after one day, i finnaly figured out how to :)
I've first found some help on those both discutions :
a)https://www.drupal.org/node/1920682 (see kenorb answer)
b)Create a new user in LDAP, not wherever Drupal normally creates it (see kernorb answer again)
HOW TO :
1) from LDAP server create manually an inetOrgPerson account (in phpldapadmin it is called a "Courier Mail Account") , let's call it 'myuser'
next steps will be done in drupal admin=>configuration=>people=>LDAP configuration
2) setup LDAP server, and test it (see links above for further details)
3) again in server test page, set myuser into 'Testing Drupal Username' field.
Start the test, then copy somewhere 'testing_drupal_user_dn' value from test result.
4) now 2 things must be done :
a) choose a user schema, inetOrgPerson is a good schema for drupal as it contains email, username, and password fields
b) find witch fields are requiered by your LDAP server for this schema
so search on google [NameOfTheSchema] [NameOfYourLdapServer] attributes
(e.g : "inetorgperson openldap attributes")
then note witch fields are marked as requiered.
for example i found this :
there we see that
objectClass, sn, and cn are marked as required
To resume, you have now noted somewhere: the dn (step 3) and the required field (this step)
c) now, how to set objectclass?
get back to phpldapadmin, display 'myuser' account that you have manually created, then click on export =>LDIF
as example here my result :
# Entry 1: uid=myuser,ou=drupal,dc=mydomain,dc=lan
description: my description
it is important to respect the order of objectclass fields. In my case i'll have to set in drupal :
UserToken => inetOrgPerson=> [objectclass:0]
UserToken => top => [objectclass:1]
5) go to admin=>configuration => LDAP configuration => user
then "Basic Provisioning to LDAP Settings" section
Check all checkbox into "LDAP Entry Provisioning Events "
Now fill the table bellow
For each line created, you'll have to check both "ON LDAP ENTRY CREATION" and "ON SYNC TO LDAP ENTRY" collumns
a) You MUST have a line with [dn] as target, this is here that you use the dn retreived in step 3.
i had this : testing_drupal_user_dn = uid=myuser,ou=drupal,dc=mydomain,dc=lan
so i add this line :
--user tokens-- => uid=[property.name],ou=drupal,dc=mydomain,dc=lan => [dn]
b) You MUST set objectclass lines . If we refere to my result in step 4) c) , i have to add 2 lines :
--user tokens-- => inetOrgPerson => [objectclass:0]
--user tokens-- => top => [objectclass:1]
c) you MUST add as many lines as there is required fields in the schema. If we refere to my case step 4) b) i have to setup objectclass , sn and cn, so i have to add two more lines :
Property:UserName => => [cn]
Property:UserName => => [sn]
To Resume :
3 steps to follow :
- Setup connection to LDAP server then test it
- Give a correct path to user entries (path is called DN with lpda)
- Choose a user schema (inetOrgPerson is a good one) and fill all fields required by this schema (this is specific of your LDAP server so refere to its doc)
How to test :
in admin=>configuration=>people=>LDAP configuration=>Settings , check " Enabled Detailed LDAP Watchdog logging.", then edit a user in drupal to trigger the sync with LDAP (assuming you followed my howto). when you save an user in drupal, you'll see an LDAP error message if something goes wrong.