I have a large AD setup which has not been configured in the ideal fashion, the base DN:


Now the existing structure of our AD looks something like:

@ 1122 Logan
@ 2150 Logan
@ 1480 Church

Trying to test the authentication of the user Alejandro (old network guy was being funny when he gave me a user name).

Here is my Server Property Dump:

Server Properties:

sid = Davinci
numeric_sid = 1
name = Employees
status = 1
ldap_type = ad
address = davinci
port = 389
tls = 0
followrefs = 0
bind_method = 2
basedn = Array ( [0] => dc=davinci,dc=cadorath,dc=local )
binddn =
user_dn_expression = cn=%username,%basedn
user_attr = samaccountname
account_name_attr =
mail_attr =
mail_template =
picture_attr =
unique_persistent_attr =
unique_persistent_attr_binary = 0
ldap_to_drupal_user =
testing_drupal_username = Alejandro
testing_drupal_user_dn = cn=Alejandro,ou=@ 1122 Logan,dc=davinci,dc=mydomain,dc=local
grp_unused = 0
grp_object_cat =
grp_nested = 0
grp_user_memb_attr_exists = 0
grp_user_memb_attr =
grp_memb_attr =
grp_memb_attr_match_user_attr =
grp_derive_from_dn = 0
grp_derive_from_dn_attr =
grp_test_grp_dn =
grp_test_grp_dn_writeable =
search_pagination = 0
search_page_size = 1000

I enter in my password for non-anonymous search (Windows login password)...

Testing Drupal DN:

cn=Alejandro,ou=@ 1122 Logan,dc=davinci-1,dc=cadorath,dc=local

Drupal logs report:

LDAP bind failure for user userdn=, pass=XXX.

Where does the userdn get constructed???

I still cannot login to drupal with Windows login details...D7 is running in the same domain as Davinci so I assume I missing something in the syntax of connection string???

  • Which version of the ldap module are you using? This is working for me similar to the answer from tenken. Aug 31, 2014 at 13:21

1 Answer 1


The ldap config page for users and fields has a user_dn entry you can set.

  • I visit: admin/config/people/accounts/fields and see an "ldap_user_current_dn" field but its hidden and locked for modification? How does this supposed to work? Apr 22, 2014 at 19:26
  • hmmm, on my setup(s) its usually not inactive. It lets you set the DN needed for some LDAP configurations. On a Windows LDAP box (I never got to fully work), I was using the following based on sysadmins request cn=%[email protected],%basedn
    – tenken
    Apr 22, 2014 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.