Extension talk:LDAPProvider/2020
Add topic| This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made. |
Group sync not working.
[edit]Hello,
I have set a fresh installation of mediawiki with ldap autentication. I have it working users can log in. Main problem is that groups are not been sync, If I uncomment the wfLoadExtension( 'LDAPGroups' ); or LDAPUserInfo one it shows an error:
[cff073f5068a68def791a7c3] 2020-01-08 07:43:39: Fatal exception of type MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException
I have test with ShowUserGroups.php and seems to be working:
php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain ldap-midominio.es --username rpv68m
Full DNs:
cn=G_usu_dominildap,ou=usuarios,o=ldap
cn=wikiCPD,ou=CPD,ou=usuarios,o=ldap
cn=G_usu_wikiCPD_admin,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap
Short names:
g_usu_ldapctg
wikicpd
g_usu_wikicpd_admin
What I'm doing wrong? Here is my LocalSettings:
wfLoadExtension( 'PluggableAuth' );
#$wgPluggableAuth_EnableAutoLogin="true";
$wgPluggableAuth_EnableLocalLogin="true";
$wgPluggableAuth_ButtonLabelMessage="Dominio Novell";
wfLoadExtension( 'LDAPProvider' );
#wfLoadExtension( 'Auth_remoteuser' );
wfLoadExtension( 'LDAPGroups' );
wfLoadExtension( 'LDAPUserInfo' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
$LDAPProviderDomainConfigProvider = function()
{
$config =
[
"ldap-midominio.es" =>
[
"connection" =>
[
"server" => "dominio-ldap.ldap-midominio.es",
"user" => "cn=wikicpd,ou=usuarios,ou=recursos,o=ldap",
"pass" => "lahfd.lsab34",
"basedn" => "ou=usuarios,o=ldap",
"groupbasedn" => "ou=usuarios,o=ldap",
"userbasedn" => "ou=usuarios,o=ldap",
"searchattribute" => "cn",
"searchstring" => "cn=USER-NAME,ou=CPD,ou=usuarios,o=ldap",
"usernameattribute" => "cn",
"realnameattribute" => "cn",
"emailattribute" => "mail",
"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory" ],
"authorization" =>
[
"rules" =>
[
"groups" =>
[
"required" => [ "cn=G_usu_wikiCPD_admin,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"cn=G_usu_wikiCPD_CPD,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"cn=G_usu_wikiCPD_programadores,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"cn=G_usu_wikiCPD_sistemas,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"cn=G_usu_wikiCPD_soporte,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"cn=G_usu_wikiCPD_usuarios,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap"
]
]
]
],
"groupsync" =>
[
"mechanism" => "mappedgroups",
"mapping" =>
[
"sysop" => "cn=G_usu_wikiCPD_admin,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"bureaucrat" => "cn=G_usu_wikiCPD_admin,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"CPD" => "cn=G_usu_wikiCPD_CPD,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"programadores" => "cn=G_usu_wikiCPD_programadores,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"sistemas" => "cn=G_usu_wikiCPD_sistemas,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"soporte" => "cn=G_usu_wikiCPD_soporte,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap",
"users" => "cn=G_usu_wikiCPD_usuarios,ou=adminsrv,ou=Grupos,ou=usuarios,o=ldap"
]
],
"userinfo" =>
[
"email" => "mail",
"realname" => "cn",
"properties.gender" => "gender"
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
}; Kronoct (talk) 07:52, 8 January 2020 (UTC)
- Does this only happen when "Auth_remoteuser" is enabled? If so, this is a known bug https://phabricator.wikimedia.org/T214147
- A workaround would be to patch the file
LDAPProvider/src/UserDomainStore.phplike this: /** * @param User $user to get domain for * @return string|null */ public function getDomainForUser( User $user ) { return "ldap-midominio.es"; $userId = $user->getId(); ...
- If this also happens without "Auth_remoteuser" the workaround may still work. You might also want set the value of
ldap_domains.domainin the database to "ldap-midominio.es" for all users. Osnard (talk) 07:32, 9 January 2020 (UTC) - Sorry for delay in answer I didnt notice there was a reply.
- Auth_remoteuser is disabled, If I enable that extensions it directly didnt works.
- I have follow instruction and change LDAPProvider/src/UserDomainStore.php adding line
- return "ldap-midominio.es";
- after
- public function getDomainForUser( User $user ) {
- Now it didn't give the previos error but now If I try to access to wiki with an LDAP user it shows HTTP ERROR 500 this web page didnt work and in the URL of the browser I can see: https://wiki.ldap-midominio.es/index.php/Especial:PluggableAuthLogin
- If I access with a Local user it works right. Kronoct (talk) 12:29, 10 January 2020 (UTC)
- If I disable both extensions (LDAPGroups and LDAPUserInfo) with the modification on UserDomainStore it shows the same error. Kronoct (talk) 12:32, 10 January 2020 (UTC)
- I have just disable the modification and I have the same error... maybe I have broke my system in another test. I will inform later. Kronoct (talk) 12:35, 10 January 2020 (UTC)
- I have a similar problem: The login works but no groups are automatically added to the user.
- On the other hand if I manually add the user to a group, for example 'bureaucrat', which is not part of the domain, I get the following:
[LDAPGroups] Removing 'bureaucrat' from 'myuser'.- Ideally, the behaviour would be the other way around: Adding the groups automatically but not removing them. 134.130.45.92 (talk) 11:14, 14 February 2020 (UTC)
- Addition (134.130.45.92 was me): the groups which are part of the domain do not get deleted. Tuebel (talk) 12:04, 14 February 2020 (UTC)
- If using "allgroups" mechanism, the groups must exists in the wiki. Have you set them in $wgGroupPermissions anywhere? Osnard (talk) 20:27, 14 February 2020 (UTC)
- If you don't want groups like "bureaucrat" to be removed, you need to put them on the list of "locally-managed" groups. See "Domain Config" documentation Osnard (talk) 20:28, 14 February 2020 (UTC)
- Thank you, the "locally-managed" groups work as expected now.
- I have tried both "allgroups" and "mappedgroups" and the group is part of a $wgGroupPermissions. Still, the group does not get synced when I login. Tuebel (talk) 08:57, 17 February 2020 (UTC)
- Can you please share the output of the CLI script "LDAPProvider/maintenance/ShowUserGroups.php" and your current configuration? Osnard (talk) 10:13, 17 February 2020 (UTC)
- The ouput of the script is:
Full DNs:Short names:- My LDAP configuration is:
{"my_domain": {"connection": {"server": "my_server.de","port": 389,"user": "cn=Wiki,ou=Bot,ou=Benutzer,ou=my_organization,dc=my_domain,dc=de","pass": "SECRET","enctype": "tls","options": {},"basedn": "ou=my_ou,dc=my_domain,dc=de","userbasedn": "ou=Benutzer,ou=my_organization,dc=my_domain,dc=de","groupbasedn": "ou=Gruppen,,ou=my_organization,dc=my_domain,dc=de","searchattribute": "samaccountname","usernameattribute": "samaccountname","realnameattribute": "displayname","emailattribute": "mail"},"userinfo": [],"authorization": [],"groupsync": {"mechanism": "mappedgroups","locally-managed": ["bot","user","sysop","bureaucrat","interface-admin"],"mapping": {"g-mitarbeiter": "CN=G-Mitarbeiter,OU=Gruppen,OU=my_organization,DC=my_domain,DC=de"}}}}- And here the section from LocalSettings.php:
# Permissions$wgGroupPermissions['*']['edit'] = false;$wgGroupPermissions['*']['autocreateaccount'] = true;$wgGroupPermissions['*']['createaccount'] = false;$wgGroupPermissions['user']['delete'] = true;# Interner Bereich$wgGroupPermissions['g-mitarbeiter']['read'] = true;define('NS_INTERN', 100);define('NS_INTERN_TALK', 101);$wgExtraNamespaces[NS_INTERN] = 'Intern';$wgExtraNamespaces[NS_INTERN_TALK] = 'Intern_Diskussion';$wgNamespacesToBeSearchedDefault[NS_INTERN] = true;$wgNamespacePermissionLockdown[NS_INTERN]['read'] = array('g-mitarbeiter');$wgNamespacePermissionLockdown[NS_INTERN_TALK]['read'] = array('g-mitarbeiter');$wgNonincludableNamespaces[] = NS_INTERN;$wgNonincludableNamespaces[] = NS_INTERN_TALK;# Advanced Editors for Design Issues$wgGroupPermissions['AdvancedEditors']['editinterface'] = true;# Load LDAP Config from JSON$ldapJsonFile = "/var/www/html/ldap.json";# Activate ExtensionwfLoadExtension('LDAPAuthentication2');wfLoadExtension('LDAPAuthorization');wfLoadExtension('LDAPProvider');wfLoadExtension('LDAPGroups');wfLoadExtension('LDAPUserInfo');wfLoadExtension('PluggableAuth');$LDAPProviderDomainConfigs = $ldapJsonFile;$wgPluggableAuth_ButtonLabel = "Log In";- So I am trying to sync the group
g-mitarbeiter.
Tuebel (talk) 14:00, 19 February 2020 (UTC)- Well, as
ShowUserGroups.phpdoes not return anything I believe your group-request is configured wrong. By defaultconnection.grouprequestis set toGroupUniqueMember. You might need to set it toGroupMemberor more likelyUserMemberOf. - Try setting
{"connection": {..."grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"...- Then run
ShowUserGroups.phpagain. Osnard (talk) 07:41, 20 February 2020 (UTC) - Great, now I see all the groups from the active directory! But they still do not get synced.
- I also tried
"mechanism": "MediaWiki\\Extension\\LDAPGroups\\SyncMechanism\\AllGroups::factory",- instead of
"mechanism": "allgroups",- The same for mappedgroups. Tuebel (talk) 15:00, 3 March 2020 (UTC)
- The groups to be synced must exist in the wiki. So if you have the AD group
CN=G-Mitarbeiter,OU=Gruppen,OU=my_organization,DC=my_domain,DC=de, you need to have a local wiki group called "G-Mitarbeiter". E.g. by adding something like$wgGroupPermissions['G-Mitarbeiter']['read'] = true;to yourLocalSettings.phpOsnard (talk) 06:56, 4 March 2020 (UTC) - This already the case .... Tuebel (talk) 10:51, 4 March 2020 (UTC)
- That's strange. Can you please share the output of "ShowUserGroups.php", the group related settings in your wiki and the domain config of the LDAP Stack? Osnard (talk) 13:16, 4 March 2020 (UTC)
- ShowUserGroups.php:
Full DNs:CN=G-LBR,OU=Labor,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-PLA-Chief,OU=Lehre,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-MDF-Chief,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-MRT-Chief,OU=Lehre,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-Med,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-Admin,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deCN=G-Service,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=deShort names:g-lbrg-pla-chiefg-mdf-chiefg-mrt-chiefg-medg-adming-service- LocalSettings.php (I tried g-mitarbeiter and g-med):
# Permissions$wgGroupPermissions['*']['edit'] = false;$wgGroupPermissions['*']['autocreateaccount'] = true;$wgGroupPermissions['*']['createaccount'] = false;$wgGroupPermissions['user']['delete'] = true;# Interner Bereich$wgGroupPermissions['g-mitarbeiter']['read'] = true;$wgGroupPermissions['g-med']['read'] = true;define('NS_INTERN', 100);define('NS_INTERN_TALK', 101);$wgExtraNamespaces[NS_INTERN] = 'Intern';$wgExtraNamespaces[NS_INTERN_TALK] = 'Intern_Diskussion';$wgNamespacesToBeSearchedDefault[NS_INTERN] = true;$wgNamespacePermissionLockdown[NS_INTERN]['read'] = array('g-mitarbeiter');$wgNamespacePermissionLockdown[NS_INTERN_TALK]['read'] = array('g-mitarbeiter');$wgNonincludableNamespaces[] = NS_INTERN;$wgNonincludableNamespaces[] = NS_INTERN_TALK;# Advanced Editors for Design Issues$wgGroupPermissions['AdvancedEditors']['editinterface'] = true;# Load LDAP Config from JSON$ldapJsonFile = "/var/www/html/ldap.json";# Activate ExtensionwfLoadExtension('LDAPAuthentication2');wfLoadExtension('LDAPAuthorization');wfLoadExtension('LDAPProvider');wfLoadExtension('LDAPGroups');wfLoadExtension('LDAPUserInfo');wfLoadExtension('PluggableAuth');$LDAPProviderDomainConfigs = $ldapJsonFile;$wgPluggableAuth_ButtonLabel = "Log In";- ldap.json:
{"IRT": {"connection": {"server": "mydc.de","port": 636,"user": "myuser","pass": "mypass","enctype": "ssl","options": {},"basedn": "ou=IRT,dc=win,dc=mydc,dc=de","userbasedn": "ou=Benutzer,ou=IRT,dc=win,dc=mydc,dc=de","groupbasedn": "ou=Gruppen,ou=IRT,dc=win,dc=mydc,dc=de","searchattribute": "samaccountname","usernameattribute": "samaccountname","realnameattribute": "displayname","emailattribute": "mail","grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"},"userinfo": [],"authorization": [],"groupsync": {"mechanism": "MediaWiki\\Extension\\LDAPGroups\\SyncMechanism\\MappedGroups::factory","locally-managed": ["bot","user","sysop","bureaucrat","interface-admin","widgeteditor"],"mapping": {"g-mitarbeiter": "CN=G-Mitarbeiter,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=de","g-med": "CN=G-Med,OU=Gruppen,OU=IRT,DC=win,DC=mydc,DC=de"}}}}Tuebel (talk) 07:52, 9 March 2020 (UTC)- So from what I can see, "g-med" should be synced, but "g-mitarbeiter" is not in the list the wiki gets from LDAP, so it won't be synced. Osnard (talk) 15:45, 9 March 2020 (UTC)
- That's what I thought, too. So, I am in the group g-med and all members of g-med are part of g-mitarbeiter. That is probably why g-mitarbeiter does not show up. With the old LDAP Authentication however, it worked just fine. Moreover, g-med is not synced either. Tuebel (talk) 15:11, 11 March 2020 (UTC)
- "connection.nestedgroups" is currently only possible with
"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"Osnard (talk) 15:06, 16 March 2020 (UTC) - I have let it sit for a while as it was not my top priority. Today I have checked again and it magically seems to work for Mediawiki 1.35.2 again.
- Thanks for your help! Tuebel (talk) 08:51, 12 October 2021 (UTC)
Call to undefined function ldap_connect()
[edit]/wiki/index.php/Special:PluggableAuthLogin Error from line 244 of /var/www/mediawiki-1.34.0/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Call to undefined function ldap_connect()
Backtrace:
#0 /var/www/mediawiki-1.34.0/extensions/LDAPProvider/src/PlatformFunctionWrapper.php(261): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->connect()
#1 /var/www/mediawiki-1.34.0/extensions/LDAPProvider/src/Client.php(88): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper::getConnection()
#2 /var/www/mediawiki-1.34.0/extensions/LDAPProvider/src/Client.php(76): MediaWiki\Extension\LDAPProvider\Client->makeNewConnection()
#3 /var/www/mediawiki-1.34.0/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()
#4 /var/www/mediawiki-1.34.0/extensions/LDAPAuthentication2/src/PluggableAuth.php(76): MediaWiki\Extension\LDAPProvider\Client->canBindAs()
#5 /var/www/mediawiki-1.34.0/extensions/PluggableAuth/includes/PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate()
#6 /var/www/mediawiki-1.34.0/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute()
#7 /var/www/mediawiki-1.34.0/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run()
#8 /var/www/mediawiki-1.34.0/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath()
#9 /var/www/mediawiki-1.34.0/includes/MediaWiki.php(900): MediaWiki->performRequest()
#10 /var/www/mediawiki-1.34.0/includes/MediaWiki.php(527): MediaWiki->main()
#11 /var/www/mediawiki-1.34.0/index.php(44): MediaWiki->run()
#12 {main}
Server is CentOS 7, php 7.4.2, http 2.4.6 Igor-the-insane (talk) 19:48, 6 February 2020 (UTC)
- Have you installed the PHP extension "php-ldap"? You should be able to install using "yum" or "zypper" Osnard (talk) 08:27, 7 February 2020 (UTC)
- Yes! Thanks!!! 2A0C:5C84:1:6004:0:0:0:911C (talk) 19:13, 30 August 2024 (UTC)
- Thx Osnar, this solved the Problem 193.73.106.104 (talk) 06:44, 17 July 2020 (UTC)
- HI I have installed "yum install php-ldap" but still facing same issue. Akki30 (talk) 12:16, 8 June 2021 (UTC)
- Please make sure the extension is enabled when PHP is invoked by the webserver. You can check this using `phpinfo();` in some file served by your webserver. Osnard (talk) 13:24, 8 June 2021 (UTC)
- Yes!! extension is enabled. 143.97.2.35 (talk) 14:56, 8 June 2021 (UTC)
- we're also having same issue with LDAPs connectivity, But, we do not have the package 'rh-php74-php-ldap.x86_64' available in our RHEL7.9 server. Pls suggest trusted source to download & install the same under RHEL7.9 SanjayKSahu (talk) 15:08, 8 June 2021 (UTC)
- Sorry, I am not an expert for RedHat/CentOS servers. Maybe people from the respective boards and mailing lists can provide better answers. All I can say is that
Call to undefined function ldap_connect()indicates that the PHP extension for LDAP is not properly loaded. Osnard (talk) 06:59, 9 June 2021 (UTC) - Hi, I am using LDAPProvider and I have set PARAMS in ldapprovider.json.
- I am facing an issue connecting my domain as I have added the correct domain.
- Error: extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'example.net'!
- I am Using v1.35.0 LDAPStack LocalSettings.php from URL:
- LDAP_hub/Migration_from_extension_LDAPAuthentication#Auth_remoteuser_(Kerberos_auth)_with_LDAPProvider_features
- Also, I want to know from which file domain name is picking up. I have changed the domain name from Localsetiings.php and ldapprovider.json but it's still showing the same.
- Please suggest.
- Thanks Akki30 (talk) 07:28, 11 June 2021 (UTC)
- If you are using Extension:Auth_remoteuser, the domain will be extcrated from whatwever is set in
$_SERVER['REMOTE_USER']. Make sure you have configured the proper$LDAPAuthorizationAutoAuthRemoteUserStringParser. Osnard (talk) 06:22, 14 June 2021 (UTC)
wgLDAPGroupUseFullDN replacement
[edit]I'm migrating from the old LdapAuthentication to the new stack and it didn't work. I need a replacement for $wgLDAPGroupUseFullDN = array( "LDAP"=>false)
I need to search members in groups like this: (&(objectclass={GROUPOBJECTCLASS})({GROUPATTRIBUTE}=$username))
Instead of this this plugin is doing this search: (&(objectclass={GROUPOBJECTCLASS})({GROUPATTRIBUTE}=$userDN))
I modified Configurable.php to archive this but it'd nice to have a ldap provider parameter to configure that.
Thx Dimassc (talk) 11:40, 18 February 2020 (UTC)
- If you share your "Configurable", I may be able to add a proper setting. Thanks! Osnard (talk) 06:52, 19 February 2020 (UTC)
- I did an ugly fix, adding this line just after $userDN is set in getUserGroup ($username ):
public function getUserGroups( $username ) {$userDN = new EscapedString( $this->ldapClient->getUserDN( $username ) );$userDN = $username;...- I think we need to add a $wgLDAPGroupUseFullDN substitute in the $LDAPProviderDomainConfigProvider config:
$LDAPProviderDomainConfigProvider = function() {$config = ['LDAP' => ['connection' => ["groupusefulldn" => false,...- And then use it at Configurable.php. Dimassc (talk) 11:17, 19 February 2020 (UTC)
- Thank you. I have created a task: https://phabricator.wikimedia.org/T245718 Osnard (talk) 07:33, 20 February 2020 (UTC)
Could not authenticate credentials against domain "DOMAIN"
[edit]Hello,
i'm using Mediawiki 1.31.1 and PHP 7.3.12 (cgi-fcgi) and i try to LDAP-connect with an external Active Directory. If i try to login i get "Could not authenticate credentials against domain "DOMAIN"" Username and Passwort are correct. If i run
$ php ShowUserInfo.php --domain "DOMAIN" --userName "username"
i get:
[8881f2c014a416438526f25b] [no req] MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/vhosts/.../wiki/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain ''!
