Drupal role membership for a user is *removed* if the user is not in a matching LDAP group when you check the option for "Use LDAP group to Drupal roles filtering" on the groups settings page.

This is good behavior, I think - it's just a little stricter than implied from the docs, or at least I didn't get that impression from what I read.

Happy to help with drafting if needed.

Comments

verta’s picture

verta commented
Component: Documentation » Code

Update:

I've had a real change of heart. It would be really nice if this was optional. I find I need to maintain LDAP users in Drupal roles, and would like to synch them with AD groups also, but not lose my Drupal role assignments on the sync.

I'll probably have to disable the sync, as it's going to be more important that I control access in the site than having a match with organizational groups right now.

cgmonroe’s picture

cgmonroe commented
Component: Code » Documentation

The latest -dev version contains a lot of changes to ldapgroups. If one of the new admin features doesn't meet your needs, the new hook, hook_ldap_user_roles_alter, that can be used to support this via some 3rd party module code.

For details see: #1475272: 6.x-1.0 Release Candidate 1 Status

Changing this back to documentation because the docs do need to be updated for the new code.