Port LDAP module to Drupal 8

I moved this thread to: #1115704: Drupal 7 Status Updates since its hard to separate d7 and d8 issues.

But I think we should keep this thread for discussion of the drupal 8 port. I just think the issue tagging/tracking should use the data structure of the project module.

We've begun porting this module to Drupal 8. We have limited time and budget so will be concentrating on a small number of areas to get us across the line.
* ldap_servers (Active Directory)
* ldap_users
* ldap_authentication

So far we have:
* Migrated ldap_servers to Entities
* Migrated the ldap_server test form

You should be able to:
* Install ldap_servers
* Install ldap_users
* Install ldap_authentication
* Create an ldap_server
* Test an ldap_server

Again we are only focusing on our use case as we only have one LDAP server to test against.

We'd love to fund someone to get this over the line on our behalf but it would need to be quick. Please PM me if you are interested.

Progress here:
https://github.com/Laudanum/ldap/tree/holly-server-dev

Patch attached (to date) attached.

Ok here is another big patch with progress to date.

So far we have:
* Migrated ldap_servers to Entities
* Migrated the ldap_server test form
* Migrated ldap_user settings
* Migrated ldap_authentication settings

You should be able to:
* Install ldap_servers
* Install ldap_users
* Install ldap_authentication
* Create an ldap_server
* Test an ldap_server and get an LDAP user
* Configure ldap_user module
* Configure ldap_authentication module
* Not white screen if you visit the log in page ;)

Any people wishing to help please chime in.

Fresh install of drupal 8.0.0 RC3, only installed modules are ctools and this so far, got this error when attempting to enable LDAP Server:

Fatal error: Call to undefined function drupal_alter() in H:\srv\dcfwebroot\modules\ldap\ldap_servers\ldap_servers.module on line 945

When I go back to the site it appears to have been enabled successfully, but I haven't tested to see if functionality is broken.

Hi @whiplashomega. Are you installing the module as downloaded from D.O? Did you apply the patch in #4? Or are you using the branch I mention in #3? Line 945 doesn't have a drupal_alter in it anymore. 967 has the drupal 8 version which is \Drupal::moduleHandler()->alter('ldap_servers_ldap_types', $types);. I'm going to post another patch now anyway so maybe wait for that to test.

Ok here is an up to date patch.

So far we have:
* Migrated ldap_servers to Entities
* Migrated the ldap_server test form
* Migrated ldap_user settings
* Migrated ldap_authentication settings
* Migrated the ldap_user_identities table which replaces the core authmap in D6/7

You should be able to:
* Install ldap_servers
* Install ldap_users
* Install ldap_authentication
* Create an ldap_server
* Test an ldap_server and get an LDAP user
* Configure ldap_user module
* Configure ldap_authentication module
* Not white screen if you visit the log in page ;)
* Log in as an LDAP user

Looking at it now I'm thinking that this should have been done as an AuthenticationProvider rather than following the old pattern. However this is supposed to be a straight port. And I'm not clear if AuthenticationProvider is REST only or not.

Hi @queenvictoria.

I downloaded the latest drupal 8 dev version from D.O. and applied the patch in comment #7 above.

After I install LDAP User module in Drupal 8 RC2 I get warnings like this:

Warning: Missing argument 2 for Drupal\field\Entity\FieldStorageConfig::loadByName(), called in C:\xampp\htdocs\drupal8\modules\contrib\ldap\ldap_user\ldap_user.install on line 561 and defined in Drupal\field\Entity\FieldStorageConfig::loadByName() (line 802 of core\modules\field\src\Entity\FieldStorageConfig.php).

If I try to run update.php again I get a message like this:
Some of the pending updates cannot be applied because their dependencies were not met

When I look at the status report page I see this message:

User Fields for LDAP User Module Missing	
Fields are added to the Drupal User entity for LDAP User module functionality. These fields should have been created in LDAP User update 7203. The following userfields are missing:Rerun update 7203 to correct this; it will not write over destroy existing fields.

It looks like it didn't install properly?

I'm wondering if I ran the patch against the correct module? Should I have ran the patch against the latest Drupal 7 version of the module? If not, I'm not sure what else to do to get the module installed. Any assistance would be appreciated!

