Extension:LDAPProvider

This page is a translated version of the page Extension:LDAPProvider and the translation is 41% complete.

Other languages:

English • ‎Türkçe • ‎français • ‎日本語

この拡張機能は MediaWiki Stakeholders' Group のメンバーが保守しています。

As a successor of LDAP Authentication a stack of LDAP related extensions has been created. They all need to interact with a remote LDAP resource. To ease and unify configuration and maintenance, this extension was created. It provides classes and configuration to query data from LDAP resources.

**MediaWiki 拡張機能マニュアル**
LDAPProvider リリースの状態: 安定

説明	Provides a common infrastructure to connect to a LDAP resource and run queries against it.
作者	Cindy Cicalese, Mark A. Hershberger, Robert Vogel
最新バージョン	1.0.3
互換性ポリシー	リリースブランチ
MediaWiki	1.31+
データベースの変更	はい
ライセンス	GNU 一般公衆利用許諾書 2.0 以降
ダウンロード	拡張機能をダウンロード Git ^[?]: Git master をダウンロードリポジトリを参照 (GitHub) コミット履歴リポジトリの貢献者 (GitHub) コードレビュー
パラメーター $LDAPProviderCacheTime $LDAPProviderCacheType $LDAPProviderPreSearchUsernameModifierRegistry $LDAPProviderDefaultDomain $LDAPProviderDomainConfigs $LDAPProviderDomainConfigProvider $LDAPProviderClientRegistry
使用するフック LoadExtensionSchemaUpdates
translatewiki.net で翻訳を利用できる場合は、LDAPProvider 拡張機能の翻訳にご協力ください
使用状況とバージョンマトリクスを確認してください。
問題点	未解決のタスク · バグを報告

インストール

ダウンロードして、ファイルを extensions/ フォルダー内の LDAPProvider という名前のディレクトリ内に配置します。
以下のコードを LocalSettings.php の末尾に追加します:
```
wfLoadExtension( 'LDAPProvider' );
```
Run php maintenance/update.php to create the necessary database table(s).
Configure as required
完了 – ウィキの「Special:Version」に移動して、拡張機能が正しくインストールされたことを確認します。

"Extension config" versus "Domain config"

This extensions features two kinds of configuration. On the one side there is the classic "extension configuration". It can be set up by using global variables within the LocalSettings.php. Be aware that those variables do not have a wg prefix. Those settings affect the extension as a whole.

On the other side there is a configuration that is specific to a remote LDAP resource, like connection settings, group membership query mechanism or base DNs. Multiple domains can be configured independently. These settings only affect the communication to the LDAP resource, based on the domain that this resource serves.

Extension config settings

When using them in `LocalSettings.php`, these variables need to be prefixed with `$LDAPProvider`
名前	既定	説明
`CacheType`	`"CACHE_ANYTHING"`	The sort of cache to use for the connection information.
`CacheTime`	`500`	How long cached items should stick around in seconds.
`ClientRegistry`	`[]`	Allows registration of custom clients. The key is the domain to be handled, the value is a callback that returns an objects which derives from `Client`.
`DomainConfigs`	`"/etc/mediawiki/ldapprovider.json"`	Stores per domain configuration. Only evaluated if `$LDAPProviderDomainConfigProvider` is set to use the default `LocalJSONFile`. See below.
`DomainConfigProvider`	`"\\MediaWiki\\Extension\\LDAPProvider\\DomainConfigProvider\\LocalJSONFile::newInstance"`	Specifies the mechanism for obtaining the domain configuration. Must be a callback that returns an `IDomainConfigProvider`.
`DefaultDomain`	`""`	Specifies the domain to fall back in case no domain was found for a user. This is often the case when using Extension:Auth_remoteuser for network based authentication.
`PreSearchUsernameModifierRegistry`	[ "removespaces": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\RemoveSpaces::newInstance", "spacetounderscore": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\SpacesToUnderscores::newInstance", "spacestounderscores": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\SpacesToUnderscores::newInstance", "strtolower": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\ToLower::newInstance", "lowercase": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\ToLower::newInstance" ]	Specifies factory callbacks for objects of type `MediaWiki\\Extension\\LDAPProvider\\IPreSearchUsernameModifier`. The keys can be used in the domain configuration in the field `connection.presearchusernamemodifiers`. Example for a custom modifier: $LDAPProviderPreSearchUsernameModifierRegistry ['custom-prefix-modifier'] = function() { return new MediaWiki\Extension\LDAPProvider \PreSearchUsernameModifier\GenericCallback( function( $username ) { return "some_prefix_$username"; } ); };

