--- a/doc/book/en/admin/ldap.rst	Fri Jul 20 09:22:51 2012 +0200
+++ b/doc/book/en/admin/ldap.rst	Thu Jul 19 16:41:10 2012 +0200
@@ -29,6 +29,15 @@
 The base functionality for this is in
 :file:`cubicweb/server/sources/ldapuser.py`.
 
+External dependencies
+---------------------
+
+You'll need the following packages to make CubicWeb interact with your LDAP /
+Active Directory server:
+
+* python-ldap
+* ldaputils if using `ldapfeed` source
+
 Configurations options
 ----------------------
 

--- a/server/test/unittest_ldapuser.py	Fri Jul 20 09:22:51 2012 +0200
+++ b/server/test/unittest_ldapuser.py	Thu Jul 19 16:41:10 2012 +0200
@@ -32,7 +32,6 @@
 from cubicweb.devtools.httptest import get_available_port
 from cubicweb.devtools import get_test_db_handler
 
-from cubicweb.server.session import security_enabled
 from cubicweb.server.sources.ldapuser import GlobTrFunc, UnknownEid, RQL2LDAPFilter
 
 CONFIG = u'user-base-dn=ou=People,dc=cubicweb,dc=test'
@@ -110,10 +109,9 @@
 
     def _pull(self):
         with self.session.repo.internal_session() as isession:
-            with security_enabled(isession, read=False, write=False):
-                lfsource = isession.repo.sources_by_uri['ldapuser']
-                stats = lfsource.pull_data(isession, force=True, raise_on_error=True)
-                isession.commit()
+            lfsource = isession.repo.sources_by_uri['ldapuser']
+            stats = lfsource.pull_data(isession, force=True, raise_on_error=True)
+            isession.commit()
 
     def test_delete(self):
         """ delete syt, pull, check deactivation, repull,

--- a/sobjects/ldapparser.py	Fri Jul 20 09:22:51 2012 +0200
+++ b/sobjects/ldapparser.py	Thu Jul 19 16:41:10 2012 +0200
@@ -71,7 +71,9 @@
         session.commit(free_cnxset=False)
 
     def update_if_necessary(self, entity, attrs):
-        entity.complete(tuple(attrs))
+        # disable read security to allow password selection
+        with entity._cw.security_enabled(read=False):
+            entity.complete(tuple(attrs))
         if entity.__regid__ == 'CWUser':
             wf = entity.cw_adapt_to('IWorkflowable')
             if wf.state == 'deactivated':