Moodle in English: Current users being deleted

Current users being deleted

by Steve Power - Thursday, November 30, 2006, 12:56 AM

I have been struggling with auth_ldap_sync_users.php for a little while now. I am running it on my development server but cannot run it on my production server as it marks some active users as deleted. The development server uses a backup of the production server database and sits on the same network.

Can anyone help here? What are the criteria which the script uses to determine that a user should be deleted?

My users are in Active directory. They can and do log in both to the network and to Moodle yet when I run the sync script as well as removing many old students and adding some new ones I loose a number of current staff and students.

In hope
Steve

Re: Current users being deleted

by Joel Palachuvattil - Saturday, December 2, 2006, 1:06 AM

I seem to be having a similar problem. Our users authenticate via Active Directory. Cron.php isn't running regularly, but I believe that the last time it did, a number of students were unenrolled from courses, and if I correctly recall the number of users before the script was run, were deleted from Moodle altogether. We are running Moodle 1.6.1 on a Windows 2003 server. This is a first-time setup, so everyone who has had an account on the server is a current student or teacher.

Also hopeful,
Joel

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Saturday, December 2, 2006, 11:51 PM

Disclaimer: I don't use auth_ldap_sync_users.php myself, but I've played with the code for some time. What follows is based in this playing, not in actual usage. YMMV and all that

Can anyone help here? What are the criteria which the script uses to determine that a user should be deleted?

The script creates a temporary list of external users from the contexts your specify in your LDAP settings, using the ldap_user_attribute as the searching key. Ths script assumes the value of this ldap_user_attribute matches the user's 'ID Number'.

It then compares the internal list of users with the temporary external list to find users found in the internal list but not in the external one. These users are unenrolled from their courses and deleted from Moodle.

The lists' comparison is based on the 'ID Number' value. If an internal user doesn't have any 'ID Number' value or its value is not found in the temporary external list, that user is unenrolled and deleted.

So you need to make sure all of your users have valid 'ID Number' values, and that you fill in those values from the same place that you specify in 'ldap_user_attribute' in your LDAP settings page.

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Steve Power - Monday, December 4, 2006, 11:22 PM

Iñaki

Thanks for this. I have been 'playing' with the code a bit today and have made a few changes which have improved the situation a bit. Where the $sql SELECT is built I added UPPER() to the u.idnumber and e.idnumber comparisons. That changed my deleted users count from 2245 down to 1432.

I do not know how the case of idnumber can differ between the moodle database and AD but it obviously does. The 1432 users now deleted include a lot of students who have left since last year but also all of the staff in one context. Yet these staff are able to log in so I am puzzled as to what exactly is going on with the sync.

Regards
Steve

Average of ratings: -

Re: Current users being deleted

by Steve Power - Tuesday, December 5, 2006, 12:02 AM

Stranger and stranger I just re ran the sync script again and having noted down the number of users deleted for the last post I spotted it had changed to 2233 up from the 1432. So I removed the UPPER() and ran again and got 2229 to delete.

I am restoring the same database each time before running the script so why could it think there were a different number of users to delete each time?

Regards
Steve

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Tuesday, December 5, 2006, 12:33 AM

Maybe your LDAP directory is changing between your tests? (just a shot in the dark).

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Tuesday, December 5, 2006, 12:31 AM

Being able to log in means nothing wrt user syncing

. If the users' account exist and have a valid password, they can log in. That's all that you neeed: a user account and a password.

Syncing is based in the 'ID Number' field alone. Nothing else, nothing more. So you need to make sure that field is filled in and has something sensible there. Otherwise Moodle will delete that user.

You can have a look at your Moodle user accounts and search the ones that don't have anyting in the 'ID Number' field with:

SELECT id,username FROM mdl_user WHERE auth='ldap' AND idnumber IS NULL;

Those users will be deleted no matter what. The rest will need to match their 'ID Number' value to the 'ldap_user_attribute' in the LDAP directory. If there is no user in the LDAP server with a 'ldap_user_attribute' that matches the 'ID Number' of a given Moodle user, that given user will be deleted too.

