Extension talk:LDAPGroups/2024

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

Older comments can be found at Extension talk:LdapGroups

Problem to get groups from LDAP

Latest comment: 2 years ago3 comments2 people in discussion

Hello,

I've problem about this extension i can find my group with ldapsearch but that doesn't work with this extension :

I've blank return with this command :

php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain domain.local --username myuser

My ldap config :

{

"domain.local": {

"connection": {

"server": "srv-dc1.domain.local",

"port": "389",

"use-tls": "true",

"user": "CN=Mediawiki,OU=My Accounts,dc=domain,dc=local",

"pass": "password",

"enctype": "clear",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "dc=domain,dc=local",

"groupbasedn": "OU=My Groups,dc=domain,dc=local",

"userbasedn": "OU=My Accounts,dc=domain,dc=local",

"searchattribute": "samaccountname",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": {

"rules": {

"groups": {

"required": [ "CN=Mediawiki_Access,OU=My Groups,dc=domain,dc=local" ]

}

},

"groupsync": {

"mapping": {

"engineering": "CN=Mediawiki_Admins,OU=My Groups,dc=domain,dc=local",

"bureaucrat": "CN=Mediawiki_Admins,OU=My Groups,dc=domain,dc=local",

"interface-admin": "CN=Mediawiki_Admins,OU=My Groups,dc=domain,dc=local",

"sysop": "CN=Mediawiki_Admins,OU=My Groups,dc=domain,dc=local"

}

And i've this error into my apache :

Undefined array key "memberof" in /var/lib/mediawiki/extensions/LDAPProvider/src/UserGroupsRequest/UserMemberOf.php

What can i check ?

Regards,

Kévin. ElogKevinL (talk) 15:53, 7 March 2024 (UTC)Reply

Well, apparently the group information is is not stored in the the memberOf field of the of the "user info". Try to use a different value for grouprequest

"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"
"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"
"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory"
"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMemberUid::factory"

Depending on the chosen value, additional configuration may be required. See also Extension:LDAPProvider#Domain_config_settings Osnard (talk) 07:28, 11 March 2024 (UTC)Reply

Hello,

Thank you the value GroupMember work !

Regards,

Kévin. ElogKevinL (talk) 13:26, 11 March 2024 (UTC)Reply

How to assign multiple LDAP groups?

Latest comment: 2 years ago2 comments2 people in discussion

Hello,

i like to assign multiple LDAP groups to a single mediawiki group. How can that be done?

php it would look like this

$group['admin'] = "Grp_IT1;

$group['admin'] += "Grp_IT2;

This does overwrite but not extend...

"groupsync": {

"mapping": {

"admin": "CN=Grp_IT1,OU=example,DC=com",

"admin": "CN=Grp_IT2,OU=example,DC=com",

"sysop": "CN=Grp_IT1,OU=example,DC=com"

}

} Neftal23 (talk) 08:32, 2 May 2024 (UTC)Reply

You should be able to do this with

"groupsync": {
  "mapping": {
   "admin": [
      "CN=Grp_IT1,OU=example,DC=com",
      "CN=Grp_IT2,OU=example,DC=com"
   ],
   "sysop": "CN=Grp_IT1,OU=example,DC=com"
  }
}

Osnard (talk) 08:38, 2 May 2024 (UTC)Reply

Assign groups based on ldap attribute?

Latest comment: 1 year ago2 comments2 people in discussion

I'd like to add users to a MediaWiki group based on the setting of an ldap attribute.

If the user has "personType" set to "emp" in ldap then add them to the "employee" MediaWiki group and insure they are not in "contractors"

If the user has "personType" set to "con" in ldap then add them to the "contractor" MediaWiki group and insure they are not in "employees"

If the person does not have a "personType" attribute, remove them from both groups.

For another group, if the field "specialId" exists with any value, add them to the "specials" group, otherwise remove them from "specials".

Can this be done with settings? I suspect I'll need a callback function in LocalSettings.php to handle this. Is there a hook to call? TimRiker (talk) 18:55, 11 October 2024 (UTC)Reply

Well, Extension:LDAPGroups does not support group mapping based regular (non-group membership) attributes. Its internal logic is only provided with values from the grouprequest configured in Extension:LDAPProvider. There is also no callback or hooks that can be used for this. One would need to implement a new MediaWiki\Extension\LDAPGroups\ISyncMechanism.

But, if you use Extension:PluggableAuth for login, rather than Extension:Auth_remoteuser, you may be able to use its group sync capabilities.

This should be doable with a configuration like this:

$wgPluggableAuth_Config = [
  "My LDAP" => [
...
    'groupsyncs' => [
      [
        'type' => 'mapped',
        'map' => [
          'employee' => [ 'personType' => 'emp' ],
          'contractors' => [ 'personType' => 'con' ],
          // Unfortunately there is no wildcard support, so all values need to be set explicitly
          'specials' => [ 'specialId' => [ '...', '...'  ] ]
        ]
      ]
    ]
  ]
];

Also check out the various test cases implemented in Extension:PluggableAuth: https://github.com/wikimedia/mediawiki-extensions-PluggableAuth/blob/7.1.0/tests/phpunit/Group/MapGroupsTest.php#L70-L89

Be aware, that Extension:PluggableAuth only syncs on login, unlike Extension:LDAPGroups, which does this once an hour even during an active session. Osnard (talk) 06:06, 14 October 2024 (UTC)Reply