LDAP password sync, happens every login

Question

I've successfully setup the LDAP configuration so that users can login to Drupal using their LDAP account. I've mapped the Drupal password to the LDAP password so that when users change their Drupal password it updates their LDAP password.

I mapped Pwd: User only to [unicodePwd] and it synchronizes On LDAP Entry Creation and On Synch to LDAP Entry.

Those are the only two Synch options, and I need them in order to set the LDAP password.

The Question How can I synchronize the password only when the user sets their Drupal password? The LDAP password expiration date keeps changing every time a user logs into Drupal because it synchronizes the password with LDAP.

Edit: I actually thought I answered this question by only checking On LDAP Entry Creation and not On Synch to LDAP Entry. That did prevent the password from being set every login, but it also prevented it from being changed at all! Problem remains...

Answer 1

The password field is special in that it should only be synchronized when the password changes. The most current version of the LDAP module can trigger field synch's either on account creation or during any account synch. It doesn't allow the password field to be triggered only during password changes.

The password field can be unicodePwd for AD, or userPassword for other LDAP databases.

I had to modify the 7.x-2.x April 8, 2014 version of LDAP to get this to work. Within the modifyLdapEntry function we need to know if the password field is being modified. Don't synchronize the password field if we know the password is not changed (which is true during login synchronization). Also, do not synchronize the password if it's not set (such as during the edit account page).

Modify LdapServer.class.php, function modifyLdapEntry(), adding global variables for the current password, and for whether or not the password is being changed. If there is no current password but we are changing the password (such as password reset form or admin edit user form), set the password. Also, if the current password is given and it does not match the new password (such as user edit form), set the password. Otherwise, unset that property from being synchronized.

..

  global $current_password;
  global $changing_password;
  if ((empty($current_password) && $changing_password) || (!empty($current_password) && $current_password != $attributes['unicodePwd']))
  {
    $attributes['unicodePwd'] = ldap_servers_convert_password_for_active_directory_unicodePwd($attributes['unicodePwd']);
  }
  else
  {
    unset($attributes['unicodePwd']);
  }

..

Modify the ldap_user.module, function ldap_user_grab_password_validate(), and set the current password if it is given, and set the changing password variable if we know it's changing.

/**
 * store password from logon forms in ldap_user_ldap_provision_pwd static variable
 * for use in provisioning to ldap
 */
function ldap_user_grab_password_validate($form, &$form_state) {

   // This is not a login form but profile form and user is inserting password to update email
  if (!empty($form_state['values']['current_pass_required_values'])) {
    if (!empty($form_state['values']['current_pass']) && empty($form_state['values']['pass'])) {
      ldap_user_ldap_provision_pwd('set', $form_state['values']['current_pass']);
    }
    // Or this is a profile form where the user is updating their own password
    elseif (!empty($form_state['values']['pass'])) {
      global $current_password;
      $current_password = $form_state['values']['current_pass'];
      ldap_user_ldap_provision_pwd('set', $form_state['values']['pass']);
    }
  }
  // otherwise a logon form
  elseif (!empty($form_state['values']['pass'])) {
    if ($form['account']['pass']['#type'] == "password_confirm") {
      global $changing_password;
      $changing_password = TRUE;
    }

    ldap_user_ldap_provision_pwd('set', $form_state['values']['pass']);
  }
}