diff --git a/ldap_authentication/ldap_authentication.inc b/ldap_authentication/ldap_authentication.inc
index 3c2c8e2..63663df 100644
--- a/ldap_authentication/ldap_authentication.inc
+++ b/ldap_authentication/ldap_authentication.inc
@@ -440,12 +440,14 @@ Will not work on most ldaps.'),
   $user_edit = array(); // array of attributes that are changing for existing users
   if (!$account_exists && isset($auth_conf->enabledAuthenticationServers[$ldap_user['sid']])) {
     $ldap_server = $auth_conf->enabledAuthenticationServers[$ldap_user['sid']];
-    $puid = $ldap_server->derivePuidFromLdapEntry($ldap_user);
+    $puid = $ldap_server->derivePuidFromLdapEntry($ldap_user['attr']);
     if ($puid) {
       $account = $ldap_server->drupalUserFromPuid($puid);
       if ($account) {
         $account_exists = TRUE;
         $user_edit['name'] = $name;
+        $account = user_save($account, $user_edit, 'ldap_user');
+        user_set_authmaps($account, array("authname_ldap_user" => $name));
       }
     }
   }
diff --git a/ldap_authentication/tests/ldap_authentication.test b/ldap_authentication/tests/ldap_authentication.test
index b7f7361..f3f14cd 100644
--- a/ldap_authentication/tests/ldap_authentication.test
+++ b/ldap_authentication/tests/ldap_authentication.test
@@ -481,8 +481,22 @@ class LdapAuthenticationTestCase extends DrupalWebTestCase {
     $authenticationConf = new LdapAuthenticationConfAdmin();
     $authenticationConf->allowTestPhp = '';
     $authenticationConf->save();
+  
+  
+  /**
+   * need to test username changes with PUID
+   *   - given a user exists
+   *   - change samaccountname in ldap server
+   *   - have user logon
+   *   - make sure old user and new user have same puid
+   *
+   */
+  
+  
   /***  multiple options used in whitelist **/
 
+
+
    /**
     * LDAP_authen.WL.allow[match].exclude[match] -- desired result: authenticate fail
     */
diff --git a/ldap_servers/LdapServer.class.php b/ldap_servers/LdapServer.class.php
index 418494e..2167d72 100644
--- a/ldap_servers/LdapServer.class.php
+++ b/ldap_servers/LdapServer.class.php
@@ -53,16 +53,33 @@ class LdapServer {
    */
 
   public function drupalUserFromPuid($puid) {
+    
+   // list($account, $user_entity) = ldap_user_load_user_acct_and_entity('jkeats');
+    //debug('drupalUserFromPuid:account and user entity'); debug($account); debug($user_entity);
     $query = new EntityFieldQuery();
     $query->entityCondition('entity_type', 'user')
     ->fieldCondition('ldap_user_puid_sid', 'value', $this->sid, '=')
     ->fieldCondition('ldap_user_puid', 'value', $puid, '=')
     ->fieldCondition('ldap_user_puid_property', 'value', $this->unique_persistent_attr, '=')
     ->addMetaData('account', user_load(1)); // run the query as user 1
-
+// ->entityCondition('bundle', 'user')
     $result = $query->execute();
+   // debug("drupalUserFromPuid: puid=$puid, sid=". $this->sid . "attr=" . $this->unique_persistent_attr); debug($result);
     if (isset($result['user'])) {
-      $user = entity_load('user', array_keys($result['user']));
+      $uids = array_keys($result['user']);
+      if (count($uids) == 1) {
+        $user = entity_load('user', array_keys($result['user']));
+        return $user[$uids[0]];
+      }
+      else {
+        $uids = join(',',$uids);
+        $tokens = array('%uids' => $uids, '%puid' => $puid, '%sid' =>  $this->sid, '%ldap_user_puid_property' =>  $this->unique_persistent_attr);
+        watchdog('ldap_server', 'multiple users (uids: %uids) with same puid (puid=%puid, sid=%sid, ldap_user_puid_property=%ldap_user_puid_property)', $tokens, WATCHDOG_ERROR);
+        return FALSE;
+      }
+    }
+    else {
+      return FALSE;
     }
 
