Extension talk:LDAPProvider/2019

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

Parse error for in Dynamic PHP array "options": {

Latest comment: 7 years ago2 comments2 people in discussion

Parse error: syntax error, unexpected ':', expecting ']' 108.171.129.189 (talk) 19:51, 26 January 2019 (UTC)Reply

Can you share your configuration please? Of course without sensitive data. Osnard (talk) 09:10, 5 July 2019 (UTC)Reply

It works

Latest comment: 6 years ago44 comments5 people in discussion

Hello everybody!

I just wanted to post a message here that, as of this moment (actually probably as of two+ weeks ago to be exact), that Mediawiki's LDAP stack does in fact work. My MW version is 1.33.0, and my LDAP extension stack version is 1.0.0.

I'm using Mediawiki as the knowledge base solution at my company, and SSO is the only way to go. Thank you developers for making this possible! These extension pages and the documentation could use some work though. I'd really like to help but I don't know where to start modifying (yes, I've read the MW mantra, thank you). If anyone else has any issues with the LDAP stack, just know that it does work, and maybe post a comment to this post? At least we'll know that there's people who want to use this extension. 12.13.92.34 (talk) 17:42, 6 February 2019 (UTC)Reply

could you share your config file?

R2spotuser (talk) 03:57, 8 September 2019 (UTC)Reply

Are you aware of the page LDAP_hub/Migration_from_extension_LDAPAuthentication? Osnard (talk) 06:15, 9 September 2019 (UTC)Reply

Yes.. I tried following the example there but it is not working. I am not getting remote user in the correct format..The wiki was setup using Oracle Webgate not mod_auth_kerb. could this be the reason? the remote_user returns (lasname+first initial) and it is not pulling the dn. If you are available i can schedule a webex with you to take a look at the config..

R2spotuser (talk) 00:06, 12 September 2019 (UTC)Reply

Are there other fields in $_SERVER that could be used to calculate the LDAP username (Maybe post the - anonymized - output of var_dump( $_SERVER );)? Is there a "searchstring" that can be fed with the "lastname+first initial" format to retrieve the user object from LDAP?

Unfortunately I can not offer a Webex session. If you need professional support, please have a look at https://en.hallowelt.com/service/support-and-maintenance/ Osnard (talk) 06:39, 13 September 2019 (UTC)Reply

thanks. I seem to be getting closer. I redid the local settings. when i click log in and type in credentials , i get the error below.. After the error, if i click on any of the links I appear to be logged in and can browse and make changes to the wiki.

Also, i should add that when i use only Auth_remoteuser extension, an account in created and user is able to login with SSO.

5daf5d6ee55084a54e2e9f62] /mw5/index.php?title=Special:UserLogin&returnto=Special:SpecialPages Error from line 9 of D:\Apache24\htdocs\mw5\extensions\LDAPUserInfo\src\Hook\UserLoggedIn\SyncUserInfo.php: Class 'MediaWiki\Extension\LDAPProvider\Hook\UserLoggedIn' not found

Backtrace:

#0 D:\Apache24\htdocs\mw5\includes\AutoLoader.php(109): require()

#1 [internal function]: AutoLoader::autoload(string)

#2 [internal function]: spl_autoload_call(string)

#3 D:\Apache24\htdocs\mw5\includes\Hooks.php(163): is_callable(string)

#4 D:\Apache24\htdocs\mw5\includes\Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#5 D:\Apache24\htdocs\mw5\includes\auth\AuthManager.php(2407): Hooks::run(string, array)

#6 D:\Apache24\htdocs\mw5\includes\auth\AuthManager.php(693): MediaWiki\Auth\AuthManager->setSessionDataForUser(User, boolean)

#7 D:\Apache24\htdocs\mw5\includes\auth\AuthManager.php(384): MediaWiki\Auth\AuthManager->continueAuthentication(array)

#8 D:\Apache24\htdocs\mw5\includes\specialpage\AuthManagerSpecialPage.php(353): MediaWiki\Auth\AuthManager->beginAuthentication(array, string)

#9 D:\Apache24\htdocs\mw5\includes\specialpage\AuthManagerSpecialPage.php(482): AuthManagerSpecialPage->performAuthenticationStep(string, array)

#10 D:\Apache24\htdocs\mw5\includes\htmlform\HTMLForm.php(660): AuthManagerSpecialPage->handleFormSubmit(array, VFormHTMLForm)

#11 D:\Apache24\htdocs\mw5\includes\specialpage\AuthManagerSpecialPage.php(416): HTMLForm->trySubmit()

#12 D:\Apache24\htdocs\mw5\includes\specialpage\LoginSignupSpecialPage.php(313): AuthManagerSpecialPage->trySubmit()

#13 D:\Apache24\htdocs\mw5\includes\specialpage\SpecialPage.php(569): LoginSignupSpecialPage->execute(NULL)

#14 D:\Apache24\htdocs\mw5\includes\specialpage\SpecialPageFactory.php(558): SpecialPage->run(NULL)

#15 D:\Apache24\htdocs\mw5\includes\MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#16 D:\Apache24\htdocs\mw5\includes\MediaWiki.php(865): MediaWiki->performRequest()

#17 D:\Apache24\htdocs\mw5\includes\MediaWiki.php(515): MediaWiki->main()

#18 D:\Apache24\htdocs\mw5\index.php(42): MediaWiki->run()

#19 {main}

Current localsettings

wfLoadExtensions( [

'Auth_remoteuser',

'LDAPProvider',

'LDAPUserInfo',

'LDAPGroups'

] );

$wgAuthRemoteuserUserNameReplaceFilter = [

'@MY.DOMAIN$' => ''

];

$LDAPProviderDomainConfigProvider = function() {

$config = [

'xxx.xxx' => [

'connection' => [

"server" => "ldap.xxx.xxx",

"user" => "cn=fdsa_cderwiki,ou=service accounts,ou=administrators,dc=xxx,dc=xxx",

"pass" => 'Dr67@W4m',

"options" => [

"LDAP_OPT_DEREF" => 1

],

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"basedn" => "dc=xxx,dc=xxx",

"groupbasedn" => "ou=groups,ou=cder,ou=accounts,dc=xxx,dc=xxx",

"userbasedn" => "dc=xxx,dc=xxx",

"searchattribute" => "samaccountname",

"searchstring" => "",

"usernameattribute" => "samaccountname",

"realnameattribute" => "cn"

],

'authorization' => [

"rules" => [

"groups" => [

"required" => [

"CN=CDERWiki,OU=Groups,OU=CDER,OU=Accounts,DC=xxx,DC=xxx"

]

],

'userinfo' => [

"attributes-map" => [

"realname" => "cn"

]

],

'groupsync' => [

"mechanism" => "mappedgroups",

"mapping" => [

"sysop" => "CN=CDERWiki,OU=Groups,OU=CDER,OU=Accounts,DC=xxx,DC=xxx",

"cderwiki" => "CN=CDERWiki,OU=Groups,OU=CDER,OU=Accounts,DC=xxx,DC=xxx"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

#####Error logging######

##PHP Error ###

error_reporting( -1 );

ini_set( 'display_errors', 1 );

$wgShowExceptionDetails = true;

$wgShowDBErrorBacktrace = true;

##SQL Error ###

$wgDebugDumpSql = true;

##Debug log to file ###

$wgLDAPDebug = 3;

$wgDebugLogFile = 'd:\Apache24\htdocs\mw5\logfile.txt';

$wgDebugComments = true;

$wgDebugLogGroups['PluggableAuth'] = 'd:\Apache2 \mw5\PluggableAuth.log'; $wgDebugLogGroups['LDAP'] = 'd:\Apache24\htdocs\mw5\LDAPlog.log';

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = 'd:\Apache24\htdocs\mw5\providerlog.log';

$wgDebugLogGroups['LDAPGroups'] = 'd:\Apache24\htdocs\mw5\LDAPgroupslog.log';

$wgDebugLogGroups['LDAPUserInfo'] = 'd:\Apache24\htdocs\mw5\LDAPuserinfolog.log';

$wgDebugLogGroups['LDAPAuthorization'] = 'd:\Apache24\htdocs\mw5\LDAPauthlog.log';

$wgDebugLogGroups['Auth_remoteuser'] = 'd:\Apache24\htdocs\mw5\remoteuser.log'; R2spotuser (talk) 05:35, 20 September 2019 (UTC)Reply

This error indicates that you have a version mismatch in the LDAP-Stack extensions. Please update _all of the LDAP-prefixed extensions to the latest version (I recommend using REL1_31 branch, as this is the LTS branch and I know it's working, as we have it running at quite a number of customers). Osnard (talk) 07:01, 20 September 2019 (UTC)Reply

if there a particular site i can get them from.. I thought i had the upgraded version already...

disregard.. Found them..

R2spotuser (talk) 21:01, 20 September 2019 (UTC)Reply

I replaced the version and i no longer get the error.. I can use my credentials (user name and password to get in.. But no one else can (maybe because i created a local account in mediawiki).

From the logs, i still see a format issue with how my user name is returned..

2019-09-21 03:11:32 server my_wiki5: Unsupported format!

2019-09-21 03:11:42 server my_wiki5: Could not check login requirements for EJIOFOHR

[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff

[caches] LocalisationCache: using store LCStoreDB

[session] Can't login remote user 'EJIOFOHR' automatically. Blocked this user when applying filter to ''.

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff. R2spotuser (talk) 03:24, 25 September 2019 (UTC)Reply

When you run LDAPProvider/maintenance/ShowUserGroups.php --username=EJIOFOHR --domain=xxx.xxx does CN=CDERWiki,OU=Groups,OU=CDER,OU=Accounts,DC=xxx,DC=xxx show up in the output? Osnard (talk) 13:29, 25 September 2019 (UTC)Reply

yes, that along with other groups I am a member of. When I run LDAPProvider/maintenance/ShowUserInfo.php --domain xxx.xxx --username EJIOFOHR I get all my account info also..

But I do not think the wiki is really connecting and using LDAP.. How do I check if groups are syncing? or if it is trying to use my account pulled from LDAP. I think it is just using the local account I created when configuring the wiki. R2spotuser (talk) 20:03, 26 September 2019 (UTC)Reply

The line Can't login remote user 'EJIOFOHR' automatically. Blocked this user when applying filter to '' implies that LDAPAuthorization hooks into Auth_remoteuser. Please try to remove $wgAuthRemoteuserUserNameReplaceFilter. Instead configure $LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';. LDAPAuthorization is probably not able to extract the domain otherwise. Osnard (talk) 06:00, 2 October 2019 (UTC)Reply

where would i look. $wgAuthRemoteuserUserNameReplaceFilter is not present in localsettings file... i added $LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain'; to the local settings file and there is no difference in the log.

when I remove 'LDAPAuthorization' from localsettings, everyone who accesses the wiki is automatically logged in. Even if they are not part of the authorization group (dn).

R2spotuser (talk) 03:04, 3 October 2019 (UTC)Reply

Hi,

I am trying to configure it for my company. MW 1.31 but I do not know how to debug or if it is working. Any help would be appreciated.

62.14.255.236 (talk) 15:49, 11 February 2019 (UTC)Reply

BTW could you share your config file? 62.14.255.236 (talk) 16:04, 11 February 2019 (UTC)Reply

I am interested too.

I have downloaded LDAPProvider, LDAPAuthentication2, LDAPUserInfo, LDAPGroups and PluggableAuth.

All of them are activated in Localsettings.php and the file ldapprovider,json was created but the Webpage is withe on access 132.187.202.59 (talk) 12:30, 15 March 2019 (UTC)Reply

Okay the white page is solved. I am on the site but no SSO is working 132.187.202.59 (talk) 13:25, 15 March 2019 (UTC)Reply

With Auth_remoteuser it is working now. But i get "No configuration available for domain ''!" too 132.187.202.59 (talk) 14:31, 15 March 2019 (UTC)Reply

What does the value of $_SERVER['REMOTE_USER'] look like, and what value have you configured for $LDAPAuthorizationAutoAuthRemoteUserStringParserRegistry Osnard (talk) 09:14, 5 July 2019 (UTC)Reply

Greetings Osnard..

I had to completely restart configuring mediawiki.. I am currently using 1.34. I have it configured to create an account on first visit to the page.. Now i have installed the LDAP stack so i can restrict access to specific groups. we plan to have several wikis with different group access..

There are 2 values i can get. The network folks configured to pull the header is the straight username format.

1 straight username using $_SERVER['OAM_REMOTE_USER']

2 is cn=,ou=,ou= $_SERVER['REMOTE_USER']

$LDAPAuthorizationAutoAuthRemoteUserStringParserRegistry = 'username-at-domain';

---showuserinfo.php shows some of the groups the member is part of and a lot of additional info in the log

--- Checklogin is True

---show userinfo gives this

[365cd6ac1093e478e66cc70a] [no req] Error from line 71 of D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\UserInfoRequest.php: Class 'MediaWiki\Extension\LDAPProvider\MWException' not found

Backtrace:

#0 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\Client.php(228): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo(string)

#1 D:\Apache24\htdocs\mw15\includes\libs\objectcache\BagOStuff.php(133): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}(integer)

#2 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\Client.php(229): BagOStuff->getWithSetCallback(string, integer, Closure)

#3 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\maintenance\ShowUserInfo.php(49): MediaWiki\Extension\LDAPProvider\Client->getUserInfo(string)

#4 D:\Apache24\htdocs\mw15\maintenance\doMaintenance.php(99): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()

#5 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\maintenance\ShowUserInfo.php(72): require_once(string)

#6 {main}

Here is a copy of my localsettings file

wfLoadExtension( 'AccessControl' );

wfLoadExtension( 'CodeEditor' );

require_once "$IP/extensions/LdapAuthentication/LdapAuthentication.php";

wfLoadExtension( 'LDAPGroups' );

wfLoadExtension( 'Auth_remoteuser' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'PdfHandler' );

wfLoadExtension( 'Renameuser' );

wfLoadExtension( 'WikiEditor' );

wfLoadExtension( 'PluggableAuth' );

# End of automatically generated settings.

# Add more configuration options below.

###############################################################################################################################################################

$wgGroupPermissions['cderwiki']['edit'] = true;

#$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';

#$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'domain-backslash-username';

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

$user = ( $_SERVER[ 'REMOTE_USER' ] ) ;

}

return $user;

};

$LDAPAuthorizationAutoAuthRemoteUserStringParserRegistry = 'username-at-domain';

$LDAPProviderDomainConfigProvider = function() {

$config = [

'fda.gov' => [

'connection' => [

"server" => "xxx.xxx",

"user" => "CN=FFFF,OU=Service Accounts,OU=Administrators,DC=ccc,DC=ccc",

"pass" => 'xxxxxxx',

## "enctype" => 'SSL',

"options" => [

"LDAP_OPT_DEREF" => 1

],

## "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory",

## "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory#",

"basedn" => "dc=xxx,dc=xxx",

"groupbasedn" => "ou=groups,ou=cder,ou=accounts,dc=xxx,dc=xxx",

"userbasedn" => "dc=xxx,dc=xxx",

"searchattribute" => "CN",

"searchstring" => "",

"usernameattribute" => "cn",

"realnameattribute" => "cn"

],

'authorization' => [

"rules" => [

"groups" => [

"required" => [

"cn=cderwiki,ou=groups,ou=cder,ou=accounts,dc=xxx,dc=xxx"

]

],

'userinfo' => [

"attributes-map" => [

"realname" => "cn",

"email" => "mail"

]

],

'groupsync' => [

"mechanism" => "mappedgroups",

"mapping" => [

"sysop" => "cn=cderwtestg,ou=scientific,ou=groups,dc=xxx,dc=xxx",

"cderwiki" => "cn=cderwtestg1,ou=scientific,ou=groups,dc=xxx,dc=xxx"

]

];

## $wgPluggableAuth_ButtonLabel = "Log In";

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

#####Error logging######

##PHP Error ###

error_reporting( -1 );

ini_set( 'display_errors', 1 );

$wgShowExceptionDetails = true;

$wgShowDBErrorBacktrace = true;

##SQL Error ###

$wgDebugDumpSql = true;

##Debug log to file ###

$wgLDAPDebug = 3;

$wgDebugLogFile = 'd:\Apache24\htdocs\mw15\logfile.txt';

$wgDebugComments = true;

$wgDebugLogGroups['PluggableAuth'] = 'd:\Apache24\htdocs\mw15\plug.log \mw5\PluggableAuth.log';

$wgDebugLogGroups['LDAP'] = 'd:\Apache24\htdocs\mw15\LDAPlog.log';

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = 'd:\Apache24\htdocs\mw15\providerlog.log';

$wgDebugLogGroups['LDAPGroups'] = 'd:\Apache24\htdocs\mw15\LDAPgroupslog.log';

$wgDebugLogGroups['LDAPUserInfo'] = 'd:\Apache24\htdocs\mw15\LDAPuserinfolog.log';

$wgDebugLogGroups['LDAPAuthorization'] = 'd:\Apache24\htdocs\mw15\LDAPauthlog.log';

$wgDebugLogGroups['LDAPAuthorization2'] = 'd:\Apache24\htdocs\mw15\LDAPauthlog.log';

$wgDebugLogGroups['Auth_remoteuser'] = 'd:\Apache24\htdocs\mw15\remoteuser.log';

Thanks for your help R2spotuser (talk) 20:53, 17 February 2020 (UTC)Reply

The reason to the callstack was a bug in the extension. It has been fixed now. But still, there is a problem: The error indicates that a search for the provided username in LDAP returned more than one result. This must never happen. Can you tell me what happens if you execute a LDAP search from the CLI using "(CN=<some-username>)"? Osnard (talk) 09:02, 19 February 2020 (UTC)Reply

so just open a prompt and run " ldapsearch --baseDN dc=xxx,dc=xxx "(cn=uername)"?? substituting username with an actual user

R2spotuser (talk) 20:43, 21 February 2020 (UTC)Reply

Yes Osnard (talk) 07:02, 24 February 2020 (UTC)Reply

I may be doing something wrong but when i run ldapsearch --baseDN dc=xxx,dc=xxx "(cn=uername) i get an error "ldapsearch is not recognized as an internal or external command

R2spotuser (talk) 02:36, 27 February 2020 (UTC)Reply

This means that you don't have `ldapsearch` installed. Which operating system are you running on? If it is Windows, you may want to use `ADExplorer` instead. Osnard (talk) 15:07, 27 February 2020 (UTC)Reply

Windows server 2012R2. is there a specific class i should select in ADEXPLORER?

I ran the search using cn=username against dc=xxx, dc=xxx and it pulled up a bunch of dn entries from the domain. when i run it against the specific group ($wgLDAPUserBaseDNs) OU=Accounts,DC=xxx,DC=xxx , I get the dn entry for the user R2spotuser (talk) 06:12, 28 February 2020 (UTC)Reply

Maybe we need to implement a new "UserInfoRequest" for your case. Usually the search for a certain user-DN should only return _one_ entry. As you can see from [1], we are using the "searchattribute" and the user-base-DN four the query. You could try to hack this part of the code and provide it to me if it's working. I can then check if I can properly implement this into the extension so it is safe for updates.

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/master/src/UserInfoRequest.php#L51-L76 Osnard (talk) 07:41, 2 March 2020 (UTC)Reply

when i change attribute to distinguisedname and run showuserinfo.php, it now returns one entry

// We explicitly put "memberof" here because it's an operational

// attribute in some servers.

$attributes = [ "distinguishedname" ];

from ldap log

2020-03-03 07:00:30 xxxxxxxxxxx my_wiki_15: # returns: array (

'count' => 1,

0 =>

array (

'distinguishedname' =>

array (

'count' => 1,

0 => 'CN=EJIOFOHR,OU=xxxx,OU=Accounts,DC=xxx,DC=xxx',

),

0 => 'distinguishedname',

'count' => 1,

'dn' => 'CN=EJIOFOHR,OU=xxxx,OU=Accounts,DC=xxx,DC=xxx',

),

)

When i reload the wiki i get

Warning: ldap_connect(): Could not create session handle: Local error in D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 244

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 54

Warning: ldap_count_entries() expects parameter 1 to be resource, bool given in D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 295

[cccb79982df2e8c1cf979622] /mw15/index.php/Main_Page Exception from line 70 of D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\PlatformFunctionWrapper.php: Nothing to bind with!