My localsettings.php:
$LDAPProviderDomainConfigProvider = function() {
$config = [
'DOMAIN' => [
'connection' => [
"server" => "serveradress",
"enctype" => "ssl",
"user" => "cn=username,ou=bla,dc=DOMAIN,dc=bla",
"pass" => "bla",
"port" => "636",
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "dc=DOMAIN,dc=lokal",
"groupbasedn" => "ou=bla,dc=DOMAIN,dc=bla",
"userbasedn" => "dc=DOMAIN,dc=bla",
"searchattribute" => "sAMAccountName",
"searchstring" => "sAMAccountName=username,ou=bla,dc=DOMAIN,dc=bla",
"usernameattribute" => "sAMAccountName",
"realnameattribute" => "cn",
"emailattribute" => "mail"
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};
$wgPluggableAuth_EnableAutoLogin = false;
$wgPluggableAuth_EnableLocalLogin = true;
$wgPluggableAuth_EnableLocalProperties = false;
$wgPluggableAuth_ButtonLabel = "Log in";
$wgShowExceptionDetails = true;
$wgDebugLogGroups['PluggableAuth'] =
$wgDebugLogGroups['LDAP'] =
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =
$wgDebugLogGroups['LDAPGroups'] =
$wgDebugLogGroups['LDAPUserInfo'] =
$wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log'; MariusAPP (talk) 07:52, 26 February 2020 (UTC)
- Could you please set
$GLOBALS['LDAPProviderDefaultDomain'] = 'DOMAIN';- and retry? And maybe truncate `ldap_domains` database table. Osnard (talk) 15:10, 27 February 2020 (UTC)
- Hello Osnard,
- No progress so far..
- I inserted $GLOBALS['LDAPProviderDefaultDomain'] = 'DOMAIN'; into localsetings.php right above $LDAPProviderDomainConfigProvider.
- The ldap_domain table only contains one entry. I exported the table:
- -- phpMyAdmin SQL Dump
- -- version 4.9.0.1
- -- https://www.phpmyadmin.net/
- --
- -- Host: localhost:3306
- -- Erstellungszeit: 04. Mrz 2020 um 11:39
- -- Server-Version: 10.1.44-MariaDB-0ubuntu0.18.04.1
- -- PHP-Version: 7.3.13
- SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO";
- SET AUTOCOMMIT = 0;
- START TRANSACTION;
- SET time_zone = "+00:00";
- /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
- /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
- /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
- /*!40101 SET NAMES utf8mb4 */;
- --
- -- Datenbank: `l_wiki`
- --
- -- --------------------------------------------------------
- --
- -- Tabellenstruktur für Tabelle `ldap_domains`
- --
- CREATE TABLE `ldap_domains` (
- `domain_id` int(11) NOT NULL,
- `domain` varbinary(255) NOT NULL,
- `user_id` int(11) NOT NULL
- ) ENGINE=InnoDB DEFAULT CHARSET=binary;
- --
- -- Daten für Tabelle `ldap_domains`
- --
- INSERT INTO `ldap_domains` (`domain_id`, `domain`, `user_id`) VALUES
- (1, 0x6c6f63616c, 1);
- --
- -- Indizes der exportierten Tabellen
- --
- --
- -- Indizes für die Tabelle `ldap_domains`
- --
- ALTER TABLE `ldap_domains`
- ADD PRIMARY KEY (`domain_id`),
- ADD KEY `user_id` (`user_id`);
- --
- -- AUTO_INCREMENT für exportierte Tabellen
- --
- --
- -- AUTO_INCREMENT für Tabelle `ldap_domains`
- --
- ALTER TABLE `ldap_domains`
- MODIFY `domain_id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=2;
- COMMIT;
- /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
- /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
- /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; MariusAPP (talk) 11:00, 4 March 2020 (UTC)
- Can you please enable and share the debug logs? Osnard (talk) 13:19, 4 March 2020 (UTC)
- Here comes the content of the debug logs:
- • Start request GET /index.php?title=Spezial:Anmelden&returnto=Hauptseite
- HTTP HEADERS:
- UPGRADE-INSECURE-REQUESTS: 1
- COOKIE: plesk-items-per-page=eNqrVjJItkixNDVOVrIyMtVRskxOMjM0MoDyko2Nk5LNjNJAvFoA64QKuQ%3D%3D; plesk-sort-field=eNqrVjJItkixNDVOVrJSykvMTVXSUbJMTjIzNDIAiZSkVpQo1QIAv7AKbA%3D%3D; plesk-sort-dir=eNqrVjJItkixNDVOVrJSKi1Q0lGyTE4yMzQygPJrAZRBCNA%3D; _ga=GA1.2.1987481010.1566202827; lehrer_wikiCalumma_desktop-view=true; sites-active-list-state-collapsed=%7B%7D; databases-active-list-state-collapsed=%7B%7D; uat-iid=3EC2.BE4A.C598.4D02.ACB7.52C5.956D.D28F; lehrer_wiki_session=9n9uh3772dcm6k3lj8ajdgpputus7n42; phpMyAdmin=681d7d9518d424a6a4c46d79015d9280; PLESKSESSID=a40646050c6a7a755d1108fc017513d2; uat-sid=A406; UseDC=master; UseCDNCache=false
- CONNECTION: close
- REFERER: https://lehrer-wiki.kgs-sehnde.de/index.php?title=Spezial:Anmelden&returnto=Hauptseite ACCEPT-ENCODING: gzip, deflate, br
- ACCEPT-LANGUAGE: de,en-US;q=0.7,en;q=0.3
- ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
- USER-AGENT: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:73.0) Gecko/20100101 Firefox/73.0
- HOST: lehrer-wiki.kgs-sehnde.de
- • [caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
- • [caches] LocalisationCache: using store LCStoreCDB
- • [session] Session "9n9uh3772dcm6k3lj8ajdgpputus7n42" requested without UserID cookie
- • [DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
- • [DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
- • [DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
- "IPAddress": "77.8.104.203",
- "UserAgent": "Mozilla\/5.0 (Macintosh; Intel Mac OS X 10.15; rv:73.0) Gecko\/20100101 Firefox\/73.0",
- "ChronologyProtection": false,
- "ChronologyPositionIndex": 0
- }
- • [DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost:3306'.
- • [SQLBagOStuff] Connection 111654 will be used for SqlBagOStuff
- • [DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost:3306'.
- • [BsMemcached] BsConfig: Fetching settings from DB
- • User::getBlockedStatus: checking...
- • [CryptRand] 0 bytes of randomness leftover in the buffer.
- • [session] SessionBackend "9n9uh3772dcm6k3lj8ajdgpputus7n42" data dirty due to dirty(): AuthManagerSpecialPage->handleReturnBeforeExecute/MediaWiki\Auth\AuthManager->removeAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
- • [session] SessionBackend "9n9uh3772dcm6k3lj8ajdgpputus7n42" save: dataDirty=1 metaDirty=0 forcePersist=0
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 1):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 1)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.056, true, 2)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 1583747884)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/CachedBagOStuff.php(65): SqlBagOStuff->set('lehrer_wiki:MWS...', Array, 1583747884, 1)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(732): CachedBagOStuff->set('lehrer_wiki:MWS...', Array, 1583747884, 1)
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(607): MediaWiki\Session\SessionBackend->save()
- 10 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(581): MediaWiki\Session\SessionBackend->autosave()
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(293): MediaWiki\Session\SessionBackend->renew()
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/session/Session.php(127): MediaWiki\Session\SessionBackend->persist()
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(231): MediaWiki\Session\Session->persist()
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(861): MediaWiki->performRequest()
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 19 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 20 {main}
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 2):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 2)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.1022, true, 1)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 30)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(545): SqlBagOStuff->set('lehrer_wiki:mes...', 1, 30)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(418): BagOStuff->add('lehrer_wiki:mes...', 1, 30)
- 9 [internal function]: BagOStuff->{closure}()
- 10 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/wait-condition-loop/src/WaitConditionLoop.php(92): call_user_func(Object(Closure))
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(429): Wikimedia\WaitConditionLoop->invoke()
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(472): BagOStuff->lock('lehrer_wiki:mes...', 0, 30, 'MessageCache::g...')
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(742): BagOStuff->getScopedLock('lehrer_wiki:mes...', 0, 30, 'MessageCache::g...')
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(412): MessageCache->getReentrantScopedLock('lehrer_wiki:mes...', 0)
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): MessageCache->loadFromDBWithLock('de', Array, NULL)
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('de')
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(899): MessageCache->getMsgFromNamespace('Loginreqlink', 'de')
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'loginreqlink', true, Array)
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'loginreqlink', true)
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('loginreqlink', true, Object(Language))
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(842): Message->fetchMessage()
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(934): Message->toString('text')
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(156): Message->text()
- 24 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(233): LoginSignupSpecialPage->load(NULL)
- 25 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
- 26 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- 27 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
- 28 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(861): MediaWiki->performRequest()
- 29 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 30 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 31 {main}
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 3):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 3)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.1029, true, 2)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 0)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(670): SqlBagOStuff->set('lehrer_wiki:mes...', Array)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(420): MessageCache->saveToCaches(Array, 'all', 'de')
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): MessageCache->loadFromDBWithLock('de', Array, NULL)
- 10 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('de')
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(899): MessageCache->getMsgFromNamespace('Loginreqlink', 'de')
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'loginreqlink', true, Array)
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'loginreqlink', true)
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('loginreqlink', true, Object(Language))
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(842): Message->fetchMessage()
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(934): Message->toString('text')
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(156): Message->text()
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(233): LoginSignupSpecialPage->load(NULL)
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(861): MediaWiki->performRequest()
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 24 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 25 {main}
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 4):
- query-m: DELETE FROM `objectcache` WHERE keyname = 'X'
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: DELETE...', 4)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: DELETE...', 1583744284.1033, true, 1)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('DELETE FROM `ob...', 'DELETE /* SqlBa...', true, 'SqlBagOStuff::d...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2845): Wikimedia\Rdbms\Database->query('DELETE FROM `ob...', 'SqlBagOStuff::d...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(433): Wikimedia\Rdbms\Database->delete('`objectcache`', 'keyname = 'lehr...', 'SqlBagOStuff::d...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(447): SqlBagOStuff->delete('lehrer_wiki:mes...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(485): BagOStuff->unlock('lehrer_wiki:mes...')
- 7 [internal function]: BagOStuff->{closure}()
- 8 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/scoped-callback/src/ScopedCallback.php(76): call_user_func_array(Object(Closure), Array)
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): Wikimedia\ScopedCallback->__destruct()
- 10 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('de')
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(899): MessageCache->getMsgFromNamespace('Loginreqlink', 'de')
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'loginreqlink', true, Array)
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'loginreqlink', true)
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('loginreqlink', true, Object(Language))
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(842): Message->fetchMessage()
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(934): Message->toString('text')
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(156): Message->text()
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(233): LoginSignupSpecialPage->load(NULL)
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(861): MediaWiki->performRequest()
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 24 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 25 {main}
- • [MessageCache] MessageCache::load: Loading de... local cache is empty, global cache is expired/volatile, loading from database
- • Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform
- • Parser: using preprocessor: Preprocessor_DOM
- • Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct
- • QuickTemplate::__construct was called with no Config instance passed to it
- • [CryptRand] 0 bytes of randomness leftover in the buffer.
- • [CryptRand] 0 bytes of randomness leftover in the buffer.
- • [session] SessionBackend "9n9uh3772dcm6k3lj8ajdgpputus7n42" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->continuePrimaryAuthentication/MediaWiki\Auth\AuthManager->removeAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
- • [authentication] Login failed in primary authentication by PluggableAuthPrimaryAuthenticationProvider
- • [session] SessionBackend "9n9uh3772dcm6k3lj8ajdgpputus7n42" data dirty due to dirty(): AuthManagerSpecialPage->handleFormSubmit/AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->continueAuthentication/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty
- • [session] SessionBackend "9n9uh3772dcm6k3lj8ajdgpputus7n42" save: dataDirty=1 metaDirty=0 forcePersist=0
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 5):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 5)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.3206, true, 2)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 1583747884)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/CachedBagOStuff.php(65): SqlBagOStuff->set('lehrer_wiki:MWS...', Array, 1583747884, 1)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(732): CachedBagOStuff->set('lehrer_wiki:MWS...', Array, 1583747884, 1)
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionBackend.php(596): MediaWiki\Session\SessionBackend->save()
- 10 [internal function]: MediaWiki\Session\SessionBackend->MediaWiki\Session\{closure}()
- 11 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/scoped-callback/src/ScopedCallback.php(76): call_user_func_array(Object(Closure), Array)
- 12 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/scoped-callback/src/ScopedCallback.php(56): Wikimedia\ScopedCallback->__destruct()
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionManager.php(886): Wikimedia\ScopedCallback::consume(NULL)
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/session/SessionManager.php(214): MediaWiki\Session\SessionManager->getSessionFromInfo(Object(MediaWiki\Session\SessionInfo), Object(WebRequest))
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/WebRequest.php(730): MediaWiki\Session\SessionManager->getSessionById('9n9uh3772dcm6k3...', true, Object(WebRequest))
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/DerivativeRequest.php(61): WebRequest->getSession()
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/specials/SpecialUserLogin.php(140): DerivativeRequest->getSession()
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/AuthManagerSpecialPage.php(501): SpecialUserLogin->getToken()
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(196): AuthManagerSpecialPage->getPreservedParams(true)
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/LoginSignupSpecialPage.php(327): LoginSignupSpecialPage->getPreservedParams(true)
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPage.php(522): LoginSignupSpecialPage->execute(NULL)
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))
- 24 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(861): MediaWiki->performRequest()
- 25 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 26 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 27 {main}
- • [authevents] Login attempt
- • QuickTemplate::__construct was called with no Config instance passed to it
- • [CryptRand] 0 bytes of randomness leftover in the buffer.
- • MediaWiki::preOutputCommit: primary transaction round committed
- • MediaWiki::preOutputCommit: pre-send deferred updates completed
- • MediaWiki::preOutputCommit: LBFactory shutdown completed
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 6):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 6)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.3559, true, 1)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 30)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(545): SqlBagOStuff->set('lehrer_wiki:mes...', 1, 30)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(418): BagOStuff->add('lehrer_wiki:mes...', 1, 30)
- 9 [internal function]: BagOStuff->{closure}()
- 10 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/wait-condition-loop/src/WaitConditionLoop.php(92): call_user_func(Object(Closure))
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(429): Wikimedia\WaitConditionLoop->invoke()
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(472): BagOStuff->lock('lehrer_wiki:mes...', 0, 30, 'MessageCache::g...')
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(742): BagOStuff->getScopedLock('lehrer_wiki:mes...', 0, 30, 'MessageCache::g...')
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(412): MessageCache->getReentrantScopedLock('lehrer_wiki:mes...', 0)
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): MessageCache->loadFromDBWithLock('en', Array, NULL)
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('en')
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(928): MessageCache->getMsgFromNamespace('Startseite/en', 'en')
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'startseite', true, Array)
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'startseite', true)
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('Startseite', true, Object(Language))
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(982): Message->fetchMessage()
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1357): Message->exists()
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1305): Skin->addToSidebarPlain(Array, '*SEARCH\n*naviga...')
- 24 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1261): Skin->addToSidebar(Array, 'sidebar')
- 25 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1287): Skin->{closure}()
- 26 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(481): Skin->buildSidebar()
- 27 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(249): SkinTemplate->prepareQuickTemplate()
- 28 /var/www/vhosts/-----my_wiki_url-----/includes/OutputPage.php(2388): SkinTemplate->outputPage()
- 29 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(868): OutputPage->output(true)
- 30 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(880): MediaWiki->{closure}()
- 31 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 32 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 33 {main}
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 7):
- query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 7)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1583744284.3565, true, 2)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 0)
- 7 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(670): SqlBagOStuff->set('lehrer_wiki:mes...', Array)
- 8 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(420): MessageCache->saveToCaches(Array, 'all', 'en')
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): MessageCache->loadFromDBWithLock('en', Array, NULL)
- 10 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('en')
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(928): MessageCache->getMsgFromNamespace('Startseite/en', 'en')
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'startseite', true, Array)
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'startseite', true)
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('Startseite', true, Object(Language))
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(982): Message->fetchMessage()
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1357): Message->exists()
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1305): Skin->addToSidebarPlain(Array, '*SEARCH\n*naviga...')
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1261): Skin->addToSidebar(Array, 'sidebar')
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1287): Skin->{closure}()
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(481): Skin->buildSidebar()
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(249): SkinTemplate->prepareQuickTemplate()
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/OutputPage.php(2388): SkinTemplate->outputPage()
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(868): OutputPage->output(true)
- 24 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(880): MediaWiki->{closure}()
- 25 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 26 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 27 {main}
- • [DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 8):
- query-m: DELETE FROM `objectcache` WHERE keyname = 'X'
- 0 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: DELETE...', 8)
- 1 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: DELETE...', 1583744284.3568, true, 1)
- 2 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('DELETE FROM `ob...', 'DELETE /* SqlBa...', true, 'SqlBagOStuff::d...')
- 3 /var/www/vhosts/-----my_wiki_url-----/includes/libs/rdbms/database/Database.php(2845): Wikimedia\Rdbms\Database->query('DELETE FROM `ob...', 'SqlBagOStuff::d...')
- 4 /var/www/vhosts/-----my_wiki_url-----/includes/objectcache/SqlBagOStuff.php(433): Wikimedia\Rdbms\Database->delete('`objectcache`', 'keyname = 'lehr...', 'SqlBagOStuff::d...')
- 5 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(447): SqlBagOStuff->delete('lehrer_wiki:mes...')
- 6 /var/www/vhosts/-----my_wiki_url-----/includes/libs/objectcache/BagOStuff.php(485): BagOStuff->unlock('lehrer_wiki:mes...')
- 7 [internal function]: BagOStuff->{closure}()
- 8 /var/www/vhosts/-----my_wiki_url-----/vendor/wikimedia/scoped-callback/src/ScopedCallback.php(76): call_user_func_array(Object(Closure), Array)
- 9 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(342): Wikimedia\ScopedCallback->__destruct()
- 10 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(971): MessageCache->load('en')
- 11 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(928): MessageCache->getMsgFromNamespace('Startseite/en', 'en')
- 12 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(868): MessageCache->getMessageForLang(Object(Language), 'startseite', true, Array)
- 13 /var/www/vhosts/-----my_wiki_url-----/includes/cache/MessageCache.php(808): MessageCache->getMessageFromFallbackChain(Object(Language), 'startseite', true)
- 14 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(1290): MessageCache->get('Startseite', true, Object(Language))
- 15 /var/www/vhosts/-----my_wiki_url-----/includes/Message.php(982): Message->fetchMessage()
- 16 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1357): Message->exists()
- 17 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1305): Skin->addToSidebarPlain(Array, '*SEARCH\n*naviga...')
- 18 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1261): Skin->addToSidebar(Array, 'sidebar')
- 19 /var/www/vhosts/-----my_wiki_url-----/includes/skins/Skin.php(1287): Skin->{closure}()
- 20 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(481): Skin->buildSidebar()
- 21 /var/www/vhosts/-----my_wiki_url-----/includes/skins/SkinTemplate.php(249): SkinTemplate->prepareQuickTemplate()
- 22 /var/www/vhosts/-----my_wiki_url-----/includes/OutputPage.php(2388): SkinTemplate->outputPage()
- 23 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(868): OutputPage->output(true)
- 24 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(880): MediaWiki->{closure}()
- 25 /var/www/vhosts/-----my_wiki_url-----/includes/MediaWiki.php(524): MediaWiki->main()
- 26 /var/www/vhosts/-----my_wiki_url-----/index.php(42): MediaWiki->run()
- 27 {main}
- • [MessageCache] MessageCache::load: Loading en... local cache is empty, global cache is expired/volatile, loading from database
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Html::openElement/Html::dropDefaults/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Sanitizer::encodeAttribute/htmlspecialchars/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Html::openElement/Html::dropDefaults/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Sanitizer::encodeAttribute/htmlspecialchars/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Html::openElement/Html::dropDefaults/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Sanitizer::encodeAttribute/htmlspecialchars/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • SpecialPage::getContext called and $mContext is null. Return RequestContext::getMain(); for sanity
- • [GlobalTitleFail] MessageCache::parse called by Html::openElement/Html::dropDefaults/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by Sanitizer::encodeAttribute/htmlspecialchars/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by TemplateParser->processTemplate/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [GlobalTitleFail] MessageCache::parse called by LCRun3::sec/TemplateParser->{closure}/Message->__toString/Message->toString/Message->parseText/MessageCache->parse with no title set.
