diff --git a/a/ldap_authentication/LdapAuthenticationConf.class.php b/b/ldap_authentication/LdapAuthenticationConf.class.php
index b9b7770..64b9bf8 100644
--- a/a/ldap_authentication/LdapAuthenticationConf.class.php
+++ b/b/ldap_authentication/LdapAuthenticationConf.class.php
@@ -96,7 +96,7 @@ class LdapAuthenticationConf {
    *
    * @var int
    */
-  public $emailOption = LDAP_AUTHENTICATION_EMAIL_FIELD_DEFAULT;
+  public $emailOption = LDAP_AUTHENTICATION_EMAIL_FIELD_DEFAULT;  
 
    /**
    * Email handling option
@@ -107,6 +107,26 @@ class LdapAuthenticationConf {
    * @var int
    */
   public $emailUpdate = LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_DEFAULT;
+  
+  /**
+   * Picture handling option
+   *   LDAP_AUTHENTICATION_PICTURE_FIELD_REMOVE -- don't show email on user forms
+   *   LDAP_AUTHENTICATION_PICTURE_FIELD_DISABLE (default) -- disable email on user forms
+   *   LDAP_AUTHENTICATION_PICTURE_FIELD_ALLOW -- allow editing of email on user forms
+   *
+   * @var int
+   */
+  public $pictureOption = LDAP_AUTHENTICATION_PICTURE_FIELD_DEFAULT;
+  
+  /**
+   * Picture handling option
+   *   LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY -- (default) Update stored email if LDAP email differs at login and notify user
+   *   LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE  -- Update stored email if LDAP email differs at login but don\'t notify user
+   *   LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_DISABLE -- Don\'t update stored email if LDAP email differs at login
+   *
+   * @var int
+   */
+  public $pictureUpdate = LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_DEFAULT;
 
   public $ssoEnabled = FALSE;
   public $ssoRemoteUserStripDomainName = FALSE;
@@ -168,6 +188,8 @@ class LdapAuthenticationConf {
     'ldapUserHelpLinkText',
     'emailOption',
     'emailUpdate',
+  	'pictureOption',
+  	'pictureUpdate',
     'allowOnlyIfTextInDn',
     'excludeIfTextInDn',
     'allowTestPhp',
diff --git a/a/ldap_authentication/LdapAuthenticationConfAdmin.class.php b/b/ldap_authentication/LdapAuthenticationConfAdmin.class.php
index 8ebe996..7d6c335 100644
--- a/a/ldap_authentication/LdapAuthenticationConfAdmin.class.php
+++ b/b/ldap_authentication/LdapAuthenticationConfAdmin.class.php
@@ -79,10 +79,26 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
       LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE => t('Update stored email if LDAP email differs at login but don\'t notify user.'),
       LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_DISABLE => t('Don\'t update stored email if LDAP email differs at login.'),
       );
+    
+    /**
+     * 5. Picture
+     */
+    
+    $values['pictureOptionOptions'] = array(
+    		LDAP_AUTHENTICATION_PICTURE_FIELD_REMOVE => t('Don\'t show an picture field on user forms.  LDAP derived picture will be used for user and connot be changed by user'),
+    		LDAP_AUTHENTICATION_PICTURE_FIELD_DISABLE => t('Show disabled picture field on user forms with LDAP derived picture.  LDAP derived picture will be used for user and connot be changed by user'),
+    		LDAP_AUTHENTICATION_PICTURE_FIELD_ALLOW => t('Leave picture field on user forms enabled.  Generally used when provisioning to LDAP or not using picture derived from LDAP.'),
+    );
+    
+    $values['pictureUpdateOptions'] = array(
+    		LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY => t('Update stored picture if LDAP picture differs at login and notify user.'),
+    		LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE => t('Update stored picture if LDAP picture differs at login but don\'t notify user.'),
+    		LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_DISABLE => t('Don\'t update stored picture if LDAP picture differs at login.'),
+    );
 
 
     /**
-     * 5. Single Sign-On / Seamless Sign-On
+     * 6. Single Sign-On / Seamless Sign-On
      */
 
       $values['ldapImplementationOptions'] = array(
@@ -160,20 +176,30 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
   protected $allowOnlyIfTextInDnDescription;
   protected $excludeIfTextInDnDescription;
   protected $allowTestPhpDescription;
-
-   /**
+  
+  /**
    * 4. Email
    */
-
+  
   public $emailOptionDefault = LDAP_AUTHENTICATION_EMAIL_FIELD_REMOVE;
   public $emailOptionOptions;
-
+  
   public $emailUpdateDefault = LDAP_AUTHENTICATION_EMAIL_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY;
   public $emailUpdateOptions;
 
