--- a/cubicweb/server/sources/ldapfeed.py	Wed Oct 26 11:24:57 2016 +0200
+++ b/cubicweb/server/sources/ldapfeed.py	Fri Sep 30 17:36:02 2016 +0200
@@ -1,4 +1,4 @@
-# copyright 2003-2015 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
+# copyright 2003-2016 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
 # contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
 #
 # This file is part of CubicWeb.
@@ -262,11 +262,12 @@
         except Exception:
             self.error('while trying to authenticate %s', user, exc_info=True)
             raise AuthenticationError()
-        eid = self.repo.system_source.extid2eid(cnx, user['dn'].encode('ascii'))
-        if eid is None or eid < 0:
+        rset = cnx.execute('Any X,SN WHERE X cwuri %(extid)s, X is CWUser, '
+                           'X cw_source S, S name SN', {'extid': user['dn']})
+        if not rset or rset[0][1] != self.uri:
             # user is not known or has been moved away from this source
             raise AuthenticationError()
-        return eid
+        return rset[0][0]
 
     def _connect(self, user=None, userpwd=None):
         protocol, host, port = self.connection_info()

--- a/cubicweb/server/test/unittest_ldapsource.py	Wed Oct 26 11:24:57 2016 +0200
+++ b/cubicweb/server/test/unittest_ldapsource.py	Fri Sep 30 17:36:02 2016 +0200
@@ -292,7 +292,7 @@
             self.assertEqual(e.cw_source[0].name, 'system')
             self.assertTrue(e.creation_date)
             self.assertTrue(e.modification_date)
-            source.pull_data(cnx)
+            source.pull_data(cnx, raise_on_error=True)
             rset = cnx.execute('CWUser X WHERE X login %(login)s', {'login': 'syt'})
             self.assertEqual(len(rset), 1)
             self.assertTrue(self.repo.system_source.authenticate(cnx, 'syt', password='syt'))

--- a/cubicweb/sobjects/ldapparser.py	Wed Oct 26 11:24:57 2016 +0200
+++ b/cubicweb/sobjects/ldapparser.py	Fri Sep 30 17:36:02 2016 +0200
@@ -1,4 +1,4 @@
-# copyright 2011-2015 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
+# copyright 2011-2016 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
 # contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
 #
 # This file is part of CubicWeb.
@@ -120,8 +120,12 @@
     def build_importer(self, raise_on_error):
         """Instantiate and configure an importer"""
         etypes = ('CWUser', 'EmailAddress', 'CWGroup')
-        extid2eid = dict((self.source.decode_extid(x), y) for x, y in
-                self._cw.system_sql('select extid, eid from entities where asource = %(s)s', {'s': self.source.uri}))
+        extid2eid = {}
+        for etype in etypes:
+            rset = self._cw.execute('Any XURI, X WHERE X cwuri XURI, X is {0},'
+                                    ' X cw_source S, S name %(source)s'.format(etype),
+                                    {'source': self.source.uri})
+            extid2eid.update(dict((extid.encode('ascii'), eid) for extid, eid in rset))
         existing_relations = {}
         for rtype in ('in_group', 'use_email', 'owned_by'):
             rql = 'Any S,O WHERE S {} O, S cw_source SO, SO eid %(s)s'.format(rtype)