- • [gitinfo] Computed cacheFile=/var/www/vhosts/-----my_wiki_url-----/gitinfo.json for /var/www/vhosts/-----my_wiki_url-----
- • [gitinfo] Cache incomplete for /var/www/vhosts/-----my_wiki_url----- MariusAPP (talk) 09:06, 9 March 2020 (UTC)
- This looks like the standard MediaWiki debug log. I'd need the ones especially for LDAP Stack? Osnard (talk) 15:42, 9 March 2020 (UTC)
- I got this:
- $wgShowExceptionDetails = true;
- $wgDebugLogGroups['PluggableAuth'] =
- $wgDebugLogGroups['LDAP'] =
- $wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =
- $wgDebugLogGroups['LDAPGroups'] =
- $wgDebugLogGroups['LDAPUserInfo'] =
- $wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log';
- $wgShowSQLErrors = true;
- $wgShowDBErrorBacktrace = true;
- $wgDebugToolbar = true;
- at the end, and this:
- <?php
- error_reporting( -1 );
- ini_set( 'display_errors', 1 );
- at the start of my localsettings.php
- I can't find an "/tmp/LDAP.log"-File anywhere.. Where do I find the Error-Logs for the LDAP-Stack? If I try to Login the only Error displayed is: Could not authenticate credentials against domain "DOMAIN"
MariusAPP (talk) 11:10, 11 March 2020 (UTC)- Ups, got it:
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_connect( $hostname = 'ldaps://___wiki___url:636', $port = 389 );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # __METHOD__ returns Resource id #437
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # returns 1
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: Setting LDAP_OPT_REFERRALS to 0
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # returns 1
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: Setting LDAP_OPT_DEREF to 1
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # returns 1
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_bind( $linkID, $bindRDN = 'CN=USER,OU=BLA,DC=BLA,DC=BLA', $bindPassword = 'XXXX' );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # returns 1
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: ldap_bind( $linkID, $bindRDN = 'sAMAccountName=USER,ou=BLA,dc=BLA,dc=BLA', $bindPassword = 'XXXX' );
- 2020-03-11 11:17:56 h2752863.___wiki-server___.net ___wiki___: # returns MariusAPP (talk) 11:21, 11 March 2020 (UTC)
- This looks truncated. Can you please run
php LDAPProvider/maintenance/ShowUserInfo.php --domain="DOMAIN" --username="username"(with equal-signes and casing!) and post what is returned and logged to the '/tmp/LDAP.log'? Osnard (talk) 15:11, 16 March 2020 (UTC)
Group-Restriction by AD Authentification
[edit]Hello everybody!
I have the following Problem. I've added the LDAPProvider-Plugin.
The Authentification with the LDAP (AD) works fine.
Now, every User in my AD are able to login in the wiki.
Can someone tell me how to restrict the login so that only one group can login to the wiki?
Here my config:
$LDAPProviderDomainConfigProvider = function()
{
$config =
[
"domain" =>
[
"connection" =>
[
"server" => "domain.te",
"user" => "CN=User1,OU=Users,OU=Sd,DC=domain,DC=te",
"pass" => "passwd",
"basedn" => "dc=domain,dc=te",
"groupbasedn" => "dc=domain,dc=te",
"userbasedn" => "dc=domain,dc=te",
"searchattribute" => "samaccountname",
"searchstring" => "USER-NAME@domain.te",
"usernameattribute" => "samaccountname",
"realnameattribute" => "cn",
"emailattribute" => "mail",
"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
],
"authorization" =>
[
"rules" =>
[
"groups" =>
[
"required" => [ "CN=wikiAccess_group,OU=OrgUni,OU=Grps,DC=domain,DC=te" ]
]
]
],
"groupsync" =>
[
"mechanism" => "mappedgroups",
"mapping" =>
[
"admin" => "CN=wikiAccess_admin_group,OU=OrgUni,OU=Grps,DC=domain,DC=te"
]
],
"userinfo" =>
[
"email" => "mail",
"realname" => "cn",
"properties.gender" => "gender"
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
}; KampuliSa (talk) 07:58, 28 February 2020 (UTC)
- You have set up the group restricton in "authorization.rules.groups.required" properly. Do you have Extension:LDAPAuthorization extension installed an enabled? Osnard (talk) 10:50, 28 February 2020 (UTC)
Could not authenticate credentials against domain ...
[edit]Hello,
I have a working LDAP configuration for active directory with LDAP simple bind (Config 1).
Now I am forced to use LDAP over SSL because Microsoft will not support LDAP simple bind any longer.
I tried to configure LDAP over SSL (Config 2) but I get the error message "Could not authenticate credentials against domain "companyname".
The certificate should be correct and I can communicate with the AD server because LDAP simple bind is still working.
I think some of my parameters are wrong or missing and would be grateful for any hints.
#Config 1
#Working simple bind configuration
wfLoadExtension( 'LdapAuth' );
$wgLdapAuthUseLocal = true;
$wgLdapAuthDomainNames = ['companyname'];
$wgLdapAuthUsernameField = [ 'companyname' => 'sAMAccountName' ];
$wgLdapAuthIsActiveDirectory = [ 'companyname' => true ];
$wgLdapAuthServers = [ 'companyname' => ['dc01.companyname.xx', 'dc02.companyname.xx']];
$wgLdapAuthBindDN = [ 'companyname' => 'bind user name' ] ;
$wgLdapAuthBindPass = [ 'companyname' => 'bind user password' ];
$wgLdapAuthEncryptionType = [ 'companyname' => 'none' ];
$wgLdapAuthEncryptionType = [ 'companyname' => 'ssl' ];
$wgShowExceptionDecompanynameils = true;
$wgLdapAuthSearchTree = [ 'companyname' => true ];
$wgLdapAuthMapGroups = ['companyname' => []];
$wgLdapAuthBaseDN = [ 'companyname' => 'OU=UserscompanynameXX,DC=companyname,DC=xx'];
$wgLdapAuthSearchFilter = [ 'companyname' => '(&(objectClass=user)(sAMAccountName=%1$s)(memberOf:1.2.840.113556.1.4.1941:=cn=companyname_WIKI-access,ou=WIKI,ou=2222_Excompanynamedm,dc=companyname,dc=xx))'];
#Config 2
#Not working LDAP over SSL configuration
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPGroups' );
wfLoadExtension( 'LDAPUserInfo' );
$LDAPProviderDomainConfigProvider = function() {
$config = [
'companyname' => [
"connection" => [
"server" => "ldap.companyname.xx",
"port" => "636",
"enctype" => "ssl",
"user" => "bind user name",
"pass" => "bind user password",
"basedn" => "OU=UserscompanynameXX,DC=companyname,DC=xx",
"groupbasedn" => "ou=WIKI,dc=companyname,dc=xx",
"userbasedn" => "dc=companyname,dc=xx",
"searchattribute" => "uid",
"usernameattribute" => "sAMAccountName",
"realnameattribute" => "cn",
"emailattribute" => "mail"
],
"groupsync" => [
"cn=companyname_WIKI-access,ou=WIKI,ou=2222_ExtAdm,dc=companyname,dc=xx"
],
"userinfo" => [
],
"authorization" => [
"rules" => [
"groups" => [
"required" => [ "companyname_WIKI-access" ]
]
]
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
}; Managedata (talk) 12:14, 9 March 2020 (UTC)
- Can you please enable and share the debug logs? Osnard (talk) 15:40, 9 March 2020 (UTC)
- Btw: Which server operating system are you running on? Osnard (talk) 07:51, 10 March 2020 (UTC)
- LDAPprovider/Client log:
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Setting LDAP_OPT_REFERRALS to 0
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (
- 'base' => 'OU=UserscompanynameAG,DC=companyname,DC=xx',
- 'filter' => '(uid=myusername)',
- 'attributes' =>
- array (
- 0 => '*',
- 1 => 'memberof',
- ),
- )
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Could not get user DN!
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: '' Managedata (talk) 08:38, 10 March 2020 (UTC)
- $wgDebugLogGroups['PluggableAuth']
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: In execute()
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Getting PluggableAuth singleton
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: Authentication failure.
- 2020-03-10 08:28:50 wiki01.companyname.xx productionprintingwikidb: ERROR: Could not authenticate credentials against domain "companyname" Managedata (talk) 08:40, 10 March 2020 (UTC)
- The server operation system is Centos 7.7 (centos-release-7-7.1908.0.el7.centos.x86_64). The log says user DN is the problem but I have no idea what I have to change. Managedata (talk) 08:43, 10 March 2020 (UTC)
- I have chanded basedn, groupbasedn and userbasedn. Now php ShowUserInfo and CheckLogin work. I think I have a problem with any of the group parameters or a group parameter is missing in my LocalSettings.php because ShowUserGroups returns only "Full DNs: Short names:".
- My current Localsettings.php
- $LDAPProviderDomainConfigProvider = function() {
- $config = [
- "companyname" => [
- "connection" => [
- "server" => "ldap.companyname.xx",
- "port" => "636",
- "enctype" => "ssl",
- "user" => "LDAPuser",
- "pass" => "LDAPuser password",
- "basedn" => "dc=companyname,dc=xx",
- "groupbasedn" => "dc=companyname,dc=xx",
- "userbasedn" => "dc=companyname,dc=xx",
- "searchstring" => "companyname\\USER-NAME",
- "searchattribute" => "samaccountname",
- "usernameattribute" => "samaccountname",
- "realnameattribute" => "cn",
- "emailattribute" => "mail"
- ],
- "groupsync" => [
- "CN=companyname_WIKI-access,OU=WIKI,OU=WIKI-Admins,DC=companyname,DC=xx"
- ],
- "userinfo" => [
- ],
- "authorization" => [
- "rules" => [
- "groups" => [
- "required" => [ "CN=companyname_WIKI-access,OU=WIKI,OU=2222_Excompanynamedm,DC=companyname,DC=xx" ]
- ]
- ]
- ]
- ]
- ];
- return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
- };
Managedata (talk) 12:27, 10 March 2020 (UTC)- Good to hear there is progress. I guess the main difference was switching from
connection.searchattribute = uidtoconnection.searchattribute = samaccountname. - But regarding your current issue: Try to set
connection.grouprequestto one of these valuesMediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factoryMediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factoryMediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserGidNumber::factory
- Check
ShowUserGroups.phpfor each setting Osnard (talk) 08:56, 11 March 2020 (UTC) - It works now! After inserting "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
- the LDAP authentication works. Thank you for your help. Managedata (talk) 13:04, 11 March 2020 (UTC)
Could not bind to LDAP: (-1) Can't contact LDAP server when trying to switch to LDAPS
[edit]When I am trying to switch to LDAPS using
"port" : "637",
"enctype": "ssl",
I am getting:
2a36f59f1dd724005c227a9f] /w/index.php?title=Special:PluggableAuthLogin MWException from line 169 of /data/www/bluespice/w/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server
Backtrace:
#0 /data/www/bluespice/w/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /data/www/bluespice/w/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /data/www/bluespice/w/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /data/www/bluespice/w/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#4 /data/www/bluespice/w/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)
#5 /data/www/bluespice/w/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
#6 /data/www/bluespice/w/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)
#7 /data/www/bluespice/w/includes/MediaWiki.php(861): MediaWiki->performRequest()
#8 /data/www/bluespice/w/includes/MediaWiki.php(524): MediaWiki->main()
#9 /data/www/bluespice/w/index.php(42): MediaWiki->run()
#10 {main}
from Debuglog:
[LDAP] ldap_connect( $hostname = 'ldaps://XXXX.net:636', $port = 389 );
[LDAP] # __METHOD__ returns Resource id #105
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_PROTOCOL_VERSION to 3
[LDAP] ldap_set_option( $linkID, $option = 17, $newval = 3 );
[LDAP] # returns 1
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_REFERRALS to 0
[LDAP] ldap_set_option( $linkID, $option = 8, $newval = 0 );
[LDAP] # returns 1
[error] [a81ad9ed23d3b327b63bccdb] /w/index.php?title=Special:PluggableAuthLogin ErrorException from line 122 of /data/www/bluespice/w/extensions/LDAPProvider/src/Client.php: PHP Notice: Array to string conversion
.
.
.
[LDAP] ldap_set_option( $linkID, $option = , $newval = Array );
[LDAP] # returns
[MediaWiki\Extension\LDAPProvider\Client] Cannot set option to LDAP connection!
[LDAP] ldap_bind( $linkID, $bindRDN = 'XXXX', $bindPassword = 'XXXX' );
[LDAP] # returns
[LDAP] ldap_error( $linkID );
[LDAP] # returns Can't contact LDAP server
[LDAP] ldap_errno( $linkID );
[LDAP] # returns -1
I have tested that the port is open and other software works with LDAPS.
Any Ideas? D3s3ertf0x (talk) 07:48, 7 April 2020 (UTC)
- Extension debug log:
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: In execute()
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Getting PluggableAuth singleton
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: ldap_connect( $hostname = 'ldaps://XXXX.net:636', $port = 389 );
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: # __METHOD__ returns Resource id #90
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Setting LDAP_OPT_REFERRALS to 0
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Setting 0 to Array
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = , $newval = Array );
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: # returns
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: Cannot set option to LDAP connection!
- 2020-04-03 09:34:46 d6dc7b45ad93 bluespice: ldap_bind( $linkID, $bindRDN = 'XXXX', $bindPassword = 'XXXX' );
- 2020-04-03 09:34:47 d6dc7b45ad93 bluespice: # returns
- 2020-04-03 09:34:47 d6dc7b45ad93 bluespice: ldap_error( $linkID );
- 2020-04-03 09:34:47 d6dc7b45ad93 bluespice: # returns Can't contact LDAP server
- 2020-04-03 09:34:47 d6dc7b45ad93 bluespice: ldap_errno( $linkID );
- 2020-04-03 09:34:47 d6dc7b45ad93 bluespice: # returns -1 D3s3ertf0x (talk) 08:29, 7 April 2020 (UTC)
- {
- "NET": {
- "connection": {
- "server": "XXXX.net",
- "port" : "636",
- "user": "XXXX",
- "pass": "XXXX",
- "enctype": "ssl",
- "options": [
- {"LDAP_OPT_DEREF": 1}
- ],
- "basedn": "DC=domain,DC=net",
- "groupbasedn": "DC=domain,DC=net",
- "userbasedn": "DC=domain,DC=net",
- "searchattribute": "samaccountname",
- "searchstring": "USER-NAME@domain.com",
- "usernameattribute": "samaccountname",
- "realnameattribute": "cn",
- "emailattribute": "mail"
- }
- }
- } D3s3ertf0x (talk) 08:31, 7 April 2020 (UTC)
- Pleas try
- Osnard (talk) 14:16, 7 April 2020 (UTC)
{ "NET": { "connection": { "server": "XXXX.net", "port" : "636", "user": "XXXX", "pass": "XXXX", "enctype": "ssl", "options": { "LDAP_OPT_DEREF": 1 }, "basedn": "DC=domain,DC=net", "groupbasedn": "DC=domain,DC=net", "userbasedn": "DC=domain,DC=net", "searchattribute": "samaccountname", "searchstring": "USER-NAME@domain.com", "usernameattribute": "samaccountname", "realnameattribute": "cn", "emailattribute": "mail" } } } - One error is gone but the main problem is still there:
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: In execute()
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: Getting PluggableAuth singleton
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: ldap_connect( $hostname = 'ldaps://XXXX.net:636', $port = 389 );
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: # __METHOD__ returns Resource id #99
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: Setting LDAP_OPT_REFERRALS to 0
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: Setting LDAP_OPT_DEREF to 1
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 08:34:18 d6dc7b45ad93 bluespice: ldap_bind( $linkID, $bindRDN = 'CN=XXXX,OU=XXX,OU=Generic-Users,OU=Accounts,OU=DE,DC=XXXX,DC=net', $bindPassword = 'XXXX' );
- 2020-04-08 08:34:19 d6dc7b45ad93 bluespice: # returns
- 2020-04-08 08:34:19 d6dc7b45ad93 bluespice: ldap_error( $linkID );
- 2020-04-08 08:34:19 d6dc7b45ad93 bluespice: # returns Can't contact LDAP server
- 2020-04-08 08:34:19 d6dc7b45ad93 bluespice: ldap_errno( $linkID );
- 2020-04-08 08:34:19 d6dc7b45ad93 bluespice: # returns -1 D3s3ertf0x (talk) 08:39, 8 April 2020 (UTC)
- Looks like the port is still set to "389". Can you try to remove the quotes from the port-value in the JSON file? Osnard (talk) 14:32, 8 April 2020 (UTC)
- That does not seem to change anything. $port = 389 is this a problem?
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: In execute()
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: Getting PluggableAuth singleton
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: ldap_connect( $hostname = 'ldaps://XXXX.net:636', $port = 389 );
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: # __METHOD__ returns Resource id #90
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: Setting LDAP_OPT_REFERRALS to 0
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: Setting LDAP_OPT_DEREF to 1
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: # returns 1
- 2020-04-08 18:58:56 d6dc7b45ad93 bluespice: ldap_bind( $linkID, $bindRDN = 'XXXX', $bindPassword = 'XXXX' );
- 2020-04-08 18:58:57 d6dc7b45ad93 bluespice: # returns
- 2020-04-08 18:58:57 d6dc7b45ad93 bluespice: ldap_error( $linkID );
- 2020-04-08 18:58:57 d6dc7b45ad93 bluespice: # returns Can't contact LDAP server
- 2020-04-08 18:58:57 d6dc7b45ad93 bluespice: ldap_errno( $linkID );
- 2020-04-08 18:58:57 d6dc7b45ad93 bluespice: # returns -1 D3s3ertf0x (talk) 19:03, 8 April 2020 (UTC)
- Just an idea: if a self signed certificate is used by the LDAP server PHP might not be able to verifiy it. You can turn off verification of self-signed certificates in OpenLDAP config: https://stackoverflow.com/questions/3866406/need-help-ignoring-server-certificate-while-binding-to-ldap-server-using-php Osnard (talk) 11:54, 9 April 2020 (UTC)
- Thats it, adding
- putenv('LDAPTLS_REQCERT=never');
- to line 87 of
- w/extensions/LDAPProvider/src/Client.php
- solved the problem.
- Thanks D3s3ertf0x (talk) 08:56, 9 July 2020 (UTC)
- I have the same exact error. I tried putting the putenv('LDAPTLS_REQCERT=never'); in line 87 but it's not resolving the issue I'm having. Thanks in advance.
/*** Handle initialization or recall saved connection*/protected function init() {// Already initialized?if ( $this->connection->isConnected() ) {return;}putenv('LDAPTLS_REQCERT=never');$this->makeNewConnection();$this->setupCache();$this->setConnectionOptions();$this->maybeStartTLS();$this->establishBinding();}Laujc (talk) 15:51, 2 June 2021 (UTC)
A couple of qustions re: Domain config
[edit]I have included the following in my ldap.json configuration:
"realnameattribute": "displayname",
But user accounts are created with the Active Directory 'CN' attribute as their Real name. The ShowUserInfo.php script returns the correct value for displayname.
Additionally the following exception is intermittently displayed when logging in:
[XqA6UV14XNCRDOFSt083VwAAABA] /wiki/Special:PluggableAuthLogin MWException from line 209 of /var/www/bluespice/w/extensions/LDAPProvider/src/Client.php: Error in LDAP search: Can't contact LDAP server
Pressing the back button in the browser and logging in again usually works. This is suggesting to me that the server is timing out connecting to the LDAP source. I'm assuming that I can set one of the options in the link on the extension page* to increase the timeout (possibly LDAP_OPT_NETWORK_TIMEOUT or LDAP_OPT_TIMELIMIT) but the page linked does not give a description of the purpose of the options, default values nor valid values (e.g. the options above are integers, but do they represent seconds, milliseconds or what?) Could anyone suggest what the best course of action would be?
n.b. I tried adding the link to the PHP documentation page for the LDAP options, but that was disallowed as link spam.
Many thanks. Doc Dish (talk) 08:04, 27 April 2020 (UTC)
- First of all, please make sure your
ldap.jsonis readable by the webserver. UsuallyShowuserInfo.phpgets executed in a different user context than a web request to the wiki. - You can use all constants within the "connection.options"-object of your
ldap.json.LDAP_OPT_TIMELIMITis to be given in seconds.LDAP_OPT_NETWORK_TIMEOUTassumable too. - What kind of authentication do you use? Network based (with Extension:Auth_remoteuser) or form based (with Extension:LDAPAuthentication2)? Osnard (talk) 09:14, 27 April 2020 (UTC)
- Users can login using their LDAP credentials, so I would guess that ldap.json is accessible (it is owned by the Apache service user). I am using forms-based authentication with LDAPAuthentication2.
- Thanks for the link to the constants page. Do you know any resource detailing the default values?
- Thank you!
Doc Dish (talk) 09:53, 27 April 2020 (UTC)- Unfortunately I don't know the default values and I wasn't able to find documentation about it. The issue you are describing sounds strange. If it works "sometimes", then the extensions configuration should be okay. Maybe there is an issue in the network layer or the LDAP setup in general.
- Are you using LDAPS? If so, there might be issues with the certificate . You might need to modify your
openldap/sysconffile and setTLS_REQCERT never. Please also check if the hostname configured in the LDAP servers certificate is the same that you have set in yourconnection.serverfield. Osnard (talk) 13:35, 27 April 2020 (UTC)
php syntax error in Config.php
[edit]When executing command php maintenance/update.php, I received an error saying there was a php syntax error in src/Config.php on line 9.