Backtrace:

#0 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\Client.php(153): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->bind(string, string)

#1 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#2 D:\Apache24\htdocs\mw15\extensions\LDAPProvider\src\Client.php(332): MediaWiki\Extension\LDAPProvider\Client->init()

#3 D:\Apache24\htdocs\mw15\extensions\LDAPAuthorization\src\RequirementsChecker.php(69): MediaWiki\Extension\LDAPProvider\Client->getUserGroups(string)

#4 D:\Apache24\htdocs\mw15\extensions\LDAPAuthorization\src\RequirementsChecker.php(47): MediaWiki\Extension\LDAPAuthorization\RequirementsChecker->makeGroupRequirements(string, array)

#5 D:\Apache24\htdocs\mw15\extensions\LDAPAuthorization\src\Hook\AuthRemoteuserFilterUserName.php(101): MediaWiki\Extension\LDAPAuthorization\RequirementsChecker->allSatisfiedBy(string)

#6 D:\Apache24\htdocs\mw15\extensions\LDAPAuthorization\src\Hook\AuthRemoteuserFilterUserName.php(67): MediaWiki\Extension\LDAPAuthorization\Hook\AuthRemoteuserFilterUserName->process()

#7 D:\Apache24\htdocs\mw15\includes\Hooks.php(174): MediaWiki\Extension\LDAPAuthorization\Hook\AuthRemoteuserFilterUserName::callback(string)

#8 D:\Apache24\htdocs\mw15\includes\Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#9 D:\Apache24\htdocs\mw15\extensions\Auth_remoteuser\src\UserNameSessionProvider.php(288): Hooks::run(string, array)

#10 D:\Apache24\htdocs\mw15\includes\session\SessionManager.php(466): MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider->provideSessionInfo(WebRequest)

#11 D:\Apache24\htdocs\mw15\includes\session\SessionManager.php(191): MediaWiki\Session\SessionManager->getSessionInfoForRequest(WebRequest)

#12 D:\Apache24\htdocs\mw15\includes\WebRequest.php(806): MediaWiki\Session\SessionManager->getSessionForRequest(WebRequest)

#13 D:\Apache24\htdocs\mw15\includes\session\SessionManager.php(129): WebRequest->getSession()

#14 D:\Apache24\htdocs\mw15\includes\Setup.php(827): MediaWiki\Session\SessionManager::getGlobalSession()

#15 D:\Apache24\htdocs\mw15\includes\WebStart.php(81): require_once(string)

#16 D:\Apache24\htdocs\mw15\index.php(41): require(string) R2spotuser (talk) 07:08, 3 March 2020 (UTC)Reply

This looks strange. It implies that the wiki can not connect to the LDAP properly. Do you have changed anything else in your configuration? Could it be that your proxy user (CN=FFFF) does not have a "distinguishedname".

You can try to use $attributes = [ "*", "memberof", "distinguishedname" ];. But it's pretty unlikely that this helps. If ShowUserInfo.php works the regular login should also work, as both use the same configuration. Osnard (talk) 07:01, 4 March 2020 (UTC)Reply

ok i completely redid the wiki.. including all the extensions..Remote_USER is pulling my full dn as in "cn=ejiofohr,ou=cder,ou=accounts,cn=users,dc=xxx,dc=xxx"

I tried using this code below (you provided a while back) but when i do this nothing is pulled into the log for user name.

$wgAuthRemoteuserUserName = function() {
	$user = '';
	if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {
		$user = strtolower( preg_replace( 'cn=(.*?),ou=cder,ou=accounts,cn=users,dc=xxx,dc=xxx', '$1', $_SERVER[ 'REMOTE_USER' ] ) );
	}
	return $user;
};

Can't login remote user '' automatically. Given remote user name is not of type string or empty. Can you help correct this? (i think this may be the best bet)

Additional Testing..

I also tried using one of the others which returned EJIOFOHR and appended the @domain (using code below) and even thought it returns EJIOFOH@xxx.xxx

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'XXX_REMOTE_USER' ] ) ) {

$user = ( $_SERVER[ 'XXX_REMOTE_USER' ] ) . '@xxx.xxx';

}

return $user;

};

I also get this. Can't login remote user '' automatically. Given remote user name is not of type string or empty. Can you help correct this?

If i use the same code with out appending the domain (no @xxx.xxx)

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'OAM_REMOTE_USER' ] ) ) {

$user = ( $_SERVER[ 'OAM_REMOTE_USER' ] );

}

return $user;

};

i get

log1

2020-03-06 07:07:08 Mediawiki my_wiki16: Could not check login requirements for EJIOFOHR

2020-03-06 07:07:08 Mediawiki my_wiki16: Unsupported format!

Log2

'filter' => '(samaccountname=EJIOFOHR)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2020-03-06 07:06:30 Mediawiki my_wiki16: Could not get user DN!

showuserinfo and showusergroups both work and show in the logs..

'base' => 'dc=fda,dc=gov',

'filter' => '(samaccountname=EJIOFOHR)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2020-03-06 07:13:22 Mediawiki my_wiki16: Found user DN: 'CN=EJIOFOHR,OU=CDER,OU=Accounts,DC=xxx,DC=xxx'

2020-03-06 07:13:22 Mediawiki my_wiki16: Ran LDAP search for '(&(objectclass=group)(member=CN=EJIOFOHR,OU=CDER,OU=Accounts,DC=xxx,DC=xxx))' in 0.038999080657959 seconds. R2spotuser (talk) 07:17, 6 March 2020 (UTC)Reply

Well, the pattern you chose for preg_replace misses proper delimiters and will emit a ERROR: Delimiter must not be alphanumeric or backslash. This should be visible in the regular PHP error log. Therefore $user returned by your $wgAuthRemoteuserUserName callback function will be NULL. Try using the pattern #cn=(.*?),ou=cder,ou=accounts,cn=users,dc=xxx,dc=xxx#si (see also https://www.php.net/manual/en/function.preg-replace.php).

So the reason that ShowUserGroups.php and ShowUserInfo.php work properly is that you provide the username explicitly. So chances are good that it's just the $wgAuthRemoteuserUserName that causes the issue. Osnard (talk) 06:54, 9 March 2020 (UTC)Reply

Thanks Osnard . I will make some changes and report back on this one.

I installed another instance of mw just so i can compare.. I am able to get $user to return ejiofohr@xxx.xxx. I used the other method you because some users do not have the same account path (ou=accounts,cn=users,dc=xxx,dc=xxx) as i do. still unable to login..

Full config....

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'xxx_REMOTE_USER' ] ) ) {

$user = strtolower( $_SERVER[ 'xxx_REMOTE_USER' ] ) . '@xxx.xxx';

}

return $user;

};

$wgLDAPAutoAuthUsername = $_SERVER["REMOTE_USER"];

$LDAPProviderDomainConfigProvider = function() {

$config = [

'xxx.xxx' => [

'connection' => [

"server" => "xxx-dc-wdcmd-2v ldap.xxx.xxx",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"user" => "xxxx,ou=service accounts,ou=administrators,dc=xxx,dc=xxx",

"pass" => 'Dr67@W4m',

## "port" => '636',

## "enctype" => 'clear',

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory",

"basedn" => "dc=xxx,dc=xxx",

"groupbasedn" => "ou=scientific,ou=groups,dc=xxx,dc=xxx",

"userbasedn" => "dc=xxx,dc=xxx",

"searchattribute" => "samaccountname",

## "searchstring" => "xxx.xxx\\USER-NAME",

"searchstring" => "USER-NAME@xxx.xxx",

## "searchstring" => "cn=USER-NAME,ou=cder,ou=accounts,cn=users,dc=xxx,dc=xxx",

"usernameattribute" => "samaccountname",

"realnameattribute" => "displayname"

],

'authorization' => [

"rules" => [

"groups" => [

"required" => [

"cn=cderwtestg1,ou=scientific,ou=groups,dc=xxx,dc=xxx"

]

],

'userinfo' => [

"attributes-map" => [

"realname" => "displayname",

"email" => "mail"

]

],

'groupsync' => [

"mechanism" => "mappedgroups",

"mapping" => [

"sysop" => "cn=cderwtestg,ou=scientific,ou=groups,dc=xxx,dc=xxx",

"cderwtestg1" => "cn=cderwtestg1,ou=scientific,ou=groups,dc=xxx,dc=xxx",

"bureaucrat" => "cn=cderwtestg2,ou=scientific,ou=groups,dc=xxx,dc=xxx"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

log1:

[localisation] LocalisationCache: using store LCStoreDB

[session] SessionManager using store SqlBagOStuff

[session] Can't login remote user 'ejiofohr@xxx.xxx' automatically. Blocked this user when applying filter to ''.

[session] Session "vc76t5bl95fq4ut45l5etgo56mqkiv30" requested without UserID cookie

[DBQuery] Wikimedia\Rdbms\DatabaseMysqlBase::open [0.001s] localhost: SET group_concat_max_len = 262144, sql_mode = ''

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: request info {

Log2:

2020-03-10 00:10:38 mediawiki my_wiki16: Could not check login requirements for ejiofohr@xxx.xxx

2020-03-10 00:10:38 mediawiki my_wiki16: Unsupported format! R2spotuser (talk) 01:16, 10 March 2020 (UTC)Reply

Have you enabled Extension:LDAPAuthorization and set $LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';? Osnard (talk) 07:50, 10 March 2020 (UTC)Reply

Yea i did

Here are the extensions i have enabled..

wfLoadExtension( 'Auth_remoteuser' );

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPGroups' );

wfLoadExtension( 'PluggableAuth' );

$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$wgGroupPermissions['*']['autocreateaccount'] = true;

$wgGroupPermissions['*']['createaccount'] = true; R2spotuser (talk) 02:54, 12 March 2020 (UTC)Reply

I went over and noticed $LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain'; was misspelled.. I fixed and am now getting

Warning: ldap_connect(): Could not create session handle: Local error in D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 244

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 54

Warning: ldap_count_entries() expects parameter 1 to be resource, bool given in D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\PlatformFunctionWrapper.php on line 295

[073f60b1cd3b17f5846849ca] /mw16/ Exception from line 70 of D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\PlatformFunctionWrapper.php: Nothing to bind with!

Backtrace:

#0 D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\Client.php(153): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->bind(string, string)

#1 D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#2 D:\Apache24\htdocs\mw16\extensions\LDAPProvider\src\Client.php(331): MediaWiki\Extension\LDAPProvider\Client->init()

#3 D:\Apache24\htdocs\mw16\extensions\LDAPAuthorization\src\RequirementsChecker.php(69): MediaWiki\Extension\LDAPProvider\Client->getUserGroups(string)

#4 D:\Apache24\htdocs\mw16\extensions\LDAPAuthorization\src\RequirementsChecker.php(47): MediaWiki\Extension\LDAPAuthorization\RequirementsChecker->makeGroupRequirements(string, array)

#5 D:\Apache24\htdocs\mw16\extensions\LDAPAuthorization\src\Hook\AuthRemoteuserFilterUserName.php(102): MediaWiki\Extension\LDAPAuthorization\RequirementsChecker->allSatisfiedBy(string)

#6 D:\Apache24\htdocs\mw16\extensions\LDAPAuthorization\src\Hook\AuthRemoteuserFilterUserName.php(68): MediaWiki\Extension\LDAPAuthorization\Hook\AuthRemoteuserFilterUserName->process()

#7 D:\Apache24\htdocs\mw16\includes\Hooks.php(174): MediaWiki\Extension\LDAPAuthorization\Hook\AuthRemoteuserFilterUserName::callback(string)

#8 D:\Apache24\htdocs\mw16\includes\Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#9 D:\Apache24\htdocs\mw16\extensions\Auth_remoteuser\src\UserNameSessionProvider.php(288): Hooks::run(string, array)

#10 D:\Apache24\htdocs\mw16\includes\session\SessionManager.php(466): MediaWiki\Extension\Auth_remoteuser\UserNameSessionProvider->provideSessionInfo(WebRequest)

#11 D:\Apache24\htdocs\mw16\includes\session\SessionManager.php(191): MediaWiki\Session\SessionManager->getSessionInfoForRequest(WebRequest)

#12 D:\Apache24\htdocs\mw16\includes\WebRequest.php(806): MediaWiki\Session\SessionManager->getSessionForRequest(WebRequest)

#13 D:\Apache24\htdocs\mw16\includes\session\SessionManager.php(129): WebRequest->getSession()

#14 D:\Apache24\htdocs\mw16\includes\Setup.php(827): MediaWiki\Session\SessionManager::getGlobalSession()

#15 D:\Apache24\htdocs\mw16\includes\WebStart.php(81): require_once(string)

#16 D:\Apache24\htdocs\mw16\index.php(41): require(string)

#17 {main} R2spotuser (talk) 15:29, 13 March 2020 (UTC)Reply

Looks like the LDAP client can not connect with the configured values for "user"/"pass". Osnard (talk) 15:03, 16 March 2020 (UTC)Reply

I tested with the LDAP clients using the same information and am able to.. is there something else i can try?

R2spotuser (talk) 18:07, 16 March 2020 (UTC)Reply

If on the CLI ShowUserInfo.php works, but in the webbrowser it doesn't this means that the contiguration can not be ready by the webserver user. Do you have your configuration in a dedicated file that is not accessible by the webserver user? Osnard (talk) 10:53, 17 March 2020 (UTC)Reply

hmm will check. But if I just use Auth_remoteUser plugin, it created the account and logs in. Are there different permissions needed for LDAP extensions?? R2spotuser (talk) 01:49, 20 March 2020 (UTC)Reply

"Auth_remoteuser" does not communicate with LDAP at all. But the LDAP extensions do. E.g. for checking authorization and syncing user groups and info. And they need to be able to connect. If CLI calls (like "ShowUserInfo.php") succeed, everything should be set up properly. If it still does not work when using the webbrowser then the LDAP config may not be readable by the webserver user context. Osnard (talk) 13:58, 20 March 2020 (UTC)Reply

allowed permissions for everyone and still doesnt work. There must be some configuration on the server or something I am missing. ShowUserInfo.php is running with no issue same with group info.. is there anything else you recommend i check? this is on a Windows server..

R2spotuser (talk) 02:13, 27 March 2020 (UTC)Reply

so I went back to the drawing board. spoke with some admins and started from stratch....

I now have 3 instances (LDAP, AD and one using json file). I keep getting stopped with the same issue..

mediawiki 1.34.1

from LDAPAuthorization

2020-04-13 00:41:49 FDSWV04453 my_wiki_3: Could not check login requirements for USERNAME@xx.xx

2020-04-13 00:41:49 FDSWV04453 my_wiki_3: Unsupported format!

From wiki log

[session] SessionManager using store SqlBagOStuff

[session] Can't login remote user 'USERNAME@xxx.xxx' automatically. Blocked this user when applying filter to ''.

[session] Session "ff2n33benppl03au2f5en9bvivg5vprh" requested without UserID cookie

[DBQuery] Wikimedia\Rdbms\DatabaseMysqlBase::open [0.001s] localhost: SET group_concat_max_len = 262144, sql_mode = ''

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: request info {

notes:

$_SERVER[ 'XXX_REMOTE_USER' returns "USERNAME"

So i added this to the localsettings

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'XXX_REMOTE_USER' ] ) ) {

# $user = strtolower( $_SERVER[ 'XXX_REMOTE_USER' ] );

$user =( $_SERVER[ 'OAM_REMOTE_USER' ] ) . '@XXX.XXX';

}

return $user;

};

Checking the logs, It is now returning username@xxx.xxx (which is the right format, correct?) So what is blocking it? why is it unsupported format?

both showuserinfo and show usergroups are running and pulling info from AD and LDAP respectively..

R2spotuser (talk) 19:37, 13 April 2020 (UTC)Reply

Well "Unsupported format!" means that the configured $LDAPAuthorizationAutoAuthRemoteUserStringParser (in you case 'username-at-domain' ) could not parse the given username [1][2][3]. As the log states "Could not check login requirements for USERNAME@xx.xx", we can assume that the username is actually "USERNAME@xx.xx", which should be parseable by 'username-at-domain' [2]. So the only Thing that I can think of is, that for some reason not 'username-at-domain' is used for parsing, but actually 'domain-backshlash-username'. You could check this by putting a error_log( $remoteUserStringParserKey ); at [4]. Alternatively you could reconfigure your $wgAuthRemoteuserUserName callback to set $user =( 'XXX.XXX\\' . $_SERVER[ 'OAM_REMOTE_USER' ] );

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/blob/53e1ada6db71bb19412a54c8e6d4f776962f6238/src/Hook/AuthRemoteuserFilterUserName.php#L114-L115

[2] https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/blob/53e1ada6db71bb19412a54c8e6d4f776962f6238/src/AutoAuth/RemoteUserStringParser/UsernameAtDomain.php#L17

[3] https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/blob/53e1ada6db71bb19412a54c8e6d4f776962f6238/src/AutoAuth/RemoteUserStringParser/DomainBackslashUsername.php#L17

[4] https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/blob/53e1ada6db71bb19412a54c8e6d4f776962f6238/src/Hook/AuthRemoteuserFilterUserName.php#L77 Osnard (talk) 14:52, 11 May 2020 (UTC)Reply

Strange thing is also that log states "Could not check login requirements for USERNAME@xx.xx" (two "x") but also "Can't login remote user 'USERNAME@xxx.xxx' automatically" (three "x"). Osnard (talk) 14:53, 11 May 2020 (UTC)Reply

How can I set my default domain?

Latest comment: 7 years ago3 comments2 people in discussion

Should the OpenID Connect Extension work with the LDAPUserInfo and LDAPGroups plugin, I always get the exception "No configuration available for domain ''!" and no Usersettings are changed. 62.178.171.148 (talk) 18:36, 6 March 2019 (UTC)Reply

There is no way of doing this at the moment. But this is a known issue and will be addressed soon. Osnard (talk) 20:08, 7 March 2019 (UTC)Reply

As a workaround you may add this to UserDomainStore.php [1]

public function getDomainForUser( User $user ) {
	return 'LDAP'; //If 'LDAP' is what you have configured as your domain
	$userId = $user->getId();

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/561064647df62579d123e59585782d7e8f13d1fb/src/UserDomainStore.php#L27-L28 Osnard (talk) 09:17, 5 July 2019 (UTC)Reply

Got it to work with bug fix

Latest comment: 6 years ago41 comments10 people in discussion

I am on MW 1.32.0 and am attempting to integrate with our corporate Active Directory for LDAP. I managed to get it to work with minimal configuration.

For reference, here is my config, using the LocalSettings.php method of config. I put "comments" in below which you need to strip.

wfLoadExtension("LDAPProvider");

$LDAPProviderDomainConfigProvider = function() {

$config = [

"mydomain" => [ // lowercase domain name--uses case-sensitive match

"connection" => [

"server" => "ldap.mydomain.com", // LDAP server (AD server for me)

"user" => "mydomain\\myadminuser", // NOT TESTED

"pass" => "admin password", // NOT TESTED

"basedn" => "dc=mydomain,dc=com", // Base DN for searching for user attributes

"groupbasedn" => "dc=mydomain,dc=com", // Present, but I don't use

"userbasedn" => "dc=mydomain,dc=com", // Used for authentication

"searchattribute" => "samaccountname", // lowercase (case-sensitive)

"searchstring" => "mydomain\\USER-NAME", // The form for AD

"usernameattribute" => "samaccountname", // For AD

"realnameattribute" => "cn",

"emailattribute" => "mail"

],

"groupsync" => [ // Intentionally empty for me, not using

],

"userinfo" => [ // Already have the three fields above I want

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

There is a problem if you do NOT want to use an admin user. In our environment, every user can bind to AD and search, so there is no need to create (and maintain the password for) a service admin account just for searching. However, the code in LDAPProvider/Client.php assumes that the admin user will be used for searching. This creates a problem.

I created a code fix whereby Client.php checks to see if the user successfully bound, and if so does not try to bind again to the admin user before searching. That works for my AD-based LDAP, but perhaps in the general case there should be an option to force re-binding to the admin user before searching.

t seems to me that there are two mutually exclusive options for which user to use for searching: use the admin user if supplied, or stay bound to the login user if admin user not supplied. I wrote my change to implement this logic. I'll see if I can figure out how to get the change pushed back in. Chiefgeek157 (talk) 15:22, 28 March 2019 (UTC)Reply

Thanks for your contribution! I will try to add it to the extension! [1] Osnard (talk) 05:54, 15 April 2019 (UTC)Reply

I did manage to submit a code change. It is awaiting review. Chiefgeek157 (talk) 16:49, 15 April 2019 (UTC)Reply

I have been beating my head against this one for a week or so now. I was able to get it working with the above configuration settings from chiefgeek. I think the main things were setting "mydomain" instead of "LDAP" and using the samaccountname and correct search string attributes of "mydomain\\USER_NAME". I set this up on a Windows Server 2016, IIS, Mediawiki 1.33, PHP 7.2.7, MySQL 8.0.16 Rjhumphrey (talk) 21:58, 22 July 2019 (UTC)Reply

I am close, but something isn't right. When I enter the wrong credentials, I get the appropriate auth error. When I enter the correct credentials, I get the error:

"Could not fetch required user info to complete login"

The logs don't show anything useful. I've tried changing realnameattribute to displayname (which I'd prefer instead of cn). Any ideas? I am using Active Directory.