+   /**
+   * 5. Picture
+   */
+
+  public $pictureOptionDefault = LDAP_AUTHENTICATION_PICTURE_FIELD_REMOVE;
+  public $pictureOptionOptions;
+
+  public $pictureUpdateDefault = LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY;
+  public $pictureUpdateOptions;
+
 
    /**
-   * 5. Single Sign-On / Seamless Sign-On
+   * 6. Single Sign-On / Seamless Sign-On
    */
 
   public $ssoEnabledDescription;
@@ -379,6 +405,29 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
       '#default_value' => $this->emailUpdate,
       '#options' => $this->emailUpdateOptions,
       );
+    
+    $form['picture'] = array(
+    		'#type' => 'fieldset',
+    		'#title' => t('Picture'),
+    		'#collapsible' => TRUE,
+    		'#collapsed' => FALSE,
+    );
+    
+    $form['picture']['pictureOption'] = array(
+    		'#type' => 'radios',
+    		'#title' => t('Picture Behavior'),
+    		'#required' => 1,
+    		'#default_value' => $this->pictureOption,
+    		'#options' => $this->pictureOptionOptions,
+    );
+    
+    $form['picture']['pictureUpdate'] = array(
+    		'#type' => 'radios',
+    		'#title' => t('Picture Update'),
+    		'#required' => 1,
+    		'#default_value' => $this->pictureUpdate,
+    		'#options' => $this->pictureUpdateOptions,
+    );
 
 
     /**
@@ -517,6 +566,8 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
     $this->excludeIfNoAuthorizations = ($values['excludeIfNoAuthorizations']) ? (int)$values['excludeIfNoAuthorizations'] : NULL;
     $this->emailOption  = ($values['emailOption']) ? (int)$values['emailOption'] : NULL;
     $this->emailUpdate  = ($values['emailUpdate']) ? (int)$values['emailUpdate'] : NULL;
+    $this->pictureOption  = ($values['pictureOption']) ? (int)$values['pictureOption'] : NULL;
+    $this->pictureUpdate  = ($values['pictureUpdate']) ? (int)$values['pictureUpdate'] : NULL;
     $this->ssoExcludedPaths = $this->linesToArray($values['ssoExcludedPaths']);
     $this->ssoExcludedHosts = $this->linesToArray($values['ssoExcludedHosts']);
     $this->ssoRemoteUserStripDomainName = ($values['ssoRemoteUserStripDomainName']) ? (int)$values['ssoRemoteUserStripDomainName'] : NULL;
diff --git a/a/ldap_authentication/ldap_authentication.inc b/b/ldap_authentication/ldap_authentication.inc
index 95975d4..e45d5a6 100644
--- a/a/ldap_authentication/ldap_authentication.inc
+++ b/b/ldap_authentication/ldap_authentication.inc
@@ -63,7 +63,19 @@ function _ldap_authentication_login_form_alter(&$form, &$form_state, $form_id) {
   }
 }
 
-
+/**
+ * Check if thumbnail has been changed in user form, update ldap_user thumb info.
+ * 
+ * @param Array $form_state
+ */
+function _ldap_authentication_user_validate_picture(&$form_state){
+	if(isset($form_state['values']['picture_upload']->fid) &&
+			$form_state['user']->data['ldap_user']['init']['thumb']['fid'] != $form_state['values']['picture_upload']->fid){
+		$form_state['user']->data['ldap_user']['init']['thumb']['fid'] = $form_state['values']['picture_upload']->fid;
+		$form_state['user']->data['ldap_user']['init']['thumb']['changed'] = true;
+		return;
+	}
+}
 
 /**
   * alter user editing form (profile form) based on ldap authentication configuration
@@ -76,6 +88,7 @@ function _ldap_authentication_login_form_alter(&$form, &$form_state, $form_id) {
 function _ldap_authentication_form_user_profile_form_alter(&$form, $form_state) {
   // keep in mind admin may be editing another users profile form.  don't assume current global $user
   $auth_conf = ldap_authentication_get_valid_conf();
+  
   if ($auth_conf && ldap_authentication_ldap_authenticated($form['#user'])) {
     if ($auth_conf->emailOption == LDAP_AUTHENTICATION_EMAIL_FIELD_REMOVE) {
       $form['account']['mail']['#type'] = 'hidden';
@@ -87,6 +100,18 @@ function _ldap_authentication_form_user_profile_form_alter(&$form, $form_state)
     elseif ($auth_conf->emailOption == LDAP_AUTHENTICATION_EMAIL_FIELD_ALLOW) {
       // email field is functional
     }
+    
+  if ($auth_conf->pictureOption == LDAP_AUTHENTICATION_PICTURE_FIELD_REMOVE) {
+      $form['picture']['#type'] = 'hidden';
+    }
+    elseif ($auth_conf->pictureOption == LDAP_AUTHENTICATION_PICTURE_FIELD_DISABLE) {
+      $form['picture']['#disabled'] = TRUE;
+      $form['picture']['#description'] = t('This picture is automatically set and may not be changed.');
+    }
+    elseif ($auth_conf->pictureOption == LDAP_AUTHENTICATION_PICTURE_FIELD_ALLOW) {
+      // picture field is functional
+      $form['#validate'][] = 'ldap_authentication_user_validate_picture';      
+    }
 
