Group Sync fail with at least OpenLDAP and "memberOf"

#1 is the desired behavior. #2 is undesirable for performance as well as unpredictability of dealing with binary or otherwise unspecified fields. ldap_servers_attributes_needed was specifically put in to resolve this problem.

Appreciate the patch and asking ahead of time for direction.

I just applied this patch to solve the MemberOf issue. It does did immediately correct the issue for me. Unfortunately, I don't have any other directories to test against. I can confirm that is corrects the issue in OpenLDAP 2.4.23.
I did have a couple of patch hunks fail. Hunk 1 in "ldap_servers/LdapServer.class.php" and Hunk 4 in "ldap_user/LdapUserConf.class.php". But, I did apply it to a beta5 installation.

Cleaner patch with removed dsm()s.
Not including the fix for: #1993092: LDAP *: Why is ldap configuration keyed on user choosen langage ?
I'm not sure how I can test that patch.

I just added the default 'all' context to make this work. Passing a null context into ldap_servers_attributes_needed would likely not get good results. I'll push this as soon as I resolve my current git issue.

This is committed. See:

http://drupalcode.org/project/ldap.git/commitdiff/1e56d1fafb86d5202a5c96...

http://drupalcode.org/project/ldap.git/commitdiff/f09b2acaeadcf891fe0559...

A patch file got committed here (filename Issue1994850#8), and I'm curious why:

function userUserNameToExistingLdapEntry($drupal_user_name, $ldap_context = NULL) {

   if (!$ldap_context) {
     $ldap_context = 'all';
   }

instead of:

function userUserNameToExistingLdapEntry($drupal_user_name, $ldap_context = 'all') {

Hi I've encountered the same problem after updating to beta-8 version, it seems that issue is not still addressed in dev branch.

Here is the patch I've used it mainly does the same as the one previously posted but it also checks for groupUserMembershipsAttrExists.

Came to the exact same conclusion as #11, except in a different place.

Doesn't this seem more fitting in the ldap_servers_ldap_attributes_needed_alter() function where the rest of the required attributes are all located?

 /**
   * Implements hook_ldap_attributes_needed_alter().
   */
  function ldap_servers_ldap_attributes_needed_alter(&$attributes, $params) {

    $attributes['dn'] = ldap_servers_set_attribute_map(@$attributes['dn'], 'ldap_dn'); // force this data type

    if ($params['sid'] && $params['sid']) { // puid attributes are server specific
      if (is_scalar($params['sid'])) {
        $ldap_server = ldap_servers_get_servers($params['sid'], 'enabled', TRUE);
      }
      else {
        $ldap_server = $params['sid'];
      }
      // mail, unique_persistent_attr, user_attr, mail_template, and user_dn_expression are needed for all functionality
      if (!isset($attributes[$ldap_server->mail_attr])) {
        $attributes[$ldap_server->mail_attr] = ldap_servers_set_attribute_map();
      }
      if (!isset($attributes[$ldap_server->picture_attr])) {
        $attributes[$ldap_server->picture_attr] = ldap_servers_set_attribute_map();
      }
      if ($ldap_server->unique_persistent_attr && !isset($attributes[$ldap_server->unique_persistent_attr])) {
        $attributes[$ldap_server->unique_persistent_attr] = ldap_servers_set_attribute_map();
      }
      if ($ldap_server->user_dn_expression) {
        ldap_servers_token_extract_attributes($attributes, $ldap_server->user_dn_expression, TRUE);
      }
      if ($ldap_server->mail_template) {
        ldap_servers_token_extract_attributes($attributes, $ldap_server->mail_template);
      }
      if (!isset($attributes[$ldap_server->user_attr])) {
        $attributes[$ldap_server->user_attr] = ldap_servers_set_attribute_map();
      }
      if (isset($ldap_server->groupUserMembershipsAttrExists) && !isset($attributes[$ldap_server->groupUserMembershipsAttr])) {
        $attributes[$ldap_server->groupUserMembershipsAttr] = ldap_servers_set_attribute_map();
      }
    }
  }

Patch #12 fails with the following because it wasn't made correctly:
http://take.ms/z4QAS

Resubmitting patch using Patch Submission Standards.

Hate to revive this old issue but the patches applied in #9 also broke CAS Attributes. CAS Attributes no longer returns all LDAP tokens. Updating to the latest 7.x-2.x-dev release for some other LDAP fixes broke this for us.

Here's a patch that applies to 7.x-2.x that reverts the two commits in #9 for anyone else running into the issue I described above.

This has been rolled back as it also caused #2779595: Authorization not properly reading group membership

Closing issue as outdated due to no further development on 7.x, if you feel this issue is still relevant and you are willing to work on a patch and/or debug the problem, please reopen.