$LDAPProviderDomainConfigProvider = function() {

$config = [

'myschool.edu' => [

'connection' => [

"server" => "dc01.myschool.edu",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"port" => 389,

"enctype" => "clear",

"basedn" => "dc=myschool,dc=edu",

"groupbasedn" => "dc=myschool,dc=edu",

"userbasedn" => "dc=myschool,dc=edu",

"searchattribute" => "samaccountname",

"searchstring" => "myschool\\USER-NAME",

"usernameattribute" => "samaccountname",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [

'cn=global wiki,ou=groups-internal,ou=people,dc=myschool,dc=edu'

]

],

'userinfo' => [

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

}; 24.218.251.105 (talk) 04:02, 1 August 2019 (UTC)Reply

Can you try executing php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain "myschool.edu" --username "SomeUser" and php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain "myschool.edu" --username "SomeUser", please? Osnard (talk) 07:00, 1 August 2019 (UTC)Reply

Thanks Osnard for helping out. Here is the output, but I'm not sure why this would work since I am not supplying the user's password.

php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain "myschool.edu" --username "SomeUser"

[284ba05d3ac05c4f66f00469] [no req] MWException from line 187 of /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php: Error in LDAP search: Operations error

Backtrace:

#0 /var/www/techwiki/w/extensions/LDAPProvider/src/UserInfoRequest.php(62): MediaWiki\Extension\LDAPProvider\Client->search(string, string, array)

#1 /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php(218): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo(string)

#2 /var/www/techwiki/w/includes/libs/objectcache/BagOStuff.php(158): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}()

#3 /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php(219): BagOStuff->getWithSetCallback(string, integer, Closure)

#4 /var/www/techwiki/w/extensions/LDAPProvider/maintenance/ShowUserInfo.php(48): MediaWiki\Extension\LDAPProvider\Client->getUserInfo(string)

#5 /var/www/techwiki/w/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()

#6 /var/www/techwiki/w/extensions/LDAPProvider/maintenance/ShowUserInfo.php(71): require_once(string)

#7 {main}

php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain "myschool.edu" --username "SomeUser"

PHP Warning: ldap_count_entries() expects parameter 2 to be resource, boolean given in /var/www/techwiki/w/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 295

[77544ac29d0a4a8516e6b73e] [no req] MWException from line 187 of /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php: Error in LDAP search: Operations error

Backtrace:

#0 /var/www/techwiki/w/extensions/LDAPProvider/src/UserGroupsRequest/GroupMember.php(32): MediaWiki\Extension\LDAPProvider\Client->search(string, string, array)

#1 /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php(331): MediaWiki\Extension\LDAPProvider\UserGroupsRequest\GroupMember->getUserGroups(string)

#2 /var/www/techwiki/w/includes/libs/objectcache/BagOStuff.php(158): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}()

#3 /var/www/techwiki/w/extensions/LDAPProvider/src/Client.php(332): BagOStuff->getWithSetCallback(string, integer, Closure)

#4 /var/www/techwiki/w/extensions/LDAPProvider/maintenance/ShowUserGroups.php(48): MediaWiki\Extension\LDAPProvider\Client->getUserGroups(string)

#5 /var/www/techwiki/w/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserGroups->execute()

#6 /var/www/techwiki/w/extensions/LDAPProvider/maintenance/ShowUserGroups.php(71): require_once(string)

#7 {main} JonathanKing~mediawikiwiki (talk) 01:28, 2 August 2019 (UTC)Reply

Here's the output from the logging you helped me setup elsewhere

2019-08-02 02:26:33 wiki techwikidb-tw_: ldap_connect( $hostname = 'ldap://dc01.myschool.edu:389 ldap://dc02.myschool.edu:389'

, $port = 389 );

2019-08-02 02:26:33 wiki techwikidb-tw_: # __METHOD__ returns Resource id #206

2019-08-02 02:26:33 wiki techwikidb-tw_: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2019-08-02 02:26:33 wiki techwikidb-tw_: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2019-08-02 02:26:33 wiki techwikidb-tw_: # returns 1

2019-08-02 02:26:33 wiki techwikidb-tw_: Setting LDAP_OPT_REFERRALS to 0

2019-08-02 02:26:33 wiki techwikidb-tw_: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2019-08-02 02:26:33 wiki techwikidb-tw_: # returns 1

2019-08-02 02:26:33 wiki techwikidb-tw_: Setting LDAP_OPT_DEREF to 1

2019-08-02 02:26:33 wiki techwikidb-tw_: ldap_set_option( $linkID, $option = 2, $newval = 1 );

2019-08-02 02:26:33 wiki techwikidb-tw_: # returns 1

2019-08-02 02:26:33 wiki techwikidb-tw_: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2019-08-02 02:26:38 wiki techwikidb-tw_: # returns 1

2019-08-02 02:26:38 wiki techwikidb-tw_: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2019-08-02 02:26:38 wiki techwikidb-tw_: # returns 1

2019-08-02 02:26:38 wiki techwikidb-tw_: ldap_search( $linkID, $baseDN = 'dc=myschool,dc=edu', $filter = '(samaccountname=jking

)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = );

2019-08-02 02:26:38 wiki techwikidb-tw_: # returns

2019-08-02 02:26:38 wiki techwikidb-tw_: ldap_error( $linkID );

2019-08-02 02:26:38 wiki techwikidb-tw_: # returns Operations error JonathanKing~mediawikiwiki (talk) 02:32, 2 August 2019 (UTC)Reply

This looks like a binding issue. The credentials you have set in connection.user/connection.pass may not work or the specified user account is not allowed to perform a search in your LDAP. Osnard (talk) 06:08, 2 August 2019 (UTC)Reply

I would tend to agree with you, but I had this same setup working with LDAP_Authentication with no binding problems. I don't use a service account, I can just use my own regular AD account to bind and authenticate. JonathanKing~mediawikiwiki (talk) 15:48, 2 August 2019 (UTC)Reply

I just used an account in the connection setup for binding, and now I'm blocked at Authorization (will look at that later though). I know that my AD account can search, and that I didn't have to specify a bind account for LDAP_Authentication. What is different about the new setup that makes this not work for me? I really don't want to ask for an AD account to be created for this if possible. If I provide the correct AD credentials in the login form, shouldn't those credentials be sufficient to look that same account and pull the groups it's in? JonathanKing~mediawikiwiki (talk) 15:58, 2 August 2019 (UTC)Reply

Well, this has probably changed from the old version (actually I can not tell for sure).

When you enter the credentials, they will only be used for the "authentication part", which means that the combination of username and password is verified by a successful bind. All other calls to the LDAP server will then again be made using "anonymous bind" (unless you specify connection.user and connection.pass of course). These include requesting user information (for getting the proper username, realname and e-mail-address) as well as the group memberships (which might be used for the "authorization part").

So unfortunately it looks like you either use a proxy user, or make sure that your LDAP supports searching for anonymous (which I would not recommend). Osnard (talk) 12:26, 5 August 2019 (UTC)Reply

Thanks Osnard, I went with the proxy user. JonathanKing~mediawikiwiki (talk) 21:51, 5 August 2019 (UTC)Reply

Thanks for this thread, its insightful.

I think I'm having the same problem, while looking to migrate to the new LDAP stack. In my old/current LDAP_Authentication setup I'm not using a proxy user and I would prefer not using one at all. I don't have control over the LDAP setup (AD actually), but I don't think it supports anonymous searching. I think the LDAP_Authentication did not rely on this?

It seems that my only option is to start using a proxy user? 217.67.234.67 (talk) 09:44, 16 September 2019 (UTC)Reply

I'm in the same situation. I am currently using direct authentication with user accounts, without any bind account. I don't have control over AD and it does not allow for anonymous searching. 217.67.234.67 (talk) 09:38, 22 October 2019 (UTC)Reply

Lol; this is about the same install (I'll talk with my colleague). 217.67.234.67 (talk) 09:45, 22 October 2019 (UTC)Reply

At the moment, yes. Sorry. Osnard (talk) 11:38, 16 September 2019 (UTC)Reply

Hi Osnard,

I am trying to implement LDAP Stack on mediawiki 1.33. So far not so successful.

First problem, when I set

$LDAPAuthentication2AllowLocalLogin = true;

$wgAuthRemoteuserAllowUserSwitch = true;

$wgPluggableAuth_EnableLocalLogin = true;

I get TWO "Log in" buttons on the login screen. One (default) is for the stock login page. The other is from PluggableAuth. If I don't allow local login then the default/stock login button will disappear.

Is there a way to have one login button for both local and LDAP authentication?

Second problem which is more serious is that I can't get it to work. I tried

php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain "mydomain.local" --username "SomeUser"

php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain "mydomain.local" --username "SomeUser"

php extensions/LDAPProvider/maintenance/CheckLogin.php --domain "mydomain.local" --username "SomeUser"

They all return results. CheckLogin.php gives me an "OK" after I put in the right password.

But I can't login mediawiki. Page says: User not authorized

Logs:

2019-09-17 21:34:45 server wiki: Found user DN: 'CN=MyUser,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=MyCompany,DC=local'

2019-09-17 21:34:45 server wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'CN=MyUser,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=MyCompany,DC=local'

2019-09-17 21:34:45 server wiki: ldap_bind( $linkID, $bindRDN = 'CN=MyUser,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=MyCompany,DC=local', $bindPassword = 'XXXX' );

2019-09-17 21:34:45 server wiki: # returns 1

2019-09-17 21:34:45 server wiki: Authenticated new user:

2019-09-17 21:34:45 server wiki: Authorization failure. Czakl (talk) 21:39, 17 September 2019 (UTC)Reply

Okay, so authentication works, but authorization does not. This is probably due to some constraint you have set up. Do you have enabled group-based-restrictions e.g. in authoritzation.rules.groups of your domain-config? Osnard (talk) 06:12, 19 September 2019 (UTC)Reply

What settings do I need to use to set up the proxy user? I used to have:

$wgLDAPProxyAgent = array( "domain.whatever" => "uid=wikistuff,ou=applications,o=company,c=us" );

$wgLDAPProxyAgentPassword = array( "domain.whatever" => "XXXXX" );

my current config:

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo'

] );

$LDAPProviderDomainConfigProvider = function() {

$config = [

"domain.whatever" => [

"connection" => [

"server" => "server.company.org",

"searchattribute" => "uid",

"searchstring" => "uid=wikistuff,ou=applications,o=company,c=us",

"password" => "XXXXX",

"basedn" => "o=company,c=us",

"usernameattribute" => "uid",

"enctype" => "clear",

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

Current error I am getting: Could not authenticate credentials against domain "domain.whatever"

The ShowUserInfo, ShowUserGroups, and CheckLogin all appear to be working fine. Jrsovereign (talk) 20:50, 18 October 2019 (UTC)Reply

You say "CheckLogin" works, but form-based-authentication in the web browser does not? That's very strange. Both are using the same method...

Are there any hints on the log? Osnard (talk) 12:20, 19 October 2019 (UTC)Reply

2019-10-21 14:13:46 wiki: ldap_connect( $hostname = 'ldap://server.company.org:389', $port = 389 );

2019-10-21 14:13:46 wiki: # __METHOD__ returns Resource id #364

2019-10-21 14:13:46 wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2019-10-21 14:13:46 wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2019-10-21 14:13:46 wiki: # returns 1

2019-10-21 14:13:46 wiki: Setting LDAP_OPT_REFERRALS to 0

2019-10-21 14:13:46 wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2019-10-21 14:13:46 wiki: # returns 1

2019-10-21 14:13:46 wiki: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2019-10-21 14:13:46 wiki: # returns 1

2019-10-21 14:13:46 wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=wikistuff,ou=applications,o=company,c=US'

2019-10-21 14:13:46 wiki: ldap_bind( $linkID, $bindRDN = 'uid=wikistuff,ou=applications,o=company,c=US', $bindPassword = 'XXXX' );

2019-10-21 14:13:46 wiki: # returns 1 Jrsovereign (talk) 14:19, 21 October 2019 (UTC)Reply

Got closer, adding this line:

"binddn" => "uid=wikistuff,ou=applications,o=company,c=US",

So now when I do CheckLogin, it works with my personal account name and password. But it does not work on the site, gives me Could not fetch required user info to complete login Jrsovereign (talk) 18:03, 21 October 2019 (UTC)Reply

Could there be some sort of firewall blocking the browser from connecting? Some setting from the old LDAP Authentication I am missing? Jrsovereign (talk) 14:24, 23 October 2019 (UTC)Reply

I don't think this is a browser problem at all. Osnard (talk) 09:22, 25 October 2019 (UTC)Reply

well, it only works when i use the proxy account password, not my user password Jrsovereign (talk) 16:01, 19 October 2019 (UTC)Reply

Can you please modify the file src/PlatformFunctionWrapper.php, lines 76-79 in the extension "LDAPProvider" from

\MediaWiki\suppressWarnings();
$ret = \ldap_bind( $this->linkID, $bindRDN, $bindPassword );
\MediaWiki\restoreWarnings();
wfDebugLog( "LDAP", "# returns $ret" );

to

$ret = \ldap_bind( $this->linkID, $bindRDN, $bindPassword );
wfDebugLog( "LDAP", "# returns $ret" );
if( !$ret ) {
    wfDebugLog( "LDAP", "# error:" . \ldap_error( $this->linkID ) );
}

Then run the Login again and share the debug log and the standard PHP error log here.

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/e9595e641774c0d386b498f7277c17e0e72be5a2/src/PlatformFunctionWrapper.php#L76-L79 Osnard (talk) 09:33, 25 October 2019 (UTC)Reply

OK, so I noticed I only get things logged when I run one of your maintenance scripts. Nothing ever gets logged when I go from the login screen of the browser.

Here is a log from using CheckLogin:

IP: 127.0.0.1

Start command line script /opt/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php

[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff

[caches] LocalisationCache: using store LCStoreDB

Unstubbing $wgParser on call of $wgParser::setHook from require_once

Parser: using preprocessor: Preprocessor_DOM

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "127.0.0.1",

"UserAgent": false,

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

and here's the other log:

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_connect( $hostname = 'ldap://myldapserver.opr.mycompany.org:389', $port = 389 );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # __METHOD__ returns Resource id #370

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns 1

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: Setting LDAP_OPT_REFERRALS to 0

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns 1

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns 1

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'o=mycompany,c=us',

'filter' => '(uid=myuserid)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_search( $linkID, $baseDN = 'o=mycompany,c=us', $filter = '(uid=myuserid)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns Resource id #383

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_count_entries( $linkiID, $result = 'Resource id #383' );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns 1

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_get_entries( $linkID, $resultID );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns: array (

'count' => 1,

0 =>

array (

'objectclass' =>

array (

'count' => 5,

0 => 'top',

1 => 'person',

2 => 'organizationalPerson',

3 => 'inetOrgPerson',

4 => 'mycompanyperson',

),

0 => 'objectclass',

//ALL MY USER INFO LISTED OUT

),

)

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: Found user DN: 'uid=myuserid,ou=employee,o=mycompany,c=US'

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=myuserid,ou=employee,o=mycompany,c=US'

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: ldap_bind( $linkID, $bindRDN = 'uid=myuserid,ou=employee,o=mycompany,c=US', $bindPassword = 'XXXX' );

2019-10-25 15:03:48 myserverid.opr.test.mycompany.org wiki: # returns 1 Jrsovereign (talk) 15:30, 25 October 2019 (UTC)Reply

Do you have the other extensions from LDAP Stack like Extension:PluggableAuth and Extension:LDAPAuthentication2 installed? Osnard (talk) 09:03, 29 October 2019 (UTC)Reply

yes Jrsovereign (talk) 11:17, 29 October 2019 (UTC)Reply

Ah, sorry. I looked at the config from "Chiefgeek157", not yours.

Have you set $wgDebugLogFiles['LDAPAuthentication2']?

If nothing get's logged when you try from-based-authentication from the browser this means that the wiki never even tries to connect to LDAP. There are only very little cases:

The plugin assumes you try to log in locally: https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/8b043184ede3a458a8500f8807c250a6629bfbb1/src/PluggableAuth.php#L54-L68
The plugin found no domain to be chosen: https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/8b043184ede3a458a8500f8807c250a6629bfbb1/src/PluggableAuth.php#L74-L75 But this should result in a visible error message at the login form.
The plugin faced an issue while trying to connect to LDAP: https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/8b043184ede3a458a8500f8807c250a6629bfbb1/src/PluggableAuth.php#L101 (But actually in that case you should see something on the log already) Osnard (talk) 12:19, 31 October 2019 (UTC)Reply

So I reconfigured my log files to separate the files... the only files that come back are LDAP and Client - and ONLY when I do the CheckLogin script:

$wgDebugLogGroups = array(

'PluggableAuth' => '/tmp/pa.log',

'LDAP' => '/tmp/LDAP.log',

'MediaWiki\\Extension\\LDAPProvider\\Client' => '/tmp/client.log',

'LDAPGroups' => '/tmp/grp.log',

'LDAPUserInfo' => '/tmp/user.log',

'LDAPAuthentication2' => '/tmp/auth2.log',

'LDAPAuthorization' => '/tmp/authz.log',

); Jrsovereign (talk) 17:06, 1 November 2019 (UTC)Reply

Yeah the local login thing might be an issue...at one point I set AllowLocalLogin to true, and it did log me in using local using the password stored in the database, but when I selected to log in with the domain, it failed. Jrsovereign (talk) 14:36, 31 October 2019 (UTC)Reply

But if it actually fails when authenticating against the LDAP resource you should see an appropriate error message in the login form and also have something put out to the log file... Osnard (talk) 09:09, 1 November 2019 (UTC)Reply

Also does the PHP version matter? Here's what I have:

Product	Version
MediaWiki	1.33.1
PHP	7.0.27 (apache2handler)
MariaDB	5.5.64-MariaDB
Elasticsearch	5.6.10

Jrsovereign (talk) 17:08, 1 November 2019 (UTC)Reply

could there be an issue with my domain having spaces and parenthesis? it is "prod (b2e)" Jrsovereign (talk) 16:21, 1 November 2019 (UTC)Reply

No, neither PHP version, nor parenthesis in the domain name should be an issue. Osnard (talk) 11:43, 4 November 2019 (UTC)Reply

Is there anything I would need to do with SELinux settings? Jrsovereign (talk) 15:31, 5 November 2019 (UTC)Reply

I have the same symptoms as Jrsovereign. Logs don't show anything from web, only if I run php extensions/maintenance... I've disabled selinux on my host in the hopes to get some form of logs, no joy. Awliste (talk) 20:45, 7 November 2019 (UTC)Reply

I managed to make web login work after removing the content of "authorization" block. Mediatera (talk) 07:08, 24 February 2020 (UTC)Reply

In that case no authorization rules will be applied. You can always check what the application "sees" by executing "LDAPProvider/maintenance/ShowUserGroups.php" on the CLI. This should give you an idea of what to put into "authorization" and also answer the question if the "group request" is configured properly. Osnard (talk) 14:55, 24 February 2020 (UTC)Reply

What am I doing wrong?

Latest comment: 7 years ago4 comments2 people in discussion

See below for my LocalSettings.php stanza for LDAPProvider. We are not seeing any queries to the ldap server at all, and therefore I am unable to login to my wiki, which is set to private with the main page visible. This is upgrading from 1.23 with the old LdapAuthentication (which worked beautifully) to 1.31 with LDAPProvider. I can still login with the local admin account, even as ldap accounts are not able to authenticate.

We are on RHEL6 with the Software Collections version of apache 2.4, php7.0, and mariadb 5.6 installed. We are trying to piece this together since the base RHEL6 is woefully out of date for all these services.

