Syncing LDAP users

Question

We're using LDAP as our source for users. This works fine, and everyone can simply log in using their LDAP info, and it will create a Drupal user for that person. However, one of our requirements is having a (searchable) list of users on the site. This means that we regularly need to check LDAP for new and changed entries, and merge them with our drupal users.

The LDAP for Drupal 7 module has a list of events that trigger LDAP provisioning. One of them says: On cron runs. Not implemented yet. I haven't found anything about the state of this, as this is basically what we need.

Because of problems in migrating our website to new versions, we're currently trying to rewrite everything to use community modules. Therefore, we'd very much prefer an official solution. We've currently switched the user list to a LDAP query view, but this is only a temporary solution.

Answer 1

I've worked with LDAP and i have done a function on cron execution, to create automaticly user (of a certain role) who are not already created by login

I hope this will help you

function _synchro_ldap(){

  $server = "serveur.com";
  $rootdn = "name";
  $rootpw = "pwd";
  $ds = ldap_connect( $server );
  $r = ldap_bind( $ds, $rootdn, $rootpw );

  $dn = "OU=AAAAA,OU=BBBB";

  $filtre="cn=test";

  $sr = ldap_search($ds, $dn, $filtre); 

  $info = ldap_get_entries($ds, $sr);

  for ($i = 0; $i < $info[0]["member"]["count"]; $i++) {

    $sr2 = ldap_search($ds, $info[0]["member"][$i], "cn=*");

    $info2 = ldap_get_entries($ds, $sr2);   

    $name       = $info2[0]["samaccountname"][0];
    $mail       = $info2[0]["mail"][0];
    $nom        = $info2[0]["sn"][0];
    $prenom     = $info2[0]["givenname"][0];
    $dn         = $info2[0]["distinguishedname"][0];

    if( !empty($mail) && !empty($name) && $name!= "admin" ){

        $u = user_load(array("name" => $name));
        $m = user_load(array("mail" => $mail));


        if( !$u && !$m) { // user does not exist in drupal

            // Create a user
            $details = array(
                'name'                  => $info2[0]["samaccountname"][0],
                'mail'                  => $info2[0]["mail"][0],
                'access'                => 0,
                'status'                => 1,
                'ldap_authentified'     => TRUE,
                'ldap_dn'               => $dn,
                'ldap_config'           => "1"
            );

            $u = user_save( null, $details ); // Creation du user
            $user_id = $u->uid;             
            user_multiple_role_edit( array( $user_id ), "add_role", $role_id_custom );  
        }
    }
  } 
  ldap_close( $ds );
}

Answer 2

Ok. This is an old question... But I want to give the answer I have found after many hours of work.

To import (I mean create a Drupal user for) ALL users from LDAP, first create a query named something like 'all_employees' on admin/config/people/ldap/query page. This should be the machine name for your query. Make sure your query returns all the users you want to import.

Here is a function that you can use in a custom module that imports ldap users using the built-in LDAP functionality:

function importUsers($ldap_query_id='all_employees') {
  $ldapQuery = ldap_query_get_queries($ldap_query_id, 'all', TRUE, TRUE);
  $ldap_users = $ldapQuery->query();

  foreach ($ldap_users as $ldap_user) {
    $username = $ldap_user['samaccountname'][0];
    if (!empty($username)) {

      $ldap_user_conf = ldap_user_conf();
      $user_edit = array('name' => $username);
      $save = true;
      $ldap_user_conf->provisionDrupalAccount(NULL, $user_edit, NULL, $save);

    }
  }   
}

There might be warnings or errors if you already have some users from LDAP but that's okay.

Answer 3

It sounds like you are looking for LDAP Feeds https://www.drupal.org/node/1300812 which we have used to do this fine. LDAP User module will only handle the authentication, and only triggers when the user logs in, as you've found. But for a stafflist, we needed the other 90% of staff who never even use the CMS to be updated also. LDAP Feeds does that, and also lets you sync additional data fields from LDAP to Drupal 7 user accounts.

We run it nightly. Example results are (the lower table on) https://www.niwa.co.nz/atmosphere/key-contacts

The biggest remaining problem was deleting users from the stafflist once they disappeared from LDAP - that's still tricky.