     if (!ldap_authentication_show_reset_pwd($form['#user'])) {
       $form['account']['current_pass']['#disabled'] = TRUE;
@@ -102,6 +127,7 @@ function _ldap_authentication_form_user_profile_form_alter(&$form, $form_state)
 }
 
 
+
 /**
   * user form validation will take care of username, pwd fields
   * this function validates ldap authentication specific
@@ -284,6 +310,45 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state, $re
       }
     }
   }
+  /**
+   * VI.C: existing Drupal account with incorrect picture.  fix picture if appropriate
+   *
+   */
+  $picture_attr = $auth_conf->enabledAuthenticationServers[$ldap_user['sid']]->picture_attr;  
+  if(isset($picture_attr)){  	  	
+  	if ($drupal_account_exists &&  (
+  			$auth_conf->pictureUpdate == LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY ||
+  			$auth_conf->pictureUpdate == LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE
+  	))  {
+  		$ldap_server = ldap_servers_get_servers($ldap_user['sid'], 'enabled');
+  		$ldap_server = $ldap_server[$ldap_user['sid']];  		
+  		$drupal_username = $ldap_server->userUsernameFromLdapEntry($ldap_user['attr']);  			
+  		$picture = $ldap_server->userPictureFromLdapEntry($ldap_user['attr'], $drupal_username, TRUE);  		  		 		
+  		if ($picture){
+				$edit['picture'] = $picture;
+				if(isset($picture->md5Sum)){
+					$edit['data']['ldap_user']['init']['thumb'] = Array(
+							'md5' => $picture->md5Sum,
+							'fid' => $picture->fid,
+							'changed' => $picture->changed,
+							); 
+				}				
+			}
+  	
+  		$watchdog_tokens['%username'] = $drupal_account->name;
+  		if (!$updated_account = user_save($drupal_account, $user_edit)) {
+  			watchdog('ldap_authentication', 'Failed to make changes to user %username updated %changed.', $watchdog_tokens,  WATCHDOG_ERROR);
+  		}
+  		elseif ($auth_conf->pictureUpdate == LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY ) {
+  			if (isset($user_edit['picture'])) {
+  				$watchdog_tokens['%picture'] = $user_edit[$picture->md5Sum];
+  				drupal_set_message(t('Your picture has been updated to match your current account (%picture).', $watchdog_tokens), 'status');
+  			}  		
+  		}
+  	}  	
+  	
+  }
+  
   
   /**
    * VI.C: no existing Drupal account.  consider provisioning Drupal account.
diff --git a/a/ldap_authentication/ldap_authentication.module b/b/ldap_authentication/ldap_authentication.module
index 3f92e6e..7689ecd 100644
--- a/a/ldap_authentication/ldap_authentication.module
+++ b/b/ldap_authentication/ldap_authentication.module
@@ -29,6 +29,16 @@ define('LDAP_AUTHENTICATION_EMAIL_FIELD_DISABLE',      3);
 define('LDAP_AUTHENTICATION_EMAIL_FIELD_ALLOW',        4);
 define('LDAP_AUTHENTICATION_EMAIL_FIELD_DEFAULT',      3);
 