UPDATE: I also tried installing the module using the version referenced above from GitHub, and I get the same errors.

A step closer? I changed ldap_user_update_check_user_fields() function in ldap_user.install to look like this, which fixed the "missing argument" errors in my above comment:

$entity_type_id = $field_conf['instance']['entity_type'];
$field_info = \Drupal\field\Entity\FieldStorageConfig::loadByName($entity_type_id, $field_id);

Now I can at least load the LDAP Configuration pages (which didn't show up previously). I'm still seeing other warnings and still can't run update.php, but this might be a good start...

Hi @beefheartfan.

Please use the branch on github that I mentioned and report any errors. And of course you shouldn't be using this in production.
https://github.com/Laudanum/ldap/tree/holly-server-dev

You shouldn't be getting update errors as there are no D8 updates yet. I'll remove them from the code.

Also try and catch me on #drupal-contrib or #drupal-au to discuss where its falling over. Thanks!

Hiding patches

Ok here is an updated patch which should be against 8.x-2.x-dev (git HEAD). I've removed the update hooks. There is an 8000 update which may fail as 1) it shouldn't be numbered 8000 and 2) the update probably isn't needed. Please let me know.
-- EDIT don't use #12 patch it is BACKWARDS

Sorry that patch was backwards please try this one instead.

Thanks! I used the patch in #13 against 8.x-2.x-dev (git HEAD). This worked great for LDAP Servers module. I was able to get my server set up and run a test against it.

However, when I attempted to set up the users and authentication, I got a white screen with these errors in my PHP log file:
Recoverable fatal error: Object of class Drupal\Core\Field\FieldItemList could not be converted to string in \modules\contrib\ldap\ldap_user\LdapUserConfAdmin.class.php on line 70

Recoverable fatal error: Object of class Drupal\Core\Field\FieldItemList could not be converted to string in \modules\contrib\ldap\ldap_authentication\LdapAuthenticationConfAdmin.class.php on line 268

I changed those lines to remove the references to the server->name objects and it seems to work fine! I was able to set up my users and authentication and successfully login to the site through LDAP!

For example, I changed this:
$this->authenticationServersOptions[$sid] = $ldap_server->name . ' (' . $ldap_server->address . ') Status: ' . $enabled;

to this:
$this->authenticationServersOptions[$sid] = $sid . ' Status: ' . $enabled;

Hi there. I've already fixed this in the github port that isn't in the current patch in #13 that fixes this. Do you think you could switch to github? Make sure to use the `holly-server-dev` branch
https://github.com/Laudanum/ldap/commit/8c0b98140c6f3f25356d5151c723c46d...

Here is an updated patch. We've moved into the 8.x-3.x branch as we are refactoring to a new pattern. Please see the issue queue on github and the D.O issue on module port progress.

https://github.com/Laudanum/ldap/issues

I downloaded the latest version from the github mentioned in #19 above:
https://github.com/Laudanum/ldap

I am able to successfully create a server, set up authentication and user info, and actually login using LDAP. Thanks so much for your work so far!

I've created a diff between D.O 8.x-2.x and Github 8.x-3.x. It's still a better idea to use Github at the moment please.

A major change is the way ldap_authorization is being handled.

LDAP Authorization allowed LDAP data to configure a Drupal user's authority (not to be confused with authenication). For example adding them to a Drupal role (ldap_authorization_drupal_roles) or an Organic Group (ldap_authorization_og).

After discussions with @johnbarclay we've created a new module "Authorization" to handle it in a more abstract way. ldap_authorization is now an Authorization "provider" and ldap_authorization_drupal_roles is now a new Authorization "consumer" called "authorization_drupal_roles" inside Authorization.

https://github.com/Laudanum/authorization

This allows modules from any kind of authentication to provide data for authorizations. It also allows modules to provide different kinds of consumers. The Authentication module is in heavy development and Authentication Drupal Roles is just barely working. Again please use the github version above for now please.

i can install the server module but when i try to install the user module i get this error:

Drupal\Core\Field\FieldException: Attempt to create a configurable field of non-configurable field storage ldap_user_puid_s
id. in Drupal\field\Entity\FieldConfig->getFieldStorageDefinition() (line 294 of C:\inetpub\wwwroot\dru8\core\modules\field
\src\Entity\FieldConfig.php).

