This article explains why users from specific domains are not imported through LDAP due to the email address validator in the Liferay platform, and provides a solution to resolve this if a specific domain is required for your business needs.
For example, domains that use two hyphens (for example: a-b-test.com) will not pass the defaultemailaddressvalidator being used in Liferay Digital Enterprise 7.0, and the following error message will be seen in console as a result:
17:08:48,279 ERROR [liferay/scheduled_user_ldap_import-1][LDAPUserImporterImpl:801] Unable to import user CN=sallyb@l-e-mplastics.com,CN=Users: null:null:{samaccountname=sAMAccountName: 0001107625}
com.liferay.portal.kernel.exception.UserEmailAddressException$MustValidate: Email name address testuser@a-b-test.com must validate with com.liferay.portal.kernel.security.auth.DefaultEmailAddressValidator
Resolution
This issue can be reproduced with a-b-test.com domain.
This observed behavior is intended, as the email address validator that the Liferay platform uses by default takes domains with two hyphens, like in the example above, as invalid ones.
To resolve this, it will be necessary to either change the domain (which is not ideal) or to implement a new email address validator. This is done by creating a hook to accommodate the domains, and then adjusting the following portal properties that point to the correct validator class in portal-ext.properties:
# Input a class name that implements
# com.liferay.portal.security.auth.EmailAddressValidator. This class will be
# called to validate user email addresses.
#
# This property is not read by the portal except for portal properties
# overridden by liferay-hook.xml. It remains here only as a reference.
#
#users.email.address.validator=com.liferay.portal.security.auth.DefaultEmailAddressValidator
#users.email.address.validator=com.liferay.portal.security.auth.LiberalEmailAddressValidator