Our plan is to allow customer to register for site access through Drupal, then on approval it should provision an LDAP record. That's the plan, anyway, since I've got a similar setup running on D6, and from what I've read it seems like that should be possible in D7. I set up all the info on D7 like I do in D6, all the required modules and pre-reqs check out, and it seems correct.
Specifically, I've set up Under "Servers -> Server Configuration" the Base DN to be "ou=members,dc=site,dc=org" and under "Expression for User DN" I have "uid=%username,ou=members,dc=site,dc=org", where I'm assuming %username is the Drupal username.
Then under "User -> Basic provisoning to LDAP settings" I'm mapping "Provisioning from Drupal to LDAP Mappings", and I have a field where I've selected "--user tokens--" and set the value there to be "uid=[username],ou=members,dc=site,dc=org" with the Target LDAP Token to be "[dn]."
I've made progress but I'm stymied when setting the Drupal user to "approved." I get this message:
Debug:
'LDAP Server ldap_add(<em class="placeholder">uid=,ou=members,dc=site,dc=org</em>) Error Server ID = <em class="placeholder">aulv02admin.site.org</em>, LDAP Err No: <em class="placeholder">34</em> LDAP Err Message: <em class="placeholder">Invalid DN syntax</em> '
in LdapServer->createLdapEntry() (line 419 of /var/www/d7test/sites/all/modules/ldap/ldap_servers/LdapServer.class.php).
The changes have been saved.
It looks like it saves changes locally, but I've yet to get it to create an LDAP account. So I guess my questions are:
1) Can I, in fact, create an LDAP account out of Drupal like I'm planning to?
2) If so, where might I look to find the source of this error? The clue would seem to be the missing data in the ldap_add() command where it goes "uid=[no data],ou=...". If my guess of [username] in the Drupal to LDAP Mapping is not correct, what might I use there?
| Comment | File | Size | Author |
|---|---|---|---|
| #13 | Screen Shot 2014-01-24 at 11.59.01.png | 199.45 KB | kenorb |
Comments
Comment #1
johnbarclay commentedThis definately needs some documentation. I'm tagging this as a task.
What fields are you mapping? Here are some examples: http://drupalcode.org/project/ldap.git/blob_plain/refs/heads/7.x-2.x:/ld...
The documentation should go at: http://drupal.org/node/1685352, but any help within the ui is also appreciated. I thought I put a section like "Example Tokens and Mappings" in the UI of ldap user.
Comment #2
taquil commentedThanks for the prompt response. Under the LDAP Configuration/User tab, in the section labeled "Basic Provisioning to LDAP Settings," there are 3 LDAP servers: one is our employee AD that is read-only, then there's the LDAP server I'd like to provision our members into. And Hogwarts I assume came with the install(?). I've chosen the member LDAP. Under "LDAP Entry Provisioning Events," I've checked all 3 boxes. Then in "Provisioning from Drupal to LDAP Mappings" I've got 5 fields:
1) Property: Username to Target Token [uid]
2) Property: Email to Target Token [mail]
3) Property: Drupal User Id to Target Token [uidNumber]
4) --user tokens-- with this string: uid=[username],ou=members,dc=site,dc=org to Target Token [dn]
5) --user tokens-- with this string: uid=[username],ou=members,dc=site,dc=org to Target Token [entryDN]
Then on all 5 lines I've checked the box to synch "On LDAP Entry Creation" and none have the "On Synch to LDAP Entry" checked.
This is what I have so far. The goal is to build a member signup form that collects name, company, address, phone, etc., and upon approval of the account in Drupal it would create the user account in LDAP and populate it with all that data. Then, hopefully, allow the members to edit their info in Drupal, address, phone, etc., and that would get updated in LDAP. But 1 step at a time.
Comment #3
taquil commentedAh, I just figured out that the token "[property.name]" was literally that. I was thinking it was just an example like SomeGenericProperty.SomeAttributeName. I replaced that in my User Token string and re-saved my Drupal user and was rewarded with a new error:
So the username "cbarkley" is in there for the uid value, but something else is failing. The Drupal Userid for Cbarkley is 70. Looking at the Drupal log, there are 7 messages that were recorded when I clicked "save" on the user screen. Two of them say this:
Type: ldap_server
Location: http://d7test.site.org/user/70/edit?destination=admin/people
Message: ldap_read() function error. LDAP Error: No such object, ldap_read() parameters:
One is the Debug message above, and one is very similar:
Type: ldap_server
Location: http://d7test.site.org/user/70/edit?destination=admin/people
Message: LDAP Server ldap_add(uid=cbarkley,ou=members,dc=site,dc=org) Error Server ID = aulv02admin.site.org, LDAP Err No: 65 LDAP Err Message: Object class violation
And two are more telling:
Type: ldap_user
Location: http://d7test.site.org/user/70/edit?destination=admin/people
Message: LDAP entry on server aulv02admin.site.org not created because error. . username=cbarkley, uid=70
Type: ldap_server
Location: http://d7test.site.org/user/70/edit?destination=admin/people
Message: ldap_read() function error. LDAP Error: No such object, ldap_read() parameters:
When I test the connection to the member LDAP it all works fine doing the connection and looking up test users, even those created created with the D6 installation.
