Ldap Provision: LDAP data pre populate

This may help do what you need. #1089256-14: LDAP User: Provisioning of LDAP accounts and LDAP Attributes Very much pre-alpha but it is doing what I need for the moment without any problems. Allows you to map profile fields to ldap fields and fetch information during cron run.

Hello,
I just installed your ldap_profile module and mapped some test fields to ldap fields. But when I log on nothing happens with these fields.

I use MS Active Directory as LDAP server. Accounts that log on to drupal dont exist - so they are created during first logon. Mail and username are filled with data from AD and my test fields are not :-(

Trying to figure out what is the problem but with no success at the moment. Will continue to search, but maybe i dont know some secret. So i decided to write here, sorry if it was a wrong decision...

And sorry for my english :-)

I apologize for not explaining the current functionality of the module. It will not do what you are asking of it right now. It currently only works with ldap_provision until more development is done to integrate it with other piece of the ldap package. The way it currently works is:

1. Install & enable both modules
2. Complete your mapping between drupal and ldap fields as you have described.
3. Visit the provisioning page and select the options for what accounts you want to create/update (i.e. all people once a day, every cron, etc)
4. If you are testing I would suggest selecting every cron so you can see immediate results. Run cron and then look at recent log messages to see what happened.

you should see 3 watchdog messages like the following
LDAP processing x accounts
LDAP create success for x
LDAP update success for x

this will let you know that the cron job worked and give you some details about how many accounts were created/updated.

Let me know if this seems to help.

I will update these modules to be more integrated soon, but as of right now the ldap_authentication will not utilize ldap_profile to get the mapping information, only ldap_provision will.

thank you for reply so quickly.

In my previous post i said i installed ldap_profile module but indeed I installed them both and checked cron results. It said:
LDAP processing 1 accounts
LDAP create success for 0
LDAP update success for 0
No matter what type of filtering I choose: all accounts or just one account by username, or ldap query. And nothing happens to fields in user profiles and zero users created. If i submit a test in a ldap_provision form it prints out a table header but no strings in a table.

I thought: well, it doesnt work like this so it may work when user logs on for the first time. No success. So i posted my previous message and begun to explore code.

And found just what you said about ldap authentication not using this feature half a hour before your post :-)

ldap server test do search all users and properties that i wanted to populate, so problem is not there.
Ldap authentication works fine.
No errors in log.

For now i have no more ideas which way to go to find a problem. Maybe its AD special feature? Maybe field type in the user profile must be not a text? Maybe cyrillic data in AD do this? Please help!

Update: search() function returns nothing... continue

If the test isn't returning, then there is a problem with the ldap_provision search. Are you using a DN and password for non-anonymous search in your ldap server configuration. Is your base dn in that configuration the same one where your users are located? Does the test function for the ldap_servers return a result when you put in a valid username? Just trying to get a better idea of what differences could be to your setup vs mine.

Yes. I use a dn an password for non-anonymous search.

I have 4 base DNs in my config. Each of them contains users.

Test function in ldap_servers calls user_lookup() function. In this function they use foreach cycle for each basedn in configuration. This function returns a good result for users in each of my basedns.
Your function calls directly search() from Ldapserver object. And it returns false because of my multiple basedns.
Second problem is that when i select 'all users' filter it searches with filter 'uid=*' - ad returns nothing. Replaced filter with 'mail=*', caus' each of my users has email in properties.
It started to search if basedn is forced to first of my basedns (changed condition in search method of Ldapserver class. im not a programmer so my terminology may be wrong, sorry).
It finds 97 accounts in this ou and then i have several error messages and no users adds to drupal :( errors attached.

I continue. There is a progress :)

Victory!

It now does everything it should.

Users added and fields filled.

Needed to change sAMAccountName in server configuration to samaccountname and that it. Dont know why, but in Ldapserver class there is strtolower on attributes names. So your module searches key like it is entered in my config while search results contain them in lower case.

Now cant decide what to change to get full happiness: i need accounts to be searched in all my basedns. So i can change search method in ldap_servers which is wrong written for my situation. Or i can change your search method to pass basedns one by one.

Thanks for collaboration!