Apparently this is due to my php version that cannot handle the declaration public const something. The "public" keyword has to be removed because a const is public by default. So I deleted all public const declaration (replaced them by const only), then relaunched the command and it worked fine. Tguiot (talk) 08:57, 12 May 2020 (UTC)
- You are using an old PHP version. Please use the `REL1_31` branch of the extension to be compatible with older PHP versions. Osnard (talk) 09:53, 12 May 2020 (UTC)
- Thanks. I upgraded my php version and it's ok now. Tguiot (talk) 08:10, 14 May 2020 (UTC)
hide password
[edit]when configuring the json file, the password is in clear. My system admins are not a big fan of this. is there a way to provide the password so that it's not written like this in a config file ? Tguiot (talk) 12:56, 13 May 2020 (UTC)
- Instead of using JSON fo configuration you can use PHP. You can then implement custom logic that decrypts the password from an encrypted given value. But whatever you choose, if somebody gains access to the server he will probably be able to read it out anyways. Osnard (talk) 13:33, 13 May 2020 (UTC)
- yes, that's what I thought. Thanks for your input. Tguiot (talk) 08:11, 14 May 2020 (UTC)
Windows Config - Could not authenticate credentials again domain 'my domain.my.com'
[edit]I have been trying to setup SSO with LDAP on an IIS Server in a Windows 2016 environment.
I enabled windows auth in IIS and got Auth_remoteuser to automatically log me in as MYDOMAIN\0001 (example). However, I need more control on authorisation so I tried:
wfLoadExtension( 'WikiEditor' );
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'Auth_remoteuser' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPUserInfo' );
#wfLoadExtension( 'LDAPGroups' );
$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'domain-backslash-username';
$LDAPAuthentication2UsernameNormalizer = 'strtolower';
$LDAPAuthentication2AllowLocalLogin = false;
$wgAuthRemoteuserAllowUserSwitch = false;
$wgPluggableAuth_EnableLocalLogin = false;
$wgAuthRemoteuserUserName = function() {
$user = '';
if( isset( $_SERVER['REMOTE_USER'] ) ) {
$user = strtolower( $_SERVER['REMOTE_USER'] );
}
return $user;
};
error_log( var_export( $_SERVER['REMOTE_USER'], true ) ); //Should be "xxx.xxx\\SomeUser"
$LDAPProviderDomainConfigProvider = function() {
$config = [
'mydomain.my.com' => [
'connection' => [
"server" => "my-dc.mydomain.my.com",
"user" => "CN=Media Wiki,CN=Users,DC=mydomain,DC=my,DC=com",
"pass" => "xxxxx",
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "DC=mydomain,DC=my,DC=com",
"groupbasedn" => "DC=mydomain,DC=my,DC=com",
"userbasedn" => "DC=mydomain,DC=my,DC=com",
"searchattribute" => "uid",
"usernameattribute" => "uid",
"realnameattribute" => "fullname",
"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
],
'userinfo' => [
'attributes-map' => [
'realname' => 'fullname'
]
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};
It not longer auto signs me in but I get a 'log in with pluggable auth' on the sign in page. I tired that but it always comes back as Could not authenticate credentials again domain 'my domain.my.com'.
It isn't really an error so I am struggling to debug it (I have all debug messages turned on). Kittencorn (talk) 11:31, 15 May 2020 (UTC)
- Looks like you have no rules defined for the "authorization" part. Therefor authorization may just fail. Please try to add a "authorization.rules" element to the domain config. Use
LDAPProvider/maintenance/ShowUserGroups.phpto check whether the "grouprequest" is set up properly and the LDAP extensions can "see" the right groups of the user. Osnard (talk) 09:20, 18 May 2020 (UTC) - Thanks, this now works. However I am still having issues with it being very slow. ShowUserGroups returns Undefined index: REMOTE_USER. Kittencorn (talk) 13:53, 18 May 2020 (UTC)
- Having
Undefined index: REMOTE_USER.on CLI calls is normal. Nothing to worry about. - Regarding the slowness: LDAP queries should be cached by default. Does
LDAPProvider/maintenance/ShowUserGroups.phpalso take a long time? Even if called twice with the same parameters? Are there a lot of groups in the result? Osnard (talk) 15:30, 18 May 2020 (UTC) - Thanks for your help! The script always seems to take about 4 seconds to run and I have about 16 groups. I am getting a separate error (Refused to execute script from 'https://mydomain.com/load.php?lang=en-gb&modules=startup&only=scripts&raw=1&skin=vector' because its MIME type ('text/html') is not executable, and strict MIME type checking is enabled.) in the Chrome console so that might also be the cause of the slow loading. Kittencorn (talk) 15:50, 18 May 2020 (UTC)
- If the CLI script always takes 4 seconds then apparently something is wrong with your caching. Also unless you have a really huge LDAP resource this should be way faster. Can you check if a non-PHP query (e.g. with tools like ADExplorer, LDAPAdmin or ldap-search) is also this slow? Osnard (talk) 08:15, 19 May 2020 (UTC)
- It isn't. I am using WinCache:
- LocalSettings
- $wgMainCacheType = CACHE_ACCEL;
- $wgMemCachedServers = [];
- php.ini
- [wincache]
- extension = php_wincache.dll
- I don't seem to be getting any errors Kittencorn (talk) 16:08, 20 May 2020 (UTC)
Ldap Help
[edit]I am having problems with mapping groups. Can you please look at my configuration and help me? I would appreciate it. I am using FreeIPA as my LDAP source. I can use the php CLI tools to view all the groups.
<sytaxhighlight lang="php">
$LDAPProviderDomainConfigProvider = function() {
$config = [
'LDAP' => [
'connection' => [
"server" => "censored",
"user" => "uid=mediawiki,cn=sysaccounts,cn=etc,dc=ids,dc=rti,dc=reimbtech,dc=com",
"pass" => 'censored',
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "dc=ids,dc=rti,dc=reimbtech,dc=com",
"groupbasedn" => "cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
"userbasedn" => "cn=users,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
"searchattribute" => "uid",
"searchstring" => "uid=USER-NAME,cn=users,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
"usernameattribute" => "uid",
"realnameattribute" => "cn",
"emailattribute" => "mail",
"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers" => [ "spacestounderscores", "lowercase" ],
],
"groupsync" => [
"mechanism" => "MediaWiki\\Extension\\LDAPGroups\\SyncMechanism\\MappedGroups::factory",
"mapping" => [
"sysop" => "cn=misuxadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
"bureaucrat" => "cn=misuxadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
"Administrators" => "cn=misuxadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com",
]
],
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
}; </syntaxhighlight> Ryanyoungenvision (talk) 18:13, 8 June 2020 (UTC)
- Your configuration looks good. Can you confirm that you have Extension:LDAPGroups installed and enabled? You say that
LDAPProvider/maintenance/ShowUserGroups.phplists the group DNs that you have ingroupsync.mapping? Osnard (talk) 19:29, 8 June 2020 (UTC) - I do not have ldapgroups installed. I think that is the issue then?
- www-data@mario:~/mediawiki-1.34.1/extensions/LDAPProvider/maintenance$ php ShowUserGroups.php --domain LDAP -u ryayoung
- Full DNs:
- cn=ipausers,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=uxadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=bca4e202-4be2-11e9-8477-005056a9cb31,cn=hbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=ef6796e8-4b2a-11e9-a5b8-005056a9cb31,cn=sudorules,cn=sudo,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=User Administrator,cn=roles,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=User Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add User to default group,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Change User password,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage User Certificates,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage User Principals,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage User SSH Public Keys,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read UPG Definition,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read User Kerberos Login Attributes,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Unlock User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Radius Servers,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Group Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Groups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify External Group Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Group Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Groups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Groups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Stage User Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Stage User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Preserved Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Stage User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify User RDN,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Preserve User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Preserved Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Stage User password,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Stage Users,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Stage User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove preserved User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Reset Preserved User password,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Undelete User,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=IT Specialist,cn=roles,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Host Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Retrieve Certificates from the CA,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Revoke Certificate,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Hosts,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add krbPrincipalName to a Host,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Enroll a Host,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host Certificates,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host Enrollment Password,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host Keytab,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host Keytab Permissions,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host Principals,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Host SSH Public Keys,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Hosts,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Hosts,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Service Keytab,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Service Keytab Permissions,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Host Group Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Hostgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Hostgroup Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Hostgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Hostgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Service Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Services,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Service Principals,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Services,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Services,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Service Delegations,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Service Delegation Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Service Delegations,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Service Delegations,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Automount Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Automount Keys,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Automount Keys,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Automount Keys,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Automount Locations,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Automount Locations,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Automount Maps,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Automount Maps,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Automount Maps,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=IT Security Specialist,cn=roles,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Netgroups Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Netgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Netgroup Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Netgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Netgroups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=HBAC Administrator,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add HBAC Rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete HBAC Rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage HBAC Rule Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify HBAC Rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add HBAC Services,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete HBAC Services,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add HBAC Service Groups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete HBAC Service Groups,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage HBAC Service Group Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Sudo Administrator,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Sudo Command,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete Sudo Command,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Sudo Command,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Sudo Command Group,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete Sudo Command Group,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Manage Sudo Command Group Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Sudo Command Group,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Sudo rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete Sudo rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Sudo rule,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Security Architect,cn=roles,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Delegation Administrator,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Privilege Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Privileges,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Privileges,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Privileges,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Roles,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Role Membership,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Roles,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Remove Roles,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Replication Administrators,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Add Replication Agreements,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Modify Replication Agreements,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Read Replication Agreements,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Modify DNA Range,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Read PassSync Managers Configuration,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Modify PassSync Managers Configuration,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Read LDBM Database Configuration,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Add Configuration Sub-Entries,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Read DNA Range,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Write IPA Configuration,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Write IPA Configuration,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Password Policy Administrator,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Group Password Policy costemplate,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Add Group Password Policy,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Delete Group Password Policy,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Modify Group Password Policy,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=System: Read Group Password Policy,cn=permissions,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Enrollment Administrator,cn=roles,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=Host Enrollment,cn=privileges,cn=pbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=3720dba6-4f28-11e9-ab2a-10604b990cd8,cn=hbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=passwdexempt,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=slurmposix,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=slurmqa,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=c1347d82-4c05-11e9-bf37-005056a9cb31,cn=hbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=slurmprod,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=misuxadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=admins,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=dbadmin,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=d23518c6-4be2-11e9-bc11-005056a9cb31,cn=hbac,dc=ids,dc=rti,dc=reimbtech,dc=com
- ipaUniqueID=4f013aca-4c00-11e9-a15e-005056a9cb31,cn=sudorules,cn=sudo,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=vmware,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- cn=test,cn=groups,cn=accounts,dc=ids,dc=rti,dc=reimbtech,dc=com
- Short names:
- ipausers
- uxadmin
- bca4e202-4be2-11e9-8477-005056a9cb31
- ef6796e8-4b2a-11e9-a5b8-005056a9cb31
- user administrator
- user administrators
- system: add user to default group
- system: add users
- system: change user password
- system: manage user certificates
- system: manage user principals
- system: manage user ssh public keys
- system: modify users
- system: read upg definition
- system: read user kerberos login attributes
- system: remove users
- system: unlock user
- system: read radius servers
- group administrators
- system: add groups
- system: modify external group membership
- system: modify group membership
- system: modify groups
- system: remove groups
- stage user administrators
- system: add stage user
- system: modify preserved users
- system: modify stage user
- system: modify user rdn
- system: preserve user
- system: read preserved users
- system: read stage user password
- system: read stage users
- system: remove stage user
- system: remove preserved user
- system: reset preserved user password
- system: undelete user
- it specialist
- host administrators
- retrieve certificates from the ca
- revoke certificate
- system: add hosts
- system: add krbprincipalname to a host
- system: enroll a host
- system: manage host certificates
- system: manage host enrollment password
- system: manage host keytab
- system: manage host keytab permissions
- system: manage host principals
- system: manage host ssh public keys
- system: modify hosts
- system: remove hosts
- system: manage service keytab
- system: manage service keytab permissions
- host group administrators
- system: add hostgroups
- system: modify hostgroup membership
- system: modify hostgroups
- system: remove hostgroups
- service administrators
- system: add services
- system: manage service principals
- system: modify services
- system: remove services
- system: add service delegations
- system: modify service delegation membership
- system: read service delegations
- system: remove service delegations
- automount administrators
- system: add automount keys
- system: modify automount keys
- system: remove automount keys
- system: add automount locations
- system: remove automount locations
- system: add automount maps
- system: modify automount maps
- system: remove automount maps
- it security specialist
- netgroups administrators
- system: add netgroups
- system: modify netgroup membership
- system: modify netgroups
- system: remove netgroups
- hbac administrator
- system: add hbac rule
- system: delete hbac rule
- system: manage hbac rule membership
- system: modify hbac rule
- system: add hbac services
- system: delete hbac services
- system: add hbac service groups
- system: delete hbac service groups
- system: manage hbac service group membership
- sudo administrator
- system: add sudo command
- system: delete sudo command
- system: modify sudo command
- system: add sudo command group
- system: delete sudo command group
- system: manage sudo command group membership
- system: modify sudo command group
- system: add sudo rule
- system: delete sudo rule
- system: modify sudo rule
- security architect
- delegation administrator
- system: modify privilege membership
- system: add privileges
- system: modify privileges
- system: remove privileges
- system: add roles
- system: modify role membership
- system: modify roles
- system: remove roles
- replication administrators
- add replication agreements
- modify replication agreements
- read replication agreements
- remove replication agreements
- modify dna range
- read passsync managers configuration
- modify passsync managers configuration
- read ldbm database configuration
- add configuration sub-entries
- read dna range
- write ipa configuration
- write ipa configuration
- password policy administrator
- system: add group password policy costemplate
- system: delete group password policy costemplate
- system: modify group password policy costemplate
- system: read group password policy costemplate
- system: add group password policy
- system: delete group password policy
- system: modify group password policy
- system: read group password policy
- enrollment administrator
- host enrollment
- 3720dba6-4f28-11e9-ab2a-10604b990cd8
- passwdexempt
- slurmposix
- slurmqa
- c1347d82-4c05-11e9-bf37-005056a9cb31
- slurmprod
- misuxadmin
- admins
- dbadmin
- d23518c6-4be2-11e9-bc11-005056a9cb31
- 4f013aca-4c00-11e9-a15e-005056a9cb31
- vmware
- test Ryanyoungenvision (talk) 17:32, 9 June 2020 (UTC)
- Ok. I have added ldapgroups and upon logging in i get this:
- Notice: Undefined index: memberof in /var/www/mediawiki-1.34.1/extensions/LDAPProvider/src/UserGroupsRequest/UserMemberOf.php on line 19
- Warning: array_map(): Expected parameter 2 to be an array, null given in /var/www/mediawiki-1.34.1/extensions/LDAPGroups/src/SyncMechanism/MappedGroups.php on line 52
- Warning: Invalid argument supplied for foreach() in /var/www/mediawiki-1.34.1/extensions/LDAPGroups/src/SyncMechanism/MappedGroups.php on line 72 Ryanyoungenvision (talk) 17:39, 9 June 2020 (UTC)
- Okay, so the result of the LDAP query for the group membership fails. That's strange, because if
LDAPProvider/maintenance/ShowUserGroups.phpworks then the LDAPGroups implementation should also work, as the code and config used is the same. - Can you try to enable the debug log and check whether there are any error messages due to the LDAP communication. Osnard (talk) 07:06, 10 June 2020 (UTC)
- Yeah sure. do you want me to email you the log file? Give me a few and Ill get back to you. Ryanyoungenvision (talk) 15:23, 11 June 2020 (UTC)
- You could share the log here directly of upload it to some "paste-bin" service and provide a link. Make sure to strip sensitive information beforehand. Osnard (talk) 06:48, 12 June 2020 (UTC)
- https://pastebin.com/gEjHdp6J Ryanyoungenvision (talk) 18:40, 15 June 2020 (UTC)
- Sorry for the delay. Things have been hectic. Ryanyoungenvision (talk) 18:42, 15 June 2020 (UTC)
- Strange, you have set `"presearchusernamemodifiers" => [ "spacestounderscores", "lowercase" ],` but still the log shows a query for `(uid=Ryoung test3)` instead of `(uid=ryoung_test3)`.
- Can you try adding
$username = $this->modifyUsername( $username );- to `LDAPProvider/src/Client.php` at the beginning of the function `getUserGroups` (https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.3/src/Client.php#L346) Osnard (talk) 15:42, 18 June 2020 (UTC)
- I do believe that is working. Let me confirm on Monday 100%. Ryanyoungenvision (talk) 01:06, 20 June 2020 (UTC)
LDAP Filter out inactive accounts
[edit]The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
Hi,
I have a requirement to use a search filter to filter out any inactive accounts. Specifically, I need to use accountStatus=active filter to allow login for active users alone. I tried a few different methods, but none seems to work. The problem happened after I upgraded our old mediawiki to 1.34 and since the old LDAP Authentication plugin ceased to work. This is the settings on our old wiki that I'm trying to implement:
---
//Require the following additional search string.
$wgLDAPAuthAttribute = array(
"example.com" => "accountStatus=active"
);
---
and these are the things I tried so far:
---
..
$LDAPProviderDomainConfigProvider = function() {
$config = [
'Company' => [
'connection' => [
"server" => "ldap.default.svc.cluster.local",
"user" => "cn=authcheck,ou=System,ou=Accounts,dc=company,dc=com",
"pass" => 'password',
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "dc=company,dc=com",
"groupbasedn" => "ou=Groups,dc=company,dc=com",
"userbasedn" => "ou=People,ou=Accounts,dc=company,dc=com",
"searchattribute" => "accountStatus=active,uid",
"searchstring" => "uid=USER-NAME,ou=People,ou=Accounts,dc=company,dc=com",
"usernameattribute" => "uid",
"realnameattribute" => "cn",
"emailattribute" => "mail"
]
..
---
As that didn't work, I tried using LDAP Authorization plugin:
---
..
$LDAPProviderDomainConfigProvider = function() {
$config = [
'company' => [
'connection' => [
"server" => "ldap.default.svc.cluster.local",
"user" => "cn=authcheck,ou=System,ou=Accounts,dc=company,dc=com",
"pass" => 'password',
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "dc=company,dc=com",
"groupbasedn" => "ou=Groups,dc=company,dc=com",
"userbasedn" => "ou=People,ou=Accounts,dc=company,dc=com",
"searchattribute" => "uid",
"searchstring" => "uid=USER-NAME,ou=People,ou=Accounts,dc=company,dc=com",
"usernameattribute" => "uid",
"realnameattribute" => "cn",
"emailattribute" => "mail"
],
"authorization" =>
[
"rules" =>
[
"attributes" =>
[
"&" => [
"accountStatus" => "active"
]
]
]
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
---
That too doesn't work. Some debug logs for the latter:
---
[MediaWiki\Extension\LDAPProvider\Client] MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=user,ou=People,ou=Accounts,dc=company,dc=com'
[LDAP] ldap_bind( $linkID, $bindRDN = 'uid=user,ou=People,ou=Accounts,dc=company,dc=com', $bindPassword = 'XXXX' );
[LDAP] # returns 1
[session] SessionBackend "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" save: dataDirty=1 metaDirty=0 forcePersist=0
[PluggableAuth] Authenticated new user: user
[PluggableAuth] Authorization failure.
---
The only other way I can make it work is to hard code it in the file LDAPProvider/src/UserInfoRequest.php on line 54
---
$filter = "(&({$this->searchAttribute}=$escapedUserName)(accountStatus=active))";
---
Is there any other way? Shanu Koyakutty (talk) 09:34, 12 June 2020 (UTC)
- Well, using
authorization.rules.attributesseems to be the proper way to do this. Can you please confirm that you have Extension:LDAPAuthorization enabled? Please also check if the "accountStatus" in the domain config and the output ofLDAPProvider/maintenance/ShowUserInfo.phphave the same casing. Osnard (talk) 09:04, 15 June 2020 (UTC)- The original wiki is live. I will spin up another GKE deployment and let you know the output of ShowUserInfo.php .I believe this what I need to do? @Osnard
- php extensions/LDAPProvider/maintenance/ShowUserInfo.php --username Shanu -d Company
- LDAPAuthorization was enabled, but have it removed now. I will give you more details soon. Thanks! Shanu Koyakutty (talk) 04:45, 16 June 2020 (UTC)
- But wait. In you log it actually says
[PluggableAuth] Authorization failure. Isn't this what you wanted to archive? Osnard (talk) 09:05, 15 June 2020 (UTC) - This happens irrespective of whether acccountStatus is active or deactive.
