Updating users data through LDAP

Issue

• We have enabled importing users and groups through LDAP.
• Import works perfectly, although we have seen user data is not updated when it changes in Active Directory: email or user name, for example.

Environment

• Liferay DXP with LDAP configured.

Resolution

• Importing user through LDAP uses two ways to get users from system and compare them to choose whether the imported user is a new one or is an existing user to be updated. These two ways are by screen name and by email.
• These both user's attributes have an unique constraint so that a Liferay DXP instance can not have any user with neither same screen name nor same email.
  • Following database indexes are defined to that effect: ix_eec1e477 (screen name) and ix_6c9f41d8 (email)
• Besides, next two properties are also related:

#
# Set this to true to always autogenerate user screen names even if the user
# gives a specific user screen name. If this is set to true, the LDAP
# importer will fetch users by their email address even if the property
# "company.security.auth.type" is set to screenName.
#
# Env: LIFERAY_USERS_PERIOD_SCREEN_PERIOD_NAME_PERIOD_ALWAYS_PERIOD_AUTOGENERATE
#
users.screen.name.always.autogenerate=false

#
# The portal can authenticate users based on their email address, screen
# name, or user ID.
#
# Env: LIFERAY_COMPANY_PERIOD_SECURITY_PERIOD_AUTH_PERIOD_TYPE
#
company.security.auth.type=emailAddress
#company.security.auth.type=screenName
#company.security.auth.type=userId

• As conclusion:
  • When a user is added to Liferay DXP, both attributes screen name and email, can not be updated through LDAP individually.
  • If both attributes are updated at the same time, a new user will be added to Liferay DXP.
  • The rest of user's attributes can be updated.

Additional Information

• Connecting to a User Directory