Update:it turns out since this is an updated site from drupal 7 which had the ldap module enable it had in the database the fields populated and created an entity mismatched, i fixed it by deleting the old tables in the database and then enabling the modules and now it works.

Good to hear it is working on Windows! Please submit any fixes you make as pull requests in github. Greatly appreciated!

I am unable to activate the module because it requires the "number" module as far as I can tell this module doesn't exist.

http://screencast.com/t/5JTwnJAiGQ

EDIT : Will try x.3.x before

@F.E.M. and @ Sdesplanque please use the 8.x-3.x branch from Github. Also you'll need the ExternalAuth (D.O) and Authorization (Github) to complete the set.

Please see #22 for the explanation.

Hi All,

I have Drupal 8.0.3 with LDAP installed (from the 8.x-3.x branch from Github)

I am attempting to get AD LDAP authentication working. I successfully bind to AD, and when I use my AD account to test, it finds me (count = 1). But, when I try to login with my AD credentials, it doesn't work.

I followed all the instructions for this LDAP module install; seems to be working; but when I try to add users, I get the following error:

Notice: Undefined property: LdapAuthenticationConf::$templateUsagePromptUser in Drupal\ldap_authentication\EventSubscriber\LDAPAuthenticationSubscriber->onEvent() (line 15 of C:\Apache24\htdocs\modules\ldap\ldap_authentication\src\EventSubscriber\LDAPAuthenticationSubscriber.php).

Is there anything I should do to get this working with AD?

Thanks for the help,

Hmm I'm using AD successfully. You'll need:

• ldap_servers
• ldap_user
• ldap_authentication
• in future you'll need externalauth

You'll need to set ldap_user and ldap_authentication to use the server you created and tested. Perhaps send screenshots or .yml files of your configuration (xxxx out the passwords &c.).

Some options aren't wired up. Perhaps you've ticked some boxes that don't go anywhere?

Are you also using Authorization module?

edit --

Hey I see that @webflo reported this too here
https://github.com/Laudanum/ldap/issues/16

Looks like I had a look at it and decided its legacy and should be removed or replaced.

Hi,

Could you tell me where and which .yml files to present?

As an aside, I installed Drupal, v7 and it works with AD. I had to get something up and running for the next phase of development, for the team...

I can move back to d8 - and I want to.. Just ran out of time yesterday. So, if you could tell me where I need to go, I'll get those config/settings..

Thanks, lots.

Andrew

Ok so maybe screenshots are simpler ;)

If you export your configuration to code then you'll need:

ldap_authentication.settings.yml
ldap_servers.*.yml
ldap_servers.settings.yml
ldap_user.settings.yml

I'm attempting to get this working against OpenLDAP. I'm able to create an ldap serve, and test against it successfully.

When I try and login to the drupal site via an ldap sourced user it will not authenticate, looking in the server logs I see the following error:

Notice: Undefined property: LdapAuthenticationConf::$templateUsagePromptUser in Drupal\ldap_authentication\EventSubscriber\LDAPAuthenticationSubscriber->onEvent() (line 15 of /usr/local/www/drupal8/modules/ldap/ldap_authentication/src/EventSubscriber/LDAPAuthenticationSubscriber.php).

Hi @darcyb. I've had LDAP 8.x-3.x working successfully against a Dockerised OpenLDAP. Please confirm that you are using the Github version. Note that a lot of options aren't wired up.

By the sounds of it you could solve the undefined property issue by a) defining it or b) removing it if its not required. You could then create a pull request which I would accept.

When i add a server i can test it in the test form if i input the search password manually but if i leave it empty to test with the stored password it fails.

Failed to bind to server. ldap error #49 Invalid credentials

Also i suspect that because of this when a user tries to login i get an authentication failed.

I have ldap, user and authentication all using the same server.
I'm on the 8.x-3.x branch from github.

