LDAP User Password in Active Directory does not allow user to log in.

Same thing happening here, unfortunately. The account is disabled by default and the password returned by the module does not match the one in the server.

I am pretty sure the problem here is that LDAP Provisioning expects the password to be in the userPassword attribute, which is correct for most LDAP systems, while Active Directory needs the password to live in unicodePwd, while userPassword is an alias.

I'm looking into the module code to see if there is an easy patch. There are several issues with LDAPProvisioning and Active Directory. Unfortunately I think it all boils down to the fact that this module isn't ready for production use with Active Directory just yet. It's really smooth with an OpenLDAP, but needs some more refinement for the "special" bits in Active Directory.

I don't have a patch yet, but do have a fix if you are in a pinch. The passwords aren't working because they need to be stored as unicode in Active Directory.

If you are writing to Active Directory your LDIF attribute for the password should look something like this:
unicodePwd: !pass
instead of
userPassword: !pass

But, if you set it up that way, the account creation will likely fail, b/c AD will reject entires into unicodePwd that aren't unicode. So, I just hacked up the ldap_prov module to change the password to unicode before passing it to the ldap_auth module's account creation class. Here's my bit of hackery, starting around 1854 in ldap_provisioning.module

$pass_ldap = $_ldapprov_ldap->getOption('encrypted') ? '{md5}'. base64_encode(pack('H*', md5($pass))) : $pass;
/**
 * CUSTOM
 * Converting the password to unicode so that it will properly write to the Active Directory
 * unicodePwd field.
 */
$pass_ldap = "\"" . $pass_ldap . "\"";
$len = strlen($pass_ldap);
$new_pass_ldap = "";

for($i=0;$i<$len;$i++) {
  $new_pass_ldap .= "{$pass_ldap{$i}}\000";
}
...
$ldap_vars['!pass'] = $new_pass_ldap;

...with a little help from my friends.

So now, I guess the question is how do we make this conditional for use in the module.

In other words, what is the best way to denote that your LDAP connection is to an AD system? Should it be part of LDAP provisioning or part of LDAP authentication?

Thoughts?