Shanu Koyakutty (talk) 04:42, 16 June 2020 (UTC) - I have now tested it on a dev deployment with LDAP Authorization plugin. Here is the LocalSettings.php that I used:
<?php</code> # This file was automatically generated by the MediaWiki 1.34.1 # installer. If you make manual changes, please keep track in case you # need to recreate them later. # # See includes/DefaultSettings.php for all configurable settings # and their default values, but don't forget to make changes in _this_ # file, not there. # # Further documentation for configuration settings may be found at: # https://www.mediawiki.org/wiki/Manual:Configuration_settings # Protect against web entry if ( !defined( 'MEDIAWIKI' ) ) { exit; } ## Uncomment this to disable output compression # $wgDisableOutputCompression = true; $wgSitename = "Company Internal Wiki"; $wgMetaNamespace = "Company_Internal_Wiki"; ## The URL base path to the directory containing the wiki; ## defaults for all runtime URL paths are based off of this. ## For more information on customizing the URLs ## (like /w/index.php/Page_title to /wiki/Page_title) please see: ## https://www.mediawiki.org/wiki/Manual:Short_URL $wgScriptPath = ""; ## The protocol and server name to use in fully-qualified URLs $wgServer = "https://wiki-dev.company.com"; ## The URL path to static resources (images, scripts, etc.) $wgResourceBasePath = $wgScriptPath; ## The URL path to the logo. Make sure you change this from the default, ## or else you'll overwrite your logo when you upgrade! // $wgLogo = "$wgResourceBasePath/resources/assets/wiki.png"; $wgLogo = "$wgResourceBasePath/images/company.png"; ## UPO means: this is also a user preference option $wgEnableEmail = true; $wgEnableUserEmail = true; # UPO $wgEmergencyContact = "wiki@staff.company.com"; $wgPasswordSender = "wiki@staff.company.com"; $wgEnotifUserTalk = true; # UPO $wgEnotifWatchlist = true; # UPO $wgEmailAuthentication = true; ## Database settings $wgDBtype = "mysql"; $wgDBserver = "127.0.0.1"; $wgDBname = "db_name"; $wgDBuser = "db_user"; $wgDBpassword = "db_password"; # MySQL specific settings $wgDBprefix = ""; # MySQL table options to use during installation or update $wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary"; ## Shared memory settings $wgMainCacheType = CACHE_ACCEL; $wgMemCachedServers = []; ## To enable image uploads, make sure the 'images' directory ## is writable, then set this to true: $wgEnableUploads = true; $wgUseImageMagick = true; $wgImageMagickConvertCommand = "/usr/bin/convert"; # InstantCommons allows wiki to use images from https://commons.wikimedia.org $wgUseInstantCommons = false; # Periodically send a pingback to https://www.mediawiki.org/ with basic data # about this MediaWiki instance. The Wikimedia Foundation shares this data # with MediaWiki developers to help guide future development efforts. $wgPingback = false; ## If you use ImageMagick (or any other shell command) on a ## Linux server, this will need to be set to the name of an ## available UTF-8 locale $wgShellLocale = "C.UTF-8"; ## Set $wgCacheDirectory to a writable directory on the web server ## to make your wiki go slightly faster. The directory should not ## be publicly accessible from the web. #$wgCacheDirectory = "$IP/cache"; # Site language code, should be one of the list in ./languages/data/Names.php $wgLanguageCode = "en"; $wgSecretKey = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; # Changing this will log out all existing sessions. $wgAuthenticationTokenVersion = "1"; # Site upgrade key. Must be set to a string (default provided) to turn on the # web installer while LocalSettings.php is in place $wgUpgradeKey = "xxxxxxxxxxx"; ## For attaching licensing metadata to pages, and displaying an ## appropriate copyright notice / icon. GNU Free Documentation ## License and Creative Commons licenses are supported so far. $wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright $wgRightsUrl = ""; $wgRightsText = ""; $wgRightsIcon = ""; # Path to the GNU diff3 utility. Used for conflict resolution. $wgDiff3 = "/usr/bin/diff3"; ## Default skin: you can change the default skin. Use the internal symbolic ## names, ie 'vector', 'monobook': $wgDefaultSkin = "vector"; # Enabled skins. # The following skins were automatically enabled: wfLoadSkin( 'MonoBook' ); wfLoadSkin( 'Timeless' ); wfLoadSkin( 'Vector' ); # The following permissions were set based on your choice in the installer # No new user registration should be allowed through wiki $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['autocreateaccount'] = true; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['read'] = false; # End of automatically generated settings. # Add more configuration options below. # Added by Shanu Koyakutty $wgFavicon = "$wgScriptPath/images/favicon.ico"; wfLoadExtensions( array( 'WikiEditor', 'PluggableAuth', 'LDAPProvider', 'LDAPAuthentication2', 'LDAPAuthorization' ) ); $LDAPProviderDomainConfigProvider = function() { $config = [ 'Company' => [ 'connection' => [ "server" => "ldap.default.svc.cluster.local", "user" => "cn=authcheck,ou=System,ou=Accounts,dc=company,dc=com", "pass" => 'password', "options" => [ "LDAP_OPT_DEREF" => 1 ], "basedn" => "dc=company,dc=com", "groupbasedn" => "ou=Groups,dc=company,dc=com", "userbasedn" => "ou=People,ou=Accounts,dc=company,dc=com", "searchattribute" => "uid", "searchstring" => "uid=USER-NAME,ou=People,ou=Accounts,dc=company,dc=com", "usernameattribute" => "uid", "realnameattribute" => "cn", "emailattribute" => "mail" ], "authorization" => [ "rules" => [ "&" => [ "accountStatus" => "active" ] ] ] ] ]; return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config ); };root@admod-wiki-development-0:/var/www/html# php extensions/LDAPProvider/maintenance/ShowUserInfo.php -u Shanu -d Company</code> cn => Shanu Koyakutty mail => shanu@company.com employeenumber => 123 givenname => Shanu gidnumber => 1002 homedirectory => /thome/shanu sn => Koyakutty loginshell => /bin/bash mailquotasize => 100 objectclass => 0 => inetOrgPerson 1 => posixAccount 2 => greenUser 3 => top uidnumber => 1148 uid => shanu accountstatus => deactive dn => uid=shanu,ou=People,ou=Accounts,dc=company,dc=com- Even if I change the accountStatus to deactive, I'm still able to login to the wiki.
- >> Please also check if the "accountStatus" in the domain config and the output of
LDAPProvider/maintenance/ShowUserInfo.phphave the same casing. - If you mean by domain config, if it is LDAP config, yes, both have the same casing. Shanu Koyakutty (talk) 07:06, 16 June 2020 (UTC)
- Please try `accountstatus` in lowecase in your settings. Osnard (talk) 15:16, 18 June 2020 (UTC)
- Thank you very much @Osnard. That did the trick. This is my final
LocalSettings.php. Note that I have added anattributessection too along with changing the case in case that helps someone. In the last example,attributeswas removed. "authorization" =></code> [ "rules" => [ "attributes" => [ "&" => [ "accountstatus" => "active" ] ] ] ] Shanu Koyakutty (talk) 06:19, 19 June 2020 (UTC)
The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.
Could not bind to LDAP: (-1) Can't contact LDAP server
[edit]CentOS Linux release 7.7.1908 (Core)
PHP 7.2.31 (php-ldap is installed)
Mediawiki 1.33
All the LDAP extensions are 1.31
I have been following the guide here, except I am using SSL and port 636:
Manual:Active Directory Integration
When attempting to log in I receive:
[XxhLFzNdrvbGAcaA-3oWbwAAAAQ] /index.php/Special:PluggableAuthLogin MWException from line 169 of /var/www/html/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server
Backtrace:
#0 /var/www/html/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /var/www/html/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#4 /var/www/html/includes/specialpage/SpecialPage.php(569): PluggableAuthLogin->execute(NULL)
#5 /var/www/html/includes/specialpage/SpecialPageFactory.php(558): SpecialPage->run(NULL)
#6 /var/www/html/includes/MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)
#7 /var/www/html/includes/MediaWiki.php(865): MediaWiki->performRequest()
#8 /var/www/html/includes/MediaWiki.php(515): MediaWiki->main()
#9 /var/www/html/index.php(42): MediaWiki->run()
#10 {main}
I can run the following, and it successfully retrieves all of the details of the user
php ShowUserInfo.php --domain "domain.com" --username "username"
ldap.json looks like:
{
"domain.com": {
"connection": {
"server": "ad.domain.com",
"port": "636",
"user": "CN=svc.mediawiki,OU=Accounts.Service,OU=Server Objects,DC=sub,DC=domain,DC=com",
"pass": "xxxxxxxxx",
"enctype": "ssl",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "DC=sub,DC=domain,DC=com",
"userbasedn": "DC=sub,DC=domain,DC=com",
"groupbasedn": "DC=sub,DC=domain,DC=com",
"searchattribute": "samaccountname",
"usernameattribute": "samaccountname",
"realnameattribute": "cn",
"emailattribute": "mail",
"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
},
"userinfo": [],
"authorization": [],
"groupsync": {
"mapping": {
"company-Users": "CN=mediawiki-users,OU=Groups.ServiceRoles,OU=Server Objects,DC=sub,DC=domain,DC=com",
"bureaucrat": "CN=mediawiki-admins,OU=Groups.ServiceRoles,OU=Server Objects,DC=sub,DC=domain,DC=com",
"interface-admin": "CN=mediawiki-admins,OU=Groups.ServiceRoles,OU=Server Objects,DC=sub,DC=domain,DC=com",
"sysop": "CN=mediawiki-admins,OU=Groups.ServiceRoles,OU=Server Objects,DC=sub,DC=domain,DC=com"
}
}
}
}
localsettings.php looks like:
// LDAP Config
// Safe IP or not (for bypassing external login via AD)
$safeIPs = array('127.0.0.1','localhost');
$ipsVars = array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR');
foreach ($ipsVars as $ipsVar) {
if (isset($_SERVER[$ipsVar]) && mb_strlen($_SERVER[$ipsVar]) > 3 ) { $wikiRequestIP = $_SERVER[$ipsVar]; break; }
}
$wikiRequestSafe = (isset($wikiRequestIP) && ( in_array($wikiRequestIP,$safeIPs) ));
// Create Wiki-Group 'company-users' from default user group
$wgGroupPermissions['company-users'] = $wgGroupPermissions['user'];
// Private Wiki. External LDAP login. Default NS requires login.
$wgEmailConfirmToEdit = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgBlockDisablesLogin = true;
// Load LDAP Config from JSON
$ldapJsonFile = "$IP/ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
$testJson = @json_decode(file_get_contents($ldapJsonFile),true);
if (is_array($testJson)) {
$ldapConfig = true;
} else {
error_log("Found invalid JSON in file: $IP/ldap.json");
}
}
// Activate Extension
if ( $ldapConfig ) {
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPUserInfo' );
wfLoadExtension( 'LDAPGroups' );
$LDAPProviderDomainConfigs = $ldapJsonFile;
$wgPluggableAuth_ButtonLabel = "Please work!";
if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }
}
error_reporting( -1 );
ini_set( 'display_errors', 1 );
$wgShowExceptionDetails = true;
$wgShowDBErrorBacktrace = true;
Any guidance would be much appreciated Droptheanchor (talk) 14:43, 22 July 2020 (UTC)
- I have tried changing the port to 389 and enctype to clear with the same results Droptheanchor (talk) 16:26, 22 July 2020 (UTC)
- If you can successfully run `ShowUserInfo.php`, then the connection setup okay. Maybe the webserver user is not allowed to read the domain configuration file? Osnard (talk) 07:59, 24 July 2020 (UTC)
LDAP Help Needed - version 1.34
[edit]Unable to connect to ldap, getting this error:
Could not authenticate credentials against domain "mydomainname"
When i try to run
php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain="mydomainname" --username="mysuerid"
I get the data but some warnings in starting:
PHP Notice: Array to string conversion in /u01/geowiki/extensions/LDAPProvider/src/Client.php on line 121
Notice: Array to string conversion in /u01/geowiki/extensions/LDAPProvider/src/Client.php on line 121
PHP Warning: constant(): Couldn't find constant 0 in /u01/geowiki/extensions/LDAPProvider/src/Client.php on line 122
Warning: constant(): Couldn't find constant 0 in /u01/geowiki/extensions/LDAPProvider/src/Client.php on line 122
PHP Notice: Array to string conversion in /u01/geowiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 52
Notice: Array to string conversion in /u01/geowiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 52 Anksanks03 (talk) 12:36, 24 July 2020 (UTC)
- Can you please share your domain config? Also please try "CheckLogin.php" script from the CLI Osnard (talk) 13:40, 24 July 2020 (UTC)
- Domain Config File: LocalSettings.php
- <?php
- error_reporting( -1 );
- ini_set( 'display_errors', 1 );
- if ( !defined( 'MEDIAWIKI' ) ) {
- exit;
- }
- $wgSitename = "Wiki";
- $wgMetaNamespace = "Wiki";
- $wgScriptPath = "/wiki";
- $wgServer = "myservername";
- $wgResourceBasePath = $wgScriptPath;
- $wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
- $wgEnableEmail = true;
- $wgEmergencyContact = "apache@🌻.invalid";
- $wgPasswordSender = "apache@🌻.invalid";
- $wgEmailAuthentication = true;
- $wgDBtype = "mysql";
- $wgDBserver = "localhost";
- $wgDBname = "growth_wiki";
- $wgDBuser = "wikiuser";
- $wgDBpassword = "mydbpassword";
- $wgDBprefix = "";
- $wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
- $wgMainCacheType = CACHE_ACCEL;
- $wgMemCachedServers = [];
- $wgEnableUploads = true;
- $wgUseInstantCommons = false;
- $wgPingback = false;
- $wgShellLocale = "en_US.utf8";
- $wgLanguageCode = "en";
- $wgSecretKey = "mysecretkey";
- $wgAuthenticationTokenVersion = "1";
- $wgUpgradeKey = "444f57f19cc42f85";
- $wgRightsUrl = "";
- $wgRightsText = "";
- $wgRightsIcon = "";
- $wgDiff3 = "/usr/bin/diff3";
- $wgGroupPermissions['*']['createaccount'] = false;
- $wgGroupPermissions['*']['edit'] = false;
- $wgGroupPermissions['*']['read'] = false;
- $wgDefaultSkin = "vector";
- wfLoadSkin( 'MonoBook' );
- wfLoadSkin( 'Timeless' );
- wfLoadSkin( 'Vector' );
- wfLoadExtension( 'CodeEditor' );
- wfLoadExtension( 'WikiEditor' );
- $wgLDAPDebug = 3; //for debugging LDAP
- $wgShowExceptionDetails = true; //for debugging MediaWiki
- $wgDebugLogFile = "/tmp/mediwikidebug.log";
- $ldapJsonFile = "/etc/mediawiki/ldapprovider.json";
- $ldapConfig = false;
- $wikiRequestSafe = true;
- if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
- $testJson = @json_decode(file_get_contents($ldapJsonFile),true);
- if (is_array($testJson)) {
- $ldapConfig = true;
- } else {
- error_log("Found invalid JSON in file: $IP/ldap.json");
- }
- }
- // Activate Extension
- if ( $ldapConfig ) {
- wfLoadExtension( 'PluggableAuth' );
- wfLoadExtension( 'LDAPProvider' );
- wfLoadExtension( 'LDAPAuthentication2' );
- wfLoadExtension( 'LDAPAuthorization' );
- wfLoadExtension( 'LDAPUserInfo' );
- wfLoadExtension( 'LDAPGroups' );
- $LDAPProviderDomainConfigs = $ldapJsonFile;
- $wgPluggableAuth_ButtonLabel = "Log In";
- if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }
- } Anksanks03 (talk) 09:46, 28 July 2020 (UTC)
- Json File: ldapprovider.json
- {
- "my domain": {
- "connection": {
- "server": "server1 server2",
- "user": "CN=myldapuser,OU=service_accounts,OU=groups_users,DC=corp,DC=mycompany,DC=com",
- "pass": "mypassword",
- "options": {
- "LDAP_OPT_DEREF": 1
- },
- "basedn": "dc=corp,dc=mycompany,dc=com",
- "groupbasedn": "dc=corp,dc=mycompany,dc=com",
- "userbasedn": "dc=corp,dc=mycompany,dc=com",
- "searchattribute": "samaccountname",
- "searchstring": "samaccountname=USER-NAME,OU=mycompany_users,OU=group_users,dc=corp,dc=mycompany,dc=com",
- "usernameattribute": "samaccountname",
- "realnameattribute": "cn",
- "emailattribute": "mail",
- "presearchusernamemodifiers": ["spacestounderscores", "lowercase"]
- },
- "userinfo": [],
- "groupsync": {
- "mapping": {
- "groups_users": "OU=groups_users,DC=corp,DC=mycompany,DC=com"
- }
- }
- }
- } Anksanks03 (talk) 09:49, 28 July 2020 (UTC)
- checklogin fails for me
- Debug Log:
- [SQLBagOStuff] MainObjectStash using store ReplicatedBagOStuff
- [objectcache] MainWANObjectCache using store EmptyBagOStuff
- IP: 127.0.0.1
- Start command line script extensions/LDAPProvider/maintenance/CheckLogin.php
- [localisation] LocalisationCache: using store LCStoreDB
- [session] SessionManager using store SqlBagOStuff
- [LDAP] ldap_connect( $hostname = 'ldap://myserver1:389 ldap://myserver2:389', $port = 389 );
- [LDAP] # __METHOD__ returns Resource id #209
- [MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_PROTOCOL_VERSION to 3
- [LDAP] ldap_set_option( $linkID, $option = 17, $newval = 3 );
- [LDAP] # returns 1
- [MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_REFERRALS to 0
- [LDAP] ldap_set_option( $linkID, $option = 8, $newval = 0 );
- [LDAP] # returns 1
- [MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_DEREF to 1
- [LDAP] ldap_set_option( $linkID, $option = 2, $newval = 1 );
- [LDAP] # returns 1
- [LDAP] ldap_bind( $linkID, $bindRDN = 'CN=myldapuser,OU=service_accounts,OU=groups_users,DC=corp,DC=mycompany,DC=com', $bindPassword = 'XXXX' );
- [LDAP] # returns 1
- [MediaWiki\Extension\LDAPProvider\Client] MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'samaccountname=myuser,OU=geo_users,OU=group_users,dc=corp,dc=mycompany,dc=com'
- [LDAP] ldap_bind( $linkID, $bindRDN = 'samaccountname=myuser,OU=geo_users,OU=group_users,dc=corp,dc=mycompany,dc=com', $bindPassword = 'XXXX' );
- [LDAP] # returns
- [DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: request info {
- "IPAddress": "127.0.0.1",
- "UserAgent": false,
- "ChronologyProtection": false,
- "ChronologyPositionIndex": 0,
- "ChronologyClientId": false
- }
- ~
- ~ Anksanks03 (talk) 09:53, 28 July 2020 (UTC)
- The warnings i were getting are not coming now. Only this error: Could not authenticate credentials against domain "mydomain". As my checklogin fails, I am not sure what part I am giving wrong as it is not able to authenticate. Anksanks03 (talk) 09:56, 28 July 2020 (UTC)
- Please use a domain without a space, e.g. "mydomain". Please disable "Extension:LDAPAuthorization" if not required. The lack of a "authorization" section in your domain config may cause issues.
- From the debug log it looks like the user
samaccountname=myuser,OU=geo_users,OU=group_users,dc=corp,dc=mycompany,dc=com is just not allowed to bind with the provided password. Osnard (talk) 15:03, 28 July 2020 (UTC)
- Thanks for the response Osnard. I tried removing the Extension:LDAPAuthorization. Also there is no space in my domain name. Just renamed it here to mask it.
- What else I can do to test or debug the issue. Anksanks03 (talk) 15:45, 28 July 2020 (UTC)
- You can use
LDAPProvider/maintenance/CheckLogin.php to test various configurations. Maybe remove/change the "searchstring" setting. Osnard (talk) 15:47, 28 July 2020 (UTC)
- In the previous version of mediawiki we had, we were using Extension:LDAP Authentication and it was working fine. I am not sure if that version is compatible with version 1.34 Anksanks03 (talk) 15:48, 28 July 2020 (UTC)
- Okay, let me try few options Anksanks03 (talk) 15:49, 28 July 2020 (UTC)
- Osnard,
- THANK YOU!!!
- I removed searchstring. After that I got error for Auto-creation of a local account failed: Automatic account creation is not allowed.
- I added the line $wgGroupPermissions['*']['createaccount'] = true; to my config.
- Now I am able to conenct to the mediawiki using my account.
