I have a large AD setup which has not been configured in the ideal fashion, the base DN:


Now the existing structure of our AD looks something like:

@ 1122 Logan
@ 2150 Logan
@ 1480 Church

Trying to test the authentication of the user Alejandro (old network guy was being funny when he gave me a user name).

Here is my Server Property Dump:

Server Properties:

sid = Davinci
numeric_sid = 1
name = Employees
status = 1
ldap_type = ad
address = davinci
port = 389
tls = 0
followrefs = 0
bind_method = 2
basedn = Array ( [0] => dc=davinci,dc=cadorath,dc=local )
binddn =
user_dn_expression = cn=%username,%basedn
user_attr = samaccountname
account_name_attr =
mail_attr =
mail_template =
picture_attr =
unique_persistent_attr =
unique_persistent_attr_binary = 0
ldap_to_drupal_user =
testing_drupal_username = Alejandro
testing_drupal_user_dn = cn=Alejandro,ou=@ 1122 Logan,dc=davinci,dc=mydomain,dc=local
grp_unused = 0
grp_object_cat =
grp_nested = 0
grp_user_memb_attr_exists = 0
grp_user_memb_attr =
grp_memb_attr =
grp_memb_attr_match_user_attr =
grp_derive_from_dn = 0
grp_derive_from_dn_attr =
grp_test_grp_dn =
grp_test_grp_dn_writeable =
search_pagination = 0
search_page_size = 1000

I enter in my password for non-anonymous search (Windows login password)...

Testing Drupal DN:

cn=Alejandro,ou=@ 1122 Logan,dc=davinci-1,dc=cadorath,dc=local

Drupal logs report:

LDAP bind failure for user userdn=, pass=XXX.

Where does the userdn get constructed???

I still cannot login to drupal with Windows login details...D7 is running in the same domain as Davinci so I assume I missing something in the syntax of connection string???

  • Which version of the ldap module are you using? This is working for me similar to the answer from tenken. – Johnathan Elmore Aug 31 '14 at 13:21

The ldap config page for users and fields has a user_dn entry you can set.

  • I visit: admin/config/people/accounts/fields and see an "ldap_user_current_dn" field but its hidden and locked for modification? How does this supposed to work? – Alex.Barylski Apr 22 '14 at 19:26
  • hmmm, on my setup(s) its usually not inactive. It lets you set the DN needed for some LDAP configurations. On a Windows LDAP box (I never got to fully work), I was using the following based on sysadmins request cn=%username@YOURDOMAIN.FOO,%basedn – tenken Apr 22 '14 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.