   }
@@ -1021,7 +1038,11 @@ class LdapServer {
     return FALSE;
   }
 
-
+ /**
+   * @param ldap entry array $ldap_entry
+   *
+   * @return string user's username value
+   */
   public function deriveUsernameFromLdapEntry($ldap_entry) {
 
     if ($this->account_name_attr != '') {
@@ -1036,7 +1057,11 @@ class LdapServer {
   }
 
 
-
+  /**
+   * @param ldap entry array $ldap_entry
+   *
+   * @return string user's mail value
+   */
   public function deriveEmailFromLdapEntry($ldap_entry) {
     if ($this->mail_attr) { // not using template
       return @$ldap_entry[$this->mail_attr][0];
@@ -1050,15 +1075,21 @@ class LdapServer {
     }
   }
 
-  public function derivePuidFromLdapEntry($user_ldap_entry) {
-    // dpm('derivePuidFromLdapEntry'); dpm($this->unique_persistent_attr); dpm($user_ldap_entry);
+
+  /**
+   * @param ldap entry array $ldap_entry
+   *
+   * @return string user's PUID or permanent user id (within ldap)
+   */
+  public function derivePuidFromLdapEntry($ldap_entry) {
+  
     if ($this->unique_persistent_attr
-        && isset($user_ldap_entry[$this->unique_persistent_attr][0])
-        && is_scalar($user_ldap_entry[$this->unique_persistent_attr][0])
+        && isset($ldap_entry[$this->unique_persistent_attr][0])
+        && is_scalar($ldap_entry[$this->unique_persistent_attr][0])
         ) {
 
       //@todo this should go through whatever standard detokenizing function ldap_server module has
-      return $user_ldap_entry[$this->unique_persistent_attr][0];
+      return $ldap_entry[$this->unique_persistent_attr][0];
     }
     else {
       return FALSE;
diff --git a/ldap_user/LdapUserConf.class.php b/ldap_user/LdapUserConf.class.php
index 65f3b0a..e2d9cf1 100644
--- a/ldap_user/LdapUserConf.class.php
+++ b/ldap_user/LdapUserConf.class.php
@@ -648,7 +648,8 @@ function __construct() {
     if ($save) {
      // $account = new stdClass();
       $account = user_load($drupal_user->uid);
-      return user_save($account, $user_edit, 'ldap_user');
+      $result = user_save($account, $user_edit, 'ldap_user');
+      return $result;
     }
     else {
       return TRUE;
@@ -906,28 +907,42 @@ function __construct() {
         'function' => 'provisionDrupalAccount',
         'direction' => LDAP_USER_SYNCH_DIRECTION_TO_DRUPAL_USER,
       );
+      
       drupal_alter('ldap_entry', $ldap_user, $params);
-      $this->entryToUserEdit($ldap_user, $user_edit, $ldap_server, LDAP_USER_SYNCH_DIRECTION_TO_DRUPAL_USER, $synch_context);
-
-      if ($save) {
-        $account = user_save(NULL, $user_edit, 'ldap_user');
-        if (!$account) {
-          drupal_set_message(t('User account creation failed because of system problems.'), 'error');
-       //   debug(t('User account creation failed because of system problems.'));
+      // look for existing drupal account with same puid.  if so update username and attempt to synch in current context
+      $puid = $ldap_server->derivePuidFromLdapEntry($ldap_user['attr']);
+      $account2 = ($puid) ? $ldap_server->drupalUserFromPuid($puid) : FALSE;
+
+      if ($account2) { // account exists
+        // 1. correct username and authmap
+        $account = user_save($account2, $user_edit, 'ldap_user');
+        user_set_authmaps($account, array("authname_ldap_user" => $user_edit['name']));
+        // 2. attempt synch if appropriate for current context
+        if ($account && $this->contextEnabled($synch_context, LDAP_USER_SYNCH_DIRECTION_TO_DRUPAL_USER, 'synch')) {
+          $account = $this->synchToDrupalAccount($account, $user_edit, $synch_context, NULL, TRUE);
         }
-        else {
-        // //dpm("user save success");//dpm($account);
-          user_set_authmaps($account, array('authname_ldap_user' => $user_edit['name']));
+        $result = ($account) ? $account : $account2;
+        return $result;
+      }
+      else {
+      
+        $this->entryToUserEdit($ldap_user, $user_edit, $ldap_server, LDAP_USER_SYNCH_DIRECTION_TO_DRUPAL_USER, $synch_context);
+  
+        if ($save) {
+          $account = user_save(NULL, $user_edit, 'ldap_user');
+          if (!$account) {
+            drupal_set_message(t('User account creation failed because of system problems.'), 'error');
+         //   debug(t('User account creation failed because of system problems.'));
+          }
+          else {
+          // //dpm("user save success");//dpm($account);
+            user_set_authmaps($account, array('authname_ldap_user' => $user_edit['name']));
+          }
+          return $account;
         }
-        return $account;
+        return TRUE;
       }
-      return TRUE;
     }
-    else {
-
-    }
-
-
   }
   