I added a couple updates to the modules that hopefully gets this a little closer to working. I added some initial support for multiple servers and multiple dns per server. I also fixed a bug that had hardcoded a user_attr of 'uid' instead of getting the variable from the server configuration. Let me know if this fixes any problems.

Made small adjustment to ldap_profile module to fix the strtolower issue. Attached both to keep latest copies of the module together in the post.

1. when running cron it gives an error:
Fatal error: Cannot use object of type LdapServer as array in /data/drupal/data/sites/all/modules/ldap_provision/ldap_provision.module on line 132

2. after fixing #1:
Notice: Undefined index: sid in ldap_provision_cron_job() (line 142 of /data/drupal/data/sites/all/modules/ldap_provision/ldap_provision.module).

3. after fixing #2 - no more errors but
Create = 0 - Update = 0 - Failures = 0 for each of my basedns

4. when doing a test in configuration form it finds all users with mail (as configured). but no usernames are printed in the table. this is because of not initialized variable $ldap_server in ldap_provision.theme.inc (i inserted a foreach cycle for $servers et voila!).

5. If i choose 'all users' filter it finds not only users but groups also and if there was a computer accounts, i think, they was found too. This is AD 'feature' i think. maybe checking server type and adding objectclass=user to the filter for ad ldap will be reasonable.

6. What do you think about add one more filter type: recently changed users. For example it will be possible to search only users, changed since last provisioning. But the value of the date must change each time this filter is applied...

Let me know if you want this in the ldap project and I can check it in and give you git rights to the project.

As for me, i am sure this must be a part of ldap project.
I am building an intranet portal and it is based on AD authentication, authorization and user information.
Generally speaking, ldap databases are created for storing everything about people. So not having this functionality in ldap project makes it defective (or to say incomplete).
As I wrote earlier, I am not a programmer. So I would be very happy if daniel.tyree continue this project. From my side I am ready to do everything I can do to help.
(Also I am interested in og_ldap development with the same readiness).

I added an og (organic groups) integration issue at #1143422: OG Organic Groups Integration

If at all possible, I would love the ability to pull in additional attributes from our LDAP server into Drupal. I am extensively modifying Drupal to make it suit our needs and would love to be able to personalize our users experience by addressing them by their first and last name rather than their user ID. There are also a few other systems that we are looking at integrating but need to be able to pull in attributes directly from our LDAP server. Is this something that you foresee being added by Sept? That is when our site will be going live.

I fixed some of bugs in ldap_provision module. Now it works for me. Attached fixed version.

thanks for the updates. Ill will make sure to put them in the module.

John, if you still want to put this in head, I will continue to update it if you give me rights.

I'm also looking forward for this feature. Subscribing.

This is in head (#10, Not #16). I put it in head over the weekend. I also gave daniel.tyree vcs/git rights. I took the numbering out of the tabs after settings and servers, since the order was irrelevant.

My assumption is this should be in 7.x-1.x, not 7-x-2.x. http://drupal.org/node/806106

Sounds like their is fair amount of interest in this. Hopefully someone can step up and do some documentation. I also think a test link like in ldap authorization and ldap servers will help illustrate what the module does and help people debug tjheir configuration. Both will cut down on the number of support issues.

#16 was not in most recent dev so I basically did the same he did :/

I totally agree there's something wrong with multi-server field mapping, but because it's not widely used, let's move #16 to dev sooner to remove possible excess work for people like me.

p.s. info file is changed a bit

daniel.tyree is the only one in this thread that has commit rights to the ldap project. I don't use ldap provision, so can't be of much help. Let me know if a second ldap provision coder needs git access.

I think the general approach should be keep this is 7.x-1.x-dev and put it in the beta releases. If it has some documentation and simpletests, try to release it with 7.x-1.0 RC

Can someone start a different issue for the bug(s) in #21?

I have fallen behind due to work requirements not allowing me to update the modules. I will try to get to those mentioned pushed in this week.

#21
if someone is using code i attached - I had a bug in ldap_provision.module code, line 128:
You have to change
$accounts = $variables['accounts'];
to
$accounts = $auth_conf->search();

Here's a thread for progress updates: #1115704: Drupal 7 Status Updates

Bugs and patches should have their own issues. It makes their issue queue easier to manage.

I am using this module , but unable to map my custom first name field with ldap givenname filed . can anyone help me to solve this issue