LDAP hub/Migration from extension LDAPAuthentication

This page holds example configurations of the original Extension:LdapAuthentication and how these need to be rewritten for LDAP Stack.

Example 1

 * Allow network based authentication (aka "implicit", e.g. by using Apache's  module for Kerberos authentication)
 * Allow form based authentications with local user accounts
 * Allow form based authentications with remote LDAP user accounts
 * Restrict login to certain LDAP user groups
 * Syncronize user info
 * No syncronization of user groups

Given

Old

New

$wgLDAPAuthAttribute
Extension:LDAP_Authentication/Configuration_Options

Old

New

Auth remoteuser (Kerberos auth) with LDAPProvider features
The example includes a few extensions from LDAPStack, additional packages that you will need to make it works and some extra code that is not included in the documentation (many thanks to Osnard for his support).

Mediawiki 1.33.0 on Ubuntu 16.04. Apache2, PHP7.0, MySQL 5.7, Kerberos authentication.

LDAPProvider 1.0.1, LDAPGroups 1.0.1, LDAPUserInfo 1.0.0

Packages and apache2 mods: kerberos_packages, mod_krb5, php7.0-ldap in my case.

krb5.conf: apache2.conf: .htaccess: LocalSettings.php: Line 22 is needed for the LDAPGroup extension to work properly, when the "mappedgroups" mechanism is used.

Add  (third line) to   to make the LDAPUserInfo work: After the settings above the following command line scripts should work: To enable the debug log you can use (LocalSettings.php):

Very Simple Auth remoteuser Setup
The example is a very simple setup (that I may evolve at a later date, but is working now).

Mediawiki 1.31.5 on a late 2012 Mac Mini Server running Yosemite (10.10.5) using Server Internal Apache Version 2.4.16, PHP 7.2.21, MySQL 5.6.22

LDAP Hub Extension(s): Auth_remoteuser REL1_33  (I confirm only this one extension)

apache2.conf: At the root of my web server file system I have an .htaccess file which connects to my Yosemite Server Open Directory Service as follows:

.htaccess: LocalSettings.php: One a user authenticates through Apache's .htaccess/OpenDirectory (OD) and gains access to the server, Auth_remoteuser automatically uses the OD username/credentials as the Mediawiki login/username without any prompting or user interaction.

I plan to test/implement user groups so my setup may change substantially at a later date.