sync drupal users to open ldap We can find many discutions on how to sync ldap to drupal, or use ldap to auth drupal users, but my goal is totally different :

My goal is this :
Use drupal to manage user accounts (add/edit/delete users), then
use LDAP to share drupal users with an other website (redmine)

So the idea is that drupal send users to LDAP then redmine website use LDAP for login.

Drupal users don't have to ssh login into my server of course...

I've found no doc, no tuto on how to setup drupal LDAP module to match with my use case. So here i am.

Considering :
I have installed openldap on my debian server, and also ldap authentification module in drupal. More over i have setted up drupal and can querry my ldap server from drupal admin panel.

Questions : 

1) Is there a doc or tuto somewhere explaining how to sync drupal users to LDAP?

if no

By default posix user template contains useless attributes for me, like homedirectory or loginshell

2) So, do i have to define LDAP templates to match with drupal?

3) i've made some tests to sync users, but drupal display no info, what is going wrong? how to debug?
after one day, i finnaly figured out how to :)

I've first found some help on those both discutions : 

a)https://www.drupal.org/node/1920682 (see kenorb answer)

b)Create a new user in LDAP, not wherever Drupal normally creates it (see kernorb answer again)

HOW TO : 

1) from LDAP server create manually an inetOrgPerson account (in phpldapadmin it is called a "Courier Mail Account") , let's call it 'myuser'

next steps will be done in drupal admin=>configuration=>people=>LDAP configuration

2) setup LDAP server, and test it (see links above for further details)

3) again in server test page, set myuser into 'Testing Drupal Username' field.
Start the test, then copy somewhere 'testing_drupal_user_dn' value from test result.

4) now 2 things must be done :

a) choose a user schema, inetOrgPerson is a good schema for drupal as it contains email, username, and password fields

b) find witch fields are requiered by your LDAP server for this schema

so search on google [NameOfTheSchema] [NameOfYourLdapServer] attributes

(e.g : "inetorgperson openldap attributes")

then note witch fields are marked as requiered.

for example i found this : 
http://www.openldap.org/lists/openldap-software/200001/msg00079.html

there we see that 

objectClass, sn, and  cn are marked as required

To resume, you have now noted somewhere: the dn (step 3) and the required field (this step)

c) now, how to set objectclass?
get back to phpldapadmin, display 'myuser' account that you have manually created, then click on export =>LDIF

as example here my result :

# Entry 1: uid=myuser,ou=drupal,dc=mydomain,dc=lan
dn: uid=test1,ou=drupal,dc=mydomain,dc=lan
cn: myuser
description: my description
mail: email@email.com
objectclass: inetOrgPerson
objectclass: top
sn: myuser
uid: myuser
userpassword: mypassword


it is important to respect the order of objectclass fields. In my case i'll have to set in drupal : 
UserToken => inetOrgPerson=> [objectclass:0]
UserToken => top => [objectclass:1]

5) go to admin=>configuration => LDAP configuration => user
then "Basic Provisioning to LDAP Settings" section

Check all checkbox into "LDAP Entry Provisioning Events "

Now fill the table bellow

For each line created, you'll have to check both "ON LDAP ENTRY CREATION" and "ON SYNC TO LDAP ENTRY" collumns

a) You MUST have a line with [dn] as target, this is here that you use the dn retreived in step 3.

Example : 
i had this : testing_drupal_user_dn = uid=myuser,ou=drupal,dc=mydomain,dc=lan

so i add this line : 

--user tokens-- =&gt; uid=[property.name],ou=drupal,dc=mydomain,dc=lan =&gt; [dn]


b) You MUST set objectclass lines . If we refere to my result in step 4) c) , i have to add 2 lines : 

--user tokens-- =&gt; inetOrgPerson =&gt; [objectclass:0]
--user tokens-- =&gt; top =&gt; [objectclass:1]


c) you MUST add as many lines as there is required fields in the schema. If we refere to my case step 4) b) i have to setup objectclass , sn and cn, so i have to add two more lines : 

Property:UserName => => [cn]
Property:UserName => => [sn]

To Resume :

3 steps to follow :


Setup connection to LDAP server then test it
Give a correct path to user entries (path is called DN with lpda)
Choose a user schema (inetOrgPerson is a good one) and fill all fields required by this schema (this is specific of your LDAP server so refere to its doc)


How to test : 

in admin=>configuration=>people=>LDAP configuration=>Settings , check " Enabled Detailed LDAP Watchdog logging.", then edit a user in drupal to trigger the sync with LDAP (assuming you followed my howto). when you save an user in drupal, you'll see an LDAP error message if something goes wrong.