- Thank you very much Anksanks03 (talk) 16:15, 28 July 2020 (UTC)
- You are welcome. Glad to hear I could help. Osnard (talk) 19:25, 28 July 2020 (UTC)
Could not bind to LDAP: (49) Invalid credentials
[edit]Hello,
I am trieing to connect Mediawiki with AD LDAP.
I get this error message:
[d291e3f9c48098334243b973] /index.php/Special:PluggableAuthLogin MWException from line 169 of /var/www/cpswiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials
Backtrace:
- 0 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- 1 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
- 2 /var/www/cpswiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
- 3 /var/www/cpswiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
- 4 /var/www/cpswiki/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)
- 5 /var/www/cpswiki/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)
- 6 /var/www/cpswiki/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)
- 7 /var/www/cpswiki/includes/MediaWiki.php(900): MediaWiki->performRequest()
- 8 /var/www/cpswiki/includes/MediaWiki.php(527): MediaWiki->main()
- 9 /var/www/cpswiki/index.php(44): MediaWiki->run()
- 10 {main}
my data:
PHP Version 7.2.24-0
ubuntu0.18.04.4
Wiki-Version 1.34.0
LocalSettings.php:
<?php
error_reporting( -1 );
ini_set( 'display_errors', 1 );
- This file was automatically generated by the MediaWiki 1.34.0
- installer. If you make manual changes, please keep track in case you
- need to recreate them later.
- See includes/DefaultSettings.php for all configurable settings
- and their default values, but don't forget to make changes in _this_
- file, not there.
- Further documentation for configuration settings may be found at:
- https://www.mediawiki.org/wiki/Manual:Configuration_settings
- Protect against web entry
if ( !defined( 'MEDIAWIKI' ) ) {
exit;
}
- Uncomment this to disable output compression
- $wgDisableOutputCompression = true;
$wgSitename = "cpswiki";
$wgMetaNamespace = "Cpswiki";
- The URL base path to the directory containing the wiki;
- defaults for all runtime URL paths are based off of this.
- For more information on customizing the URLs
- (like /w/index.php/Page_title to /wiki/Page_title) please see:
- https://www.mediawiki.org/wiki/Manual:Short_URL
$wgScriptPath = "";
- The protocol and server name to use in fully-qualified URLs
$wgServer = "http://131.246.211.155";
- The URL path to static resources (images, scripts, etc.)
$wgResourceBasePath = $wgScriptPath;
- The URL path to the logo. Make sure you change this from the default,
- or else you'll overwrite your logo when you upgrade!
$wgLogo = "$wgResourceBasePath/resources/assets/wiki.png";
- UPO means: this is also a user preference option
$wgEnableEmail = true;
$wgEnableUserEmail = true; # UPO
$wgEmergencyContact = "apache@🌻.invalid";
$wgPasswordSender = "apache@🌻.invalid";
$wgEnotifUserTalk = false; # UPO
$wgEnotifWatchlist = false; # UPO
$wgEmailAuthentication = true;
- Database settings
$wgDBtype = "mysql";
$wgDBserver = "localhost";
$wgDBname = "my_wiki";
$wgDBuser = "root";
$wgDBpassword = "Niroma5%";
- MySQL specific settings
$wgDBprefix = "";
- MySQL table options to use during installation or update
$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
- Shared memory settings
$wgMainCacheType = CACHE_NONE;
$wgMemCachedServers = [];
- To enable image uploads, make sure the 'images' directory
- is writable, then set this to true:
$wgEnableUploads = true;
- $wgUseImageMagick = true;
- $wgImageMagickConvertCommand = "/usr/bin/convert";
- InstantCommons allows wiki to use images from https://commons.wikimedia.org
$wgUseInstantCommons = false;
- Periodically send a pingback to https://www.mediawiki.org/ with basic data
- about this MediaWiki instance. The Wikimedia Foundation shares this data
- with MediaWiki developers to help guide future development efforts.
$wgPingback = true;
- If you use ImageMagick (or any other shell command) on a
- Linux server, this will need to be set to the name of an
- available UTF-8 locale
$wgShellLocale = "C.UTF-8";
- Set $wgCacheDirectory to a writable directory on the web server
- to make your wiki go slightly faster. The directory should not
- be publicly accessible from the web.
- $wgCacheDirectory = "$IP/cache";
- Site language code, should be one of the list in ./languages/data/Names.php
$wgLanguageCode = "en";
$wgSecretKey = "2axxxx";
- Changing this will log out all existing sessions.
$wgAuthenticationTokenVersion = "1";
- Site upgrade key. Must be set to a string (default provided) to turn on the
- web installer while LocalSettings.php is in place
$wgUpgradeKey = "31xxxx";
- For attaching licensing metadata to pages, and displaying an
- appropriate copyright notice / icon. GNU Free Documentation
- License and Creative Commons licenses are supported so far.
$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright
$wgRightsUrl = "";
$wgRightsText = "";
$wgRightsIcon = "";
- Path to the GNU diff3 utility. Used for conflict resolution.
$wgDiff3 = "/usr/bin/diff3";
- Default skin: you can change the default skin. Use the internal symbolic
- names, ie 'vector', 'monobook':
$wgDefaultSkin = "vector";
- Enabled skins.
- The following skins were automatically enabled:
wfLoadSkin( 'MonoBook' );
wfLoadSkin( 'Timeless' );
wfLoadSkin( 'Vector' );
- End of automatically generated settings.
- Add more configuration options below.
$wgFileExtensions = array( 'png', 'gif', 'jpg', 'jpeg', 'doc',
'xls', 'mpp', 'pdf', 'ppt', 'tiff', 'bmp', 'docx', 'xlsx',
'pptx', 'ps', 'odt', 'ods', 'odp', 'odg', 'zip'
);
$wgFileExtensions[] = 'zip';
// $wgTrustedMediaFormats[] = 'ARCHIVE';
$wgTrustedMediaFormats[] = 'application/zip';
$wgLogo = "{$wgUploadPath}/CPS_Logo-3_135x135Pixel_klein.jpg";
// Options for WYSIWYG-Editor
- Default user options:
$wgGroupPermissions['*']['wysiwyg']=true;
$wgGroupPermissions['user']['wysiwyg']=true;
$wgDefaultUserOptions['riched_disable'] = false;
$wgDefaultUserOptions['riched_start_disabled'] = false;
$wgDefaultUserOptions['riched_use_toggle'] = true;
$wgDefaultUserOptions['riched_use_popup'] = false;
$wgDefaultUserOptions['riched_toggle_remember_state'] = true;
$wgDefaultUserOptions['riched_link_paste_text'] = true;
$wgDefaultUserOptions['showtoolbar'] = true;
// MW>=1.26 and versions of WYSIWYG >= "1.5.6_0 [B551+02.07.2016]"
wfLoadExtension( 'WYSIWYG' );
// MW>=1.26 and versions of WYSIWYG >= "1.5.6_0 [B551+02.07.2016]" has dependency
// to module of WikiEditor so it must be enabled too (or otherwise file
// extension.json has to be edited manually to remove dependency)
wfLoadExtension( 'WikiEditor' );
$wgShowExceptionDetails = true;
//keine Bearbeitung durch anonyme Benutzer
$wgGroupPermissions['*']['read'] = false;
//kein Lesen durch anonyme Benutzer
$wgGroupPermissions['*']['read'] = false;
//Logs aktivieren -> in Datei
//Vorschlag von Manual
//$wgDebugLogFile = "/var/log/mediawiki/debug-{$wgDBname}.log";
//$wgDebugLogFile = "/var/www/cpswiki/debug-{$wgDBname}.log";
//$wgLDAPDebug = 3;
$wgDebugLogGroups["ldap"] = "/var/www/cpswiki/debug.log";
//AD Configuration:
wfLoadExtension( 'LDAPProvider' );
//$LDAPProviderDomainConfigs = "$IP/AD_config/ldapprovider.json";
//Default-Pfad wird schon mit /var/www/cpswiki/ vordefiniert!
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPAuthentication2' );
$LDAPAuthentication2AllowLocalLogin = true;
$LDAPProviderDomainConfigProvider = function() {
$config = [
"cps.local" => [
'connection' => [
"server" => "cpsxxx.de",
"port" => "389",
"user" => "cps.local\\cpswikiMediawiki",
"pass" => 'NiXXX',
//"enctype" => "ssl",
"options" => [
"LDAP_OPT_DEREF" => 1
],
"basedn" => "DC=cps,DC=local",
"groupbasedn" => "DC=cps,DC=local",
"userbasedn" => "DC=cps,DC=local",
"searchattribute" => "sAMAccountName",
"searchstring" => "cps.local\\cpswikiMediawiki,DC=cps,DC=local",
"usernameattribute" => "sAMAccountName",
"realnameattribute" => "cn",
"emailattribute" => "mail"
]
]
];
return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};
//$LDAPProviderDomainConfigProvider= "\\MediaWiki\\Extension\\LDAPProvider\\DomainConfigProvider\\LocalJSONFile::newInstance";
//für Debugging Check
$wgDebugComments = true;
$wgSessionCacheType = CACHE_DB;
$wgHooks['SetupAfterCache'][] = function () {
global $wgSessionCacheType;
ObjectCache::getInstance( $wgSessionCacheType )->setDebug( true );
}; 2001:638:208:4903:1D73:7495:DF05:D05B (talk) 11:30, 31 July 2020 (UTC)
- In the domain config, the value for "user" (currently "cps.local\\cpswikiMediawiki") must be a valid LDAP-CN, e.g. "CN=cpswikiMediawiki,DC=cps,DC=local". Also the "searchstring" should be "CN=USER-NAME,DC=cps,DC=local". When using "sAMAccountName" anywhere, make sure your LDAP returns it in exact this casing. Usually the lower case variant "samacountname" is more common. Osnard (talk) 15:12, 31 July 2020 (UTC)
- Hello,
- Thank you.
- I edited the config:
- it is still the same error.
- what you mean with: "sAMAccountName" ... make sure your LDAP returns it in exact this casing?
$config = [ "cps.local" => [ 'connection' => [ "server" => "cpswin.cs.uni-kl.de", "port" => "389", "user" => "CN=cpswikiMediawiki,DC=cps,DC=local", "pass" => 'Nixxx', //no binding error //"enctype" => "ssl", "options" => [ "LDAP_OPT_DEREF" => 1 ], "basedn" => "DC=cps,DC=local", "groupbasedn" => "DC=cps,DC=local", "userbasedn" => "DC=cps,DC=local", "searchattribute" => "samaccountname", "searchstring" => "CN=USER-NAME,DC=cps,DC=local", "usernameattribute" => "samaccountname", "realnameattribute" => "cn", "emailattribute" => "mail" ] ] ]; Grüneisen23 (talk) 12:12, 3 August 2020 (UTC)- Regarging "samaccountname": Just put in the same value for that field name that is shown in the output of a "LDAPProvider/maintenance/ShowUserInfo.php" run.
- Regarding "Could not bind to LDAP: (49) Invalid credentials": The call-stack tells that this is actually occurring when the username and password provided in the user login from are used to bind to the LDAP.
- Does "LDAPProvider/maintenance/CheckLogin.php" work with the same credentials?
- Could you please enable the debug log and share its contents? Osnard (talk) 15:24, 3 August 2020 (UTC)
- I tried these commands:
- php extensions/LDAPProvider/maintenance/CheckLogin.php --domain cps.local --username test
- Password:Nxxxxx
- MWException from line 169 of /var/www/cpswiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials
- 0 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- 1 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
- 2 /var/www/cpswiki/extensions/LDAPProvider/maintenance/CheckLogin.php(50): MediaWiki\Extension\LDAPProvider\Client->canBindAs('test', 'Nxxx')
- 3 /var/www/cpswiki/maintenance/doMaintenance.php(99): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()
- 4 /var/www/cpswiki/extensions/LDAPProvider/maintenance/CheckLogin.php(76): require_once('/var/www/cpswik...')
- 5 {main}
- php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain cps.local --username test
- MWException from line 169 of /var/www/cpswiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials
- 0 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- 1 /var/www/cpswiki/extensions/LDAPProvider/src/Client.php(230): MediaWiki\Extension\LDAPProvider\Client->init()
- 2 /var/www/cpswiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(48): MediaWiki\Extension\LDAPProvider\Client->getUserInfo('test')
- 3 /var/www/cpswiki/maintenance/doMaintenance.php(99): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()
- 4 /var/www/cpswiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(71): require_once('/var/www/cpswik...')
- 5 {main}
- I put in these commands for debug log (LocalSettings.php): ->
- $wgDebugLogGroups['PluggableAuth'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAP'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPGroups'] =
- $wgDebugLogGroups['LDAPUserInfo'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPAuthentication2'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log';
- -> I tried also path: /var/www/cpswiki/
- but I found no LDAP.log
- Thank you Grüneisen23 (talk) 07:25, 4 August 2020 (UTC)
- Without an error log it's hard to be sure, but please try to remove
"searchstring" => "CN=USER-NAME,DC=cps,DC=local",- from your domain config. Osnard (talk) 19:21, 4 August 2020 (UTC)
- Hello!
- I'm having this error when trying to log into the mediawiki page
- [9b6ee6bb3cd60a614c7387a5] /index.php/Especial:PluggableAuthLogin MWException: Could not bind to LDAP: (49) Invalid credentials
- Backtrace:
- from /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(195)
- #0 /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(118): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- #1 /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(355): MediaWiki\Extension\LDAPProvider\Client->init()
- #2 /var/www/docs.tesacom.net/extensions/LDAPAuthentication2/src/PluggableAuth.php(184): MediaWiki\Extension\LDAPProvider\Client->canBindAs()
- #3 /var/www/docs.tesacom.net/extensions/LDAPAuthentication2/src/PluggableAuth.php(55): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin()
- #4 /var/www/docs.tesacom.net/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate()
- #5 /var/www/docs.tesacom.net/includes/specialpage/SpecialPage.php(646): PluggableAuthLogin->execute()
- #6 /var/www/docs.tesacom.net/includes/specialpage/SpecialPageFactory.php(1386): SpecialPage->run()
- #7 /var/www/docs.tesacom.net/includes/MediaWiki.php(309): MediaWiki\SpecialPage\SpecialPageFactory->executePath()
- #8 /var/www/docs.tesacom.net/includes/MediaWiki.php(913): MediaWiki->performRequest()
- #9 /var/www/docs.tesacom.net/includes/MediaWiki.php(546): MediaWiki->main()
- #10 /var/www/docs.tesacom.net/index.php(53): MediaWiki->run()
- #11 /var/www/docs.tesacom.net/index.php(46): wfIndexMain()
- #12 {main Ctorrestesam (talk) 15:35, 28 March 2022 (UTC)
- Apparently the combination of "username"/"password" configured in the LDAP domain config in the "connection" section is wrong. Osnard (talk) 07:19, 29 March 2022 (UTC)
- i just checked the credentials and they're correct.
- Now when i try to log on the wiki page it just says "LDAP login failed" Ctorrestesam (talk) 14:53, 29 March 2022 (UTC)
- This is the current error im receiving
- [39491a3c4694708175360258] /index.php/Especial:PluggableAuthLogin MWException: Could not bind to LDAP: (49) Invalid credentials
- Backtrace:
- from /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(195)
- #0 /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(118): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- #1 /var/www/docs.tesacom.net/extensions/LDAPProvider/src/Client.php(355): MediaWiki\Extension\LDAPProvider\Client->init()
- #2 /var/www/docs.tesacom.net/extensions/LDAPAuthentication2/src/PluggableAuth.php(184): MediaWiki\Extension\LDAPProvider\Client->canBindAs()
- #3 /var/www/docs.tesacom.net/extensions/WikiToLDAP/includes/PluggableAuth.php(91): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin()
- #4 /var/www/docs.tesacom.net/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\WikiToLDAP\PluggableAuth->authenticate()
- #5 /var/www/docs.tesacom.net/includes/specialpage/SpecialPage.php(646): PluggableAuthLogin->execute()
- #6 /var/www/docs.tesacom.net/includes/specialpage/SpecialPageFactory.php(1386): SpecialPage->run()
- #7 /var/www/docs.tesacom.net/includes/MediaWiki.php(309): MediaWiki\SpecialPage\SpecialPageFactory->executePath()
- #8 /var/www/docs.tesacom.net/includes/MediaWiki.php(913): MediaWiki->performRequest()
- #9 /var/www/docs.tesacom.net/includes/MediaWiki.php(546): MediaWiki->main()
- #10 /var/www/docs.tesacom.net/index.php(53): MediaWiki->run()
- #11 /var/www/docs.tesacom.net/index.php(46): wfIndexMain()
- #12 {main Ctorrestesam (talk) 18:34, 29 March 2022 (UTC)
- Could you please enable the debug log and share its contents? Osnard (talk) 08:29, 30 March 2022 (UTC)
ERROR: Could not authenticate credentials against domain
[edit]
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
<nowiki>
Hi there,
I tried for some weeks now to get LDAP Stack working with mediawiki in an AD Domain. Tried most from the other Talks here what I have found but no results so far.
My config:
##################################################
LocalSettings.php
<?php
if ( !defined( 'MEDIAWIKI' ) ) { exit;}
require_once "$IP/includes/PlatformSettings.php";
# $wgDisableOutputCompression = true;
$wgSitename = "Company";
$wgScriptPath = "/mediawiki";
$wgServer = "http://IP";
$wgResourceBasePath = $wgScriptPath;
$wgEnableEmail = true;
$wgEnableUserEmail = true; # UPO
$wgEmergencyContact = "apache@IP";
$wgPasswordSender = "apache@IP";
$wgEnotifUserTalk = false; # UPO
$wgEnotifWatchlist = false; # UPO
$wgEmailAuthentication = true;
## Database settings
$wgDBtype = "mysql";
$wgDBserver = "localhost";
$wgDBname = "mywiki";
$wgDBuser = "";
$wgDBpassword = "";
$wgDBprefix = "";
$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";
$wgMainCacheType = CACHE_NONE;
$wgMemCachedServers = [];
$wgEnableUploads = false;
#$wgUseImageMagick = true;
#$wgImageMagickConvertCommand = "/usr/bin/convert";
$wgUseInstantCommons = false;
$wgPingback = false;
$wgShellLocale = "C.UTF-8";
$wgLanguageCode = "en";
$wgSecretKey = "some";
# $wgSecretKey = "other";
$wgAuthenticationTokenVersion = "1";
$wgUpgradeKey = "some";
# $wgUpgradeKey = "other";
$wgRightsPage = "";
$wgRightsUrl = "";
$wgRightsText = "";
$wgRightsIcon = "";
$wgDiff3 = "/usr/bin/diff3";
$wgDefaultSkin = "vector";
wfLoadSkin( 'MonoBook' );
wfLoadSkin( 'Timeless' );
wfLoadSkin( 'Vector' );
# End of automatically generated settings.
# Add more configuration options below.
//commented out - first try didn't work
//wfLoadExtensions( [ 'LDAPProvider', 'LDAPUserInfo', 'LDAPGroups', 'PluggableAuth', 'LDAPAuthentication2' ] );
//LDAP
//$LDAPProviderDomainConfigs = "/etc/mediawiki/ldapprovider.json";
//$wgLDAPDomainNames = array("Comp");
//$wgLDAPServerNames = array("Comp" => "Comp.xx");
//$wgLDAPUseLocal = false;
//$wgLDAPEncryptionType = array("Comp" => "ssl");
//$wgLDAPSearchStrings = array("Comp" => "COMP\\USER-NAME");
//# testweise wegen Neuanmeldeproblemen:
//$wgGroupPermissions['*']['autocreateaccount'] = true;
//$wgPluggableAuth_EnableLocalLogin = false;
//$LDAPAuthentication2UsernameNormalizer = 'strtolower'
// DEBUG
$wgDebugLogGroups["LDAP"] = "/var/lib/mediawiki/log/ldap-debug.log";
$wgLDAPDebug = 3; //for debugging LDAP
$wgShowExceptionDetails = true; //for debugging MediaWiki
$wgDebugLogGroups["ldap"] = "/var/lib/mediawiki/log/wikidebug.log";
$wgDebugLogFile = "/var/lib/mediawiki/log/wikidebug-{$wgDBname}.log";
//LDAP
wfLoadExtension( 'LDAPProvider' );
$LDAPProviderDomainConfigs = "/etc/mediawiki/ldap.json";
wfLoadExtension( 'PluggableAuth' );
$wgPluggableAuth_EnableLocalLogin = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgGroupPermissions['*']['createaccount'] = false;
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPAuthentication2' );
$LDAPAuthentication2UsernameNormalizer = 'strtolower';
$LDAPAuthentication2AllowLocalLogin = false;
// Erstellen neuer Accounts unterbinden
//$wgGroupPermissions['*' ]['createaccount'] = false;
// Verhindern, dass nicht eingeloggte Benutzer Seiten bearbeiten:
//$wgGroupPermissions['*' ]['edit'] = false;
// Somehow I configure debug twice....
