Simpler LDAP Provisioning Using Core User Registration

Hi Jody

I just came upon this post when trying to figure out why using the normal Drupal Access Rules feature would not work when creating a user and I think you hit the nail on the head. Replacing completely the Drupal user registration form is probably why these rules don't work.

Your module sounds like a great idea to me but I'd prefer to have these changes integrated in the main LDAP Provisioning module.

Hey Jody,

Thanks for uploading the zip file, only through this simplified version i was able to create users in LDAP from Drupal's user registration page. I'm having trouble in step further and was wondering if you can throw some light. Opposite to the logic of appending integer value in names (to avoid problem in ldap) we have to return error message (to user) without creating account in ldap or drupal. After writing the modified code I'm able to avoid creating users in ldap but could not able to figure out how to stop drupal's user creation.

actual code
if ($ret = $_ldapprov_ldap->search($basedn, '('. $name_attr .'='. $name .')', array($name_attr))) {
$i = 1;
while ($ret = $_ldapprov_ldap->search($basedn, '('. $name_attr .'='. $name . $i .')', array($name_attr)) || user_load(array('name' => $name . $i))) {
$i++;
}
$name = $name . $i;
}

modified code
if ($ret = $_ldapprov_ldap->search($basedn, '('. $name_attr .'='. $name .')', array($name_attr))) {
drupal_set_message(t('Error! User name already exists in LDAP9.'), 'error');
form_set_error('name', t('The name %name is already taken.......', array('%name' => $edit['name'])));
return; //or throw exception
}

I didn't have time to read the code yet, but I wanted to say that you're completely right with this idea. I'll try to help with it when I find some time.

Great module thanks so much!

First of all I want to thank miglius for creating, upgrading (to D5 and d6) and maintaining the LDAP Provisioning Module.

If I compare the reported usage of this module (351 sites) with LDAP Integration Module (8306 sites) I see that there are nearly 24 times more of "LDAP-slaves" configurations than drupal sites as "LDAP-masters". If we want to promote drupal as a LDAP-master we need a good and especially flexible user provisioning. To be flexible it has to integrate with other modules and user hooks like regcode.module and especially content access solutions as reported by grand_master_v.

I agree with Jody Lynn that the replacement of the user registration is not useful and I want to thank her for her reduction work. I will support this simple way, because I need this for my own projects. We can try to integrate this simple way in ldap_provisioning, but if this is to complex or we find no compromise I want to see a fork as soon as possible. There is also an improvement of ldapgroups.module: "Extended LDAP Groups". Additional there is a need for upgrading this module to upcoming Drupal 7.

As Jody wrote and everybody can see in her code there is a lot of deletion. My Idea for a compromise is to make the simplified code as the main module and export additional features in another sub module if there is a need for this. Maybe the 351 drupal sites having a deep integration of this additional features.

Feature-Request: Import existing drupal users to LDAP
I am not the only one who wants to upgrade an existing drupal-installation with ldap (see also: #799892: Migration / LDAP-provisioning of existing Drupal users and #271469: Mass imports). This is also an argument against overriding the standard user handling in drupal. I think this belongs to the provisioning process as mass import of existing ldap-users to drupal belongs to ldapauth.module. This functionality we can integrate or export to sub-module, too. There are mysql-to-ldif solutions like this: https://projects.gentoo.ru/issues/show/64
But we can simplify with our lightweight LDAP Provisioning Module?

@Jody Lynn a big warm thank you

The Problem of importing existing drupal users to LDAP is the old drupal uid which is already used in nodes, comments and every data of other modules.

Hi again,

I'm using profile module and has defined firstname and lastname as profile_firstname and profile_lastname

and I'm using user_import module to import CSV, there's a problem with firstname and lastname, as in LDAP we need at least cn and sn (which is last name).

when provisioning cn and sn are not set ! what makes LDAP refuse the new account!

any idea ?

Hello,

It seems that it cannot match the firstname and lastname

I looked at ldapprov.module trying to understand howt to make it find the firstname and lastname from the CSV :(

I have this error from LDAP.

conn=3082 op=2 ADD dn="uid=1001,ou=people,dc=example,dc=com" 
Oct 27 16:02:42 zitouna slapd[22041]: Entry (uid=1001,ou=people,dc=example,dc=com): object class 'inetOrgPerson' requires attribute 'sn' 
Oct 27 16:02:42 zitouna slapd[22041]: conn=3082 op=2 RESULT tag=105 err=65 text=object class 'inetOrgPerson' requires attribute 'sn' 
Oct 27 16:02:42 zitouna slapd[22041]: conn=3082 op=3 UNBIND 

still have no idea, any ?

@zydoon: Please post this additional information to YOUR other issue: #896692: error on bulk upload
Update: I have posted there, too.

@Paratio Ok, done, but I don't think it would be appropriate as this is based on Jody's work

@Paratio post #7: I agree with all your points. Well thought out and presented!

My problem, @10 and @11, is not a ldapprov problem.
I'm using user_import and that module is not getting first and last names (thanks to devel module)

I'll keep you informed for any evolution.

I'm working with this module and it seems great with one exception - user's can't edit their first and last names in drupal and have those changes reflected in the ldap. When a user goes to their account/edit/ldap entry, they can type in a new name, but when i hit the save button the name reverts back to the original name with no error message. I have sn (!last_name) and givenName (!first_name) set up in the ldapprov settings and the givenName (profile_firstname) and sn (profile_lastname) set up in the data module and they are both set as "Editable by user." This is only a problem when users are created by importing an ldif into the ldap and simultaneously importing a csv into drupal - there is no problem if the admin creates the account in drupal. Any ideas - thanks?

I am using this patch and I added some filtering of unwanted characters when creating usernames.

Glad this is here. Thanks ZivTech folks!

In the last weeks I have done a lot of coding for my new module LDAPcontrol. The code is now commited and maintained in my sandbox:
http://drupal.org/sandbox/C_Logemann/1130156 and I hope it will become a full project in next time:
#1245542: ldapcontrol

ldapprov_register_validate() never stops a registration with the patch in #17. Attached patch, applied after #17, fixes this.

Committed to 6.x-2.x.