The problem is with the current implementation of ldap write. As of today (8.4), if you have a non-ldap user and you activate ldap-write then the user is added to the write ldap and the tuleap database is updated with the new ldap uid. However, given that the uid used for an ldapwrite (openLDAP) is incompatible with the one used by active directory, this creates a whole new mess. This gets even more complicated when the user is already an active directory member.

The solution would be to have a full read/write configuration for ldap write and store the ldap_id for the write server as a separate variable to the ldap_id for the read server.