I feel like there must be something else I do not have since my settings nearly match the configs which others have said do work for them. ldap1 in the provided settings does not register that this webserver is attempting an ldap query. Is there something else after this stanza that allows the LDAPProvider extension to speak to the ldap server? What, if anything, am I missing here?

wfLoadExtension("LDAPProvider");

$LDAPProviderDomainConfigProvider = function() {

$config = [

"LDAP" => [

"connection" => [

"server" => "ldap1.example.com",

"port" => "636",

"user" => "cn=authuser,dc=example,dc=org",

"pass" => "authuser_password",

"basedn" => "dc=example,dc=org",

"groupbasedn" => "ou=Groups,dc=example,dc=org",

"userbasedn" => "ou=People,dc=example,dc=org",

"searchattribute" => "uid",

"searchstring" => "",

"usernameattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "Email"

],

"groupsync" => [

"cn=wikieditors,ou=Groups,dc=example,dc=org"

],

"userinfo" => [

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

}; 192.150.187.199 (talk) 23:54, 12 April 2019 (UTC)Reply

Please be aware that LDAPProvider is just one part of the puzzle. If you want to authenticate or authorize a user against an LDAP, you will also need Extension:LDAPAuthentication2 and Extension:LDAPAuthorization. For more Information, please see also LDAP_hub Osnard (talk) 05:52, 15 April 2019 (UTC)Reply

Ok, thanks for that. I've now got LDAPAuthentication2, LDAPAuthorization, LDAPGroups, and PluggableAuth enabled and the LDAP server is finally seeing queries. But I am still not able to log in to my wiki. When the request comes in to the server, it only tries to verify the account and does not authorize that account. I'll keep trying to figure it out, but it would be great if there were a more detailed set of instructions somewhere of how these pieces all fit together. 192.150.187.199 (talk) 00:02, 16 April 2019 (UTC)Reply

This is where the authorization happens: https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/4d0f30657b979cb0935a65d8c1d9f83838a7f581/src/PluggableAuth.php#L67

It's implemented here: https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1ed4670da502eb1e6f9d099e2d4bd9a263207752/src/Client.php#L312-L323 Osnard (talk) 06:22, 10 May 2019 (UTC)Reply

Question on authorization

Latest comment: 7 years ago4 comments2 people in discussion

I am able to authenticate but not authorize onto my wiki. When I look at the query reaching the ldap server for authorization, it comes of the form as follows:

slapd[4356]: conn=2319618 op=7 SRCH base="ou=Groups,dc=domain,dc=org" scope=2 deref=0 filter="(&(objectClass=groupOfUniqueNames)(uniqueMember=uid=username,ou=people,dc=icsi-berkeley,dc=org))"

slapd[4356]: conn=2319618 op=7 SRCH attr=dn

slapd[4356]: <= bdb_equality_candidates: (uniqueMember) not indexed

slapd[4356]: conn=2319618 op=7 SEARCH RESULT tag=101 err=0 nentries=1 text=

slapd[4356]: conn=2319618 op=8 UNBIND

slapd[4356]: conn=2319618 fd=24 closed

This is what the log looks like when I am authorized by the old LdapAuthentication extension in 1.23:

slapd[4356]: conn=2275479 op=5 SRCH base="dc=domain,dc=org" scope=2 deref=0 filter="(&(member=uid=username,ou=people,dc=domain,dc=org)(objectClass=\

groupOfNames))"

slapd[4356]: <= bdb_equality_candidates: (member) not indexed

slapd[4356]: conn=2275479 op=5 SEARCH RESULT tag=101 err=0 nentries=18 text=

slapd[4356]: conn=2275479 op=6 UNBIND

slapd[4356]: conn=2275479 fd=24 closed

If you notice, the query for LDAPProvider has objectClass=groupOfUniqueNames instead of just groupOfNames, and it also uses uniquemember=uid instead of member=uid. It also puts them in reverse order, as you can see with the query which authorizes my account having 18 entries returned, instead of 1 (which turned out to be the wrong group membership to authorize to this wiki on top of all this).

groupOfUniqueNames and uniquemember=uid seem to be hardwired into a call to function getUserGroups in GroupUniqueMember.php, but I do not see a way to set the php array in LocalSettings.php to my own search query so I can be authorized.

I can change the function to return the query I know works, and this lets me get authorized to the wiki, but I get a message -- Fatal exception of type "MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException". If I click the home button after this error appears, it shows me logged in and I can make edits as expected.

How can I change this query through the php array method? Or is this by design, and I will need to make this change manually when/if I update the extension? 192.150.187.199 (talk) 22:33, 24 April 2019 (UTC)Reply

As a different data point, I do not get the exception when I log in with a new user who has never logged in before. It seems to only happen on users who were in the old version 1.23 prior to upgrading to 1.31.

RHEL6, apache 2.4, php7.0, mariadb5.5 if any of that helps. 192.150.187.199 (talk) 00:01, 26 April 2019 (UTC)Reply

Ok, I think I figured out the exception error. I removed the old domains from the <wiki>_ldap_domains table and no longer get the exception after logging in.

My only question now is whether there is a configuration I can make to set the authorization query to the one I posted originally? We have multiple groups with their own wikis, and some people may belong to more than one wiki ldap group which is why the uniquememberID and groupOfUniqueNames query does not return the correct group for authorization. 192.150.187.199 (talk) 16:37, 26 April 2019 (UTC)Reply

Maybe you could use the dynamic configuration like

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				//...
			],
			'authorization' => [
				//use any PHP variable here
			],
		]
	];
	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Or you might implement your own "Requirement" (https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/tree/master/src/Requirement) for Extension:LDAPAuthorization. Any patch to make this configurable is much appreciated. Osnard (talk) 06:16, 10 May 2019 (UTC)Reply

Error: ldap, Nothing to bind with!

Latest comment: 6 years ago2 comments2 people in discussion

on mediawiki 1.32.1 I get:

[21fa231c222344707daed210] /wiki/index.php/Spezial:PluggableAuthLogin Exception from line 70 of wiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Nothing to bind with!

my ldapprovider.json file looks like this

{

"LDAP": {

"connection": {

"server": "ldapurl",

"user": "cn=userauth,ou=xxxxx,dc=example,dc=de",

"pass": "passwd",

"basedn": "dc=example,dc=de",

"userbasedn": dc=example,dc=de",

"searchattribute": "uid",

"searchstring" :"",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail"

}

} Fluxxuskb (talk) 17:09, 4 June 2019 (UTC)Reply

any update on this? did you get it working? can you share config? R2spotuser (talk) 04:00, 8 September 2019 (UTC)Reply

filter and attrlist

Latest comment: 7 years ago1 comment1 person in discussion

With which fields in the json file can I change the searchfilter amd the attrlist (attributes retrieved)? 91.189.100.113 (talk) 11:02, 15 June 2019 (UTC)Reply

Could not bind to LDAP

Latest comment: 6 years ago4 comments2 people in discussion

Hello,

I am unable to figure out the correct config for the LDAPProvider. I keep getting the error Could not bind to LDAP: (-1) Can't contact LDAP Server. Below is both the error from the logs and my config:

Error:

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

[autoloader] Class Hashconfig was loaded using incorrect case

[LDAP] ldap_connect( $hostname = 'ldap://ldap.mydomain.com:636', $port = 389 );

[LDAP] # __METHOD__ returns Resource id #218

[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_PROTOCOL_VERSION to 3

[LDAP] ldap_set_option( $linkID, $option = 17, $newval = 3 );

[LDAP] # returns 1

[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_REFERRALS to 0

[LDAP] ldap_set_option( $linkID, $option = 8, $newval = 0 );

[LDAP] # returns 1

[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_DEREF to 1

[LDAP] ldap_set_option( $linkID, $option = 2, $newval = 1 );

[LDAP] # returns 1

[LDAP] ldap_bind( $linkID, $bindRDN = 'cn=user,ou=orgunit,dc=mydomain,dc=com', $bindPassword = 'XXXX' );

[LDAP] # returns

[LDAP] ldap_error( $linkID );

[LDAP] # returns Can't contact LDAP server

[LDAP] ldap_errno( $linkID );

[LDAP] # returns -1

[exception] [XQp1RUnDG2m-fc4qPaf48wAAAAc] /mediawiki/index.php/Special:PluggableAuthLogin MWException from line 141 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(68): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(285): MediaWiki\Extension\LDAPProvider\Client->init()

#2 /var/www/html/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(66): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#3 /var/www/html/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#4 /var/www/html/mediawiki/includes/specialpage/SpecialPage.php(569): PluggableAuthLogin->execute(NULL)

#5 /var/www/html/mediawiki/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#6 /var/www/html/mediawiki/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#7 /var/www/html/mediawiki/includes/MediaWiki.php(860): MediaWiki->performRequest()

#8 /var/www/html/mediawiki/includes/MediaWiki.php(517): MediaWiki->main()

#9 /var/www/html/mediawiki/index.php(42): MediaWiki->run()

#10 {main}

LocalSettings.php:

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPAuthorization' );

## Set LDAP": {

#$wgPluggableAuth_EnableLocalLogin = false;

#$wgPluggableAuth_EnableAutoLogin = false;

$LDAPProviderDomainConfigProvider = function() {

$config = [

"mydomain" => [

"connection" => [

"server" => "ldap.mydomain.com",

"port" => "636",

"enctype" => "ssl",

"user" => "cn=user,ou=orgunit,dc=mydomain,dc=com",

"pass" => "Password",

"basedn" => "dc=mydomain,dc=com",

"groupbasedn" => "ou=orgunit,dc=mydomain,dc=com",

"userbasedn" => "dc=mydomain,dc=com",

"searchattribute" => "sAMAccountName",

"searchstring" => "mydomain\\USER-NAME",

"usernameattribute" => "sAMAccountName",

"realnameattribute" => "cn",

"emailattribute" => "mail"

],

"groupsync" => [

"cn=wiki_group,ou=orgunit,dc=mydomain,dc=com"

],

"userinfo" => [

],

"authorization" => [

"rules" => [

"groups" => [

"required" => [ "wiki_group" ]

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

Thank you for your assistance in advance. Renegade04 (talk) 18:40, 26 June 2019 (UTC)Reply

I came here, because I have succesfully used LDAPProvider to provide credentials from AD to log in to mediawiki- but that is when I did not define "enctype", thus it is using "clear". When I switched to "ssl", it gave the same error as you have (Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server).

I am searching now to see how I can enable ssl for my connection to AD. 158.112.85.165 (talk) 12:33, 13 December 2019 (UTC)Reply

Ah, figured it out. I forgot to set "port": "636", in my ldapprovider.json configuration file.

But which certificates it is using, is unknown to me at the moment. 158.112.85.165 (talk) 12:36, 13 December 2019 (UTC)Reply

I was never able to get it to work. I moved on the the SimpleSAMLphp extension. Although, I have it working, I have having a few group mapping issues on users with large number of groups. Renegade04 (talk) 15:19, 12 February 2020 (UTC)Reply

LDAPNoDomainConfigException

Latest comment: 7 years ago4 comments2 people in discussion

I have the following config file

wfLoadExtensions( [

'PluggableAuth',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo'

] );

$LDAPProviderCacheTime = 1;

$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$LDAPAuthentication2AllowLocalLogin = false;

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalLogin = false;

$wgPluggableAuth_EnableLocalProperties = true;

$wgPluggableAuth_ButtonLabel = "Log in";

$LDAPProviderDomainConfigProvider = function() {

$config = [

‘myschool.edu' => [

'connection' => [

"server" => "dc01.myschool.edu dc02.myschool.edu",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"port" => 389,

"enctype" => "clear",

"user" => “myschool\wikilookupaccount",

"pass" => “supersecret",

"basedn" => "dc=myschool,dc=edu",

"groupbasedn" => "dc=myschool,dc=edu",

"userbasedn" => "dc=myschool,dc=edu",

"searchattribute" => "samaccountname",

"searchstring" => "myschool\\USER-NAME",

"usernameattribute" => "samaccountname",

"realnameattribute" => "displayname",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [

"cn=global techwiki,ou=groups-internal,ou=rcspeople,dc=myschool,dc=edu"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

and my test account is definitely in the required group, but I get the following error when I login. Note that after I get this error, I am in fact logged in and can browse the site as expected. Also note the capital letter in Myschool below, which I have only ever entered lower case in the config above. If I change the $config line to "myschool" from "myschool.edu" I get other errors. Not sure what is happening here.

[31fd0d9e14a58f830cea583f] /wiki/Special:UserLogin MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/techwiki/w/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'Myschool'!

Backtrace:

#0 /var/www/techwiki/w/extensions/LDAPProvider/src/ClientFactory.php(55): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/techwiki/w/extensions/LDAPProvider/src/Hook/UserLoggedIn.php(138): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain(string)

#2 /var/www/techwiki/w/extensions/LDAPProvider/src/Hook/UserLoggedIn.php(89): MediaWiki\Extension\LDAPProvider\Hook\UserLoggedIn->createLdapClientForDomain()

#3 /var/www/techwiki/w/extensions/LDAPProvider/src/Hook/UserLoggedIn.php(78): MediaWiki\Extension\LDAPProvider\Hook\UserLoggedIn->process()

#4 /var/www/techwiki/w/includes/Hooks.php(174): MediaWiki\Extension\LDAPProvider\Hook\UserLoggedIn::callback(User)

#5 /var/www/techwiki/w/includes/Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#6 /var/www/techwiki/w/includes/auth/AuthManager.php(2407): Hooks::run(string, array)

#7 /var/www/techwiki/w/includes/auth/AuthManager.php(693): MediaWiki\Auth\AuthManager->setSessionDataForUser(User, boolean)

#8 /var/www/techwiki/w/includes/specialpage/AuthManagerSpecialPage.php(355): MediaWiki\Auth\AuthManager->continueAuthentication(array)

#9 /var/www/techwiki/w/includes/specialpage/AuthManagerSpecialPage.php(482): AuthManagerSpecialPage->performAuthenticationStep(string, array)

#10 /var/www/techwiki/w/includes/htmlform/HTMLForm.php(660): AuthManagerSpecialPage->handleFormSubmit(array, VFormHTMLForm)

#11 /var/www/techwiki/w/includes/specialpage/AuthManagerSpecialPage.php(416): HTMLForm->trySubmit()

#12 /var/www/techwiki/w/includes/specialpage/LoginSignupSpecialPage.php(313): AuthManagerSpecialPage->trySubmit()

#13 /var/www/techwiki/w/includes/specialpage/SpecialPage.php(569): LoginSignupSpecialPage->execute(NULL)

#14 /var/www/techwiki/w/includes/specialpage/SpecialPageFactory.php(558): SpecialPage->run(NULL)

#15 /var/www/techwiki/w/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#16 /var/www/techwiki/w/includes/MediaWiki.php(865): MediaWiki->performRequest()

#17 /var/www/techwiki/w/includes/MediaWiki.php(515): MediaWiki->main()

#18 /var/www/techwiki/w/index.php(42): MediaWiki->run()

#19 {main} JonathanKing~mediawikiwiki (talk) 16:54, 2 August 2019 (UTC)Reply

It says "No configuration available for domain 'Myschool'!" but in you domain condif you have specified "myschool.edu". Please use 'Myschool' as the main key of the domain config variable. Osnard (talk) 12:17, 5 August 2019 (UTC)Reply

When I changed to Myschool, things started working again. Thanks for you help! I was certain I tried that before, but oh well, works now. JonathanKing~mediawikiwiki (talk) 02:48, 6 August 2019 (UTC)Reply

Glad to hear :) Osnard (talk) 05:40, 6 August 2019 (UTC)Reply

LDAPProvider on LocalSettings and ldapprovider.json

Latest comment: 6 years ago4 comments2 people in discussion

RESOLVED

#"searchstring" => uid=USER-NAME,ou=users,dc=solis,dc=coop,dc=br; OK

$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain'; OK
$LDAPAuthentication2UsernameNormalizer = 'strtolower'; OK
'Auth_remoteuser' = I will not use this extension anymore, It's sound's like a little confusing. OK

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

If I config all configurations of LDAPProvider on LocalSettings, I need to change any configuration on ldapprovider.json? Guilherme bangemann (talk) 14:42, 16 September 2019 (UTC)Reply

==Softwares==

Produto	Versão
MediaWiki	1.31.3
PHP	7.2.19-0ubuntu0.18.04.2 (apache2handler)
MySQL	5.7.27-0ubuntu0.18.04.1
ICU	60.2

----

LocalSettings.php :

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo',

'LDAPGroups'

] );

#$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'solis';

#$LDAPAuthentication2UsernameNormalizer = 'solis';

$LDAPAuthentication2AllowLocalLogin = true;

$wgAuthRemoteuserAllowUserSwitch = true;

$wgPluggableAuth_EnableLocalLogin = true;

$wgCookieSecure = false;

#$wgAuthRemoteuserUserName = function() {

# $user = '';

# if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

# $user = solis( $_SERVER[ 'REMOTE_USER' ] );

# }

# return $user;

#};

$LDAPProviderDomainConfigProvider = function() {

$config = [

"solis" => [ //

"connection" => [

"server" => "ldapslave.solis.com.br", // Just the LDAP's Server

"user" => "solis\\user", //

"pass" => "user-password", //

"basedn" => "dc=solis,dc=coop,dc=br", // solis.coop.br

"groupbasedn" => "dc=solis,dc=coop,dc=br", //

"userbasedn" => "dc=solis,dc=coop,dc=br", //

"searchattribute" => "samaccountname", //

"searchstring" => "solis\\USER-NAME", //

"usernameattribute" => "samaccountname", //

"realnameattribute" => "cn",

"emailattribute" => "mail"

],

"groupsync" => [ // Intentionally empty for me, not using

],

"userinfo" => [ // Already have the three fields above I want

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

----

This configuration is OK? It's right? Guilherme bangemann (talk) 14:54, 16 September 2019 (UTC)Reply

As stated in another support request

"searchstring" => "solis\\USER-NAME" is wrong. Either unset is or set it to something like uid=USER-NAME,dc=example,dc=com.
'solis' is not a valid value for $LDAPAuthorizationAutoAuthRemoteUserStringParser. You can choose between 'username-at-domain' and 'domain-backslash-username'
'solis' is not a valid value for $LDAPAuthentication2UsernameNormalizer. Is should be a callback function (or functionname) like strtolower.
The line $user = solis( $_SERVER[ 'REMOTE_USER' ] ); seems wrong, as solis is probably not a PHP function. Osnard (talk) 06:36, 19 September 2019 (UTC)Reply
"searchstring" => uid=USER-NAME,ou=users,dc=solis,dc=coop,dc=br OK
$LDAPAuthorizationAutoAuthRemoteUserStringParser = OK
$LDAPAuthentication2UsernameNormalizer = OK
'Auth_remoteuser' = I will not use this extension anymore, It's sound's like a little confusing. OK Guilherme bangemann (talk) 11:37, 19 September 2019 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

mediawiki: Could not fetch required user info to complete login

Latest comment: 6 years ago9 comments4 people in discussion

The php checklogin, showuserinfo, and showusergroups commans all work OK. The logs don't show any errors but I get the above error message. I've tried whole heaps of different things but I'm stuck.

I've tried with no "userinfo" stuff but no matter I just get the same error. I wonder what userinfo Mediawiki actually wants?

Thanks for any help.

This is in my LocalSettings:

$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'UOCNT\\LDAP';

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$LDAPAuthentication2AllowLocalLogin = false;

$wgAuthRemoteuserAllowUserSwitch = false;

$wgPluggableAuth_EnableLocalLogin = false;

$wgPluggableAuth_EnableLocalProperties = true;

$wgPluggableAuth_ButtonLabelMessage = "Login to mydomain.something";

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

$user = strtolower( $_SERVER[ 'REMOTE_USER' ] );

}

return $user;

};

$LDAPProviderDomainConfigProvider = function() {

$config = [

"mydomain.something" => [

"connection" => [

"server" => "mydomain.something",

"enctype" => "clear",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"user" => "domain\\adminuser",

"pass" => "xxxx",

"basedn" => "dc=mydomain, dc=something",

"groupbasedn" => "dc=mydomain, dc=something",

"userbasedn" => "dc=mydomain, dc=something",

"searchattribute" => "samaccountname",

"searchstring" => "domain\\USER-NAME",

"realnameattribute" => "displayname",

],

"userinfo" => [

"attributes-map" => [

"realname" => "displayname"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

}; 132.181.57.105 (talk) 00:22, 20 September 2019 (UTC)Reply

If ShowUserInfo.php works, this is indeed a strange error. Do you have the latest versions of the LDAP-Stack extensions? (I recommend using branch REL1_31, as this is LTS).

Can you please set $wgDebugLogGroups['LDAPAuthentication2'] = "/tmp/LDAPAuthentication2.log"; in your LocalSettings.php file and report that is logged in the line

Error fetching userinfo: ...

BTW: 'UOCNT\\LDAP' is not a valid value for $LDAPAuthorizationAutoAuthRemoteUserStringParser. You will probably need 'domain-backslash-username'. But this is only important if you use nwetwork-based-authentication with Extension:Auth_remoteuser. Osnard (talk) 08:22, 20 September 2019 (UTC)Reply

Thanks man, just adding $wgDebugLogGroups['LDAPAuthentication2'] = "/tmp/LDAPAuthentication2.log";

helped me fix the problem. it was complaining about missing usernameattribute and emailattribute, once those were fixed it wanted a groupinfo section. I just put in a blank setting and all is working.

Thanks so much.

