I am using Lightweight Directory Access Protocol (LDAP) and I have a question about how to put Active Directory users in a certain role based on an attribute such as memberOf.

In version 1.0, you could say in drupal authorization under II.B. DERIVE DRUPAL ROLES that you could look for memberOf or ... and when the user that logs in, has the particular role in that attribute, he receives the role that is defined in part IIA.

For example, you can have this in section IIIA - Role Mapping: CN=Head,OU=Roles,OU=Accounts,DC=Domain,DC=be|beheerder

How can we do the mapping in version 2.0? My groups that I have, are stored in the active directory in extensionattribute14

Kind Regards

1 Answer 1


I've handled this by calling a update user account function during validation against the AD.

First fetch the attributes of that account:

$filter = "(sAMAccountName=" . $username . ")";
// This is where you will need to add in extensionattribute14.
$attributes = array('sAMAccountName', 'givenName', 'sn', 'description', 'telephoneNumber', 'userAccountControl', 'distinguishedName', 'memberOf', 'proxyAddresses', 'Mobile', 'facsimileTelephoneNumber', 'mail', 'employeeNumber');
$result = ldap_search($conn, $ldap_base_dn, $filter, $attributes) or exit("Unable to search LDAP server");
$entries = ldap_get_entries($conn, $result);
$entryid = ldap_first_entry($conn, $result);
$attrs = ldap_get_attributes($conn, $entryid);

And then then call the update account function ($attrs from above is passed in as $values):

 * Makes updates to the users account based on values passed from the AD
 * @param  object $account
 * @param  array $values
function update_user_account($account, $values) {

    // ...
    // Code here to update other values from the AD
    // ...

    if(isset($values['memberOf'])) {

        // Loop over groups.
        foreach($values['memberOf'] as $k => $group_dn) {

            switch($group_dn) {
                case 'CN=GRPHO Intranet Editor,OU=Groups - Restricted,DC=universe,DC=int':
                    $updates['roles'][8] = 'Editor';
                case 'CN=GRPHO Intranet User Editor,OU=Groups - Restricted,DC=universe,DC=int':
                    $updates['roles'][9] = 'User Editor';

                // etc. etc.



    // add back in any roles that this user had that are not controlled from the AD
    if(isset($account->roles[3])) $updates['roles'][3] = 'administrator';
    if(isset($account->roles[15])) $updates['roles'][15] = 'site admin';

    user_save($account, $updates);


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.