Create a new user in LDAP, not wherever Drupal normally creates it

Question

We have an already existing LDAP of users, that we wish to use for our new site. Amazingly, the login seems to be only finding the users we want it to, and not the users we don't. We have to figure out why, because we'll probably want to change this in the future. (I mention, in case it's related to my main issue.)

However, the more important problem is that, when we create a new user, we want it to be created in the LDAP, not wherever Drupal creates it. As I understand, when it authenticates against LDAP, it simply copies the user to it's own database, and uses that from then on, which is also not what we want, in case the user changes their data. However, we'd still like the admin user to work, even if the LDAP dies or something. The documentation isn't much help with this.

So, how do I make Drupal (I'm using 7, but I don't know if it's 7 specific) use the LDAP for the creation of new users, and for existing LDAP users? (Hopefully, without totally removing the ability to use the users already in the Drupal db.)

Answer 1

You will never be able to use Drupal's core user module without using the database's user table (and many others), without seriously modifying core Drupal.

It sounds like the only reason you want Drupal to not use it's own user + roles + permissions management (and all of the other contributed Drupal modules that depend on the user module) is so that if a user updates some data in LDAP it's also updated in Drupal. If this is the case, find a method for synchronizing your LDAP user info with Drupal's user info.

You can use the hook_user_ functions in Drupal to perform whatever actions you want to happen when a user account is created, updated, etc., in Drupal. For example, if a new user account is created in the Drupal user registration form you'd be performing whatever logic you need (via PHP, or potentially something else) to insert a new record into your LDAP server.

Answer 2

To configure LDAP with Drupal 7, you'll have to install and configure LDAP module (including ldap_authentication and ldap_user). Once enabled, you'll find the configuration at /admin/config/people/ldap.

First of all, you'll have to add and configure your 'LDAP Server Configuration' depending on your LDAP configuration (Servers tab at /admin/config/people/ldap/servers).

To configure LDAP Authentication in Drupal, choose the LDAP Server Configuration in Authentication tab at /admin/config/people/ldap/authentication.

At the end, to create LDAP entries on Drupal user creation, turn on 'Create or Synch to LDAP entry when a Drupal account is created or updated.' option and the other which you think are necessary and configure Provisioning from Drupal to LDAP Mappings according to your LDAP configuration (User tab at /admin/config/people/ldap/user).

See the configuration below:

Here is example configuration exported into code using Features:

<?php
/**
 * Implements hook_default_ldap_servers().
 */
function foo_ldap_default_ldap_servers() {
  $export = array();
$ldap_servers_conf = new stdClass();
$ldap_servers_conf->disabled = FALSE; /* Edit this to true to make a default ldap_servers_conf disabled initially */
$ldap_servers_conf->api_version = 1;
$ldap_servers_conf->sid = 'ldap_pv';
$ldap_servers_conf->name = 'LDAP: Local Provisioning';
$ldap_servers_conf->status = TRUE;
$ldap_servers_conf->ldap_type = 'openldap';
$ldap_servers_conf->address = 'example.com';
$ldap_servers_conf->port = 389;
$ldap_servers_conf->tls = TRUE;
$ldap_servers_conf->followrefs = FALSE;
$ldap_servers_conf->bind_method = 1;
$ldap_servers_conf->binddn = 'cn=drupal-test,ou=Services,dc=example,dc=com';
$ldap_servers_conf->bindpw = '';
$ldap_servers_conf->basedn = array(
  0 => 'ou=People,dc=example,dc=com',
  1 => 'ou=External,ou=Access,ou=Group,dc=example,dc=com',
);
$ldap_servers_conf->user_attr = 'uid';
$ldap_servers_conf->account_name_attr = '';
$ldap_servers_conf->password_attr = 'userPassword';
$ldap_servers_conf->password_attr_encoding = 'clear';
$ldap_servers_conf->mail_attr = 'mail';
$ldap_servers_conf->mail_template = '';
$ldap_servers_conf->picture_attr = '';
$ldap_servers_conf->unique_persistent_attr = '';
$ldap_servers_conf->unique_persistent_attr_binary = FALSE;
$ldap_servers_conf->user_dn_expression = '';
$ldap_servers_conf->ldap_to_drupal_user = '';
$ldap_servers_conf->testing_drupal_username = 'admin';
$ldap_servers_conf->testing_drupal_user_dn = '';
$ldap_servers_conf->grp_unused = FALSE;
$ldap_servers_conf->grp_object_cat = 'groupofnames';
$ldap_servers_conf->grp_nested = FALSE;
$ldap_servers_conf->grp_user_memb_attr_exists = FALSE;
$ldap_servers_conf->grp_user_memb_attr = '';
$ldap_servers_conf->grp_memb_attr = 'member';
$ldap_servers_conf->grp_memb_attr_match_user_attr = 'dn';
$ldap_servers_conf->grp_derive_from_dn = FALSE;
$ldap_servers_conf->grp_derive_from_dn_attr = '';
$ldap_servers_conf->grp_test_grp_dn = 'ou=External,ou=Access,ou=Group,dc=example,dc=com';
$ldap_servers_conf->grp_test_grp_dn_writeable = '';
$ldap_servers_conf->search_pagination = FALSE;
$ldap_servers_conf->search_page_size = 1000;
$ldap_servers_conf->weight = 0;
$export['ldap_pv'] = $ldap_servers_conf;
  return $export;
}

/**
 * Implements hook_default_ldap_authorization().
 */
function foo_ldap_default_ldap_authorization() {
  $export = array();
  $consumer_type = new stdClass();
  $consumer_type->disabled = FALSE; /* Edit this to true to make a default consumer_type disabled initially */
  $consumer_type->api_version = 1;
  $consumer_type->sid = 'ldap_pv';
  $consumer_type->consumer_type = 'drupal_role';
  $consumer_type->consumer_module = 'ldap_authorization_drupal_role';
  $consumer_type->status = TRUE;
  $consumer_type->only_ldap_authenticated = TRUE;
  $consumer_type->use_first_attr_as_groupid = FALSE;
  $consumer_type->mappings = 'a:1:{i:0;a:6:{s:12:"user_entered";s:18:"OV4 Pro Repository";s:4:"from";s:70:"cn=example-group-pro,ou=External,ou=Access,ou=Group,dc=example,dc=com";s:10:"normalized";s:18:"OV4 Pro Repository";s:10:"simplified";s:18:"OV4 Pro Repository";s:5:"valid";b:0;s:13:"error_message";s:106:"Role <em class="placeholder">OV4 Pro Repository</em>_name does not exist and role creation is not enabled.";}}';
  $consumer_type->use_filter = TRUE;
  $consumer_type->synch_to_ldap = FALSE;
  $consumer_type->synch_on_logon = TRUE;
  $consumer_type->revoke_ldap_provisioned = TRUE;
  $consumer_type->create_consumers = TRUE;
  $consumer_type->regrant_ldap_provisioned = TRUE;
  $export['drupal_role'] = $consumer_type;
  return $export;
}
?>

Read more:

• https://drupal.org/project/ldap
• https://drupal.org/node/997082
• https://drupal.org/node/1920682