   function ldapAssociateDrupalAccount($drupal_username) {
diff --git a/ldap_user/tests/ldap_user.test b/ldap_user/tests/ldap_user.test
index 117f546..ac240fe 100644
--- a/ldap_user/tests/ldap_user.test
+++ b/ldap_user/tests/ldap_user.test
@@ -172,11 +172,36 @@ class LdapUserUnitTests extends LdapUserTestCasev2 {
     $jkeats_uid = $jkeats->uid;
     $this->assertTrue($jkeats->mail == 'boygen@hotmail.com', t('synchToDrupalAccount worked for property (mail) for jkeats'), $this->ldapTestId);
 
-   // return TRUE;
-     // test account exists with correct username, mail, fname, puid, puidfield, dn
-  //  debug('jkeats after user synchToDrupalAccount'); debug($jkeats);
-
 
+    /** test for username change and provisioning with puid conflict
+     jkeats drupal user already exists and has correct puid
+     change samaccountname value (puid field) of jkeats ldap entry and attempt to provision account with new username (jkeatsbrawn)
+     return should be old drupal account (same uid)
+    **/
+    
+    $this->testFunctions->setFakeServerUserAttribute('activedirectory', 'CN=jkeats,CN=Users,DC=activedirectory,DC=ldap,DC=pixotech,DC=com', 'samaccountname', 'jkeats-brawn', 0);
+    $account = NULL;
+    $user_edit = array('name' => 'jkeats-brawn');
+    $this->ldapTestId = $this->module_name . ': provisionDrupalAccount function test with existing user with same puid';
+    $jkeatsbrawn = $ldap_user_conf->provisionDrupalAccount($account, $user_edit, LDAP_USER_SYNCH_CONTEXT_INSERT_DRUPAL_USER, NULL, TRUE);    
+    
+    $this->testFunctions->setFakeServerUserAttribute('activedirectory', 'CN=jkeats,CN=Users,DC=activedirectory,DC=ldap,DC=pixotech,DC=com', 'samaccountname', 'jkeats', 0);
+    $pass = (is_object($jkeatsbrawn) && is_object($jkeats) && $jkeats->uid == $jkeatsbrawn->uid);
+    $this->assertTrue($pass, t('provisionDrupalAccount recognized PUID conflict and synched instead of creating a conflicted drupal account.'), $this->ldapTestId);
+    if (!$pass) {
+      debug('jkeats'); debug($jkeats); debug('jkeatsbrawn'); debug($jkeatsbrawn);
+    }
+    $authmaps = user_get_authmaps('jkeats-brawn');
+    $pass = $authmaps['ldap_user'] == 'jkeats-brawn';
+    $this->assertTrue($pass, t('provisionDrupalAccount recognized PUID conflict and fixed authmap.'), $this->ldapTestId);
+    
+    $pass = is_object($jkeatsbrawn) && $jkeatsbrawn->name == 'jkeats-brawn';
+    $this->assertTrue($pass, t('provisionDrupalAccount recognized PUID conflict and fixed username.'), $this->ldapTestId);
+    
+    $user_edit = array('name' => 'jkeats');
+    $jkeats = user_save($jkeatsbrawn, $user_edit, 'ldap_user');
+    
+    
     // delete and recreate test account to make sure account is in correct state
     $ldap_user_conf->deleteDrupalAccount('jkeats', LDAP_USER_SYNCH_CONTEXT_DELETE_DRUPAL_USER);
     $this->assertFalse(user_load($jkeats_uid, TRUE), t('deleteDrupalAccount deleted jkeats successfully'), $this->ldapTestId);