Domain config settings


名前	既定	説明
`server`	-	One or more hostnames of the LDAP backend. Separated by a single space.
`port`	`389`	The port the LDAP server is listening to
`user`	`""`	The FQDN of a user who has at least read rights
`pass`	`""`	The password for the user above
`options`	`{}` (JSON object or indexed PHP array)	LDAP specific options. Must be string literals as key.
`enctype`	`clear`	Must be one of `'ldapi'`, `'ssl'`, `'tls'`, or `'clear'`
`groupbasedn`	`""`	Used for group membership queries
`userbasedn`	`""`	Used for user info queries. Also for resolving a local username into an appropriate user DN.
`searchattribute`	`""`
`searchstring`	`""`
`grouprequest`	`"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"`	Mechanism to fetch user group data. There are four types available: `"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"` `"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"` `"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"` `"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory"` Which one to choose depends on the LDAP backend.
`groupobjectclass`	`""`	In case `Configurable` is used in `grouprequest` the `groupobjectclass` can be specified here. E.g. `group`
`groupattribute`	`"member"`	In case `Configurable` is used in `grouprequest` the `groupattribute` can be specified here. E.g. `member`
`presearchusernamemodifiers`	`[]`	Username modifiers, for the purpose of LDAP-query. Useful when LDAP usernames do not match MediaWiki username format. ( e.g. LDAP accounts use underscores-instead-of-spaces, or need to be lower-cased ) Use one-or-more of the available modifiers: lowercase removespaces spacestounderscores Sample Usage: `[ "lowercase" ]` `[ "removespaces" ]` `[ "spacestounderscores", "lowercase" ]` Working Example: Login-User Joe Bloggs will be translated to joe_bloggs LDAP search query, with config of: `[ "spacestounderscores", "lowercase" ]` Additional modifiers can be registered through the `$LDAPProviderPreSearchUsernameModifierRegistry` (see above) variable.
`nestedgroups`	`false`	Whether to use LDAP_MATCHING_RULE_IN_CHAIN to fetch nested groups. Will only work for Microsoft Active Directory and with `grouprequest = MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory`

Domain config providers

By default the domain specific configuration is held in a static JSON file. But one can also use a PHP based (dynamic) configuration. The relevant extension configuration is $LDAPProviderDomainConfigProvider. It needs to be a callback that returns an object of type IDomainConfigProvider.

Static JSON file

This is the default way. Just set up the extension configuration $LDAPProviderDomainConfigs to point to a valid JSON file (should be outside of web root).

$LDAPProviderDomainConfigs = "$IP/../ldapprovider.json";

Example:

{
	"LDAP": {
		"connection": {
			"server": "ldap.forumsys.com",
			"user": "cn=read-only-admin,dc=example,dc=com",
			"pass": "password",
			"options": {
				"LDAP_OPT_DEREF": 1
			},
			"basedn": "dc=example,dc=com",
			"groupbasedn": "dc=example,dc=com",
			"userbasedn": "dc=example,dc=com",
			"searchattribute": "uid",
			"searchstring": "uid=USER-NAME,dc=example,dc=com",
			"usernameattribute": "uid",
			"realnameattribute": "cn",
			"emailattribute": "mail"
		}
	}
}

Dynamic PHP array

As an alternative to the JSON file one can use a PHP array to configure the domains. In this case, just have the $LDAPProviderDomainConfigs callback return an instance of InlinePHPArray.

Example

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				"server" => "ldap.forumsys.com",
				"user" => "cn=read-only-admin,dc=example,dc=com",
				"pass" => 'password',
				"options" => [
					"LDAP_OPT_DEREF" => 1
				],
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "uid",
				"searchstring" => "uid=USER-NAME,dc=example,dc=com",
				"usernameattribute" => "uid",
				"realnameattribute" => "cn",
				"emailattribute" => "mail"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versioning

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
**However, this table helps to determine which extension-releases to use across all recent versions.**
MediaWiki リリース	Recommended Extension Version	テストの状態	最終テスト日
1.31 (LTS)	LDAPxxx_REL1_31	テスト済、推奨	2020年3月
1.32	LDAPxxx_REL1_31	未テスト	-
1.33	LDAPxxx_REL1_31	テスト済	2020年3月
1.34	LDAPxxx_REL1_31	テスト済	2020年3月
1.35 (LTS Planned)	LDAPxxx_master	テスト済	2020年3月

トラブルシューティング

Exception: "No configuration available for domain 'XYZ'!"

Please make sure, that the values in the database field ldap_domains.domain_id match with the values set in the first level of the domain-configuration (e.g. in ldapprovider.json). If they don't, you can either change the entries in the database using UPDATE ldap_domains SET domain_id = "DomainNameAsInConfiguration"; or adapt the configuration. Attention: In the current version, the domain name is case sensitive.

Exception: "No section 'authorization' found in configuration for domain 'LDAP'"

If you enabled the LDAPAuthorization extension (as recommended in the PluggableAuth documentation), you need to add the authorization configuration in the LDAPProvider domain config (more info here)

End to End Samples

Manual:Active Directory Integration (PluggableAuth + LDAP Stack)