Extension:LDAPAuthorization/ko

This extension is part of the LDAP Stack and requires the LDAPProvider extension to be installed first.

This extension depends on the PluggableAuth extension, which must be installed first.

This extensions checks for certain authorization requirements when logging into a wiki by using Extension:PluggableAuth or 확장 기능:Auth remoteuser . If one of the requirements are not satisfied the login process will be cancelled.

미디어위키 확장 기능 설명서

LDAPAuthorization 출시 상태: 안정
만든 이	Cindy Cicalese, Mark A. Hershberger, Robert Vogel
최신 버전	1.0.0
호환성 정책	스냅샷은 미디어위키와 함께 릴리스됩니다. Master is not backward compatible.
MediaWiki	1.31+
변수 $wgAutoAuthUsernameNormalizer $wgAutoAuthRemoteUserStringParserRegistry $wgAutoAuthRemoteUserStringParser $wgAutoAuthBypassWithCookieUsernameRemoteAddrs
사용된 훅 AuthRemoteuserFilterUserName PluggableAuthUserAuthorization
Licence	GNU General Public License 2.0 or later
다운로드	확장 기능 다운로드 Git [?]: 저장소 보기 (Phabricator · GitHub) Gerrit 코드 리뷰 Git 커밋 기록 Download source tarball
LDAPAuthorization 확장 기능 번역 (translatewiki.net에서 가능한 경우)

설치

• Install the LDAPProvider and PluggableAuth extensions.
• 파일을 다운로드하고 LDAPAuthorization 폴더를 extensions/ 디렉토리에 넣어 주세요.
  개발자와 코딩 기여자는 Git을 이용해 확장기능을 다운받는 것이 좋습니다.

  cd extensions/
  git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/LDAPAuthorization
  

• 아래의 코드를 LocalSettings.php 코드의 마지막에 추가합니다.

  wfLoadExtension( 'LDAPAuthorization' );
  

  Configure as required.
• 완료 – 위키의 ‘Special:Version’에 이동해서, 확장기능이 올바르게 설치된 것을 확인합니다.

Extension config settings

When using them in LocalSettings.php, these variables need to be prefixed with $LDAPAuthorization

Name	Default	Description
AutoAuthRemoteUserStringParserRegistry	{ "domain-backslash-username": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\DomainBackslashUsername::factory", "username-at-domain": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\UsernameAtDomain::factory" }	A registry of factory callbacks for different parsers, that extract domain and username from a provided domain-username. Must return IRemoteUserStringParser object. Only used in case of auto-authentication provided by 확장 기능:Auth remoteuser .
AutoAuthRemoteUserStringParser	"domain-backslash-username"	Configures which parser is needed to extract domain and username from a provided domain-username. Allowed values are: "domain-backslash-username" (Use this if $_SERVER['REMOTE_USER'] = "SOMEDOMAIN\\Some username") "username-at-domain" (Use this if $_SERVER['REMOTE_USER'] = "some.username@somedomain.local") Only used in case of auto-authentication provided by Auth remoteuser.
AutoAuthUsernameNormalizer	""	A callback that allows to modify the username when 확장 기능:Auth remoteuser is used for network based authentication. E.g. "strtolower". If form based authentication is also enabled though Extension:LDAPAuthentication2 this should have the same value as $LDAPAuthentication2UsernameNormalizer. Only used in case of auto-authentication provided by 확장 기능:Auth remoteuser .

Domain config settings

Name	Default	Description
rules.groups.required	[]	Array of group DNs that are required to complete the login process. Belonging to one group is sufficient (logical OR) to be authorized.
rules.groups.excluded	[]	Array of group DNs that the user may not be member of to complete the login process. Belonging to one group is sufficient (logical OR) to be forbidden to log in.
rules.attributes	{}	This implements the "attributes mapping" rule from Extension:LDAP Authentication Example: { "&" : { "status": "active", "|": { "department": [ "100", "200" ], "level": [ "5", "6" ] } } }
rules.query	""	Allows to provide a standard LDAP query to be tested against the user. Comparable to $wgLDAPAuthAttribute from Extension:LDAP Authentication Example: &(active=TRUE)(permissionAlias=cn=X,ou=Y,ou=accounts,dc=company,dc=local)

Example 1

If you want to configure this in LocalSettings.php you can extend the configuration for LDAPProvider like in this example:

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				...
			],
			'authorization' => [
				'rules' => [
					'groups' => [
						'required' => [ "groupname" ]
					]
				]
			]
		]
	];
...

Example 2

Here is a complete example LocalSettings.php configuration for Active Directory:

$LDAPProviderDomainConfigProvider = function()
{
	$config =
	[
		"example.com" =>
		[
			"connection" =>
			[
				"server" => "ldap.example.com",
				"user" => "cn=ldap,cn=Users,dc=example,dc=com",
				"pass" => "password",
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "samaccountname",
				"searchstring" => "USER-NAME@example.com",
				"usernameattribute" => "samaccountname",
				"realnameattribute" => "cn",
				"emailattribute" => "mail",
				"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
			],
			"authorization" =>
			[
				"rules" =>
				[
					"groups" =>
					[
						"required" => [ "cn=Developers,cn=Users,dc=example,dc=com" ]
					]
				]
			],
			"groupsync" =>
			[
				"mechanism" => "mappedgroups",
				"mapping" =>
				[
					"sysop" => "cn=Developers,cn=Users,dc=example,dc=com",
					"bureaucrat" => "cn=Developers,cn=Users,dc=example,dc=com"
				]
			],
			"userinfo" =>
			[
				"email" => "mail",
				"realname" => "cn",
				"properties.gender" => "gender"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versioning

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
However, this table helps to determine which extension-releases to use across all recent versions.

MediaWiki Release	Recommended Extension Version	Test Status	Latest Test Date
1.35 (LTS)	LDAPxxx_master	Tested	2020년 3월