Manual:Active Directory Integration

= PluggableAuth with Active-Directory LDAP =

With the evolution of Extension:PluggableAuth and LDAP Stack, getting integrated with Active-Directory LDAP is possible, but somewhat complex for new-comers.

A configuration example is provided here, to ease the setup process for those wishing to integrate with MS-AD via LDAP.

Objectives / Aims

 * Configure Mediawiki to use LDAP settings from a single location - ldap.json
 * Users will login with NT-Logon Username, also known as SAMAccountName attribute in a standard AD-schema.

Method

 * LDAP Stack extensions use a number of LDAP attributes to auto-configure the Mediawiki User: SAMAccountName, DisplayName, Mail.
 * LDAP Stack extensions use memberof attribute values to determine if any Security-Groups / Distribution-Lists map to Mediawiki Groups

Recommended Mediawiki Version

 * LDAP Stack extensions should all be at the same version ( e.g. 1.34 or master )
 * An index of all released extensions is at  https://extdist.wmflabs.org/dist/extensions/ 
 * Check that all of the LDAP extensions below are available for your Mediawiki release version.
 * If you mix the extension-versions ( e.g. use master-release for one or two extensions ) you may encounter problems, avoid this scenario.

Tested Medawiki Versions

 * Tested release-versions are shown to the right
 * On these releases, the full set of LDAP Stack extensions are available.

Required Extensions

 * Extension:LDAPAuthorization
 * Extension:LDAPAuthentication2
 * Extension:LDAPGroups
 * Extension:LDAPProvider
 * Extension:LDAPUserInfo
 * Extension:PluggableAuth

Required AD Bind-Account

 * Mediawiki uses an LDAP Bind-User / Bind-Password for communications with Active-Directory.
 * Ensure an AD user is provisioned, and grab the LDAP Distinguished Name for the User
 * Sample: CN=MediawikiAuthenticator,OU=Users,DC=acme,DC=com

LDAP Environment
The important configuration entities are detailed below - replace the default-values with your own when tuning ldap.json

= Configuration Example : LDAP Configuration with 1 Group-Mapping = This example works for a small single-domain forest, or multi-domain forest ( by using the parent domain ).

Install Mediawiki and Extensions

 * 1) Install Mediawiki, perform install and update routines.
 * 2) Install all required LDAP / PluggableAuth extensions listed above into /extensions/

Prepare ldap.json
Create an LDAP configuration file. For simplicity, we place this new file at /var/www/ldap.json then protect it for reading by the web-server.


 * A critical piece of configuration is the acme.com key in line #2 of the JSON.
 * Replace this with your AD Domain
 * Replace the following values in connection
 * server
 * user
 * pass
 * basedn
 * userbasedn
 * Replace the groupsync -> mapping values with some valid Group-DNs taken from MS "Domains and Trusts" console.
 * This allows you to specificy a DN which provides sysop privelidges

Run update.php and test LDAP login

 * After configuring LocalSettings.php and browsing to your Wiki, you should be able to load the public index / Main Page.
 * LDAP login will fail until you run update.php
 * This is because the LDAP extensions require some new SQL tables.
 * After running update.php, start a fresh browser session and perform a test login.

Debugging

 * If you encounter problems, enable debug and review the output during login.


 * Also see Manual:How to debug/Login problems