$wgLDAPDebug = 4;
$wgDebugLogGroups['PluggableAuth'] =
$wgDebugLogGroups['LDAP'] =
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =
$wgDebugLogGroups['LDAPGroups'] =
$wgDebugLogGroups['LDAPUserInfo'] =
$wgDebugLogGroups['LDAPAuthentication2'] =
$wgDebugLogGroups['LDAPAuthorization'] = '/var/lib/mediawiki/log/LDAP.log';
###################################################################
ldap.json
{
"Comp.xx": {
"connection": {
"server": "dc.Comp.xx",
"user": "CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx",
"pass": "Passwd",
"options": [
{"LDAP_OPT_DEREF": 1}
],
"port": 636,
"enctype": "ssl",
"basedn": "dc=Comp,dc=xx",
"groupbasedn": "dc=Comp,dc=xx",
"userbasedn": "dc=Comp,dc=xx",
"searchattribute": "uid",
"searchstring": "uid=USER-NAME,dc=Comp,dc=xx",
"usernameattribute": "uid",
"realnameattribute": "cn",
"emailattribute": "mail"
}
}
}
#########################################################
Log when I try to bind
2020-08-04 05:37:12 testwiki mywiki: In execute()
2020-08-04 05:37:12 testwiki mywiki: Getting PluggableAuth singleton
2020-08-04 05:37:12 testwiki mywiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
2020-08-04 05:37:13 testwiki mywiki: ldap_connect( $hostname = 'ldaps://dc.Comp.xx:636', $port = 389 ); <-- why??
2020-08-04 05:37:13 testwiki mywiki: # __METHOD__ returns Resource id #34
2020-08-04 05:37:13 testwiki mywiki: Setting KEY: LDAP_OPT_PROTOCOL_VERSION to VALUE: 3
2020-08-04 05:37:13 testwiki mywiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
2020-08-04 05:37:13 testwiki mywiki: # returns 1
2020-08-04 05:37:13 testwiki mywiki: Setting KEY: LDAP_OPT_REFERRALS to VALUE: 0
2020-08-04 05:37:13 testwiki mywiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
2020-08-04 05:37:13 testwiki mywiki: # returns 1
2020-08-04 05:37:13 testwiki mywiki: Encryption set to ssl
2020-08-04 05:37:13 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx', $bindPassword = 'XXXX' ); <-- $linkID looks like smth missing
2020-08-04 05:37:13 testwiki mywiki: # returns 1
2020-08-04 05:37:13 testwiki mywiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=me_myself,dc=Comp,dc=xx'
2020-08-04 05:37:13 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'uid=me_myself,dc=Comp,dc=xx', $bindPassword = 'XXXX' );
2020-08-04 05:37:13 testwiki mywiki: # returns
2020-08-04 05:37:13 testwiki mywiki: Authentication failure.
2020-08-04 05:37:13 testwiki mywiki: ERROR: Could not authenticate credentials against domain "Comp.xx"
####################################################
I edited LDAPProvider/src/Client.php like this because it made problems with trying to set option "0" and failed
protected function setConnectionOptions() {
$options = [
"LDAP_OPT_PROTOCOL_VERSION" => 3,
"LDAP_OPT_REFERRALS" => 0
];
if ( $this->config->has( ClientConfig::OPTIONS ) ) {
$options = array_merge(
$options, $this->config->get( ClientConfig::OPTIONS )
);
}
foreach ( $options as $key => $value ) {
if ($key != '0') { <-- this is new
$this->logger->debug( "Setting KEY: $key to VALUE: $value" );
$ret = $this->connection->setOption( constant( $key ), $value );
if ( $ret === false ) {
$message = 'Cannot set option to LDAP connection!';
$this->logger->debug( $message, [ $key, $value ] );
}
} <-- well and this is new too
}
}
OS is Ubuntu 20.04
I installed mediawiki from apt-get and got all necessary LDAP tools from source tars from mediawiki.org.
I installed local LDAP with the same config and it works.
php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain Comp.xx --username xyz
and
php maintenance/checkUsernames.php don't produce any output at all
local "getent passwd" returns domain users
# /etc/nslcd.conf
# nslcd configuration file. See nslcd.conf(5)
# for details.
# The user and group nslcd should run as.
uid nslcd
gid nslcd
# The location at which the LDAP server(s) should be reachable.
uri ldaps://dc.Comp.xx
uri ldaps://backup
# The search base that will be used for all queries.
base dc=Comp,dc=xx
# The DN to bind with for normal lookups.
#binddn CN=Linux LDAP,OU=1,OU=0,DC=Comp,DC=xx
binddn ldap.linux@comp.xx
bindpw passwd
pagesize 1000
referrals off
idle_timelimit 1000
#filter passwd (&(Objectclass=user)(!(objectClass=computer))(memberOf=CN="IntITAdm",OU=some,OU=groups,DC=Comp,DC=xx))
filter passwd (|(&(Objectclass=user)(!(objectClass=computer))(memberOf=CN="IntITMail",OU=some,OU=groups,DC=Comp,DC=xx))(&(Objectclass=user)(!(objectClass=comp>
map passwd uid sAMAccountName
map passwd uidNumber objectSid:xyz
map passwd gidNumber objectSid:xyz
map passwd homeDirectory "/home/$sAMAccountName"
map passwd gecos displayName
map passwd loginShell "/bin/bash"
filter group (&(|(objectClass=group)(Objectclass=user))(!(objectClass=computer)))
map group cn sAMAccountName
map group gidNumber objectSid:xyz
# SSL options
ssl on
tls_reqcert demand
tls_cacert /etc/ssl/certs/ca-certificates.crt
</nowiki> Ds sra (talk) 08:37, 4 August 2020 (UTC)
- So from the log it looks like binding with the configured "CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx" works, but then it tries to bind with "uid=me_myself,dc=Comp,dc=xx" and that fails. Can you confirm that "uid=me_myself,dc=Comp,dc=xx" is a proper User-DN? Is there maybe an issue with the underscore in the UID? Osnard (talk) 19:14, 4 August 2020 (UTC)
- Hi
- in the real uid is no underscore but a "." instead. i can log onto the server (connected to DAP) with that user but not into the wiki.
- Did I maybe get something wrong with uid/samaccountname etc as the LDAP server is a Windows AD? I am not really fit with AD at all.
- I tried my best to equalize wiki-LDAP with server-LDAP as the second one works fine maybe I went wrong there somehow
- I also tried to log into Mediwiki with the ldap linux users, authentication failed just the same so I am kind of certain its not the credentials but something else. Just not really sure where to look for it Ds sra (talk) 10:47, 10 August 2020 (UTC)
- 2020-08-10 10:49:35 testwiki mywiki: In execute()
- 2020-08-10 10:49:35 testwiki mywiki: Getting PluggableAuth singleton
- 2020-08-10 10:49:35 testwiki mywiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-08-10 10:49:35 testwiki mywiki: ldap_connect( $hostname = 'ldaps://dc.Comp.xx:636', $port = 389 );
- 2020-08-10 10:49:35 testwiki mywiki: # __METHOD__ returns Resource id #22
- 2020-08-10 10:49:35 testwiki mywiki: Setting KEY: LDAP_OPT_PROTOCOL_VERSION to VALUE: 3
- 2020-08-10 10:49:35 testwiki mywiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-08-10 10:49:35 testwiki mywiki: # returns 1
- 2020-08-10 10:49:35 testwiki mywiki: Setting KEY: LDAP_OPT_REFERRALS to VALUE: 0
- 2020-08-10 10:49:35 testwiki mywiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-08-10 10:49:35 testwiki mywiki: # returns 1
- 2020-08-10 10:49:35 testwiki mywiki: Encryption set to ssl
- 2020-08-10 10:49:35 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx', $bindPassword = 'XXXX' );
- 2020-08-10 10:49:35 testwiki mywiki: # returns 1
- 2020-08-10 10:49:35 testwiki mywiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=ldap.linux,dc=Comp,dc=xx'
- 2020-08-10 10:49:35 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'uid=ldap.linux,dc=Comp,dc=xx', $bindPassword = 'XXXX' );
- 2020-08-10 10:49:35 testwiki mywiki: # returns
- 2020-08-10 10:49:35 testwiki mywiki: Authentication failure.
- 2020-08-10 10:49:35 testwiki mywiki: ERROR: Could not authenticate credentials against domain "Comp.xx"
- might the problem be in the missing ou? I am not that certain, if I need to make any preparations on the AD side, in most cases I faced to now I just had to set up the client.
- I read in some talks about verification via maintenance scripts. I tried some but didnt really get results, maybe i am just not using them right. Is there siome kind of tutorial/manual page for them? tried with google but not really found anything so far Ds sra (talk) 11:26, 10 August 2020 (UTC)
- So
"uid=me_myself,dc=Comp,dc=xx" looks strange for a LDAP user name. I'd have expected a CN. The same way as you have configured it in the "connection.user" field of your domain config. Especially not that I now you are using AD as LDAP backend I am pretty sure the user DN ist wrong. Can you please share your domain config? Osnard (talk) 15:51, 10 August 2020 (UTC)
- What do you mean with domain config exactly? Is this something i can read out from the linux client? Or something I get from the AD server? and if the second one: how? :)
- As said, I am not really that fit with Microsoft AD and for now avoided changing anything there
- Changing uid to CN makes sense to me. Can i just change the string in the ldap.json file?
- "basedn": "dc=Comp,dc=xx",
- "groupbasedn": "dc=Comp,dc=xx",
- "userbasedn": "ou=0,dc=Comp,dc=xx",
- "searchattribute": "uid", //change this to cn? or keep it like this?
- "searchstring": "uid=USER-NAME,dc=Comp,dc=xx", //change to "CN=USER-NAME,DC=Comp,DC=xx" ??
- "usernameattribute": "uid",
- "realnameattribute": "cn",
- "emailattribute": "mail"
- I am a little bit far out in deep waters here by now for me, so sorry if some question seem a little dumb xD Ds sra (talk) 07:34, 11 August 2020 (UTC)
- That's the "domain config", yes. Nothing to be afraid of, thre are no dump questions when it comes to LDAP :)
- Can you try to remove "searchstring" completely? In an AD based LDAP the value for "searchattribute" mostly is "samaccountname", not "uid". Same is for the "usernameattribute". Osnard (talk) 09:41, 11 August 2020 (UTC)
- tried this, got this error on the site:
- #####################################################
- [74c233fe1a807a30f3029bc7] /mediawiki/index.php/Special:PluggableAuthLogin MWException from line 66 of /usr/share/mediawiki/extensions-core/LDAPProvider/src/DomainConfigFactory.php: No section 'authorization' found in configuration for domain 'Comp.xx'!
- Backtrace:
- #0 /usr/share/mediawiki/extensions-core/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(57): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory()
- #1 /usr/share/mediawiki/extensions-core/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(69): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->__construct()
- #2 /usr/share/mediawiki/includes/Hooks.php(177): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::callback()
- #3 /usr/share/mediawiki/includes/Hooks.php(205): Hooks::callHook()
- #4 /usr/share/mediawiki/extensions-core/PluggableAuth/includes/PluggableAuthLogin.php(47): Hooks::run()
- #5 /usr/share/mediawiki/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute()
- #6 /usr/share/mediawiki/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run()
- #7 /usr/share/mediawiki/includes/MediaWiki.php(288): SpecialPageFactory::executePath()
- #8 /usr/share/mediawiki/includes/MediaWiki.php(861): MediaWiki->performRequest()
- #9 /usr/share/mediawiki/includes/MediaWiki.php(524): MediaWiki->main()
- #10 /usr/share/mediawiki/index.php(42): MediaWiki->run()
- #11 {main}
- #####################################################
- and a log with a HUGE array (probably all there is in the domain about the user)
- ####################################################
- 2020-08-11 10:24:42 testwiki mywiki: In execute()
- 2020-08-11 10:24:42 testwiki mywiki: Getting PluggableAuth singleton
- 2020-08-11 10:24:42 testwiki mywiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-08-11 10:24:42 testwiki mywiki: ldap_connect( $hostname = 'ldaps://dc.Comp.xx:636', $port = 389 );
- 2020-08-11 10:24:42 testwiki mywiki: # __METHOD__ returns Resource id #22
- 2020-08-11 10:24:42 testwiki mywiki: Setting KEY: LDAP_OPT_PROTOCOL_VERSION to VALUE: 3
- 2020-08-11 10:24:42 testwiki mywiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: Setting KEY: LDAP_OPT_REFERRALS to VALUE: 0
- 2020-08-11 10:24:42 testwiki mywiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: Encryption set to ssl
- 2020-08-11 10:24:42 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx', $bindPassword = 'XXXX' );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (
- 'base' => 'dc=Comp,dc=xx',
- 'filter' => '(samaccountname=ldap.linux)',
- 'attributes' =>
- array (
- 0 => '*',
- 1 => 'memberof',
- ),
- )
- 2020-08-11 10:24:42 testwiki mywiki: ldap_search( $linkID, $baseDN = 'dc=Comp,dc=xx', $filter = '(samaccountname=ldap.linux)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = );
- 2020-08-11 10:24:42 testwiki mywiki: # returns Resource id #35
- 2020-08-11 10:24:42 testwiki mywiki: ldap_count_entries( $linkiID, $result = 'Resource id #35' );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: ldap_get_entries( $linkID, $resultID );
- 2020-08-11 10:24:42 testwiki mywiki: # returns: array (
- ### all data about user ldap linux (roughly 200 lines) ###
- )
- 2020-08-11 10:24:42 testwiki mywiki: Found user DN: 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx'
- 2020-08-11 10:24:42 testwiki mywiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: same as above
- 2020-08-11 10:24:42 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx', $bindPassword = 'XXXX' );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: ldap_bind( $linkID, $bindRDN = 'CN=ldap linux,OU=1,OU=0,DC=Comp,DC=xx', $bindPassword = 'XXXX' );
- 2020-08-11 10:24:42 testwiki mywiki: # returns 1
- 2020-08-11 10:24:42 testwiki mywiki: ldap_search( $linkID, $baseDN = 'ou=0,dc=Comp,dc=xx', $filter = '(samaccountname=ldap.linux)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = );
- 2020-08-11 10:24:42 testwiki mywiki: # returns Resource id #48
- 2020-08-11 10:24:42 testwiki mywiki: ldap_get_entries( $linkID, $resultID );
- 2020-08-11 10:24:42 testwiki mywiki: # returns: array (
- ### again probably all data there is about the user as above ###
- )
- 2020-08-11 10:24:42 testwiki mywiki: Ran LDAP search for '(samaccountname=ldap.linux)' in 0.001784086227417 seconds.
- #########################
- but i got no authentication error anymore, which is nice
- this is my ldap.json file after the changes:
- "basedn": "dc=Comp,dc=xx",
- "groupbasedn": "dc=Comp,dc=xx",
- "userbasedn": "ou=0,dc=Comp,dc=xx",
- "searchattribute": "samaccountname",
- "usernameattribute": "samaccountname",
- "realnameattribute": "cn",
- "emailattribute": "mail" Ds sra (talk) 10:41, 11 August 2020 (UTC)
- That's a progress! Now, disable extension LDAPAuthorization (if not requried by your use case or e.g. in conjunction with Extension:Auth_remoteuser), or configure it properly. Osnard (talk) 11:45, 11 August 2020 (UTC)
- Thanks so much. I finally got it working. I commented LDAPAuthorization out in the config and it works now. Thank you Ds sra (talk) 12:06, 11 August 2020 (UTC)
The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.
Possible Bug in Client.php - protected function setConnectionOptions()
[edit]Hi all,
I ran into the situation that the Client.php Script terminated with an error because it tried to set an option for a key "0".
I could not really look at it deeply but it happened two times while I set up test-wikis.
I added an if-condition as posted below to fix this for me.
foreach ( $options as $key => $value ) {
$this->logger->debug( "Setting $key to $value" );
HERE --> if ( $key != "0" ) {
$ret = $this->connection->setOption( constant( $key ), $value );
if ( $ret === false ) {
$message = 'Cannot set option to LDAP connection!';
$this->logger->debug( $message, [ $key, $value ] );
}
well and here... }
}
maybe you can check if this is a general bug or just for me and apply a fix (maybe mine, maybe a better one) if it's a general issue.
Have a nice day Ds sra (talk) 09:33, 13 August 2020 (UTC)
- Could you share the
connection section of your domain config? Osnard (talk) 12:29, 14 August 2020 (UTC)
After Configuring LDAP WikiEditor no longer shows
[edit]
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
I have configured LDAP and users on my network are able to log in to the wiki. However, if a user goes to either edit or create a page the WikiEditor toolbar no longer shows. If I disable the LDAP functionality by commenting out all of the LDAP section I created in LocalSettings.php, I can then log in to a non-LDAP user account and the WikiEditor toolbar shows when attempting to edit a page.
I also noticed that when I have the LDAP configuration enabled, within User Preferences that clicking on any tab after the currently displayed first tab does nothing. The tabs are there, but clicking them does not make the details of these tabs show. I am wondering if I need some additional component within my LDAP setup, or if LDAP and WikiEditor are not compatible. I have tried adding lines to the LocalSettings.php file such as "$wgHiddenPrefs[] = 'usebetatoolbar';" to see if i could force it to show. Nothing has worked. Nwroble (talk) 19:09, 26 August 2020 (UTC)
The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.
Internal Error: Could not bind to LDAP: (49) Invalid credentials
[edit]Hello,
I'm setting up a fresh installation of mediawiki. I tried to enable authentication via Windows Server 2019 Active Directory LDAP buy I get this error:
MediaWiki 1.31.8
PHP 7.2.3
CentOS7
[X2S72MCSSXcVt8h1PkewFQAAAAI] /index.php/Speciale:PluggableAuthLogin MWException from line 169 of /var/www/html/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials
Backtrace:
#0 /var/www/html/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /var/www/html/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#4 /var/www/html/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)
#5 /var/www/html/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
#6 /var/www/html/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)
#7 /var/www/html/includes/MediaWiki.php(861): MediaWiki->performRequest()
#8 /var/www/html/includes/MediaWiki.php(524): MediaWiki->main()
#9 /var/www/html/index.php(42): MediaWiki->run()
#10 {main}
I followed the procedure described at this link: Manual:Active Directory Integration.
I added this configuration into LocalSettings.php:
// Safe IP or not (for bypassing external login via AD)
$safeIPs = array('127.0.0.1','localhost');
$ipsVars = array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR');
foreach ($ipsVars as $ipsVar) {
if (isset($_SERVER[$ipsVar]) && mb_strlen($_SERVER[$ipsVar]) > 3 ) { $wikiRequestIP = $_SERVER[$ipsVar]; break; }
}
$wikiRequestSafe = (isset($wikiRequestIP) && ( in_array($wikiRequestIP,$safeIPs) ));
// Create Wiki-Group 'engineering' from default user group
$wgGroupPermissions['engineering'] = $wgGroupPermissions['user'];
// Private Wiki. External LDAP login. Default NS requires login.
$wgEmailConfirmToEdit = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgBlockDisablesLogin = true;
// Load LDAP Config from JSON
$ldapJsonFile = "$IP/ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
$testJson = @json_decode(file_get_contents($ldapJsonFile),true);
if (is_array($testJson)) {
$ldapConfig = true;
} else {
error_log("Found invalid JSON in file: $IP/ldap.json");
}
}
// Activate Extension
if ( $ldapConfig ) {
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPUserInfo' );
wfLoadExtension( 'LDAPGroups' );
$LDAPProviderDomainConfigs = $ldapJsonFile;
$wgPluggableAuth_ButtonLabel = "Log In";
if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }
}
$wgShowExceptionDetails = true;
ldap.json:
{
"lenfiber.local": {
"connection": {
"server": "serverdc01.lenfiber.local",
"port": "3268",
"user": "CN=mediawiki-sa,OU=Users,DC=lenfiber,DC=local",
"pass": "xxxxxxx",
"enctype": "clear",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "dc=lenfiber,dc=local",
"userbasedn": "dc=lenfiber,dc=local",
"groupbasedn": "dc=lenfiber,dc=local",
"searchattribute": "samaccountname",
"usernameattribute": "samaccountname",
"realnameattribute": "cn",
"emailattribute": "mail",
"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
},
"userinfo": [],
"authorization": [],
"groupsync": {
"mapping": {
"engineering": "CN=Domain Admins,OU=Groups,DC=lenfiber,DC=local",
"bureaucrat": "CN=Domain Admins,OU=Groups,DC=lenfiber,DC=local",
"interface-admin": "CN=Domain Admins,OU=Groups,DC=lenfiber,DC=local",
"sysop": "CN=Domain Admins,OU=Groups,DC=lenfiber,DC=local"
}
}
}
}
- I don't think
"enctype": "clear" will work for MS AD anymore. Can you tell that the debug logs show? Osnard (talk) 06:40, 21 September 2020 (UTC)
- I put these lines into LocalSettings.php but non LDAP.log have been created in /TMP
- $wgShowExceptionDetails = true;
- $wgDebugLogGroups['PluggableAuth'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAP'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPGroups'] =
- $wgDebugLogGroups['LDAPUserInfo'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPAuthentication2'] = '/tmp/LDAP.log';
- $wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log'; Mshuttle (talk) 07:10, 21 September 2020 (UTC)
- Please make sure
/tmp/LDAP.log is writeable by the webserver. Do you maybe have SELinux enabled? Osnard (talk) 09:59, 21 September 2020 (UTC)
- I disabled SELinux and /tmp/LDAP.log is chmod 777.