+define('LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE_NOTIFY',  1);
+define('LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_ENABLE',         2);
+define('LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_DISABLE',        3);
+define('LDAP_AUTHENTICATION_PICTURE_UPDATE_ON_LDAP_CHANGE_DEFAULT',        1);
+
+define('LDAP_AUTHENTICATION_PICTURE_FIELD_REMOVE',       2);
+define('LDAP_AUTHENTICATION_PICTURE_FIELD_DISABLE',      3);
+define('LDAP_AUTHENTICATION_PICTURE_FIELD_ALLOW',        4);
+define('LDAP_AUTHENTICATION_PICTURE_FIELD_DEFAULT',      3);
+
 define('LDAP_AUTHENTICATION_RESULT_FAIL_CONNECT',      1);
 define('LDAP_AUTHENTICATION_RESULT_FAIL_BIND',         2);
 define('LDAP_AUTHENTICATION_RESULT_FAIL_FIND',         3);
@@ -51,79 +61,79 @@ define('LDAP_AUTHENTICATION_COOKIE_EXPIRE', 0);
  * Implements hook_menu().
  */
 function ldap_authentication_menu() {
-  $items = array();
-
-  $items['admin/config/people/ldap/authentication'] = array(
-    'title' => 'Authentication',
-    'description' => 'Configure LDAP Authentication',
-    'page callback' => 'drupal_get_form',
-    'page arguments' => array('ldap_authentication_admin_form'),
-    'access arguments' => array('administer site configuration'),
-    'type' => MENU_LOCAL_TASK,
-    'weight' => 3,
-    'file' => 'ldap_authentication.admin.inc',
-  );
-
-  return $items;
+	$items = array();
+
+	$items['admin/config/people/ldap/authentication'] = array(
+			'title' => 'Authentication',
+			'description' => 'Configure LDAP Authentication',
+			'page callback' => 'drupal_get_form',
+			'page arguments' => array('ldap_authentication_admin_form'),
+			'access arguments' => array('administer site configuration'),
+			'type' => MENU_LOCAL_TASK,
+			'weight' => 3,
+			'file' => 'ldap_authentication.admin.inc',
+	);
+
+	return $items;
 }
 
- /**
+/**
  * Implements hook_menu_alter().
  * since menu items are cached, only useful to add or alter callbacks
  * for ldap authentication driven menu items.
  *
  */
 function ldap_authentication_menu_alter(&$items) {
-  ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
-  $items['user/password']['access callback'] = 'ldap_authentication_show_reset_pwd';
-  $auth_conf = ldap_authentication_get_valid_conf();
-  if (@$auth_conf->ldapUserHelpLinkUrl) {
-    $items['user/ldaphelp'] = array(
-      'title' => $auth_conf->ldapUserHelpLinkText,
-      'page callback' => 'drupal_goto',
-      'page arguments' => array($auth_conf->ldapUserHelpLinkUrl),
-      'access callback' => 'ldap_authentication_show_ldap_help_link',
-      'type' => MENU_LOCAL_TASK,
-    );
-  }
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	$items['user/password']['access callback'] = 'ldap_authentication_show_reset_pwd';
+	$auth_conf = ldap_authentication_get_valid_conf();
+	if (@$auth_conf->ldapUserHelpLinkUrl) {
+		$items['user/ldaphelp'] = array(
+				'title' => $auth_conf->ldapUserHelpLinkText,
+				'page callback' => 'drupal_goto',
+				'page arguments' => array($auth_conf->ldapUserHelpLinkUrl),
+				'access callback' => 'ldap_authentication_show_ldap_help_link',
+				'type' => MENU_LOCAL_TASK,
+		);
+	}
 }
 
 /**
  * Implements hook_theme().
  */
 function ldap_authentication_theme() {
-  return array(
-    'ldap_authentication_user_login_block_links' => array(
-      'variables' => array('ldap_user_help_link' => NULL, 'user_register' => TRUE),
-      'render element' => 'element',
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-    'ldap_authentication_user_pass_message' => array(
-      'variables' => array('show_reset_pwd' => NULL, 'auth_conf' => TRUE),
-      'render element' => 'element',
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-    'ldap_authentication_user_pass_validate_ldap_authenticated' => array(
-      'variables' => array('account' => NULL, 'auth_conf' => TRUE),
-      'render element' => 'element',
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-    'ldap_authentication_login_message' => array(
-      'render element' => 'element',
-      'variables' => array('message' => NULL),
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-    'ldap_authentication_message_not_found' => array(
-      'render element' => 'element',
-      'variables' => array('message' => NULL),
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-    'ldap_authentication_message_not_authenticated' => array(
-      'render element' => 'element',
-      'variables' => array('message' => NULL),
-      'file' => 'ldap_authentication.theme.inc'
-    ),
-  );
+	return array(
+			'ldap_authentication_user_login_block_links' => array(
+					'variables' => array('ldap_user_help_link' => NULL, 'user_register' => TRUE),
+					'render element' => 'element',
+					'file' => 'ldap_authentication.theme.inc'
+			),
+			'ldap_authentication_user_pass_message' => array(
+					'variables' => array('show_reset_pwd' => NULL, 'auth_conf' => TRUE),
+					'render element' => 'element',
+					'file' => 'ldap_authentication.theme.inc'
+			),
+			'ldap_authentication_user_pass_validate_ldap_authenticated' => array(
+					'variables' => array('account' => NULL, 'auth_conf' => TRUE),
+					'render element' => 'element',
+					'file' => 'ldap_authentication.theme.inc'
+			),
+			'ldap_authentication_login_message' => array(
+					'render element' => 'element',
+					'variables' => array('message' => NULL),
+					'file' => 'ldap_authentication.theme.inc'
+			),
+			'ldap_authentication_message_not_found' => array(
+					'render element' => 'element',
+					'variables' => array('message' => NULL),
+					'file' => 'ldap_authentication.theme.inc'
+			),
+			'ldap_authentication_message_not_authenticated' => array(
+					'render element' => 'element',
+					'variables' => array('message' => NULL),
+					'file' => 'ldap_authentication.theme.inc'
+			),
+	);
 }
 