@wolfhowling do you think you could provide yml files for ldap user, ldap authentication and config exports of ldap servers (with passwords xxx'd out and domains switched to example.com) please so we can take a look? Also I'd mention that I've only tested service account binding and I'd added a warning message when there is no password stored for that. Please try service account and check that there is a password stored in the database. It can get messy with encryption too so start with encryption off (I've not been able to test with encryption on yet). Thanks for the report!

@queenvictoria I am using service account binding and the right password is stored but it still gives me ldap error #49 Invalid credentials when testing the server with the stored password.

here it is the files you requested i have dummy information for the domain and binding but they represent exactly what my configuration is like just different characters.

ldap_servers.settings.yml
ldap_servers.server.trv.yml
ldap_user.settings.yml
ldap_authentication.settings.yml

Also i get this 4 error on the log side every time i do a test:

Notice: Undefined property: Drupal\ldap_servers\Entity\Server::$ldapToDrupalUserPhp in Drupal\ldap_servers\Entity\Server->userUsernameToLdapNameTransform() (line 738 of C:\inetpub\wwwroot\venus\modules\ldap\ldap_servers\src\Entity\Server.php).

Notice: Undefined index: class in ldap_user_preprocess_table() (line 135 of C:\inetpub\wwwroot\venus\modules\ldap\ldap_user\ldap_user.module).

Warning: Invalid argument supplied for foreach() in Drupal\ldap_servers\Form\ServerTestForm->buildForm() (line 136 of C:\inetpub\wwwroot\venus\modules\ldap\ldap_servers\src\Form\ServerTestForm.php).

Warning: in_array() expects parameter 2 to be array, null given in ldap_user_preprocess_table() (line 135 of C:\inetpub\wwwroot\venus\modules\ldap\ldap_user\ldap_user.module).

Thanks for all your help.

I'm moving this to the current branch as we've published it on drupal org now.

@wolfhowling I'll take a look asap. Thanks!

Hi @wolfhowling. I've compared your config files to my sample ones (not production but working in dev). And I notice a couple of things.

In your ldap_servers.settings.yml you have a line like
encryption: LDAP_SERVERS_ENC_TYPE_CLEARTEXT
whereas mine is
encryption: 10
Which to me means that the define('LDAP_SERVERS_ENC_TYPE_CLEARTEXT', 10); in ldap_servers.module isn't available where it should be. Please try saving the server settings page again and examine the exported yml file for server settings again after that. You should have the same value as me (10).

Currently I've only been testing exclusive authentication mode. Could you try that and see if that corrects the issue so we can open a ticket for getting that working.
IE not mixed mode. "Only LDAP Authentication is allowed except for user 1" at admin/config/people/ldap/authentication

Finally I don't have orphanedDrupalAcctBehavior set (and you do). I don't think its wired up but you could try removing it here admin/config/people/ldap/user
orphanedDrupalAcctBehavior: user_cancel_block

Ok thanks for testing! Please let me know which (if any) mean that you can sign in. Then we can open an issue for that. (And for the error logs we should open issues for them too).

Hey,

I ran into the same issue

Failed to bind to server. ldap error #49 Invalid credentials

It would work when I input the password into the test form but not when using the saved password. Looking at the config it seemed like the non-anonymous password was hashed so I exported the config, updated it with the plain text password, and then re-imported.

Success :) If i get a chance I might look into what is going on but as a guess it the non-anonymous password is being hashed when it is saved.

Aaron

@queenvictoria i fallowed your instructions and verified that the encryption in server settings is 10 and it is with the right configuration, i put the authentication mode to ldap only and left the orphanedDrupalAcctBehavior untouched.

@Gravypower i have done as you suggested as well and replaced the hashed password with the right password and imported the new configuration and now the test passes.

With this i can login an create new users thanks a lot for the help.

On a slightly different note i have the same issue i had in drupal 7 at one point, in my ldap settings if i set the AccountName attribute to something other than the AuthName atrribute i ge :
Server Error: Failed to create Drupal user account for doe, john

In other words i can login when using the user name but i cant translate the user name to the actual name of the person. In drupal 7 there was a small patch that would make this work i wonder if there is another work around for this.

Again thanks for all your help is been a life saver.