132.181.57.105 (talk) 02:06, 24 September 2019 (UTC)Reply

I'm running into "Could not fetch required user info to complete login" when trying to log in through my web browser. CheckLogin works but ShowuserGroups and Showuserinfo fails with "Error in LDAP search: Operations error". I turned on debugging for LDAPAuthenication2 and got the following with the fetch failure through the browser(Replaced my user info for security purposes):

<code>

2020-04-08 03:39:41 mywiki: Error fetching userinfo: Error in LDAP search: Operations error

2020-04-08 03:39:41 mywiki: #0 C:\...mywiki\extensions\LDAPProvider\src\UserInfoRequest.php(61): MediaWiki\Extension\LDAPProvider\Client->search('(sAMAccountName...', 'OU=Office Locat...', Array)

#1 C:\...mywiki\extensions\LDAPProvider\src\Client.php(241): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo('MyUser')

#2 C:\...mywiki\includes\libs\objectcache\BagOStuff.php(133): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}(500)

#3 C:\...mywiki\extensions\LDAPProvider\src\Client.php(242): BagOStuff->getWithSetCallback('mywiki:ld...', 500, Object(Closure))

#4 C:\...mywiki\extensions\LDAPAuthentication2\src\PluggableAuth.php(84): MediaWiki\Extension\LDAPProvider\Client->getUserInfo('MyUser')

#5 C:\...mywiki\extensions\PluggableAuth\includes\PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, 'MyUser', NULL, NULL, 'Could not fetch...')

#6 C:\...mywiki\includes\specialpage\SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#7 C:\...mywiki\includes\specialpage\SpecialPageFactory.php(611): SpecialPage->run(NULL)

#8 C:\...mywiki\includes\MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Object(Title), Object(RequestContext))

#9 C:\...mywikih\includes\MediaWiki.php(900): MediaWiki->performRequest()

#10 C:\...mywiki\includes\MediaWiki.php(527): MediaWiki->main()

#11 C:\...mywiki\index.php(44): MediaWiki->run()

</code>

This is my ldapprovider.json file:

<code>

{

"my.net": {

"connection": {

"server": "ldap.someplace.my.net",

"user": "cn=mywiki,ou=service accounts,ou=someplace,ou=office locations,dc=my,dc=net",

"password": "t8912A!b",

"enctype": "clear",

"basedn": "ou=locations,dc=my,dc=net",

"userbasedn": "ou=locations,dc=my,dc=net",

"searchattribute": "samaccountName",

"searchstring": "USER-NAME@my.net"

}

</code>

Any other tips for troubleshooting this? Any help is greatly appreciated. I'm migrating over from LDAPAuthenication->LDAPAuthenication2. 159.140.252.107 (talk) 04:01, 8 April 2020 (UTC)Reply

Operations error indicates that the service account you have configured in "user" is not allowed to execute search operation in you LDAP. You might need to configure a different service account or change it's permissions within the LDAP server. Osnard (talk) 07:06, 8 April 2020 (UTC)Reply

Thanks for the tip. I'll verify if this user has that ability. I know I was using this user just fine with the older LDAPAuthenication as "wgLDAPProxyAgent" so I figured it would work with LDAPAuthenication2. 159.140.254.85 (talk) 01:20, 9 April 2020 (UTC)Reply

Well, it should, yes. Osnard (talk) 10:51, 9 April 2020 (UTC)Reply

159.140.254.85 back. So I've verified that the user does have the ability to fetch. I wrote a php test program that does a ldap_Connect, ldap_bind, ldap_search and ldap_get_Entries. I was able to successfully fetch user information for another user with that. I think I can rule the user privs being the issue. I'll keep looking. I do think something is wrong with the "user" attribute in the ldapprovider.json. I did try putting in the wrong "password" attribute and still got the same "Could not fetch required user info to complete login". I was expecting some other message to indicate the proxy user is bad, but maybe it's the same standard message. I'll keep looking 159.140.252.107 (talk) 04:06, 10 April 2020 (UTC)Reply

Could you please try to remove the "searchstring" configuration from your domain config? Osnard (talk) 05:40, 20 April 2020 (UTC)Reply

Could not check login requirements for <username>

Latest comment: 6 years ago10 comments2 people in discussion

Hi.

I've gotten stuck in my migration to MW 1.33.1 and the new LDAP Stack implementation from LDAPAutthentication.

I have enabled the full stack of extensions as well as logging.

Running .../ShowUserInfo.php gives valid output in that it finds the user in question so the Authentication seems to be working. I do believe I am stuck at Authorization as when I try a user login the LDAP.log file shows:

---

2019-10-13 15:18:11 wikiDB-mw_: ldap_bind( $linkID, $bindRDN = 'uid= ,cn=users,dc= ,dc=lan', $bindPassword = 'XXXX' );

2019-10-13 15:18:12 wikiDB-mw_: # returns 1

2019-10-13 15:18:13 wikiDB-mw_: Could not check login requirements for

2019-10-13 15:18:13 wikiDB-mw_: Unsupported format!

2019-10-13 15:18:14 wikiDB-mw_: Could not check login requirements for

2019-10-13 15:18:14 wikiDB-mw_: Unsupported format!

Here is my config:

$LDAPProviderDomainConfigProvider = function() {

$config = [

'Directory' => [

'connection' => [

"server" => " ",

"port" => 389,

"enctype" => "clear",

"basedn" => "dc= ,dc=lan",

"groupbasedn" => "cn=groups,dc= ,dc=lan",

"userbasedn" => "cn=users,dc= ,dc=lan",

"searchattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "mail"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

Any suggestions on what could be changed?

Thanks

Gregg GMShimokura (talk) 15:51, 13 October 2019 (UTC)Reply

Looks like LDAPAuthorization can not create a proper wiki username from the remote user passed by the webserver.

What is the format of the remote user name provided in $_SERVER[ 'REMOTE_USER' ]? You can test by adding var_dump($_SERVER[ 'REMOTE_USER' ]); into your LocalSettings.php file. Osnard (talk) 11:56, 14 October 2019 (UTC)Reply

Hi Osnard,

Thanks for the reply. Here is what I could find

From the LDAP.log file:

2019-10-15 01:44:32 wikiDB-mw_: Could not check login requirements for gregg.shimokura

2019-10-15 01:44:32 wikiDB-mw_: Unsupported format!

And when I add the var_dump, I get in the browser window:

.../mediawiki/1.33.1/LocalSettings.php:217:string 'gregg.shimokura' (length=15)

Does that help in any way?

Gregg GMShimokura (talk) 01:49, 15 October 2019 (UTC)Reply

Okay, so your $_SERVER[ 'REMOTE_USER' ] lacks the domain part that Extension:LDAPAuthnorization expects. You can try to just add

$_SERVER[ 'REMOTE_USER' ] = "Directory\\" . $_SERVER[ 'REMOTE_USER' ];

in you LocalSettings.php file above the LDAP specific configuration. Be aware that Directory is just the name of the "domain" you have configured in $config Osnard (talk) 06:59, 15 October 2019 (UTC)Reply

Thanks Osnard,

To clarify, I would like to know more about the order of the commands in the LocalSetting.php

It this correct?

$_SERVER[ '$_SERVER[ 'REMOTE_USER' ] = "Directory\\" . $_SERVER[ 'REMOTE_USER' ];

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigProvider = function() {

$config = [

'Directory' => [

'connection' => [

"server" => " ",

"port" => 389,

"enctype" => "clear",

"basedn" => "dc= ,dc=lan",

"groupbasedn" => "cn=groups,dc= ,dc=lan",

"userbasedn" => "cn=users,dc= ,dc=lan",

"searchattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "mail"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_ButtonLabelMessage = "Login";

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2AllowLocalLogin = "true";

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'Auth_remoteuser' );

wfLoadExtension( 'LDAPGroups' );

wfLoadExtension( 'LDAPUserInfo' );

Thanks,

Gregg GMShimokura (talk) 13:39, 15 October 2019 (UTC)Reply

I have tried different orders and unfortunately not much has changed. The LDAP.log reports the exact same message.

In the Browser I do get the 'Directory' prefix in the var dump.

Gregg GMShimokura (talk) 13:59, 15 October 2019 (UTC)Reply

Hello again,

I had a thought to provide the output of

$ php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain Directory --username gregg.shimokura

PHP Notice: Undefined index: REMOTE_USER in .../mediawiki/1.33.1/LocalSettings.php on line 205

Notice: Undefined index: REMOTE_USER in .../mediawiki/1.33.1/LocalSettings.php on line 205

string(16) "Directory\"

cn => Gregg Shimokura

apple-user-homequota => 0

uid => gregg.shimokura

homedirectory => /dev/null

givenname => Gregg

uidnumber => 1028

gidnumber => 20

objectclass =>

0 => person

1 => inetOrgPerson

2 => organizationalPerson

3 => posixAccount

4 => shadowAccount

5 => top

6 => extensibleObject

7 => apple-user

loginshell => /usr/bin/false

sn => Shimokura

mail =>

0 => gregg.shimokura@xxx

1 => gregg.shimokura@xxx

authauthority =>

0 => ;ApplePasswordServer;XXX,1024 65537 root@xxx.lan:192.168.1.100

1 => ;Kerberosv5;;gregg.shimokura@xxx;xxx;

altsecurityidentities => Kerberos:gregg.shimokura@xxx

apple-generateduid => XXX

dn => uid=gregg.shimokura,cn=users,dc=xxx,dc=lan

$

Is this the format that the LDAP Stack is expecting?

Gregg GMShimokura (talk) 15:31, 17 October 2019 (UTC)Reply

Hi Osnard,

I have gotten a working setup for now using Auth_remoteuser and MW 1.31.5.

On my Mac Mini server I found MW 1.33.1 flaky and unusable, I could not figure out where the problems were happening.

I ended up rebuilding from scratch MW 1.31.5 and it all worked. Could not do the same with 1.33.1.

I consider the topic closed.

Thanks,

Gregg GMShimokura (talk) 03:02, 19 October 2019 (UTC)Reply

Thanks for sharing! Could you maybe share your working setup on LDAP_hub/Migration_from_extension_LDAPAuthentication as an "example"? Osnard (talk) 12:14, 19 October 2019 (UTC)Reply

Sure can.. I have done it.. Let me know if it is sufficient or could be improved. GMShimokura (talk) 19:20, 26 October 2019 (UTC)Reply

Trying to authenticate with Windows AD

Latest comment: 6 years ago4 comments2 people in discussion

Hi, I´ve been trying for a while to authenticate against a windows AD. The ideia is for the user to input the username/password from windows AD and logon to the Wiki.

The username that I am trying to authenticate is luis.fabiani. The error I am getting on the wiki page is "The supplied credentials are not associated with any user on this wiki."

The username used for binding is dynkerberos (password ommited)

My LocalSettings.php is:

$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";

wfLoadExtension( 'Moderation' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LdapGroups');

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

$LDAPAuthentication2AllowLocalLogin = true;

$wgAuthRemoteuserAllowUserSwitch = true;

$wgPluggableAuth_EnableLocalLogin = true;

$LDAPProviderDomainConfigProvider = function() {

$config = [

'dynamis.local' => [

'connection' => [

"server" => "srv04.dynamis.local",

"user" => "CN=dynkerberos,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local",

"pass" => "XXXXXX",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"basedn" => "OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local",

"groupbasedn" => "OU=Security Groups,OU=MyBusiness,DC=dynamis,DC=local",

"userbasedn" => "OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local",

"searchattribute" => "sAMAccountName",

"usernameattribute" => "sAMAccountName",

"realnameattribute" => "displayname",

"emailattribute" => "mail",

],

'authorization' => [

'rules' => [

'groups' => [

'excluded' => [

'others'

]

],

'userinfo' => [

'attributes-map' => [

'email' => 'mail',

'realname' => 'displayname'

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

$wgDebugLogGroups['PluggableAuth'] ='/var/log/mediawiki/PluggableAuth.log';

$wgDebugLogGroups['LDAP'] ='/var/log/mediawiki/LDAP.log';

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/var/log/mediawiki/LDAPProvider.log';

$wgDebugLogGroups['LDAPGroups'] ='/var/log/mediawiki/LDAPGroups.log';

$wgDebugLogGroups['LDAPUserInfo'] ='/var/log/mediawiki/LDAPUserinfo.log';

$wgDebugLogGroups['LDAPAuthorization'] = '/var/log/mediawiki/LDAPAuthorization.log';

$wgDebugLogGroups['LDAPAuthentication2'] = '/var/log/mediawiki/LDAPAuthentication2.log';

If I change sAMAccountName to uid, it does not authenticate. I think I am close, but something is not quite right.

Can anyone share any thoughts on what may be wrong?

PluggableAuth.log:

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: In execute()

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: Getting PluggableAuth singleton

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: Authenticated new user:

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: User is authorized.

LDAPProvider.log:

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: Setting LDAP_OPT_REFERRALS to 0

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: Setting LDAP_OPT_DEREF to 1

2019-10-13 18:04:47 wikinamis.dynamis.local my_wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local',

'filter' => '(sAMAccountName=luis.fabiani)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: Found user DN: 'CN=Luis Filipe Von Rainer Fabiani,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local'

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'CN=Luis Filipe Von Rainer Fabiani,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local'

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: Ran LDAP search for '(sAMAccountName=luis.fabiani)' in 0.042160034179688 seconds.

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local',

'filter' => '(sAMAccountName=)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: Could not get user DN!

2019-10-13 18:04:48 wikinamis.dynamis.local my_wiki: Ran LDAP search for '(&(objectclass=groupOfUniqueNames)(uniqueMember=))' in 0.032356977462769 seconds.

The wiki log shows

[session] SessionBackend "vcni0lsvoqe8bvob6qqkot47i65n68js" data dirty due to dirty(): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate/Mcate/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionessionBackend->dirty [error] [bcf9452d454204cabdbfe68c] /mediawiki/index.php/Especial:PluggableAuthLogin ErrorException from line 87 of /var/lib/mediawiki/extensions/LDAPAuthePluggableAuth.php: PHP Notice: Undefined index: sAMAccountName

0 /var/lib/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(87): MWExceptionHandler::handleError(integer, string, string, integer, array)
1 /var/lib/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL$
2 /var/lib/mediawiki/includes/specialpage/SpecialPage.php(569): PluggableAuthLogin->execute(NULL)
3 /var/lib/mediawiki/includes/specialpage/SpecialPageFactory.php(558): SpecialPage->run(NULL)
4 /var/lib/mediawiki/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)
5 /var/lib/mediawiki/includes/MediaWiki.php(865): MediaWiki->performRequest()
6 /var/lib/mediawiki/includes/MediaWiki.php(515): MediaWiki->main()
7 /var/lib/mediawiki/index.php(42): MediaWiki->run()
8 {main}

Luis.fabiani (talk) 18:33, 13 October 2019 (UTC)Reply

Maybe try lowercase samaccountname your settings. Please check functionality with the LDAPProvider/maintenance-scripts as described here: LDAP_hub#Debugging Osnard (talk) 11:53, 14 October 2019 (UTC)Reply

Hi Osnard

First let me congratulate you guys, this extension is fantastic.

Using samaccountname worked, but was not the only thing that needed to be changed.

Using the Debugging tools you mentioned, I found out that ShowUserGroups.php was not returning any results.

The query to the AD was (as seen on Wireshark)

(&    (objectclass=groupOfUniqueNames)(uniqueMember=CN=Luis Filipe Von Rainer Fabiani,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=dynamis,DC=local))

The problem with this query on a Microsoft AD is that apparently groupOfUniqueNames and uniqueMember are not standard (as far as my goolge searches, see here).

I verified this by searching the AD with Apache Directory Studio.

So i changed the line 26 on

/LDAPProvider/src/UserGroupsRequest/GroupUniqueMember.php

from:

"(&(objectclass=groupOfUniqueNames)(uniqueMember=$userDN))",

to:

"(&(objectclass=group)(Member=$userDN))"

Don't know if it is ok, but it works like a charm!

Osnard,

Would it be too much to ask for to include some option on the next release so the user can set this query parameter in the configuration?

Something like:

group.objectClass=group

group.uniqueMember=member

Thanks! Luis.fabiani (talk) 14:58, 14 October 2019 (UTC)Reply

Actually this has just been merged: https://gerrit.wikimedia.org/r/#/c/mediawiki/extensions/LDAPProvider/+/543408/

You can now use

connection.grouprequest = MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory
connection.groupobjectclass = group
connection.groupattribute = member (But that's the default)

TLS config w/ OpenLDAP

Latest comment: 6 years ago3 comments2 people in discussion

Hello.

Hoping that someone here wouldn't mind pointing the way for me. My wiki is in an environment where we use an OpenLDAP instance, using a TLS implementation. Wiki is built on a CentOS 7.7 host.

LocalSettings.php config looks like:

.

wfLoadExtension("LDAPProvider");

$LDAPProviderDomainConfigProvider = function() {

$config = [

'my.awesome.domain.com' => [

'connection' => [

"server" => "ldapserver.my.awesome.domain.com",

"port" => 389, ### Yep, not 636. STARTTLS takes over.

"enctype" => "tls",

"user" => "cn=awesomeuser,dc=my,dc=awesome,dc=domain,dc=com",

"pass" => "awesomepassword",

"options" => [

"LDAP_OPT_SIZELIMIT" => 0,

"LDAP_OPT_TIMELIMIT" => 15,

"LDAP_OPT_REFERRALS" => true,

"LDAP_OPT_X_TLS_CIPHER_SUITE" => string #DEFAULT:!MEDIUM is in my ldap.conf files on my working clients. Is this field required, or will it negotiate?

"LDAP_OPT_X_TLS_REQUIRE_CERT" => 3, #Trying to 'ALLOW'. Assuming integer 3 translates to LDAP_OPT_X_TLS_ALLOW. Is this correct? Hard to find firm documentation on this.

"LDAP_OPT_X_TLS_CACERTFILE" => "/var/www/html/certs/ca.crt",

"LDAP_OPT_X_TLS_CERTFILE" => "/var/www/html/certs/wiki.my.awesome.domain.com.crt",

"LDAP_OPT_X_TLS_KEYFILE" => "/var/www/html/certs/wiki.my.awesome.domain.com.key",

"LDAP_OPT_X_TLS_CRLCHECK" => 0,

"LDAP_OPT_DEREF" => 1

],

"basedn" => "dc=my,dc=awesome,dc=domain,dc=com",

"groupbasedn" => "ou=Group,dc=my,dc=awesome,dc=domain,dc=com",

"userbasedn" => "dc=my,dc=awesome,dc=domain,dc=com",

"searchattribute" => "uid",

"searchstring" => "uid=USER-NAME,dc=my,dc=awesome,dc=domain,dc=com",

"usernameattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "Email"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [ "wiki_users" ]

]

],

"userinfo" =>

[

"email" => "Email",

"realname" => "cn",

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

I enter valid creds at my login. This is the error that gets returned on my web browser:

[XcOSt6n7rrF4DJg4FgZtNQAAAAU] 2019-11-07 03:42:48: Fatal exception of type MWException

The logs on my LDAP server side (slapd.log) show this as the error:

... conn=1485 fd=30 closed (TLS negotiation failure)

Relevant portions of an ldap.conf file on a host that I know works for LDAP:

REFERRALS on

SIZELIMIT 0

TIMELIMIT 15

DEREF never

TLS_CACERTDIR /etc/pki/openldap/x509/cacerts

TLS_CIPHER_SUITE DEFAULT:!MEDIUM

TLS_REQCERT allow

TLS_CRLCHECK none

I've turned on logging as per LDAP hub#Debugging. Nothing of interest there.

I've got many questions, but mostly...

- is my $config array formatted correctly?

- "LDAP_OPT_X_TLS_CIPHER_SUITE" => string #DEFAULT:!MEDIUM is in my ldap.conf files on my working clients. Is this field required, or will it negotiate?

- "LDAP_OPT_X_TLS_REQUIRE_CERT" => 3, #Trying to 'ALLOW'. Assuming integer 3 translates to LDAP_OPT_X_TLS_ALLOW. Is this correct? Hard to find firm documentation on this.

If anyone in the hive has any insight to offer, I'd greatly appreciate it. I believe I'm close, it's just a matter of getting all the TLS pieces nudged into the right places. Once it's complete and I can verify it works, I'll post it here to save someone some headaches in the future.

Thank you in advance for any time and thought you put in to helping me out with my little puzzle.

R/,

- A

Awliste (talk) 03:47, 7 November 2019 (UTC)Reply

I can authenticate now. Issue was a puppet problem, my particular host wasn't getting a correct ldap.conf for php-ldap to use. Re-imaged it, I can login now, but new issues have arisen.

- Commenting out LDAPAuthorization, I can login to the wiki. In this configuration, when I make an edit to a page and save, the wiki times out. I'm assuming I'm not authorized to make changes - but the issue also manifests when I login with local admin account on the wiki. Uncommenting LDAPAuthorization leaves me with "User X is not authorized". I would love to troubleshoot this, but I can't gain visibility that I would like because I can't seem to get data written into the...

- logs. I can't get mediawiki LDAP extensions to log web interactions, only interactions running the php maintenance scripts from command line. Jrsovereign has described the same symptoms I see in his posts below. SElinux maybe, but I've turned off my selinux and issues persist. For my log configs, I hijacked these lines from the boards here and am using them for my wiki logging.

