Inactive portal users cannot be exported to LDAP

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 6.2.X EE, 7.0.X, 7.1.X, 7.2.X, 7.3.X, Master
• Fix Version/s: 7.4.1 CE GA2, 7.4.2 CE GA3, 7.4.13 DXP GA1, Master
• Component/s: Application Security > LDAP
• Labels:
  • ee-ts
• Story Points: 5
• Fix Priority: 3
• Git Pull Request: https://github.com/brianchandotcom/liferay-portal/pull/102019
• Bug Type: Regression Bug

LPS-36213 prevent any user which is not in "approved" status from being exported to LDAP. This is too broad brush, because it then prevents "deactivated" users from being exported.

This causes unexpected behavior when LDAP export is enabled to use portal to manage a LDAP directory. For example see scenario described in LPS-30516.

Likewise, if both LDAP export & import is enabled, then users that are deactivated on portal will get re-activated upon the next LDAP sync / login. The expectation is for a two way sync between portal & LDAP.

Steps to reproduce:

1. Configure LDAP with export enabled. Take care to map the "Status" portal user attribute to an appropriate LDAP attribute. (consider recycling the "roomNumber" from the Person schema maybe)
2. Create a new user [email protected]
3. Assert that this user now exists in the LDAP directory and has the status of 0 (i.e. "approved")
4. Deactivate the user in portal

 Expected outcome: The user now has a status of 5 (i.e. "deactivated")

 Actual outcome: The user remains untouched in the directory