Comment #4
johnbarclay commentedThese are some mapping people often forget:
The best way to make sure you have all the required ldap attributes is to either check in the ldap schema or just look through an existing person/entry. Another approach is to create a minimal user via some other ldap interface such as apache directory studio.
Comment #5
johnbarclay commentedthose are specific to a particular ldap. Yours may be different.
Comment #6
taquil commentedI've gone through the LDAP user schema and I think I got all the required fields created now, but when I try creating a new user I still get the same error as above, with the Err No 65.
One thing I've noticed is on the /admin/people/create page at the bottom, there are the some LDAP options. One is a pair of radio buttons that says whether to make it an LDAP related account or not. They seem to pertain to reading from the LDAP server to see if the user account already exists there or not. In this case, they would not, so I'll just leave them empty.
Below that is a checkbox labeled "Create corresponding LDAP entry." The note on it says,"To enable this an LDAP server must be selected for provisioning to Drupal in admin/config/people/ldap/user and manual creation of LDAP accounts must be enabled also." I am confused about this, because it's the same instructions that appeared on the radio buttons before they became active. I don't want to provision from LDAP to Drupal but the other way around. It's inactive no matter what I try, but it seems to be a key to the matter. On the specified page, I've got:
1) under "Manual Drupal Account Creation and Updates" the "Show option on form" option checked.
2) I have "None" for Basic Provisioning to Drupal Account Settings.
3) On Basic Provisioning to LDAP Settings, I've chosen the member LDAP server, and
4) Below that the three Provisioning Events checked, and all the fields mapped, AFAIK.
Below that is a paragraph explaining the relationship between a Drtupal user and LDAP entry, and it indicates there should be a table with the mapping between Drupal and the server, and if no tables are listed below, I haven't enabled provisioning servers at the top of the form. I have no tables display, but it seems like I have enabled the provisioning server. Or maybe I haven't, since, again, I don't want to read from LDAP to create a Drupal user, but vice versa.
Comment #7
taquil commentedJust figured out that the error code shown comes from the LDAP itself, not the module. Now that I know that, and with some improvements to my settings, I've been getting different errors, first 21, now 19, which I believe is a value being passed that the LDAP can't swallow. Is there any way to figure out which element that's referring to?
Comment #8
taquil commentedStill unable to make this work. I am unclear of the meaning of post #4. Is there a step-by-step guide to using this tool?
Comment #9
johnbarclay commentedNo step by steps. Not much documentation energy in this module's users thus far.
Comment #10
taquil commentedThen could you expand on #4? If there's something essential that I need to make this work, could you explain what it is?
Comment #11
kenorb commented#2
I don't think you needentryDN for user creation, as you'll get the following constraint violation error:
Use [dn] instead.
Comment #12
kenorb commentedHere is the configuration which I've tested and it works fine for me:
URL: /admin/config/people/ldap/user
Section: Provisioning from Drupal to LDAP Mappings
All of the options has 'On LDAP Entry Creation' enabled, but 'On Synch to LDAP Entry' is disabled.
Columns: User tokens, Source Drupal User tokens, Target LDAP Token.
Mandatory configuration:
Optional configuration (depending on your Drupal+LDAP configuration):
See below:

Command line for testing LDAP entries (change it accordingly to your LDAP configuration):
Note: For those who have some errors, please set loglevel to -1 and check the LDAP logs to find the further error.
Related:
http://drupal.stackexchange.com/questions/21883/create-a-new-user-in-lda...
Comment #13
kenorb commentedComment #14
kenorb commentedComment #15
kenorb commentedRelated: #2276463: LDAP Error: No such object on user creation.
Comment #16
darvanenAs an experienced Drupal admin new to LDAP I found this post REALLY helpful, particularly as it came up first when I searched Google for my problem. One thing that may help others in the future is that the error: Object class violation happens not only when you
a. Forget to map the object classes for your user
b. Fail to map all of the required attributes
but also when you
c. Try to map attributes that are not listed among the optional attributes for your classes
I hope this helps someone else in the future =)
Comment #17
dacoman commentedHi kenorb, I was wondering where did you get the 'Field: Your first name' as a user token option. In my implementation of Drupal7 with Open LDAP (Ubuntu server) there is not such option. What is driving (generating) the user tokens in the left most column? Thank you for your time.
Comment #18
kenorb commented@dacoman Probably it was a text field for the user entity object (as it says 'Field').
Comment #19
grahlI'm closing this since I cannot see any specific element of documentation we need to improve, please let us know if and what from the exchange above you believe still needs to be explained better.