#####Error logging######

##PHP Error ###

error_reporting( -1 );

ini_set( 'display_errors', 1 );

$wgShowExceptionDetails = true;

$wgShowDBErrorBacktrace = true;

##SQL Error ###

$wgDebugDumpSql = true;

##Debug log to file ###

$wgDebugLogFile = '/tmp/wikithings.log';

$wgDebugComments = true;

$wgDebugLogGroups['LDAP'] =

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =

$wgDebugLogGroups['LDAPGroups'] =

$wgDebugLogGroups['LDAPUserInfo'] =

$wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log'; Awliste (talk) 20:54, 7 November 2019 (UTC)Reply

If logging fails it is probably related to SELinux, yes. You could try using a file that the webserver is allowed to write to anyways, like the default PHP error log.

Please be aware that the 'authorization/rules/groups/required' needs to be configured with actual DNs, like cn=,wiki_users,ou=Group,dc=my,dc=awesome,dc=domain,dc=com.

You might want to use the CLI script LDAPProvider/maintenance/ShowUserGroups.php to check what LDAPProvider "sees". Osnard (talk) 07:25, 12 November 2019 (UTC)Reply

Issue Nothing to bind with!

Latest comment: 6 years ago8 comments2 people in discussion

Hi there, I a mcurrently trying to set up a Mediawiki connection with LDAP but it doesn't seem to bind when I try to login with an LDAP user

Here is the configuration of the machine :

PHP Version : 7.3

Mediawiki : 1.33

Here is the error I get when I try to login :

[1a984947c75a05a4d3959191] /mediawiki/index.php/Sp%C3%A9cial:PluggableAuthLogin Exception from line 70 of /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Nothing to bind with!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(153): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->bind(string, string)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#2 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()

#3 /var/www/html/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(78): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#4 /var/www/html/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#5 /var/www/html/mediawiki/includes/specialpage/SpecialPage.php(569): PluggableAuthLogin->execute(NULL)

#6 /var/www/html/mediawiki/includes/specialpage/SpecialPageFactory.php(558): SpecialPage->run(NULL)

#7 /var/www/html/mediawiki/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#8 /var/www/html/mediawiki/includes/MediaWiki.php(865): MediaWiki->performRequest()

#9 /var/www/html/mediawiki/includes/MediaWiki.php(515): MediaWiki->main()

#10 /var/www/html/mediawiki/index.php(42): MediaWiki->run()

#11 {main}

Here is the Localsettings.php file :

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableLocalLogin = true;

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigProvider = function() {

$config = [

"LDAP" => [

"connection" => [

"server" => "ldap://localhost",

"port" => "389",

"user" => "cn=admin,dc=admin,dc=kecexpress,dc=com",

"pass" => "admin",

"basedn" => "dc=admin,dc=kecexpress,dc=com",

"groupbasedn" => "",

"userbasedn" => "ou=people,dc=admin,dc=kecexpress,dc=com",

"searchattribute" => "uid",

"searchstring" => "uid=USER-NAME,dc=admin,dc=kecexpress,dc=com",

"usernameattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "email"

],

"groupsync" => [

],

"userinfo" => [

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

$LDAPAuthentication2AllowLocalLogin = true;

wfLoadExtension( 'LDAPAuthentication2' );

I think the issue is located at the binding process but can't really see where it is.

Thanks for your help 130.185.187.15 (talk) 16:29, 20 November 2019 (UTC)Reply

This means that either your "connection.server" or "connection.port" value is wrong. Actually "ldap://localhost" looks wrong. Try just "localhost", even though it is unusal that the LDAP server is running on the same host as the wiki does. Osnard (talk) 17:20, 20 November 2019 (UTC)Reply

I use a LDAP on localhost for the moment because I run a test server (and it works on other app i used).

So i tried to modify the "connection.server" from "ldap://localhost" to "localhost" and now it returned : "Could not authenticate credentials against domain "LDAP" ". 130.185.187.15 (talk) 18:05, 20 November 2019 (UTC)Reply

Well it looks like connection is working, but the extension can not bind to the LDAP server with the provided username/password.

You can try the maintenance/CheckLogin.php script to test login from the command line. Enable logging to see what happens in the background. Osnard (talk) 18:25, 20 November 2019 (UTC)Reply

Ok so i used the command :

php extensions/LDAPProvider/maintenance/CheckLogin.php --domain admin.kecexpress.com --username jpaul

or

php extensions/LDAPProvider/maintenance/CheckLogin.php --domain dc=admin,dc=kecexpress,dc=com --username jpaul

For both it ask for an password and i have that :

[1ec05b453bbc044ce2788c5b] [no req]   MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'dc=admin,dc=kecexpress,dc=com'!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/ClientFactory.php(55): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(49): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain(string)

#2 /var/www/html/mediawiki/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()

#3 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(77): require_once(string)

#4 {main}

or

[1ec05b453bbc044ce2788c5b] [no req]   MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'dc=admin,dc=kecexpress,dc=com'!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/ClientFactory.php(55): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(49): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain(string)

#2 /var/www/html/mediawiki/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()

#3 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(77): require_once(string)

#4 {main} 130.185.187.15 (talk) 18:50, 20 November 2019 (UTC)Reply

The domain must be LDAP in this case. It must match what you have configured in your domain condig (root element of the array) Osnard (talk) 14:52, 21 November 2019 (UTC)Reply

Oh sorry.

With :

- ldap://localhost:389

- ldap://localhost

- localhost

[a19a85b6889d5ffc08dc1e6c] [no req]   MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'ldap://localhost:389'!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/ClientFactory.php(55): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(49): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain(string)

#2 /var/www/html/mediawiki/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()

#3 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(77): require_once(string)

#4 {main}

And with LDAP :

PHP Warning:  ldap_connect(): Could not create session handle: Bad parameter to an ldap routine in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 244

Warning: ldap_connect(): Could not create session handle: Bad parameter to an ldap routine in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 244

PHP Warning:  ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

PHP Warning:  ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

PHP Warning:  ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

[2b351bc1d1621329756ce2a3] [no req]   Exception from line 70 of /var/www/html/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Nothing to bind with!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(153): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->bind(string, string)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#2 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()

#3 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(51): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#4 /var/www/html/mediawiki/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()

#5 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(77): require_once(string)

#6 {main} 130.185.187.15 (talk) 19:13, 21 November 2019 (UTC)Reply

Try to use

php extensions/LDAPProvider/maintenance/CheckLogin.php --domain LDAP --username jpaul

and make sure in your config you've got

 $config = [
  "LDAP" => [
   "connection" => [
    "server" => "localhost",
    "port" => "389",

Osnard (talk) 13:57, 22 November 2019 (UTC)Reply

No Authentication or Logs

Latest comment: 6 years ago1 comment1 person in discussion

Hi there,

I am currently trying to upgrade my MediaWiki instance to version 1.31 using php 7.2 but I'm having trouble getting authentication against active directory.

When i try to log in with an AD user i get the error "There seems to be a problem with your login session; this action has been canceled as a precaution against session hijacking. Please resubmit the form. "

I can't really debug this error too much because i Can't seem to get any logs to show up either.

here the ldap contents of my LocalSettings.php

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo'

] );

$wgDebugLogGroups['PluggableAuth'] = '*Path to log*';

$wgDebugLogGroups['LDAP'] = '*Path to log*';

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '*Path to log*';

$wgDebugLogGroups['LDAPGroups'] = '*Path to log*';

$wgDebugLogGroups['LDAPUserInfo'] = '*Path to log*';

$wgDebugLogGroups['LDAPAuthorization'] = '*Path to log*';

$LDAPAuthorizationAutoAuthRemoteUserStringParser = '*Readonly Account*@*full.domain.com*';

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$LDAPAuthentication2AllowLocalLogin = true;

$wgAuthRemoteuserAllowUserSwitch = true;

$wgPluggableAuth_EnableLocalLogin = false;

$wgShowExceptionDetails = true;

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

$user = strtolower( $_SERVER[ 'REMOTE_USER' ] );

}

return $user;

};

$LDAPProviderDomainConfigProvider = function() {

$config = [

'*company*' => [

'connection' => [

"server" => "*AD.full.domain.com*",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"searchstring" => "uid=USER-NAME,dc=*full*,dc=*domain*,dc=com",

"port" => 389,

"enctype" => "clear",

"basedn" => "dc=*full*,dc=*domain*,dc=com",

"groupbasedn" => "dc=*full*,dc=*domain*,dc=com",

"userbasedn" => "dc=*full*,dc=*domain*,dc=com",

"searchattribute" => "samaccountname",

"usernameattribute" => "samaccountname",

"realnameattribute" => "displayName",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [

'cn=*admins*,ou=SecurityGroups,dc=*full*,dc=*domain*,dc=*com*'

]

],

'userinfo' => [

'attributes-map' => [

'email' => 'mail',

'realname' => 'fullname'

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

Trying to run debug scripts give me this output

php MediaWiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php -d *company* -u *Read Only User*

[622d1c834a2802697b24f5ef] [no req] MWException from line 198 of /MediaWiki/extensions/LDAPProvider/src/Client.php: Error in LDAP search: Operations error

Backtrace:

#0 /MediaWiki/extensions/LDAPProvider/src/UserInfoRequest.php(60): MediaWiki\Extension\LDAPProvider\Client->search(string, string, array)

#1 /MediaWiki/CISDocs/extensions/LDAPProvider/src/Client.php(229): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo(string)

#2 /MediaWiki/CISDocs/includes/libs/objectcache/BagOStuff.php(159): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}()

#3 /MediaWiki/CISDocs/extensions/LDAPProvider/src/Client.php(230): BagOStuff->getWithSetCallback(string, integer, Closure)

#4 /MediaWiki/CISDocs/extensions/LDAPProvider/maintenance/ShowUserInfo.php(48): MediaWiki\Extension\LDAPProvider\Client->getUserInfo(string)

#5 /MediaWiki/CISDocs/maintenance/doMaintenance.php(94): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()

#6/MediaWiki/CISDocs/extensions/LDAPProvider/maintenance/ShowUserInfo.php(71): require_once(string)

And

php MediaWiki/extensions/LDAPProvider/maintenance/CheckLogin.php -d *company* -u *Read Only User*

FAILED

Any help would be much apreciated Bongo0458 (talk) 20:52, 21 November 2019 (UTC)Reply

TLS woes...

Latest comment: 2 years ago3 comments3 people in discussion

I have a working config on a machine I'll call prod-test. Talks TLS to my OpenLDAP provider. Built manually on a development CentOS 7.7 rig, I can log in to my wiki, make edits, monkey around. Seems to work great so far.

Once I had a working config in dev, I made a clone of our production wiki (it's a VM). It's a Mediawiki VM appliance/OVA, a default build pretty much straight from the foundation web page. Debian based. Changed the IP on my clone, updated my LocalSettings.php to match my prod-test build, added the LDAP extensions I have in my working build to my cloned appliance via SCP, gave it a php maintenance/update.php, copied/pasted the relevant portions of my LocalSettings.php over from my prod-test build, and kicked the tires. Started fine, page renders as expected, Special Pages:Version shows all my LDAP extensions, looking good... Attempted to login via LDAP with the production clone running my prod-test configs, I get the following:

<snip>

Warning: ldap_start_tls(): Unable to start TLS: Connect error in /var/www/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 121

[4bdbee442bdc5006ac0c4d20] /index.php/Special:PluggableAuthLogin MWException from line 129 of /var/www/mediawiki/extensions/LDAPProvider/src/Client.php: Could not start TLS!

</snip>

Sigh... This extension is going to be the end of me.

Checked paths of certs to make sure I'm apples-to-apples in my tests ( both at /var/www/html/certs as I get real hairy about where PHP has permissions to access, can confirm this directory exists and is correct in LocalSettings.php), checked permissions on cert files (all owned by apache2/httpd user). Error isn't showing me "Can't find constant..." as it has in the past with permissions issues. Don't suspect permissions issues here.

On my OpenLDAP provider, the slapd.log shows me a connection attempt from my cloned production instance where I can see it starts TLS and then exits. Relevant entries look like this:

2019-11-21T21:25:55.878771+00:00 awesome.ldap.server slapd[248590]: conn=1513 fd=25 ACCEPT from IP=10.1.2.219:34524 (IP=0.0.0.0:389)

2019-11-21T21:25:55.878805+00:00 awesome.ldap.server slapd[248590]: connection_get(25) 2019-11-21T21:25:55.878841+00:00 awesome.ldap.server slapd[248590]: conn=1513 op=0 EXT oid=1.3.6.1.4.1.1466.20037 2019-11-21T21:25:55.878845+00:00 awesome.ldap.server slapd[248590]: do_extended: oid=1.3.6.1.4.1.1466.20037 2019-11-21T21:25:55.878859+00:00 awesome.ldap.server slapd[248590]: conn=1513 op=0 STARTTLS 2019-11-21T21:25:55.878883+00:00 awesome.ldap.server slapd[248590]: conn=1513 op=0 RESULT oid= err=0 text= 2019-11-21T21:25:55.887117+00:00 awesome.ldap.server slapd[248590]: daemon: activity on 1 descriptor 2019-11-21T21:25:55.887121+00:00 awesome.ldap.server slapd[248590]: daemon: activity on: 2019-11-21T21:25:55.887852+00:00 awesome.ldap.server slapd[248590]: daemon: read active on 25 2019-11-21T21:25:55.887875+00:00 awesome.ldap.server slapd[248590]: connection_get(25) 2019-11-21T21:25:55.888653+00:00 awesome.ldap.server slapd[248590]: conn=1513 fd=25 TLS established tls_ssf=256 ssf=256 2019-11-21T21:25:55.899089+00:00 awesome.ldap.server slapd[248590]: daemon: read active on 25 2019-11-21T21:25:55.899117+00:00 awesome.ldap.server slapd[248590]: connection_get(25) 2019-11-21T21:25:55.899137+00:00 awesome.ldap.server slapd[248590]: connection_read(25): input error=-2 id=1513, closing. 2019-11-21T21:25:55.899141+00:00 awesome.ldap.server slapd[248590]: connection_closing: readying conn=1513 sd=25 for close 2019-11-21T21:25:55.899158+00:00 awesome.ldap.server slapd[248590]: daemon: removing 25 2019-11-21T21:25:55.899196+00:00 awesome.ldap.server slapd[248590]: conn=1513 fd=25 closed (connection lost)

@ 888653, I can see the TLS connection is established. Quick check of what a -2 error is, looks like it's not presenting my client certificate. I have SCP'd my certs over from my working instance so I know they're formatted correctly and are valid certs. The TLS session *IS* getting established, but not progressing. Again, my LDAP settings are a lift from a known working build. confirmed it's a direct copy. Not sure why this started now.

running php maintenance/CheckLogin.php shows same fault as above.

On a whim, because we're moving our VM environment into more containerized world (docker), I went ahead and pulled the Mediawiki docker image from docker hub and wrote a compose file to support this. had to install php-ldap onto the image. Using the same LocalSettings.php file, updated appropriate mounts/volumes, put certs in the right places, and fired it up.

Same exact symptom.

So in summary...

Dev centOS build - LDAP works, can authenticate.

MediaWiki OVA appliance (Debian) - LDAP doesn't work, TLS can't connect. Same relevant settings in LocalSettings.php

Docker MediaWiki container - LDAP doesn't work, TLS can't connect. Same relevant settings in LocalSettings.php

To my mind, the only delta that I can obviously see is CentOS vs. Debian. But I don't think operating system issues make sense to my problem. What does make more sense might be php, specifically, php-ldap. I find it aggravating beyond compare that the OVA doesn't ship with LDAP "bones" already in it (like this wonderful extension and it's friends that make up LDAP hub should already be packed into it and turned off, AND the appropriate PHP LDAP modules included with the OS). I think I may be missing PHP modules with the builds that come from the foundations.

To you folks who work in Debian and have a working model of this, specifically what PHP modules do you have installed? would anyone with a working LDAP/Debian build mediawiki mind giving me a dump of their packages "apt list | grep php" ?

Any other bonus thoughts in troubleshooting here are most appreciated. And @Osnard, thank you for all you do to help this community. YTMND.
Awliste (talk) 22:07, 21 November 2019 (UTC)Reply

I'm having a similar problem. Did you figure this out? Realsalt (talk) 16:34, 24 November 2020 (UTC)Reply

I figured out the difference between different distributions and it is the location of the configuration file /etc/ldap/ldap.conf which needs the contents

TLS_CACERT $SERVER_CERTIFICATE

(you need to replace $SERVER_CERTIFICATE with the public x509 certificate that the LDAP server will be serving.)

In other distributions, this configuration file may be elsewhere. It's required because the php-ldap module is using the LDAP suite.

I hope that helps; I'm planning on posting a docker compose of setting up MediaWiki + OpenLDAP + TLS soon.

Edit: Here it is:

https://github.com/createyourpersonalaccount/openldap-mediawiki/ Peptidylprolyl (talk) 03:59, 13 March 2024 (UTC)Reply

Troubleshooting maintenance scripts

Latest comment: 6 years ago1 comment1 person in discussion

I'm trying to get a MediaWiki 1.33.1 installation to interface with LDAP. I've got the LDAPProvider, PluggableAuth, and LDAPAuthentication extensions installed and active. It's partially working, but not completely. I was previously getting errors running the ShowUserInfo.php script, but now I get no output whatsoever, it just returns to the command line with nothing displayed. Using $wgDebugLogGroups['LDAPAuthorization'] I get a log generated, but everything has # returns 1 after it, which I take to be successful. I'm not sure where to go from here to troubleshoot. OceanNN (talk) 15:54, 22 November 2019 (UTC)Reply

internal error nothing to bind with / ldap_set_option(): supplied argument is not a valid ldap link resource

Latest comment: 6 years ago3 comments2 people in discussion

Im using Mediawiki on a Pleskserver. Im trying to get a ldap-connection to an external active directory

When I try to login i get this error:

Warning: ldap_set_option(): supplied argument is not a valid ldap link resource in /var/www/vhosts/.../wiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 54

Im using PHP 7.3.12

My Localsettings config is:

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPProviderDomainConfigProvider = function() {

$config = [

'LDAP' => [

'connection' => [

"server" => "ldaps://server.de",

"user" => "cn=username,ou=ouuser,dc=bla,dc=bla“,

"pass" => ‚blabla‘,

"options" => [

"LDAP_OPT_DEREF" => 1

],

"basedn" => "dc=bla,dc=bla“,

"groupbasedn" => "dc=bla,dc=bla“,

"userbasedn" => "dc=bla,dc=bla“,

"searchattribute" => "uid",

"searchstring" => "uid=username,dc=bla,dc=bla“,

"usernameattribute" => "uid",

"realnameattribute" => "cn",

"emailattribute" => "mail"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = false;

$wgShowExceptionDetails = true;

MariusAPP (talk) 17:04, 3 December 2019 (UTC)Reply

Im using Mediawiki 1.31.1 and PHP 7.3.12 (cgi-fcgi) MariusAPP (talk) 08:15, 4 December 2019 (UTC)Reply

This sounds like the connection to the LDAP server could not be established. Maybe try "server" => "server.de", "enctype" => "tls" in the connection configuration. Osnard (talk) 14:38, 11 December 2019 (UTC)Reply

There seems to be a problem with your login session; this action has been canceled as a precaution against session hijacking. Please resubmit the form.

Latest comment: 6 years ago1 comment1 person in discussion

Hi there,

currently I am trying to add LDAP authentication to my media wiki instance. I was able to log in once but on logging back in i revive the above error.