Hope this helps.

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Steve Power - Wednesday, December 6, 2006, 1:26 AM

Iñaki

The idnumber is set to hold sAMAccountName and it actually does. It is also set up to "update external' on every login and active users who are being deleted.

In the sql LEFT JOIN the e.idnumber is NULL ie it did not match the mdl_users.idnumber. I have modified the script to print detail of users it is deleting and the correct mdl_sers.idnumber is there.

In another thread you gave some debug code which printed the result of the bulk_insert and two of my inserts appear to fail. One of these is the one where all of my staff are being deleted (one campus anyway) and the other is the first 1000 on our undergraduates. I wonder if there is something set as a sAMAccount name which AD is happy with but which MySQL cannot write into the table? That way two "rogue" accounts could be wiping out 465 staff and 1000 undergraduates.

In the other thread I asked about your latest debug additions and how to improve MySQL logging as I do not see much of use in my logs.

Regards
Steve

EDIT

GOT IT!

AD bless it allows single quotes in userid's and so we have accounts which contain them. Now to hack the sync code to get around this problem.

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Wednesday, December 6, 2006, 8:18 AM

> AD bless it allows single quotes in userid's and so we have accounts which contain them. Now to hack the sync code to get around this problem.

Hummm, this shouldn't be a problem. There is a line in auth_ldap_bulk_insert() that reads:

array_map('addslashes', $users);

That line should deal with any quotes found in the $users array (which contains the userids read from the LDAP server). Really strange

Aha! Now I see it. There is a bug in the code. The above line should read:

$users = array_map('addslashes', $users);

as array_map() doesn't modify the original array, but instead returns a modified array. That should do the trick.

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Steve Power - Wednesday, December 6, 2006, 6:50 PM

Iñaki

I have not tried this change yet but I will do so soon. I thought that the problem was that the addsloashes added a slash to escape the quote but the whole lot was then sent as an sql query and I am not sure that you can escape a single quote this way in a simple sql query.

I will test and come back.

Regards
Steve

EDIT

Fanntastic Iñaki that fixes the problem although issuing the same sql INSERT with the slash from the command line produces an error.

Will you file a bug report with your fix or should I?

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Friday, December 8, 2006, 1:44 AM

> Will you file a bug report with your fix or should I?

I'll do it

It's bug MDL-7837

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Steve Power - Wednesday, December 6, 2006, 8:59 PM

Iñaki

I have continued to work on this and discovered that although the change you describe stops the deletion of whole OU's of users the users with the ' in their sAMAccountName are not added to the Moodle database. I am now off to look at the code to see if I can work out why.

This is not only a Moodle problem btw. We use scripts here to populate and update AD this is being introduced to try to rationalise the mess caused by a large number of IT techs manually entering data in different ways. Obviously our scripts cannot cope with the apostrophe as most users with one in their username have a blank sn and givenname field.

Regards
Steve

Average of ratings: -

Re: Current users being deleted

by Iñaki Arenaza - Sunday, December 10, 2006, 12:38 AM

the users with the ' in their sAMAccountName are not added to the Moodle database.

Have a look at this thread: http://moodle.org/mod/forum/discuss.php?d=54901#255919 I'd say this is what stopping those users from being added to Moodle.

Saludos. Iñaki.

Average of ratings: -

Re: Current users being deleted

by Steve Power - Monday, December 11, 2006, 10:12 PM

Iñaki

Thank you for this. I have been away from work for a few days (my 50th birthday). I will try this now and get back later.

Regards
Steve

Average of ratings: -

Re: Current users being deleted

by Steve Power - Tuesday, December 12, 2006, 12:05 AM

Iñaki

I can confirm now that this change does fix the problem with user insertion in the original ldap version of auth_ldap_sync_users.php.

For me at least the version of auth_ldap_sync_users.php in Dan Marsden's ntlm auth is not fixed by this change. In fact it does not add any users at all. I will post to this effect in a different thread.

Thanks for your help.

Steve

Average of ratings: -

Authentication

Current users being deleted