 
@@ -133,36 +143,36 @@ function ldap_authentication_theme() {
 
 function ldap_authentication_help($path, $arg) {
 
-  $authentication_help = t('LDAP authentication allows authentication against an LDAP server.  It
-        may be used alongside other authentication means such as built in Drupal authentication,
-        open id, etc.  More detailed help is available on drupal.org at !helplink.',
-          array(
-            '!helplink' => l(LDAP_SERVERS_DRUPAL_HELP_URL, LDAP_SERVERS_DRUPAL_HELP_URL),
-          ));
-
-  switch ($path) {
-    case 'admin/config/people/ldap/authentication':
-      $output = '<p>' . $authentication_help . '</p>';
-      return $output;
-
-    case 'admin/help#ldap_authentication':
-      $output = '<p>' . $authentication_help . '</p>';
-      return $output;
-  }
+	$authentication_help = t('LDAP authentication allows authentication against an LDAP server.  It
+			may be used alongside other authentication means such as built in Drupal authentication,
+			open id, etc.  More detailed help is available on drupal.org at !helplink.',
+			array(
+					'!helplink' => l(LDAP_SERVERS_DRUPAL_HELP_URL, LDAP_SERVERS_DRUPAL_HELP_URL),
+			));
+
+	switch ($path) {
+		case 'admin/config/people/ldap/authentication':
+			$output = '<p>' . $authentication_help . '</p>';
+			return $output;
+
+		case 'admin/help#ldap_authentication':
+			$output = '<p>' . $authentication_help . '</p>';
+			return $output;
+	}
 }
 
 /**
  * Implements hook_info().
  */
 function ldap_authentication_info($field = 0) {
-  $info['name']= 'ldap_authentication';
-  $info['protocol'] = 'LDAP';
+	$info['name']= 'ldap_authentication';
+	$info['protocol'] = 'LDAP';
 
-  if ($field) {
-    return $info[$field];
-  }
+	if ($field) {
+		return $info[$field];
+	}
 
-  return $info;
+	return $info;
 }
 
 
@@ -175,15 +185,15 @@ function ldap_authentication_info($field = 0) {
 
 function ldap_authentication_ldap_authenticated($user) {
 
-  if (is_numeric($user)) {
-    $user = @user_load((int)$user);
-  }
-  if (!is_object($user) || $user->uid == 0) {
-    return FALSE;
-  }
+	if (is_numeric($user)) {
+		$user = @user_load((int)$user);
+	}
+	if (!is_object($user) || $user->uid == 0) {
+		return FALSE;
+	}
 
-  $authmaps = db_query("SELECT module, authname FROM {authmap} WHERE uid = :uid", array(':uid' => $user->uid))->fetchAllKeyed();
-  return isset($authmaps['ldap_user']);
+	$authmaps = db_query("SELECT module, authname FROM {authmap} WHERE uid = :uid", array(':uid' => $user->uid))->fetchAllKeyed();
+	return isset($authmaps['ldap_user']);
 
 }
 
@@ -194,7 +204,7 @@ function ldap_authentication_ldap_authenticated($user) {
  *
  */
 function _ldap_authentication_user_access() {
-  return (boolean)(!$GLOBALS['user']->uid || !empty($GLOBALS['menu_admin']));
+	return (boolean)(!$GLOBALS['user']->uid || !empty($GLOBALS['menu_admin']));
 }
 
 
@@ -208,14 +218,14 @@ function _ldap_authentication_user_access() {
 
 function ldap_authentication_get_valid_conf($reset = FALSE) {
 
-  static $auth_conf;
-  if (!$reset && is_object($auth_conf)) {
-    return $auth_conf;
-  }
-  ldap_servers_module_load_include('php', 'ldap_authentication', 'LdapAuthenticationConf.class');
+	static $auth_conf;
+	if (!$reset && is_object($auth_conf)) {
+		return $auth_conf;
+	}
+	ldap_servers_module_load_include('php', 'ldap_authentication', 'LdapAuthenticationConf.class');
 
-  $auth_conf = new LdapAuthenticationConf();
-  return ($auth_conf->inDatabase) ? $auth_conf : FALSE;
+	$auth_conf = new LdapAuthenticationConf();
+	return ($auth_conf->inDatabase) ? $auth_conf : FALSE;
 
