Extension talk:LDAPProvider

Error

array_key_first(): Argument #1 ($array) must be of type array, null given in 195.225.38.16 04:24, 18 February 2025 (UTC)

Configuring JSON for LDAP authorization given multiple attribute values

I'm attempting to use an attribute for an authorization rule. My LDAP provide connection works and I can see in the debug log that the query happens. However, this particular attribute has multiple values. It seems that is the reason authorization fails.

Here's a snippet from my JSON file.

"authorization": { "rules": { "attributes": { "eduPersonEntitlement": "central_hpc" }

Below is what I can see in the debug log. There are multiple matches. The current config fails to authorize login.

   'edupersonentitlement' => 
   array (
     'count' => 8,
     0 => 'urn:mace:dir:entitlement:common-lib-terms',
     1 => 'urn:mace:incommon:entitlement:common:1',
     2 => 'central_hpc',
     3 => 'https://services.box.com/sp#mfa',
     4 => 'M365-A3-NonStudent',
     5 => 'https://slack.com',
     6 => 'logreader',
     7 => 'logadmin',
   )

Please advise! Thanks in advance.

Dan Dancabcaltech (talk) 00:23, 1 August 2025 (UTC)

I have tried iterating through various JSON configurations but still no luck. The Mediawiki logs consistently fail when I try attribute rules for authorization.

[LDAPAuthorization] Requirement 'attributes' not satisfied.

[LDAPAuthorization] Requirements could not be satisfied.

[PluggableAuth] Authorization failure.

Below is the latest stanza I have tried in my JSON config.

<code>

                "authorization": {

                            "rules": {

                               "attributes": {

                                        "&": {

                                          "CAPPersonStatus": "active",

                                          "eduPersonEntitlement": ["central_hpc"]

                                           }

                 }

                                      }

                },

</code> Dancabcaltech (talk) 23:21, 5 August 2025 (UTC)

I tried a different approach using the authorization.query method instead. This worked smoothly for me.

                "authorization": {

                            "rules": {

                                    "query": "&(eduPersonEntitlement=central_hpc)(capPersonStatus=active)"

                                   }

                }, Dancabcaltech (talk) 17:41, 11 August 2025 (UTC)