I´m testing 8.x-3.x-dev from DO, with drupal 8.0.5, the LDAP server is AD (samba4), which requires TLS enabled.

I get a white screen when testing, and apache´s log says the script ran out of memory, I increased to 1GB, it still fails.

My ldap_server_settings.yml has encryption: 6, I have no idea if this is correct, or how to change it to 10. (edit: Changed it to no-encryption, set the passwords again, the results remain the same).

It doesn´t matter if I type the test user password or not, the result is the same.

the relevant ldap configuration yml files are attached, please help.

Also, drush updatedb tries to perform ldap_servers_update_8000 every time I run drush updatedb, it reports "Ok", just to be still pending every time. update.php complains about an update that has a missing dependency, but I can´t find any module with such a problem.

Hi there. I don't have an AD server running TLS so it will be tricky to test that. The update script I've updated with a patch today in https://www.drupal.org/node/2698157 . It requires the External Auth module https://www.drupal.org/project/externalauth . The 8000 update can probably be removed as it's probably not required in your situation.

Please open a new ticket for this issue. Also please let me know the version of PHP, the platform, and whether PHP LDAP is compile in and enabled on your server.

Thank you!

Just to document this here, too: I've provided fixes for several minor issues in a pull request on Github https://github.com/Laudanum/ldap/pull/44

I did not run into the issues described by #45 when testing against a Microsoft AD with TLS.

Update hook ldap_servers_update_8000() is not defined correctly. I've created a pull request to fix it. https://github.com/Laudanum/ldap/pull/45

Hi deminy

Thanks for that pull request. Please do not use Github anymore, migration has moved back to d.o. I've created a separate issue for your report here: https://www.drupal.org/node/2742785

Tried the same settings as in Drupal 7.. I can pull down LDAP entries, but I get this funny looking error: "Failed to bind to server. ldap error #82 Success"

On Windows Server 2012 and IIS, server is using OpenLDAP

Hi storm_eagle

Could you please open a separate issue with your problem? Ideally you would turn on log all errors with backtrace and detailed logging via ldap_help and add the output from that there.

I'm new to Drupal and recently installed 8.1.2 and this LDAP module. I've been trying for 2 days to connect to our local Active Directory. However, every time I tried to run the server test I got an error: "Failed to bind to server. ldap error #49 Invalid credentials".
I'm sure the settings are correct and the credentials definitely are (I tested direct in Active Directory and in PHP). I also tried an online LDAP connection and that failed with the same error too. I thought maybe it's just the test that doesn't work so I tried logging in with a known AD account but it didn't work. As a final test I just installed Drupal 7 (and the modules for that) instead and with the same settings everything worked perfectly first time (tests ran as expected and I logged in with an AD account).
Please can you let me know whether I could be overlooking something simple with the settings in 8 or if it is a bug. I really don't want to use 7, but we definitely need our users to be able to log in using their network details.

The 8.x LDAP module not that friendly with our LDAP server. We made following hack to the module, and everything worked fine after that:

diff --git a/ldap/ldap_authentication/ldap_authentication.inc b/ldap/ldap_authentication/ldap_authentication.inc
index a618398..f40578e 100644
--- a/ldap/ldap_authentication/ldap_authentication.inc
+++ b/ldap/ldap_authentication/ldap_authentication.inc
@@ -186,6 +186,11 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state, $re
     return;
   }
 
+  // the value of $ldap_user['mail'] is 'false', so we need update it manual with value from attr:mail:0
+  if ($ldap_user['mail'] === false) {
+    $ldap_user['mail'] = $ldap_user['attr']['mail'][0];
+  }
+
   /**
    * V. if account_name_attr is set, drupal username is different than authname
    */
@@ -329,6 +334,9 @@ function _ldap_authentication_user_login_authenticate_validate(&$form_state, $re
       $user_edit = array('name' => $drupal_accountname, 'status' => 1);
     }
 
+    // ldap module UI bug: can not update mail mapping in ldap-user module
+    $user_edit['mail'] = $ldap_user['mail'];
+
     // don't pass in ldap user to provisionDrupalAccount, because want to requery with correct attributes needed
     // this may be a case where efficiency dictates querying for all attributes
     $drupal_account = $auth_conf->ldapUser->provisionDrupalAccount(NULL, $user_edit, NULL, TRUE);

We didn't propose a pull/merge request since this hack is just for our LDAP server. Hope it may be helpful for someone.

