diff --git a/app/models/identity.rb b/app/models/identity.rb
index 440fcd0d052..756d19adec7 100644
--- a/app/models/identity.rb
+++ b/app/models/identity.rb
@@ -15,4 +15,5 @@ class Identity < ActiveRecord::Base
   belongs_to :user
 
   validates :extern_uid, allow_blank: true, uniqueness: { scope: :provider }
+  validates :user_id, uniqueness: { scope: :provider }
 end
diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
index e6b00c531ac..c25c799d8f6 100644
--- a/config/initializers/1_settings.rb
+++ b/config/initializers/1_settings.rb
@@ -67,7 +67,7 @@ Settings.ldap['enabled'] = false if Settings.ldap['enabled'].nil?
 if Settings.ldap['enabled'] || Rails.env.test?
   if Settings.ldap['host'].present?
     server = Settings.ldap.except('sync_time')
-    server['provider_name'] = 'ldap'
+    server['provider_name'] = 'ldapmain'
     Settings.ldap['servers'] = {
       'ldap' => server
     }
@@ -80,8 +80,13 @@ if Settings.ldap['enabled'] || Rails.env.test?
     server['provider_name'] ||= "ldap#{key}".downcase
     server['provider_class'] = OmniAuth::Utils.camelize(server['provider_name'])
   end
+
+  unless Settings.ldap['servers'].select{ |k, server| server['provider_name'] == "ldapmain"}.any?
+    raise "Wrong LDAP configuration. The 'main' LDAP section is missing"
+  end
 end
 
+
 Settings['omniauth'] ||= Settingslogic.new({})
 Settings.omniauth['enabled']      = false if Settings.omniauth['enabled'].nil?
 Settings.omniauth['providers']  ||= []
diff --git a/db/migrate/20150411000035_fix_identities.rb b/db/migrate/20150411000035_fix_identities.rb
new file mode 100644
index 00000000000..12526b10e6e
--- /dev/null
+++ b/db/migrate/20150411000035_fix_identities.rb
@@ -0,0 +1,16 @@
+class FixIdentities < ActiveRecord::Migration
+  def up
+    new_provider = Gitlab.config.ldap.servers.first.last['provider_name']
+	  # Delete duplicate identities
+    Identity.connection.select_one("DELETE FROM identities WHERE provider = 'ldap' AND user_id IN (SELECT user_id FROM identities WHERE provider = '#{new_provider}')")
+	  # Update legacy identities
+    Identity.where(provider: 'ldap').update_all(provider: new_provider)
+
+    if defined?(LdapGroupLink)
+      LdapGroupLink.where('provider IS NULL').update_all(provider: new_provider)
+    end
+  end
+
+  def down
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 14e32a7946e..903ed161e4a 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20150328132231) do
+ActiveRecord::Schema.define(version: 20150411000035) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -336,12 +336,12 @@ ActiveRecord::Schema.define(version: 20150328132231) do
     t.string   "import_url"
     t.integer  "visibility_level",       default: 0,        null: false
     t.boolean  "archived",               default: false,    null: false
-    t.string   "avatar"
     t.string   "import_status"
     t.float    "repository_size",        default: 0.0
     t.integer  "star_count",             default: 0,        null: false
     t.string   "import_type"
     t.string   "import_source"
+    t.string   "avatar"
   end
 
   add_index "projects", ["created_at", "id"], name: "index_projects_on_created_at_and_id", using: :btree
@@ -459,6 +459,7 @@ ActiveRecord::Schema.define(version: 20150328132231) do
     t.integer  "notification_level",            default: 1,     null: false
     t.datetime "password_expires_at"
     t.integer  "created_by_id"
+    t.datetime "last_credential_check_at"
     t.string   "avatar"
     t.string   "confirmation_token"
     t.datetime "confirmed_at"
@@ -466,7 +467,6 @@ ActiveRecord::Schema.define(version: 20150328132231) do
     t.string   "unconfirmed_email"
     t.boolean  "hide_no_ssh_key",               default: false
     t.string   "website_url",                   default: "",    null: false
-    t.datetime "last_credential_check_at"
     t.string   "github_access_token"
     t.string   "gitlab_access_token"
     t.string   "notification_email"