Mediawiki : 1.31

PHP: 7.2

Mysql: 5.5.62

Here is my LocalSetting.php

<?php

# This file was automatically generated by the MediaWiki 1.23.6

# installer. If you make manual changes, please keep track in case you

# need to recreate them later.

#

# See includes/DefaultSettings.php for all configurable settings

# and their default values, but don't forget to make changes in _this_

# file, not there.

#

# Further documentation for configuration settings may be found at:

# https://www.mediawiki.org/wiki/Manual:Configuration_settings

# Protect against web entry

if ( !defined( 'MEDIAWIKI' ) ) {

exit;

}

wfLoadSkin( 'Vector' );

## Uncomment this to disable output compression

# $wgDisableOutputCompression = true;

## The protocol and server name to use in fully-qualified URLs

$wgServer = "https://site.com";

## The relative URL path to the skins directory

$wgStylePath = "$wgScriptPath/skins";

## The relative URL path to the logo. Make sure you change this from the default,

## or else you'll overwrite your logo when you upgrade!

$wgLogo = "$wgScriptPath/images/cis_logo.png";

## UPO means: this is also a user preference option

$wgEnableEmail = false;

$wgEnableUserEmail = true; # UPO

$wgEmergencyContact = "webmaster@site.com";

$wgPasswordSender = "webmaster@site.com";

$wgEnotifUserTalk = false; # UPO

$wgEnotifWatchlist = false; # UPO

$wgEmailAuthentication = true;

## Database settings

$wgDBtype = "mysql";

$wgDBserver = "mysql.site.com";

$wgDBname = "dbuser";

$wgDBuser = "dbuser";

$wgDBpassword = "dbpassword";

# MySQL table options to use during installation or update

$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=utf8";

# Experimental charset support for MySQL 5.0.

$wgDBmysql5 = false;

## Shared memory settings

$wgMainCacheType = CACHE_NONE;

$wgParserConf = array('class' => 'Parser',);

#$wgMainCacheType = CACHE_MEMCACHED;

#$wgMemCachedServers = ['127.0.0.1:11211'];

#$wgSessionsInMemcached = true;

## To enable image uploads, make sure the 'images' directory

## is writable, then set this to true:

$wgEnableUploads = true;

$wgUseImageMagick = true;

$wgImageMagickConvertCommand = "/usr/bin/convert";

# InstantCommons allows wiki to use images from http://commons.wikimedia.org

$wgUseInstantCommons = false;

## If you use ImageMagick (or any other shell command) on a

## Linux server, this will need to be set to the name of an

## available UTF-8 locale

$wgShellLocale = "en_US.utf8";

## If you want to use image uploads under safe mode,

## create the directories images/archive, images/thumb and

## images/temp, and make them all writable. Then uncomment

## this, if it's not already uncommented:

#$wgHashedUploadDirectory = false;

## Set $wgCacheDirectory to a writable directory on the web server

## to make your wiki go slightly faster. The directory should not

## be publically accessible from the web.

#$wgCacheDirectory = "$IP/cache";

# Site language code, should be one of the list in ./languages/Names.php

$wgLanguageCode = "en";

## Default skin: you can change the default skin. Use the internal symbolic

## names, ie 'cologneblue', 'monobook', 'vector':

$wgDefaultSkin = "vector";

## For attaching licensing metadata to pages, and displaying an

## appropriate copyright notice / icon. GNU Free Documentation

## License and Creative Commons licenses are supported so far.

$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright

$wgRightsUrl = "";

$wgRightsText = "";

$wgRightsIcon = "";

# Path to the GNU diff3 utility. Used for conflict resolution.

$wgDiff3 = "/usr/bin/diff3";

# The following permissions were set based on your choice in the installer

$wgGroupPermissions['*']['createaccount'] = false;

$wgGroupPermissions['*']['edit'] = false;

$wgDebugLogFile = "/path/to/error.log";

$wgDebugLogGroups['LDAPProvider'] = '/path/to/LDAP.log';

$

# End of automatically generated settings.

# Add more configuration options below.

# Misc settings

#$wgFileExtensions = array_merge( $wgFileExtensions, array( 'zip' ) );

# LDAP

error_reporting( -1 );

ini_set( 'display_errors', 1 );

#$wgLDAPDebug = 0;

#$wgShowSQLErrors = true;

#$wgDebugDumpSql = true;

#$wgShowDBErrorBacktrace = true;

$wgShowExceptionDetails = true;

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPGroups',

'LDAPUserInfo'

] );

$wgAuthRemoteuserAllowUserSwitch = true;

$wgPluggableAuth_EnableLocalLogin = false;

$wgShowExceptionDetails = true;

#$wgAuthRemoteuserUserNameReplaceFilter = [

# '@win2.cs.ksu.edu$' => ''

#];

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

$user = strtolower( $_SERVER[ 'REMOTE_USER' ] );

}

return $user;

};

$LDAPProviderDomainConfigProvider = function() {

$config = [

'AD' => [

'connection' => [

"server" => "AD.site.com",

"user" => "CN=searchuser,CN=Users,DC=site,DC=com",

"pass" => 'searchuser_pass',

"options" => [

"LDAP_OPT_DEREF" => 1

],

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"emailattribute" => "saaccountname",

"basedn" => "dc=site,dc=com",

"groupbasedn" => "dc=site,dc=com",

"userbasedn" => "dc=site,dc=com",

"searchattribute" => "samaccountname",

"searchstring" => "",

"usernameattribute" => "samaccountname",

"realnameattribute" => "cn"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [

'cn=admins,dc=site,dc=com'

]

],

'userinfo' => [

"attributes-map" => [

"realname" => "cn"

]

],

'groupsync' => [

"mechanism" => "mappedgroups",

"mapping" => [

"sysop" => "cn=admins,dc=site,dc=com",

"customgroup" => "CN=Users,DC=site,DC=com"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

# timezone

$wgLocaltimezone = "US/Central";

date_default_timezone_set( $wgLocaltimezone );

# turn on the nice editor by default.

wfLoadExtensions(['WikiEditor']);

# WikiEditor Options

#wfLoadExtension( ['VisualEditor'] );

$wgDefaultUserOptions['usebetatoolbar'] = 1;

$wgDefaultUserOptions['usebetatoolbar-cgd'] = 1;

# Displays the Preview and Changes tabs

$wgDefaultUserOptions['wikieditor-preview'] = 1;

# Displays the Publish and Cancel buttons on the top right side

$wgDefaultUserOptions['wikieditor-publish'] = 1;

# allow linking/embedding of images from external sites

$wgAllowExternalImages = true;

# Enable Seealso extension

# H.D.G. 1/15/2015

#require_once "$IP/extensions/Seealso/Seealso.php";

# Enable MsUpload extension

# H.D.G. 1/15/2015

#equire_once "$IP/extensions/MsUpload/MsUpload.php";

#wfLoadExtension( ['MsUpload']);

# Enable Labeled Section Transclusion

# H.D.G 1/23/15

#require_once "$IP/extensions/LabeledSectionTransclusion/lst.php";

#require_once "$IP/extensions/LabeledSectionTransclusion/lsth.php";

# Enable syntax highlighting

# SDG 2/25/2016

#require_once "$IP/extensions/SyntaxHighlight_GeSHi/SyntaxHighlight_GeSHi.php";

Here are the logs the issues causes.

IP: 192.168.1.5

Start request POST /Docs/index.php?title=Special:UserLogin&returnto=Main+Page

HTTP HEADERS:

HOST: site.com

USER-AGENT: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko/20100101 Firefox/70.0

ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

ACCEPT-LANGUAGE: en-US,en;q=0.5

ACCEPT-ENCODING: gzip, deflate, br

CONTENT-TYPE: application/x-www-form-urlencoded

CONTENT-LENGTH: 237

ORIGIN: https://site.com

CONNECTION: keep-alive

REFERER: https://site.com/Docs/index.php?title=Special:UserLogin&returnto=Main+Page

COOKIE: support_dev_wm_UserName=myuser; support_dev_wm_51a2e67c_session=hq9p1mjl1at2ihtt4dgppnealuc589uh

UPGRADE-INSECURE-REQUESTS: 1

[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff

[caches] LocalisationCache: using store LCStoreDB

[CryptRand] 0 bytes of randomness leftover in the buffer.

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "192.168.1.5",

"UserAgent": "Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:70.0) Gecko\/20100101 Firefox\/70.0",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'db.site.com'.

[SQLBagOStuff] Connection 6325684 will be used for SqlBagOStuff

[CryptRand] 0 bytes of randomness leftover in the buffer.

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" is unsaved, marking dirty in constructor

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] setcookie: "support_dev_wm_51a2e67c_session", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cUserID", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cToken", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1544038447", "/", "", "", "1"

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'db.site.com'.

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" force-persist due to persist()

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] setcookie: "support_dev_wm_51a2e67c_session", "2ca7ii61auemaic26d3fnefgrusmamrh", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cRemoteToken", "", "1578166447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cUserID", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cToken", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1544038447", "/", "", "", "1"

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" Taking over PHP session

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] already set setcookie: "support_dev_wm_51a2e67c_session", "2ca7ii61auemaic26d3fnefgrusmamrh", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cRemoteToken", "", "1578166447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cUserID", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "support_dev_wm_51a2e67cToken", "", "1544038447", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1544038447", "/", "", "", "1"

[MessageCache] MessageCache::load: Loading en... local cache is empty, global cache is expired/volatile, loading from database

Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform

Parser: using preprocessor: Preprocessor_DOM

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

QuickTemplate::__construct was called with no Config instance passed to it

[CryptRand] 0 bytes of randomness leftover in the buffer.

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" data dirty due to dirty(): LoginSignupSpecialPage->getFakeTemplate/SpecialUserLogin->getToken/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "2ca7ii61auemaic26d3fnefgrusmamrh" save: dataDirty=1 metaDirty=0 forcePersist=0

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

MediaWiki::preOutputCommit: LBFactory shutdown completed

[cookie] setcookie: "UseDC", "master", "1575574457", "/", "", "1", "1"

[cookie] setcookie: "UseCDNCache", "false", "1575574457", "/", "", "1", "1"

OutputPage::sendCacheControl: private caching; **

Request ended normally

[session] Saving all sessions on shutdown

[DBConnection] Wikimedia\Rdbms\{closure}: closing connection to database 'db.site.com'.

[DBConnection] Wikimedia\Rdbms\{closure}: closing connection to database 'db.site.com'.

Thanks in advance! Bongo0458 (talk) 20:11, 5 December 2019 (UTC)Reply

Local login with incorrect passwort possible

Latest comment: 6 years ago2 comments2 people in discussion

I configured my wiki v1.31.5 with LDAP Provider 1.0.1 and LDAPAuthentication2 v1.0.0. Everything worked as expected until I noticed that if I choose domain 'local' instead of my configured LDAP domain in the login screen, I can login as a local user with a password which is NOT the same as the one defined during setup of that local user!!!

I can not use any password to login successfully but if I use for example asdfg+gh- as password I can login with qwert+hj-. I can not login with 123456.

Whats going critically wrong here ? 134.245.249.125 (talk) 10:46, 9 December 2019 (UTC)Reply

Thanks for reporting. There is now a task for this. https://phabricator.wikimedia.org/T240338 Osnard (talk) 14:35, 11 December 2019 (UTC)Reply

Can't fetch group membership when using POSIX groups (memberUid: user1)

Latest comment: 5 years ago41 comments5 people in discussion

Please find my plugin versions, LDAP domain config, etc below the error details. The issue I am running into is that the search string when looking up groups is malformed, and I don't know how to fix it. Does anyone have an actual working config for when groups are in LDAP like so:

dn: cn=admins,ou=groups,dc=example,dc=com

objectClass: top

objectClass: posixGroup

cn: admins

memberUid: user1

memberUid: user2

So to match my group membership, I would run the below

ldapsearch -x "(&(objectClass=*)(memberUid=users))" dn -LLL -b ou=groups,dc=example,dc=com

The output of the above is

dn: cn=admins,ou=groups,dc=example,dc=com

Yet I cannot get this same functionality with LDAPProvider. When I run

php maintenance/ShowUserGroups.php --domain "LDAP" --username "user1"

I get empty output, and see the following in the mwdebug.log

2019-12-10 19:54:14 example wikidb-w: ldap_search( $linkID, $baseDN = 'ou=groups,dc=example,dc=com', $filter = '(&(objectclass=*)(memberUid=uid=user1,ou=users,dc=example,dc=com))', $attributes = [ 'dn' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = );

2019-12-10 19:54:14 example wikidb-w: # returns Resource id #216

2019-12-10 19:54:14 example wikidb-w: ldap_get_entries( $linkID, $resultID );

2019-12-10 19:54:14 example wikidb-w: # returns: array (

'count' => 0,

)

Full DNs:

Short names:

It is successfully connecting, as the ShowUserInfo.php script works great!

php maintenance/ShowUserInfo.php --domain "LDAP" --username "user1"

uid => user1

loginshell => /bin/bash

<etc>

Yet the group config isn't working - what gives?

MediaWiki: 1.33.1

PluggableAuth: 5.7

LDAPAuthentication2: 1.0.0

LDAPAuthorization: 1.0.0

LDAPProvider: 1.0.1

LDAPGroups: 1.0.1

LocalSettings.php:

$LDAPProviderDomainConfigs = "/etc/ldap/ldapprovider.json";

/etc/ldap/ldapprovider.json:

{

"LDAP": {

"connection": {

"server": "ldap.example.com",

"user": "cn=admin,dc=example,dc=com",

"pass": "password",

"options": [],

"enctype": "clear",

"basedn": "dc=example,dc=com",

"groupbasedn": "ou=groups,dc=example,dc=com",

"userbasedn": "ou=users,dc=example,dc=coma",

"searchattribute": "uid",

"searchstring": "uid=USER-NAME,ou=users,dc=example,dc=com",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory",

"groupobjectclass": "*",

"groupattribute": "memberUid"

},

"authorization": {

"rules": {

"groups": {

"required": ["cn=admins,ou=groups,dc=example,dc=com"]

}

},

"groupsync": {

"mechanism": "allgroups",

"locally-managed": ["local", "wiki", "group", "names" ]

},

"authentication": {

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail"

}

} Sebastian19276 (talk) 20:04, 10 December 2019 (UTC)Reply

Configuration looks good so far. You say ldapsearch -x "(&(objectClass=*)(memberUid=users))" dn -LLL -b ou=groups,dc=example,dc=com will give you a proper result, but

ldap_search( $linkID, $baseDN = 'ou=groups,dc=example,dc=com', $filter = '(&(objectclass=*)(memberUid=uid=user1,ou=users,dc=example,dc=com))', $attributes = [ 'dn' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );

will not?

But the userDN uid=user1,ou=users,dc=example,dc=com is okay? Osnard (talk) 14:50, 11 December 2019 (UTC)Reply

Hi Osnard,

In the constructed search filter the memberUid= parameter should be searching for just a uid, not for a full DN. It should search for "memberUid=user1" because this is how it's actually stored in LDAP; but for some reason it's searching for "memberUid=uid=user1,ou=users" which makes no sense. That user DN on its own is valid, yes.

I tried fiddling with the domain config and couldn't get a proper search filter no matter what I entered. I thought perhaps it was pulling it from "searchstring" but even when I changed it, set it to "", or removed it altogether, it wasn't changing the search filter when using ShowUserGroups.php

Thanks! Sebastian19276 (talk) 14:20, 12 December 2019 (UTC)Reply

One tiny note, just a typo in my original post where I said the ldapsearch gives me a proper result, I meant to say "memberUid=user1" not "memberUid=users". Sebastian19276 (talk) 19:50, 12 December 2019 (UTC)Reply

The current implementation uses the User-DN in the search, not the username. You could implement you own "UserGroupsRequest", by just copying the class and modifying the "search" bit. Yet it would be better to solve this generically. Unfortunately I don't have much time to spend on this at the moment. But if you are willing to help, patches are welcome.

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/master/src/UserGroupsRequest/Configurable.php#L37 Osnard (talk) 12:33, 13 December 2019 (UTC)Reply

Hey, that fixed it! I just changed userDN to username, and that's exactly what I needed. I was having trouble understanding all the PHP pieces, I don't know any PHP, and I hadn't come across that exact file yet. Cheers! Sebastian19276 (talk) 14:15, 13 December 2019 (UTC)Reply

It is fairly ridiculous that I'd have to edit the source code to get this working. Does nobody ever use POSIX groups? I take it the DN is what's used in AD implementations for group membership; but what about classic OpenLDAP on GNU/Linux systems? There must be some way to change this using just a config file, not just by editing code. Any insight would be great! Sebastian19276 (talk) 14:22, 13 December 2019 (UTC)Reply

Fun fact: this still was broken for a time because uid is not case sensitive, but memberUid is, so MediaWiki automatically capitalizing usernames didn't quite work. I copied the getUserDN function and created getUserUID, then used the output of that to search for user groups instead of using the username. So this way LDAP can take the wrongly capitalized username, match it to a user account, extract the correctly capitalized UID, use it to search for groups since memberUid is case sensitive (standard NIS schema), and then correctly return the groups. I don't have the time to get developer access, make the necessary changes, create files, etc, but hopefully this does give some insight for other people going forward.

$useruid = $this->userInfo[0]["uid"][0];

$userUID = new EscapedString( $this->ldapClient->getUserUID( $username ) );

"(&(objectclass=$objectClass)($groupAttribute=$userUID))",

Sebastian19276 (talk) 19:21, 13 December 2019 (UTC)Reply

Awesome, thanks for sharing this. I have opened a Phabricator task to adress this issue in the future: https://phabricator.wikimedia.org/T240750

Unfortunately I can not make any promises regarding a time schedule. Actually, most usecases I know are binding to a Microsoft Active Directory. But my goal would be to also support other backends.

Osnard (talk) 11:54, 14 December 2019 (UTC)Reply

Great! Glad I could help, and thank you for your time. Cheers Sebastian19276 (talk) 16:11, 8 January 2020 (UTC)Reply

Hi. I'm having the same issue of the original post (trouble setting up the openldap group). I want to restrict login to a certain group of ldap user. I changed the userDN in username in configurable.php as suggested in previous post. Now I can have the right output running /maintenance/showusergroup.php but still no luck with the login restriction. I read the rest of the thread, and maybe the problem is related to the "capitalization" of username, but I can't understand how to fix it: what files I have to edit and how ? Any help appreciated. Thanks

Fabio 151.41.62.123 (talk) 10:34, 7 May 2020 (UTC)Reply

If it really comes to "capitalization", have a look at the presearchusernamemodifiers configuration of Extension:LDAPProvider. But if ShowUserGroups.php lists the proper groups then maybe there is just an issue with the authorization configuration. You can share your config and/or enable debugging to get more information. Osnard (talk) 14:35, 7 May 2020 (UTC)Reply

hi, thanks for the reply. I can confirm that /maintenance/showusergroup.php shows the correct result.

my ldap.json file is this one:

{

"diism.unisi.it": {

"connection": {

"server": "ldap.diism.unisi.it",

"port": "389",

"user": "cn=Manager,dc=diism,dc=unisi,dc=it",

"pass": "******",

"enctype": "clear",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "dc=diism,dc=unisi,dc=it",

"userbasedn": "ou=Users,dc=diism,dc=unisi,dc=it",

"groupbasedn": "ou=Groups,dc=diism,dc=unisi,dc=it",

"searchattribute": "uid",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory",

"groupobjectclass": "*",

"groupattribute": "memberUid",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": {

"rules":{

"group": {

"required": ["cn=wiki,ou=Groups,dc=diism,dc=unisi,dc=it"]

}

},

"groupsync": []

}

} 151.41.62.123 (talk) 14:55, 7 May 2020 (UTC)Reply

just for clarification: we want to restrict access to "wiki" group on our openldap and right now, the login process let everyone in (with correct password obv.)

thank you 151.41.62.123 (talk) 15:01, 7 May 2020 (UTC)Reply

Config looks good. This might be a stupid question, but you have Extension:LDAPAuthorization installed and enabled, right? Maybe you can share the logs too? Osnard (talk) 15:50, 7 May 2020 (UTC)Reply

yes LDAPAuthorization is installed and enabled (it shows in "version" special page). What logs do you need ? don't even know if / where the extension save logs ... 151.41.62.123 (talk) 17:41, 7 May 2020 (UTC)Reply

See LDAP_hub#Debugging Osnard (talk) 11:14, 8 May 2020 (UTC)Reply

OK. thanks for the help. I enabled the log and I get it working when I use the /maintenance/showusergroup.php (and as I already told you it's working right) but nothing adds to the log file when I login from the mediawiki regular web interface... so it seems it's not workin' right ?

151.41.62.123 (talk) 10:13, 11 May 2020 (UTC)Reply

In this case the extensions seem not so be enabled when in web context. Osnard (talk) 14:54, 11 May 2020 (UTC)Reply

but it let me in when I use correct username / password and shows me error messages when use wrong ones.... moreover, I tried changing " $wgPluggableAuth_ButtonLabel " parameter, and it displays the string I put there on the web interface... so strange .....

151.41.62.123 (talk) 15:02, 11 May 2020 (UTC)Reply

Sorry. Without debugging I can't help. If the logs don't show anything I don't know where to start. Maybe it's just the log-config that is not enabled in web-context? Please double check this. Maybe use the generic Manual:$wgDebugLogFile configuration. Osnard (talk) 09:55, 12 May 2020 (UTC)Reply

Ok, so I got the "generic" logging working setting the $wgDebugLogFile, and in the logfile specified some LDAP related messages shows. Since the logfile generated is not so small, I tried to share it via external link on my drive, but it seems that this is not allowed here as I get this error:

"This action has been automatically identified as harmful, and therefore disallowed."

how can I show you the log ?