 }
 
@@ -224,35 +234,35 @@ function ldap_authentication_get_valid_conf($reset = FALSE) {
  */
 function ldap_authentication_ldap_server_in_use($sid, $server_name) {
 
-  $use_warnings = array();
-  $auth_conf = ldap_authentication_get_valid_conf();
-  if (in_array($sid, array_keys($auth_conf->sids))) {
-    $use_warnings[] = t('This server (%server_name) may not be deleted or
-      disabled because it is being used for ldap authentication.',
-      array('%server_name' => $server_name));
-  }
-  return $use_warnings;
+	$use_warnings = array();
+	$auth_conf = ldap_authentication_get_valid_conf();
+	if (in_array($sid, array_keys($auth_conf->sids))) {
+		$use_warnings[] = t('This server (%server_name) may not be deleted or
+				disabled because it is being used for ldap authentication.',
+				array('%server_name' => $server_name));
+	}
+	return $use_warnings;
 }
 
 function ldap_authentication_show_reset_pwd($user = NULL) {
 
-  if (!$user) {
-    global $user;
-  }
-  $auth_conf = ldap_authentication_get_valid_conf();
-  if (current_path() == 'user/password' || $user->uid == 1 || !$auth_conf) {
-    return TRUE;
-   // always show at user/passwordurl. otherwise user 1 will not be able to reset password.
-  }
-
-  if ($user->uid == 0) {
-    // hide reset password for anonymous users if ldap only authentication, otherwise show
-    return ($auth_conf->authenticationMode != LDAP_AUTHENTICATION_EXCLUSIVE);
-  }
-  else {
-    // authenticated user.  hide if ldap authenticated otherwise show.
-    return (!ldap_authentication_ldap_authenticated($user));
-  }
+	if (!$user) {
+		global $user;
+	}
+	$auth_conf = ldap_authentication_get_valid_conf();
+	if (current_path() == 'user/password' || $user->uid == 1 || !$auth_conf) {
+		return TRUE;
+		// always show at user/passwordurl. otherwise user 1 will not be able to reset password.
+	}
+
+	if ($user->uid == 0) {
+		// hide reset password for anonymous users if ldap only authentication, otherwise show
+		return ($auth_conf->authenticationMode != LDAP_AUTHENTICATION_EXCLUSIVE);
+	}
+	else {
+		// authenticated user.  hide if ldap authenticated otherwise show.
+		return (!ldap_authentication_ldap_authenticated($user));
+	}
 
 }
 
@@ -262,16 +272,16 @@ function ldap_authentication_show_reset_pwd($user = NULL) {
  */
 
 function ldap_authentication_form_user_pass_alter(&$form, $form_state) {
-  // the following could be in a theme preproces function
-  $auth_conf = ldap_authentication_get_valid_conf();
-  $form['ldap_warning'] = array(
-     '#type' => 'item',
-     '#markup' => theme('ldap_authentication_user_pass_message', array('auth_conf' => $auth_conf)),
-     '#weight' => 10,
-      );
-
-  // need to insert before user_pass_validate
-  array_unshift($form['#validate'], 'ldap_authentication_user_pass_validate');
+	// the following could be in a theme preproces function
+	$auth_conf = ldap_authentication_get_valid_conf();
+	$form['ldap_warning'] = array(
+			'#type' => 'item',
+			'#markup' => theme('ldap_authentication_user_pass_message', array('auth_conf' => $auth_conf)),
+			'#weight' => 10,
+	);
+
+	// need to insert before user_pass_validate
+	array_unshift($form['#validate'], 'ldap_authentication_user_pass_validate');
 }
 
 
@@ -281,31 +291,31 @@ function ldap_authentication_form_user_pass_alter(&$form, $form_state) {
  * is set to the matching user ID.
  */
 function ldap_authentication_core_override_user_login_authenticate_validate($form, &$form_state) {
-  // No additional validation of user credentials is needed when
-  // $form_state['uid'] is set.
-  if (!empty($form_state['uid'])) {
-    return;
-  }
-  user_login_authenticate_validate($form, $form_state);
+	// No additional validation of user credentials is needed when
+	// $form_state['uid'] is set.
+	if (!empty($form_state['uid'])) {
+		return;
+	}
+	user_login_authenticate_validate($form, $form_state);
 }
 