We are building a new Intranet (employee-only, behind a firewall) site, and want to use LDAP to allow users to log in on this new RHEL server running Drupal 8, using their local Microsoft AD credentials, and we also want to be able to access AD information such as the user's phone number and office location from their AD record and display this somehow in Drupal.

Is this possible?

We're new to using Drupal 8, but are pretty committed to doing so -- however, we have never used the LDAP module before (not even on our other Drupal 7 site).

Should we set up a new vanilla Drupal 7 site just to get familiar with how this module works? What kind of ballpark timeframe are we facing with regard to the Drupal 8 module being ready? Should we just wait?

Or, is the 8.x-3.0-alpha1 version good enough to start using?

Hi @chickenofeathers.

Yes you can do that with D8. You configure the module to populate Drupal user fields from LDAP fields when the user is created or updated (usually at login). I have this working on a site in production where we are grabbing the users' full name at login. I am also populating Drupal roles from LDAP groups.

I have started porting the LDAP feeds module which would allow you to update or import on a schedule but that isn't ready yet.

Hope that helps. Feel free to drop me a line if you get stuck.

Hello,
Thank you for your contribution but I can't make it work. I'm new to drupal and I'm trying to connect a fresh install of D8 to an Open LDAP server.
The connection to LDAP Servers seems to be OK, the tests are good width the module "ldap servers" (search a person and bind). But then when I try to activate "ldap users" module I got a few PHP Notice : undefined index ldap_user_puid_sid, ldap_user_puid, ldap_user_puid_property, ldap_user_current_dn,ldap_user_last_checked, ldap_user_ldap_exclude in \core\lib\Drupal\Core\Entity\Sql\SqlContentEntityStorage.php on line 568.
And the update ends with an error "The website encountered an unexpected error. Please try again later."
The same error occurs with the plugin "ldap-8.x-3.0-alpha1.tar".

In the status report, I have
Mismatched entity and/or field definitions
The following changes were detected in the entity type and field definitions.
User
The LDAP Server ID that puid was derived from. NULL if puid is independent of server configuration instance. field needs to be installed.
The Value of user's permanent unique id . This should never change for a given ldap identified user. field needs to be installed.
The Property specified as user's puid. field needs to be installed.
The User LDAP DN field needs to be installed.
The LDAP Entries that have been provisioned from this Drupal user. field needs to be installed.
The Unix timestamp of when Drupal user was compared to ldap entry. This could be for purposes of synching, deleteing drupal account, etc. field needs to be installed.
The Whether to exclude the user from LDAP functionality field needs to be installed.

Am I missing a step in the installation ? I can't find why it doesn't install...
Thank you for your help.

Hello,
I'm back with my drupal installation and ldap_user still not working for me. I'm still missing something at the installation.
As I read ldap_user.install line 81 and 85, it fetches the user info in a table called "ldap_user_identities" but I don't have any table "ldap_user_identities" ! that makes me crazy !
Who can explain my mess ?

Hi phvaillant

Please open separate support requests for your problems, this issue tracks the port overall.

That being said, the hook is irrelevant for new installations, it only moves data from that legacy table to the authorization module.

Standardized the issue title.

Hi,

I have installed Drupal version 8.2.5, and added the ldap modules. However under Ldap configuration, i cannot see the 'Authorization' tab, (this tab is available in Drupal 7).

Can somebody let me know what is the issue or workaround.

Hi arunpatkar,

This issue tracks the state of the LDAP module and is not the issue to ask for support, please open a separate support request for your problem in the future or if you have follow-up questions.

You can find Authorization under LDAP for the LDAP relevant configuration if the module ldap_authorization is enabled. To configure the actual authorization mappings you need to enable the Authorization module and it has its own page under Configuration.

Closing this issue since we are generally ported and remaining issue are what is blocking the stable release. Keeping contrib tracker at "needs Review" https://www.drupal.org/node/2598412