attached is a diff from that should fix this bug. I chose to go with username as the rest of the authentication code is keying off of username rather than idnumber.

this is the change I'd suggest

$sql = 'SELECT u.id, u.username
FROM ' . $CFG->prefix .'user u LEFT JOIN ' . $CFG->prefix .'extuser e
ON u.username = e.idnumber
WHERE u.auth=\'' . AUTH_LDAP_NAME . '\' AND u.deleted=\'0\' AND e.idnumber IS NULL';

Instead of:

$sql = 'SELECT u.id, u.username
FROM ' . $CFG->prefix .'user u LEFT JOIN ' . $CFG->prefix .'extuser e
ON u.idnumber = e.idnumber
WHERE u.auth=\'' . AUTH_LDAP_NAME . '\' AND u.deleted=\'0\' AND e.idnumber IS NULL';

I believe Dan's patch is correct, but there are 2 queries that need to be adjusted. I have brought over the diff from the old tracker.

The other option would be to populate prefix_extuser.idnumber with the same value as user.idnumber or change that fieldname in extuser to username.

Nope - not backwards! - it makes the thing work in our environment! - what looks wrong - will this not work everywhere?

Dan

please report any problems with the new code, closing now - thanks!

See http://moodle.org/mod/forum/discuss.php?d=80652#p358210