 
 function ldap_authentication_user_pass_validate(&$form_state) {
-  $name_or_mail = trim($form_state['name']['#value']);
-  if ($account = user_load_by_mail($name_or_mail)) {
-
-  }
-  else {
-    $account = user_load_by_name($name_or_mail);
-  }
-
-  if (ldap_authentication_ldap_authenticated($account)) {
-    $vars = array(
-      'account' => $account,
-      'auth_conf' => ldap_authentication_get_valid_conf(),
-    );
-    form_set_error('name', theme('ldap_authentication_user_pass_validate_ldap_authenticated', $vars));
-  }
+	$name_or_mail = trim($form_state['name']['#value']);
+	if ($account = user_load_by_mail($name_or_mail)) {
+
+	}
+	else {
+		$account = user_load_by_name($name_or_mail);
+	}
+
+	if (ldap_authentication_ldap_authenticated($account)) {
+		$vars = array(
+				'account' => $account,
+				'auth_conf' => ldap_authentication_get_valid_conf(),
+		);
+		form_set_error('name', theme('ldap_authentication_user_pass_validate_ldap_authenticated', $vars));
+	}
 }
 
 
@@ -313,8 +323,8 @@ function ldap_authentication_user_pass_validate(&$form_state) {
  * Implements hook_form_FORM_ID_alter(). for user_profile_form
  */
 function ldap_authentication_form_user_profile_form_alter(&$form, $form_state) {
-  ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
-  _ldap_authentication_form_user_profile_form_alter($form, $form_state, 'user_login');
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	_ldap_authentication_form_user_profile_form_alter($form, $form_state, 'user_login');
 
 }
 
@@ -323,8 +333,8 @@ function ldap_authentication_form_user_profile_form_alter(&$form, $form_state) {
  * Implements hook_form_FORM_ID_alter(). for user_login
  */
 function ldap_authentication_form_user_login_alter(&$form, &$form_state) {
-  ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
-  _ldap_authentication_login_form_alter($form, $form_state, 'user_login');
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	_ldap_authentication_login_form_alter($form, $form_state, 'user_login');
 
 }
 
@@ -332,8 +342,8 @@ function ldap_authentication_form_user_login_alter(&$form, &$form_state) {
  * Implements hook_form_FORM_ID_alter(). for user_login_block
  */
 function ldap_authentication_form_user_login_block_alter(&$form, &$form_state) {
-  ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
-  _ldap_authentication_login_form_alter($form, $form_state, 'user_login_block');
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	_ldap_authentication_login_form_alter($form, $form_state, 'user_login_block');
 
 }
 
@@ -341,10 +351,19 @@ function ldap_authentication_form_user_login_block_alter(&$form, &$form_state) {
  * validate function for user logon forms.
  */
 function ldap_authentication_user_login_authenticate_validate($form, &$form_state, $return_user = FALSE) {
-  ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
-  return _ldap_authentication_user_login_authenticate_validate($form_state, $return_user);
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	return _ldap_authentication_user_login_authenticate_validate($form_state, $return_user);
 }
 
+/**
+ * validate user form, check if image has been changed by user.
+ */
+
+function ldap_authentication_user_validate_picture($form, &$form_state){
+	ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication');
+	return  _ldap_authentication_user_validate_picture($form_state);
+}
+
 
 /**
  * Implements hook_user_presave().
@@ -381,20 +400,20 @@ function ldap_authentication_user_update($edit, $user, $category) {
 }
 
