupal side. We want them to be added to the corresponding ldap group (registeredUsers). They get added as individuals to the list of users in ldap no problem, and we have the group module set up to group by entry with the with mapping:
gist_registeredUsers,ou=groups,ou=dev,dc=example,dc=com|authenticated user

I thought that the extended groups module would add the user to the registered user ldap group upon login but it doesn’t. The good news is that I can edit roles after the user is registered and these changes are reflected in the ldap group listing but it appears the initial creation does not automatically add an authenticated user to a group.
Andy ideas?
thanks in advance,

I understand thanks for getting back to me - we implemented two case statements (below) yo the extended_ldapgroups module that write/removes the user to the ldap group on login (they are initially assigned to corresponding drupal roles via the rules module) which worked fine until we wired up CAS to the configuration and it stopped working. We will continue to see a solution.

case 'login':
// At login send roles to extended_ladpgroups_add_group_membership since some roles are being added directly in the db
if (array_key_exists('roles', $account)) {
$roles_added = array_keys($account->roles);
if(!empty($roles_added)){
extended_ladpgroups_add_group_membership($account, $roles_added);
}
}
break;

case 'delete':
// If a user is deleted from drupal role then delete user from the associated ldap group
$roles_removed = array_keys($account->roles);
extended_ldapgroups_remove_group_membership($account, $roles_removed);
break;

Clearing out old support requests - reopen if problem still exists in newest code (dev)