Thank you very much for your support

151.41.49.198 (talk) 10:42, 13 May 2020 (UTC)Reply

Can you just extract the lines with the keyword "ldap" (e.g. by using `grep`) and share them here? Otherwise you might want to try another sharing service, like https://pastebin.com Osnard (talk) 13:35, 13 May 2020 (UTC)Reply

root@wiki:~# cat /var/log/mediawiki.log | grep -i LDAP

[session] SessionBackend "r3oa0124nk3f7b0r3e8jk37cuup15u9b" data dirty due to dirty(): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[DBQuery] SqlBagOStuff::fetchBlobMulti [0.001s] localhost: SELECT keyname,value,exptime FROM `newwikiobjectcache` WHERE keyname = 'new_diismwiki-newwiki:ldap-provider:user-info:test:'

[DBQuery] MediaWiki\Extension\LDAPProvider\UserDomainStore::getDomainForUser [0s] localhost: SELECT domain FROM `newwikildap_domains` WHERE user_id = '4' LIMIT 1

[session] SessionBackend "jbtcl1ebdrulhif3dju9dtavjhqkmh9f" data dirty due to dirty(): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession::callback/MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->process/MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->doProcess/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[DBQuery] SqlBagOStuff::fetchBlobMulti [0.001s] localhost: SELECT keyname,value,exptime FROM `newwikiobjectcache` WHERE keyname = 'new_diismwiki-newwiki:ldap-provider:user-info:Test:'

[DBQuery] MediaWiki\Extension\LDAPProvider\UserDomainStore::getDomainForUser [0s] localhost: SELECT domain FROM `newwikildap_domains` WHERE user_id = '4' LIMIT 1

[session] SessionBackend "jbtcl1ebdrulhif3dju9dtavjhqkmh9f" data dirty due to dirty(): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession::callback/MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->process/MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->doProcess/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[DBQuery] SqlBagOStuff::fetchBlobMulti [0.001s] localhost: SELECT keyname,value,exptime FROM `newwikiobjectcache` WHERE keyname = 'new_diismwiki-newwiki:ldap-provider:user-groups:Test:' 151.41.49.198 (talk) 14:25, 13 May 2020 (UTC)Reply

pastebin can't do ... file is too big

151.41.49.198 (talk) 14:33, 13 May 2020 (UTC)Reply

Can you please again ahre your whole LDAP related config. Including enabled extensions and the domain config. Thanks! Osnard (talk) 19:11, 13 May 2020 (UTC)Reply

apart from ldap.json (already posted just before), I think the only relevant part is in Localconfig.conf in which I added this (following an example in one of the extension's page):

# End of automatically generated settings.

# Add more configuration options below.

// Safe IP or not (for bypassing external login via AD)

$safeIPs = array('127.0.0.1','localhost');

$ipsVars = array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR');

foreach ($ipsVars as $ipsVar) {

if (isset($_SERVER[$ipsVar]) && mb_strlen($_SERVER[$ipsVar]) > 3 ) { $wikiRequestIP = $_SERVER[$ipsVar]; break; }

}

$wikiRequestSafe = (isset($wikiRequestIP) && ( in_array($wikiRequestIP,$safeIPs) ));

// Create Wiki-Group 'engineering' from default user group

$wgGroupPermissions['engineering'] = $wgGroupPermissions['user'];

// Private Wiki. External LDAP login. Default NS requires login.

$wgEmailConfirmToEdit = false;

$wgGroupPermissions['*']['edit'] = false;

$wgGroupPermissions['*']['read'] = false;

$wgGroupPermissions['*']['createaccount'] = false;

$wgGroupPermissions['sysop']['createaccount'] = false;

$wgGroupPermissions['*']['autocreateaccount'] = true;

$wgBlockDisablesLogin = true;

// Load LDAP Config from JSON

$ldapJsonFile = "$IP/ldap.json";

$ldapConfig = false;

//$ldapConfig = true;

if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {

$testJson = @json_decode(file_get_contents($ldapJsonFile),true);

if (is_array($testJson)) {

$ldapConfig = true;

} else {

error_log("Found invalid JSON in file: $IP/ldap.json");

}

// Activate Extension

if ( $ldapConfig ) {

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPGroups' );

$LDAPProviderDomainConfigs = $ldapJsonFile;

$wgPluggableAuth_ButtonLabel = "Log IN TEST";

if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }

$LDAPAuthentication2AllowLocalLogin = true;

} 151.41.49.198 (talk) 22:27, 13 May 2020 (UTC)Reply

Maybe it's just the log files that can not be written when in web context. Is the webserver user allowed to access the debug log files?

But I may have found the issue in your ldap.json. It says

 "authorization": {
                        "rules":{
                               "group": {
                                        "required": ["cn=wiki,ou=Groups,dc=diism,dc=unisi,dc=it"]
                                }
                        }
                },

where it should say

 "authorization": {
                        "rules":{
                               "groups": {
                                        "required": ["cn=wiki,ou=Groups,dc=diism,dc=unisi,dc=it"]
                                }
                        }
                },

It's "groups" instead of "group" Osnard (talk) 13:18, 5 June 2020 (UTC)Reply

Hi Osnard,

I've got a similar problem when upgrading from mediawiki 1.31 to 1.35 and migrating to LDAPProvider at the same time.

Situation:

LDAP Group:

dn: cn=wiki,ou=groups,dc=example,dc=com

objectClass: top

objectClass: posixGroup

cn: wiki

memberUid: user1

memberUid: user2

to match group membership, the following query works.

ldapsearch -x "(&(objectClass=*)(memberUid=user1))" dn -LLL -b ou=groups,dc=example,dc=com

LDAP user:

dn: uid=t.test, ou=users, dc=example, dc=com

objectClass: top

objectClass: posixUser

uid: t.test

displayname: Thorsten Test

cn: Thorsten Test

mail: t.test@example.com

I migrated from Extension:LdapAuthentication to LDAP Stack:

From old config:

require_once 'extensions/LdapAuthentication/LdapAuthentication.php';
require_once 'includes/AuthPlugin.php';
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDebug = 3;
$wgDebugLogGroups['ldap'] = "/var/log/mediawiki/mediawiki-ldap.log" ;
$wgLDAPDomainNames = array( 'LDAP' );
$wgLDAPServerNames = array( 'example.com' => 'localhost' );
$wgLDAPNameMapperServerName = "localhost";
$wgLDAPNameMapperBaseDN = "dc=example,dc=com";
$wgLDAPUseLocal = false;
$wgLDAPEncryptionType = array(  'example.com' => 'clear');
$wgLDAPSearchAttributes = array( 'example.com' => 'displayname' );
$wgLDAPBaseDNs = array( 'example.com' => 'dc=example,dc=com' );
# To pull e-mail address from LDAP
$wgLDAPPreferences = array( 'example.com' => array( 'email' => 'mail') );
# Group based restriction
$wgLDAPGroupUseFullDN = array( "example.com" => false );
$wgLDAPGroupObjectclass = array( "example.com" => "posixgroup" );
$wgLDAPGroupAttribute = array( "example.com" => "memberuid" );
$wgLDAPGroupSearchNestedGroups = array( "example.com" => false );
$wgLDAPGroupNameAttribute = array( "example.com" => "cn" );
$wgLDAPRequiredGroups = array( "example.com" => array("cn=wiki,ou=groups,dc=example,dc=com"));
$wgLDAPLowerCascomsername = array(  'example.com' => false,
$wgLDAPGroupUseRetrievedUsername = array( "example.com" => true );
$wgLDAPDisableAutoCreate = array(  "example.com" => false );
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgLDAPUseLDAPGroups = array( 'example.com' => true );

To new config:

wfLoadExtensions( [
        'PluggableAuth',
        'Auth_remotcomser',
        'LDAPProvider',
        'LDAPAuthentication2',
        'LDAPAuthorization',
        'LDAPUserInfo',
        'LDAPGroups'
] );
$LDAPAuthorizationAutoAuthRemotcomserStringParser = 'username-at-domain';
$LDAPAuthentication2AllowLocalLogin = false;
$wgAuthRemotcomserAllowUserSwitch = false;
$wgPluggableAuth_EnableLocalLogin = false;
$wgAuthRemotcomserUserName = function() {
        $user = '';
        if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {
                $user = strtolower( $_SERVER[ 'REMOTE_USER' ] );
        }
        return $user;
};
$LDAPProviderDomainConfigProvider = function() {
        $config = [
                'LDAP' => [
                        'connection' => [
                                "server" => "localhost",
                                "options" => [
                                        "LDAP_OPT_DEREF" => 1
                                ],
								"basedn" => "dc=example,dc=com",
                                "groupbasedn" => "ou=groups,dc=example,dc=com",
                                "userbasedn" => "ou=users,dc=example,dc=com",
                                "searchattribute" => "uid",
                                "searchstring" => "uid=USER-NAME,ou=users,dc=example,dc=com",
                                "usernameattribute" => "cn",
                                "realnameattribute" => "cn",
                                "emailattribute" => "mail",
                                "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory",
                                "groupobjectclass" => "posixGroup",
                                "groupattribute" => "memberUid",
                        ],
                        'authorization' => [
                                'rules' => [
                                        'groups' => [
                                                'required' => [ "cn=wiki,ou=groups,dc=example,dc=com" ]
                                        ]
                                ]
                        ],
                        'userinfo' => [
                                'attributes-map' => [
                                        'email' => 'mail',
                                        'realname' => 'cn'
                                ]
                        ],
				]
		];
		
        return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};
#####Error logging######
##PHP Error ###
error_reporting( -1 );
ini_set( 'display_errors', 1 );
$wgShowExceptionDetails = true;
$wgShowDBErrorBacktrace = true;
##Debug log to file ###
$wgDebugLogFile = '/var/log/mediawiki/debuglogfile.log';
$wgDebugComments = true;
$wgDebugLogGroups['LDAP'] =
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =
$wgDebugLogGroups['LDAPUserInfo'] =
$wgDebugLogGroups['LDAPAuthorization'] = '/var/log/mediawiki/LDAPProvider.log';
$wgGroupPermissions['*']['autocreateaccount'] = true;

The users wiki username is its fullname, so attribute displayname or cn. The old setup offered the possibility to login via LDAP uid or via fullname. If it's not possible to have both, I'd prefer login by uid.

As you can see the mediawiki usernameattribute is cn, which is firstname lastname.

So I need verify the groups by uid and then bind to LDAP User with attribute cn.

As the problem seemed to be the same as Sebastians, I changed the UserGroupRequest/Configurable.php from $userDN to $username as suggested.

Since then the ShowUserGroup.php maintance script works as expected and returns all groups the user is part of. Many thanks @Sebastian19276!

Sadly the login still does not work.

When I login via browser, the following error is shown:

The user Thorsten Test is not authenticated.

The LDAP log shows the following:

2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_connect( $hostname = 'ldap://localhost:389', $port = 389 );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # __METHOD__ returns Resource id #36
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Setting LDAP_OPT_REFERRALS to 0
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Setting LDAP_OPT_DEREF to 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_set_option( $linkID, $option = 2, $newval = 1 );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=t.test,ou=users,dc=example,dc=com'
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_bind( $linkID, $bindRDN = 'uid=t.test,ou=users,dc=example,dc=com', $bindPassword = 'XXXX' );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 1
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_search( $linkID, $baseDN = 'ou=users,dc=example,dc=com', $filter = '(uid=t.test)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns Resource id #54
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_get_entries( $linkID, $resultID );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns: array (
  'count' => 1,
  0 =>
  array (
    'uid' =>
    array (
      'count' => 1,
      0 => 't.test',
    ),
    0 => 'uid',
    'uidnumber' =>
    array (
      'count' => 1,
      0 => '0',
    ),
    1 => 'uidnumber',
    'mail' =>
    array (
      'count' => 1,
      0 => 't.test@example.com',
    ),
    2 => 'mail',
    'homedirectory' =>
    array (
      'count' => 1,
      0 => '/t.test',
    ),
    3 => 'homedirectory',
    'givenname' =>
    array (
      'count' => 1,
      0 => 'Thorsten',
    ),
    4 => 'givenname',
    'gidnumber' =>
    array (
      'count' => 1,
      0 => '0',
    ),
    5 => 'gidnumber',
    'displayname' =>
    array (
      'count' => 1,
      0 => 'Thorsten Test',
    ),
    6 => 'displayname',
    'sn' =>
    array (
      'count' => 1,
      0 => 'Test',
    ),
    7 => 'sn',
    'cn' =>
    array (
      'count' => 1,
      0 => 'Thorsten Test',
    ),
    8 => 'cn',
    'objectclass' =>
    array (
      'count' => 3,
      0 => 'inetOrgPerson',
      1 => 'posixAccount',
      2 => 'top',
    ),
    9 => 'objectclass',
    'userpassword' =>
    array (
      'count' => 1,
      0 => '{SSHA}xxxxx',
    ),
    10 => 'userpassword',
    'employeetype' =>
    array (
      'count' => 1,
      0 => 'aktiv',
    ),
    11 => 'employeetype',
    'count' => 12,
    'dn' => 'uid=t.test,ou=users,dc=example,dc=com',
  ),
)
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Ran LDAP search for '(uid=t.test)' in 0.00060606002807617 seconds.
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (
  'base' => 'dc=example,dc=com',
  'filter' => '(uid=Thorsten Test)',
  'attributes' =>
  array (
    0 => '*',
    1 => 'memberof',
  ),
)
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_search( $linkID, $baseDN = 'dc=example,dc=com', $filter = '(uid=Thorsten Test)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns Resource id #66
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_count_entries( $linkiID, $result = 'Resource id #66' );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns 0
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Could not get user DN!
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_search( $linkID, $baseDN = 'ou=groups,dc=example,dc=com', $filter = '(&(objectclass=posixGroup)(memberUid=Thorsten Test))', $attributes = [ 'dn' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns Resource id #72
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: ldap_get_entries( $linkID, $resultID );
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: # returns: array (
  'count' => 0,
)
2020-11-10 14:57:36 xxxxx.xxxxx.xx wiki: Ran LDAP search for '(&(objectclass=posixGroup)(memberUid=Thorsten Test))' in 0.00049185752868652 seconds.

Somehow it first queries a ldap_search with uid=t.test but later with uid=Thorsten Test.

Can you please help me to figure out, what to do to make it work?

Cheers

Dominik Schlagmichdoch (talk) 15:18, 10 November 2020 (UTC)Reply

It is using "usernameattribute" => "cn" to set the on-wiki-username and then uses this one in the "searchstring" => "uid=USER-NAME,ou=users,dc=example,dc=com". Try to just unset the "searchstring" or use "usernameattribute" => "uid". Osnard (talk) 10:28, 16 November 2020 (UTC)Reply

Commenting out "searchstring" => "uid=USER-NAME,ou=users,dc=example,dc=com" does not seem to have any impact at all.

Using "usernameattribute" => "uid" does result in an error on every page loaded after:

"Call to a member function canExist() on null"

The goal remains to have "usernameattribute" => "cn", but still have a ldap query with uid as off: "searchstring" => "uid=UID,ou=users,dc=example,dc=com"

Thanks in advance! Schlagmichdoch (talk) 17:41, 4 December 2020 (UTC)Reply

How about setting "searchstring" => "cn=USER-NAME,ou=users,dc=example,dc=com". But this will probably not solve the issue with he "group request". Can a "cn" be used as "groupattribute" instead of "memberUid"? If not, you may need to implement a custom IUserGroupRequest class. Osnard (talk) 10:05, 7 December 2020 (UTC)Reply

I would like to keep our current ldap schema, as other apps are dependent on it too. So only "memberUid" is provided as possible "groupattribute".

Your suggestion with cn=USER-NAME seems promising though. After applying it, ShowUserGroups.php and ShowUserInfo.php do work with the ldap uid as userparameter. Perfect! Sadly CheckLogin.php does not work anymore and login via Web obviously does not work either. Is this behaviour as you had expected?

Where do I find theIUserGroupRequest class that I need to customize? Schlagmichdoch (talk) 09:31, 9 December 2020 (UTC)Reply

I see... please go back to the original search-string, so login works again. Have a look at the class UserGroupsRequest\Configurable. Try to change line 18 [1] in a way you have a proper $userDN in line 37 [2]. You may need to run $this->ldapClient->getUserInfo( $username ) to obtain the uid from the wiki username (which is the cn).

If you succeed, please share you change, so I can incorporate it into the extension. If not, tell me also, I will then check what I can do.

[1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/UserGroupsRequest/Configurable.php#L18

[2] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/UserGroupsRequest/Configurable.php#L37 Osnard (talk) 16:41, 10 December 2020 (UTC)Reply

Are you sure I need to change the Configurable again?

With the fix provided by @Sebastian19276 ($groupattribute=$username instead of $groupattribute=$userDN) the file currently looks like this:

<?php
namespace MediaWiki\Extension\LDAPProvider\UserGroupsRequest;
use MediaWiki\Extension\LDAPProvider\ClientConfig;
use MediaWiki\Extension\LDAPProvider\EscapedString;
use MediaWiki\Extension\LDAPProvider\GroupList;
use MediaWiki\Extension\LDAPProvider\UserGroupsRequest;
use MWException;
class Configurable extends UserGroupsRequest {
        /**
         * @param string $username to get the groups for
         * @return GroupList
         */
         public function getUserGroups( $username ) {
                $userDN = new EscapedString( $this->ldapClient->getUserDN( $username ) );
                $baseDN = $this->config->get( ClientConfig::GROUP_BASE_DN );
                $dn = 'dn';
                
                if ( $baseDN === '' ) {
                        $baseDN = null;
                }
                
                $ret = [];
                $objectClass = $this->config->get( ClientConfig::GROUP_OBJECT_CLASS );
                if ( empty( trim( $objectClass ) ) ) {
                        throw new MWException( sprintf(
                                "Parameter %s must be set when configurable groups request is used",
                                ClientConfig::GROUP_OBJECT_CLASS
                        ) );
                }
                $groupAttribute = $this->config->get( ClientConfig::GROUP_ATTRIBUTE );
                
                $groups = $this->ldapClient->search(
                        "(&(objectclass=$objectClass)($groupAttribute=$username))",
                        $baseDN, [ $dn ]
                );
                
                foreach ( $groups as $key => $value ) {
                        if ( is_int( $key ) ) {
                                $ret[] = $value[$dn];
                        }
                }
                return new GroupList( $ret );
        }
}

Since the fix the maintenance script ShowUserGroups.php does work properly and includes the groupdn specified with:

'authorization' => [
        'rules' => [
                'groups' => [
                        'required' => [ "cn=wiki,ou=groups,dc=example,dc=com" ]
                ]
        ]
],

So I'm not sure whether it's really a Problem with the UsergroupsRequest, since the result of your approach of changing UserGroupsRequest\Configurable should be a working ShowUserGroups.php, isn't it?

The LDAPProvider.log also shows

ldap_bind( $linkID, $bindRDN = 'uid=t.test,ou=users,dc=example,dc=com', $bindPassword = 'XXXX' );

2020-12-15 10:12:17 xxxxx.xxxxx.xx wiki: # returns 1

which seems correct, doesn't it?

When logging in with correct credentials it says: "The user Thorsten Test does not have permission"

When logging in with false credentials it says: "Could not authenticate credentials against domain "LDAP""

What do you think? How could I proceed? Schlagmichdoch (talk) 10:40, 15 December 2020 (UTC)Reply

@Osnard Do you have an idea? Schlagmichdoch (talk) 15:32, 10 January 2021 (UTC)Reply

Well, the issue is not the "authentication" (binding with user DN and provided password apparently works), but with the "authorization". This means it can not get the list of groups for your user and therefor the "required groups rule" can not be fullfilled. But you say `ShowUserGroups` lists the proper group DN that you have configured as a requirement? If this is the case authorization should also work, as the very same mechanism for fetching the groups is used. Osnard (talk) 07:55, 11 January 2021 (UTC)Reply

Exactly. 'ShowUserGroups' lists all group DNs for the user including 'wiki' configured with

authorization' => [

'rules' => [

'groups' => [

'required' => [ "cn=wiki,ou=groups,dc=example,dc=com" ]

]

],

Still the login page throws "The user Thorsten Test does not have permission"

What can I do? Schlagmichdoch (talk) 19:33, 11 January 2021 (UTC)Reply

When you run ShowUserGroups do us use "Thorsten_Test" or "t.test" as username? In the login form which of those do you enter? Osnard (talk) 08:42, 13 January 2021 (UTC)Reply

"t.test" for both.

in the login form:

- When I use "Thorsten Test" it says "Could not authenticate credentials against domain "LDAP""

- When I use "t.test" with wrong password it says "Could not authenticate credentials against domain "LDAP""

- When I use "t.test" with correct password it says "The user Thorsten Test is not permitted" Schlagmichdoch (talk) 18:54, 19 January 2021 (UTC)Reply

This is an issue with how the LDAP-Stack extensions work with the username. After login LDAP's "t.test" will be transformed to "Thorsten Test" for the wiki. Authentication will then use "Torsten Test" for authentication, which clearly fails. Please file a feature request task on Phabricator. Osnard (talk) 07:44, 18 February 2021 (UTC)Reply