 function ldap_authentication_show_ldap_help_link($user = NULL) {
-  global $user;
-
-  if (!$auth_conf = ldap_authentication_get_valid_conf()) {
-    return FALSE;
-  }
-  elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_MIXED) {
-    return (ldap_authentication_ldap_authenticated($user));
-  }
-  elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) {
-    if ($user->uid == 0 || ldap_authentication_ldap_authenticated($user)) {
-      return TRUE;
-    }
-    else {
-      return FALSE;
-    }
-  }
+	global $user;
+
+	if (!$auth_conf = ldap_authentication_get_valid_conf()) {
+		return FALSE;
+	}
+	elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_MIXED) {
+		return (ldap_authentication_ldap_authenticated($user));
+	}
+	elseif ($auth_conf->authenticationMode == LDAP_AUTHENTICATION_EXCLUSIVE) {
+		if ($user->uid == 0 || ldap_authentication_ldap_authenticated($user)) {
+			return TRUE;
+		}
+		else {
+			return FALSE;
+		}
+	}
 }
diff --git a/a/ldap_servers/LdapServer.class.php b/b/ldap_servers/LdapServer.class.php
index da691f3..6cbce46 100644
--- a/a/ldap_servers/LdapServer.class.php
+++ b/b/ldap_servers/LdapServer.class.php
@@ -1012,45 +1012,49 @@ class LdapServer {
 	 *
 	 * @return drupal file object image user's thumbnail or FALSE if none present or ERROR happens.
 	 */
-	public function userPictureFromLdapEntry($ldap_entry, $drupal_username = FALSE) {
+	public function userPictureFromLdapEntry($ldap_entry, $drupal_username = FALSE, $authenticationUpdate = FALSE) {
 		if ($ldap_entry && $this->picture_attr) {
 			//Check if ldap entry has been provisioned.
-				
+			
 			$thumb = isset($ldap_entry[$this->picture_attr][0]) ? $ldap_entry[$this->picture_attr][0] : FALSE;
-			if(!$thumb || $account->uid == '0'){
+		
+			if(!$thumb){
 				return false;
 			}
-      
+      	
 			//Create md5 check.						
-			$md5thumb = md5($thumb);
-      
+			$md5thumb = md5($thumb);					
+      		
 			/**
 			 * If existing account already has picture check if it has changed if so remove old file and create the new one 
-		   * If picture is not set but account has md5 something is wrong exit. 
+		   	 * If picture is not set but account has md5 something is wrong exit. 
 			 */
-			if ($drupal_username && $account = user_load_by_name($drupal_username)) {
-        if (isset($account->picture)){
-          // Check if image has changed
-          if (isset($account->data['ldap_user']['init']['thumb5md']) && $md5thumb === $account->data['ldap_user']['init']['thumb5md']){
-            //No change return same image					
-            return $account->picture;					
-          }
-          else {
-            //Image is different check wether is obj/str and remove fileobject
-            if (is_object($account->picture)){
-              file_delete($account->picture, TRUE);
-            }
-            elseif (is_string($account->picture)){
-              $file = file_load(intval($account->picture));
-              file_delete($file, TRUE);
-            }
-          }			
-        }
-        elseif (isset($account->data['ldap_user']['init']['thumb5md'])) {
-          watchdog('ldap_server', "Some error happened during thumbnailPhoto sync");
-          return false;
-        }
-      }
+			
+			if ($drupal_username && $account = user_load_by_name($drupal_username)) {				
+				if (isset($account->picture)){
+					// Check if image has changed
+					if (isset($account->data['ldap_user']['init']['thumb']['md5']) &&
+							$md5thumb === $account->data['ldap_user']['init']['thumb']['md5'] &&
+							( !$account->data['ldap_user']['init']['thumb']['changed'] || !$authenticationUpdate )){
+							//No change return same image							
+							$account->picture->changed = false;
+							return $account->picture;
+					}
+					else {
+						//Image is different check wether is obj/str and remove fileobject
+						if (is_object($account->picture)){
+							file_delete($account->picture, TRUE);
+						}
+						elseif (is_string($account->picture)){
+							$file = file_load(intval($account->picture));
+							file_delete($file, TRUE);
+						}
+					}
+				}
+			}else{
+				return FALSE;
+			}
+			
 			//Create tmp file to get image format.
 			$filename = uniqid();
 			$fileuri = file_directory_temp() .'/'. $filename;
@@ -1068,6 +1072,7 @@ class LdapServer {
 			);
 			$errors = file_validate($file ,$validators);
 			if (empty($errors)) {
+				$file->changed = true;
 				return $file;
 			}
       else {
diff --git a/a/ldap_user/LdapUserConf.class.php b/b/ldap_user/LdapUserConf.class.php
index c5b9d0e..f276b53 100644
--- a/a/ldap_user/LdapUserConf.class.php
+++ b/b/ldap_user/LdapUserConf.class.php
@@ -1197,19 +1197,20 @@ class LdapUserConf {
       }
     }
    
-    $drupal_username = $ldap_server->userUsernameFromLdapEntry($ldap_user['attr']);
-    
-		if ($this->isSynched('[property.picture]', $prov_events, $direction)){
-      
-			$picture = $ldap_server->userPictureFromLdapEntry($ldap_user['attr'], $drupal_username);
-      
-			if ($picture){
-				$edit['picture'] = $picture;
-				if(isset($picture->md5Sum)){
-					$edit['data']['ldap_user']['init']['thumb5md'] = $picture->md5Sum;
-				}				
-			}
-		}
+    $drupal_username = $ldap_server->userUsernameFromLdapEntry($ldap_user['attr']);    
+    if (!isset($edit['picture']) && $this->isSynched('[property.picture]', $prov_events, $direction)){    	
+    	$picture = $ldap_server->userPictureFromLdapEntry($ldap_user['attr'], $drupal_username);
+    	if ($picture){
+    		$edit['picture'] = $picture;
+    		if(isset($picture->md5Sum)){
+    			$edit['data']['ldap_user']['init']['thumb'] = Array(
+    					'md5' => $picture->md5Sum,
+    					'fid' => $picture->fid,
+    					'changed' => $picture->changed
+    			);
+    		}
+    	}
+    }
     
     if ($this->isSynched('[property.name]', $prov_events, $direction) && !isset($edit['name']) && $drupal_username) {
       $edit['name'] = $drupal_username;