- LDAP.log is still empty Mshuttle (talk) 07:14, 22 September 2020 (UTC)
- I changed target LDAP.log location and now I have the log:
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: In execute()
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: Getting PluggableAuth singleton
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_connect( $hostname = 'ldap://serverdc01.lenfiber.local:3268', $port = 389 );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # __METHOD__ returns Resource id #244
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_REFERRALS to 0
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_DEREF to 1
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_bind( $linkID, $bindRDN = 'CN=mediawiki-sa,OU=Users,DC=lenfiber,DC=local', $bindPassword = 'XXXX' );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_error( $linkID );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns Invalid credentials
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: ldap_errno( $linkID );
- 2020-09-22 07:25:21 85.208.243.252 lenfiber_wiki: # returns 49 Mshuttle (talk) 07:27, 22 September 2020 (UTC)
- Sorry, no new information here. Do the standard PHP error logs show anything? Have you tried a different "enctype"? Osnard (talk) 11:30, 22 September 2020 (UTC)
- With enctype=SSL I get:
- [X2sVY4@6US-2Ez5eYUwrVAAAAAE] /index.php/Speciale:PluggableAuthLogin MWException from line 169 of /var/www/html/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server
- Backtrace:
- #0 /var/www/html/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
- #1 /var/www/html/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
- #2 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
- #3 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
- #4 /var/www/html/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)
- #5 /var/www/html/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- #6 /var/www/html/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)
- #7 /var/www/html/includes/MediaWiki.php(861): MediaWiki->performRequest()
- #8 /var/www/html/includes/MediaWiki.php(524): MediaWiki->main()
- #9 /var/www/html/index.php(42): MediaWiki->run()
- #10 {main}
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: In execute()
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: Getting PluggableAuth singleton
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: ldap_connect( $hostname = 'ldaps://serverdc01.lenfiber.local:3268', $port = 389 );
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: # __METHOD__ returns Resource id #244
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_REFERRALS to 0
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_DEREF to 1
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:29:07 85.208.243.252 lenfiber_wiki: ldap_bind( $linkID, $bindRDN = 'CN=mediawiki-sa,OU=Users,DC=lenfiber,DC=local', $bindPassword = 'XXXX' );
- 2020-09-23 09:29:08 85.208.243.252 lenfiber_wiki: # returns
- 2020-09-23 09:29:08 85.208.243.252 lenfiber_wiki: ldap_error( $linkID );
- 2020-09-23 09:29:08 85.208.243.252 lenfiber_wiki: # returns Can't contact LDAP server
- 2020-09-23 09:29:08 85.208.243.252 lenfiber_wiki: ldap_errno( $linkID );
- 2020-09-23 09:29:08 85.208.243.252 lenfiber_wiki: # returns -1
- With encype = TLS:
- [X2sV--TpCWs5RzNOSSbeygAAAAI] /index.php/Speciale:PluggableAuthLogin MWException from line 140 of /var/www/html/extensions/LDAPProvider/src/Client.php: Could not start TLS!
- Backtrace:
- #0 /var/www/html/extensions/LDAPProvider/src/Client.php(91): MediaWiki\Extension\LDAPProvider\Client->maybeStartTLS()
- #1 /var/www/html/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
- #2 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
- #3 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
- #4 /var/www/html/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)
- #5 /var/www/html/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)
- #6 /var/www/html/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)
- #7 /var/www/html/includes/MediaWiki.php(861): MediaWiki->performRequest()
- #8 /var/www/html/includes/MediaWiki.php(524): MediaWiki->main()
- #9 /var/www/html/index.php(42): MediaWiki->run()
- #10 {main}
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: In execute()
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: Getting PluggableAuth singleton
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: ldap_connect( $hostname = 'ldap://serverdc01.lenfiber.local:3268', $port = 389 );
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: # __METHOD__ returns Resource id #244
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_REFERRALS to 0
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: Setting LDAP_OPT_DEREF to 1
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: ldap_set_option( $linkID, $option = 2, $newval = 1 );
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: # returns 1
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: ldap_start_tls( $linkID );
- 2020-09-23 09:31:43 85.208.243.252 lenfiber_wiki: # returns
- No PHP errors output Mshuttle (talk) 09:37, 23 September 2020 (UTC)
- The original message
Could not bind to LDAP: (49) Invalid credentials makes me think that the general connection settings were correct, but just the username/password was invalid, or that particular user was not allowed to "bind". That's a setting in the LDAP backend. Osnard (talk) 14:02, 23 September 2020 (UTC)
- The user is part of Domain Admins group so it has rights to bind. Mshuttle (talk) 12:21, 24 September 2020 (UTC)
- Have you tried a non-PHP console tool (like
ldapsearch on Linux) to bind with those credentials? Could you please try to implement a very basic PHP script to test the binding (Example #1 Using LDAP Bind)? Osnard (talk) 06:40, 25 September 2020 (UTC)
- I changed:
- "user": "CN=mediawiki-sa,OU=Users,DC=lenfiber,DC=local",
- to
- "user": "CN=mediawiki-sa,CN=Users,DC=lenfiber,DC=local",
- Now user mediawiki-sa binds correcly to AD domain and users get authenticated Mshuttle (talk) 08:49, 29 September 2020 (UTC)
- If i may add,
- When i had on my ldap.json "user = user@domain.net" all the php tests (checklogin, showusergroups and showuserinfo) passed perfectly.
- If i change the "user" config as CN=xxx all the tests bring back an error Ctorrestesam (talk) 19:29, 30 March 2022 (UTC)
Internal error: Parameter must be an array or an object that implements Countable
[edit]
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
Hello,
I'm not sure this is the correct place to post this, but based on the error, it seems to be the most appropriate, if I'm wrong please point me to the right place and I shall post my question there.
MediaWiki: 1.34.0
PHP: 7.3.22
MariaDB: 10.3.17
LDAPProvider: 1.0.5
PluggableAuth: 5.7
LDAPAuthentication2: 1.0.1
I'm implementing a local Wiki for my company and I'm having troubles with the LDAP configuration, the following error appears when debugging is enabled:
Warning: count(): Parameter must be an array or an object that implements Countable in /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php on line 53
[X2kKJjbSu3qH1fIln5ofhQAAABg] /index.php?title=Especial:Vers%C3%A3o MWException from line 54 of /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php: Could not parse configuration file '/var/www/mediawiki/ldap.json'!
Backtrace:
#0 /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php(73): MediaWiki\Extension\LDAPProvider\DomainConfigProvider\LocalJSONFile->__construct(string)
#1 [internal function]: MediaWiki\Extension\LDAPProvider\DomainConfigProvider\LocalJSONFile::newInstance(MediaWiki\Extension\LDAPProvider\Config)
#2 /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php(106): call_user_func_array(string, array)
#3 /var/www/mediawiki/extensions/LDAPAuthentication2/src/Setup.php(12): MediaWiki\Extension\LDAPProvider\DomainConfigFactory::getInstance()
#4 /var/www/mediawiki/includes/Setup.php(906): MediaWiki\Extension\LDAPAuthentication2\Setup::init()
#5 /var/www/mediawiki/includes/WebStart.php(81): require_once(string)
#6 /var/www/mediawiki/index.php(41): require(string)
#7 {main}
My ldap.json is as follows:
{
"LDAP": {
"connection": {
"server": "REDACTED.local",
"port": "389",
"enctype": "clear",
"user": "REDACTED@REDACTED.local",
"pass": "REDACTED",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "dc=REDACTED,dc=local",
"userbasedn": "OU=Users,OU=REDACTED,DC=REDACTED,DC=local",
"searchattribute": "sAMAccountName",
"searchstring": "sAMAccountName=USER-NAME,dc=REDACTED,dc=local",
"usernameattribute": "sAMAccountName",
"realnameattribute": "displayName",
"emailattribute": "mail"
},
"userinfo": {
"attributes-map": {
"email": "mail",
"realname": "displayName",
"nickname": "givenName"
}
}
}
}
The "user" in the "connection" part of the JSON file was set to sAMAccountName=REDACTED,dc=REDACTED,dc=local but to no avail, as I keep getting the same error. Could someone point me in the right direction, please? Any help will be much appreciated :) Kevin.murilo (talk) 20:29, 21 September 2020 (UTC)
- The JSON format itself looks good. But the message clearly says
Could not parse configuration file '/var/www/mediawiki/ldap.json'. So I'd guess that the webserver user is not allowed to access this file. By the way: Please do not put that file into a public available location (e.g. the MediaWiki installation directory). Is contains sensitive data any may be downloadable. Osnard (talk) 06:28, 22 September 2020 (UTC)
- I have changed the permission to 0777 and that didn't solve the problem, I've been trying different settings, but given I'm somewhat new to PHP and to webservers in general, I'm taking a bit of a beating, what I did realize is that disabling the LDAPAuthentication2 plugin by commenting these 3 lines
wfLoadExtension( 'LDAPAuthentication2' );$LDAPAuthentication2AllowLocalLogin = true;$LDAPAuthentication2UsernameNormalizer = "strtolower";- the Wiki works for local users, but uncommenting them makes it all break, even with
$LDAPAuthentication2AllowLocalLogin = true; . I also don't know how to point to a JSON file located somewhere else, I apologize because it seems to be a very simple issue but I can't seem to be able to fix this. Thanks in advance :) Kevin.murilo (talk) 12:38, 22 September 2020 (UTC)
- No need to apologize :)
- You can relocate the settings file by using
$LDAPProviderDomainConfigs. See Extension:LDAPProvider#Static_JSON_file. Alternatively you can use a PHP based config instead of JSON, see Extension:LDAPProvider#Dynamic_PHP_array. Osnard (talk) 13:59, 23 September 2020 (UTC)
- I rellocated the JSON file, gave it 0777 permissions but still, whenever I triy to load
LDAPAuthentication2 it all breaks, I have followed the steps provided in the LDAP stack pages, but it seems like something is still misconfigured and I can't figure out what, are there any tips you could share to help make this work? Thanks for the help so far :D Kevin.murilo (talk) 18:53, 23 September 2020 (UTC)
- What exactly means "it all breaks"? Just the same error log entries as above, or a blank page in the webbrowser? Are there any (new) error messages in the PHP error log? Have you folloewd the advices on how to debug in general and for LDAPStack extensions in general? Osnard (talk) 06:37, 25 September 2020 (UTC)
- I'm sorry for the late reply, I've been digging through forums and Wiki articles and managed to solve it about 3 days ago, everyone really liked the idea I presented and so my time has been dedicated almost fully to our internal Wiki, which has been a lot of fun.
- The error I was being presented with was the same, sorry for not being more specific with the whole "it all breaks" thing, I was basically giving up at that point hahaha.
- For future reference, maybe a lost soul finds this thread and has the same problem I had, here's what I did to fix it:
- -followed Osnard's tips, first and foremost. Thank you for giving me some of your time to help me out.
- -CHECK FOR SPELLING ERRORS!!! somewhere in there i wrote
extemsions instead of extensions and computers really don't like mispelled file paths...or mispelled anything for that matter, so yeah, I triple checked everything.
- -on the second line of my JSON file,
LDAP is supposed to be mydomain.local (local in my specific case, might be com for you), that's just another lesson on spelling mistakes and also on reading the documentation thoroughly.
- -after these steps (i knew it was a basic problem, I've been saying so all along hahaha), I solved the original problem of this thread, but was faced with the same problem mentioned here Extension talk:LDAPAuthentication2/2020#h-Authentication_Problems_with_Active_Directory_-_Credentials_Not_Associated_with-2020-01-24T19:54:00.000Z
- -to solve this, keep in mind the JSON fields MUST be in all lower case letters, so instead of
sAMAccountname you must use samaccountname and so on for all fields used by the JSON file.
- What I felt is that the documentation, although it exists, is scarce and scattered, with bits of important information missing from the pages where they'd be most useful. I do not feel confident enough in my knowledge to edit them, as I feel I'd do more harm than good, so I'm pointing this out in hopes that someone more capable than me can make said edits.
- Once again, Osnard, thanks for taking some time of your day to not only read but also answer my questions, I hope you have a great day :) Kevin.murilo (talk) 12:27, 1 October 2020 (UTC)
The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.
Internal Error: Could not bind to LDAP: (-1) Can't contact LDAP server
[edit]
The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.
Setup configuration as explained in article Manual:Active Directory Integration with some modifications, as seen below, and ran update.php
Setup information:
OS: Centos 8.2
MediaWiki: 1.35.0
SQL: MariaDB 10.3.17
PHP: 7.3.20
Relevant Section from LocalSettings.php:
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
# Diable Anonymouse viewing of wiki content
$wgGroupPermissions['*']['read'] =false;
// Load LDAP Config from JSON
$ldapJsonFile = "$IP/../ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
$testJson = @json_decode(file_get_contents($ldapJsonFile),true);
if (is_array($testJson)) {
$ldapConfig = true;
} else {
error_log("Found invalid JSON in file: $IP/ldap.json");
}
}
// Activate Extension
if ( $ldapConfig ) {
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPUserInfo' );
wfLoadExtension( 'LDAPGroups' );
$LDAPProviderDomainConfigs = $ldapJsonFile;
$wgPluggableAuth_ButtonLabel = "Log In";
$LDAPAuthentication2AllowLocalLogin = true;
}
$wgDebugLogGroups['PluggableAuth'] = '/var/log/mediawiki/PluggableAuth.log';
$wgDebugLogGroups['LDAP'] = '/var/log/mediawiki/LDAPGen.log';
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/var/log/mediawiki/LDAPProviderClient.log';
$wgDebugLogGroups['LDAPUserInfo'] = '/var/log/mediawiki/LDAPUserInfo.log';
$wgDebugLogGroups['LDAPGroups'] = '/var/log/mediawiki/LDAPGroups.log';
$wgDebugLogGroups['LDAPAuthorization'] = '/var/log/mediawiki/LDAP.log';
$wgDebugLogGroups['LDAPAuthentication2'] = '/var/log/mediawiki/LDAPAuthentication2.log';
Redacted ldap.json
{
"domain.com": {
"connection": {
"server": "dc.domain.com",
"port": "636",
"user": "CN=wikildap,OU=Users-Service,DC=domain,DC=com",
"pass": "Redacted",
"enctype": "ssl",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "dc=domain,dc=com",
"userbasedn": "dc=domain,dc=com",
"groupbasedn": "dc=domain,dc=com",
"searchattribute": "samaccountname",
"usernameattribute": "samaccountname",
"realnameattribute": "cn",
"emailattribute": "mail",
"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
},
"userinfo": [],
"authorization": [],
"groupsync": {
"mapping": {
"bureaucrat": "CN=MediaWiki Admins,OU=Groups-Security,DC=domain,DC=com",
"interface-admin": "CN=MediaWiki Admins,OU=Groups-Security,DC=domain,DC=com",
"sysop": "CN=MediaWiki Admins,OU=Groups-Security,DC=domain,DC=com"
}
}
}
}
When attempting to login from MediaWiki web page the following error is thrown:
[X4hn3AICGN7jXCch3jl1rAAAAI4] /wiki/index.php?title=Special:PluggableAuthLogin MWException from line 169 of /var/www/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server
Backtrace:
#0 /var/www/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php(92): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /var/www/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/www/mediawiki-1.35.0/extensions/LDAPAuthentication2/src/PluggableAuth.php(81): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /var/www/mediawiki-1.35.0/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#4 /var/www/mediawiki-1.35.0/includes/specialpage/SpecialPage.php(600): PluggableAuthLogin->execute(NULL)
#5 /var/www/mediawiki-1.35.0/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run(NULL)
#6 /var/www/mediawiki-1.35.0/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)
#7 /var/www/mediawiki-1.35.0/includes/MediaWiki.php(940): MediaWiki->performRequest()
#8 /var/www/mediawiki-1.35.0/includes/MediaWiki.php(543): MediaWiki->main()
#9 /var/www/mediawiki-1.35.0/index.php(53): MediaWiki->run()
#10 /var/www/mediawiki-1.35.0/index.php(46): wfIndexMain()
#11 {main}
Tested configuration with the following scripts from the cli which all worked:
php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain domain.com --username SomeUser
php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain domain.com --username SomeUser
php extensions/LDAPProvider/maintenance/CheckLogin.php --domain domain.com --username SomeUser
However as noted the MediaWiki web page does not work when attempting login and nothing is sent to the logs configured in LocalSettings.php. It feels like a module isn't properly finding the ldap.json file but cannot find which or where it may need to be modified.
Any help would be much appreciated. Bmfrei (talk) 21:19, 15 October 2020 (UTC)
- If it didn't find the domain config file (ldap.json), or wasn't able to read it, a different error would show up.
- Can you confirm username/pass are correct and the user is allowed to bind to and search in LDAP?
- Have you tried the same connection settings (username/password/hostname/password/enctype) with a different tool, like
ldapsearch?
- You could try to verify the connection settings by creating a simple PHP script also: https://www.php.net/manual/en/function.ldap-bind.php#refsect1-function.ldap-bind-examples Osnard (talk) 06:25, 16 October 2020 (UTC)
- Hello,
- Thank you for taking a look at the output.
- We can confirm as you noted that the ldap.json file is being read otherwise none of the extensions would have loaded.
- I can confirm that the username/pass are correct and the user is allowed to bind to and search in LDAP.
- The server was monitored with Wireshark and noted that no ldap/ldaps traffic was seen when attempting authentication from the web interface.
- To note the scripts within the LDAPProvider extension were succeeding during testing. For reference the scripts are:
- php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain domain.com --username SomeUser
- php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain domain.com --username SomeUser
- php extensions/LDAPProvider/maintenance/CheckLogin.php --domain domain.com --username SomeUser
- ldapsearch was tested and worked w/ 389 however unable to get 636 to bind. Tested the simple PHP script that you also provided and has the same result of 389 binding but unable to get 636 to work. Did however change the ldap.json file to use 389 and clear for the enctype with the same error produced.
- Reproduced the issue in a greenfield test environment using a new build of a Windows Server 2019 domain controller and the same server CentOS 8 w/ MediaWiki 1.35.0 configuration.
- To note as well the logs are not populating when attempting authentication from the web but are populating when using the script noted above.
- To also note the following line was added to extenstions/LDAPProvider/src/Client.php on line 87 to ignore SSL certs for the ldaps search.
- putenv('LDAPTLS_REQCERT=never');
- Thank you, Bmfrei (talk) 17:55, 16 October 2020 (UTC)
- Got another script that did end up working for ldaps however as noted in the last post required putenv('LDAPTLS_REQCERT=never'); to work .
- <?php
- putenv('LDAPTLS_REQCERT=never');
- // using ldap bind
- $ldaprdn = 'cn=wikildap,ou=Users-Service,dc=domain,dc=com'; // ldap rdn or dn
- $ldappass = 'Redacted'; // associated password
- // connect to ldap server
- $ldapconn = ldap_connect("ldaps://dc.domain.com:636")
- or die("Could not connect to LDAP server.");
- if ($ldapconn) {
- // binding to ldap server
- $ldapbind = ldap_bind($ldapconn, $ldaprdn, $ldappass);
- // verify binding
- if ($ldapbind) {
- echo "LDAP bind successful...";
- } else {
- echo "LDAP bind failed...";
- }
- }
- ?> Bmfrei (talk) 19:02, 16 October 2020 (UTC)
- And funnily enough it was due to SELINUX causing a problem and was resolved by enabling the following sebool value using the following command:
- setsebool -P httpd_can_network_connect on
- What drives me nuts is as a troubleshooting step I placed SELINUX in permissive mode however it didn't resolve the issue at that time. Hopefully this will help someone else down the road however. Bmfrei (talk) 20:04, 16 October 2020 (UTC)
- Thanks for sharing this information! So I understand, that LDAP with MediaWiki works for you now, isn't it? Osnard (talk) 10:18, 17 October 2020 (UTC)
- Hello Osnard.
- Yes this is correct, LDAP with MediaWiki works as expected now!
- Thank you Bmfrei (talk) 00:07, 19 October 2020 (UTC)
The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.
No file in the maintenance folder called update.php.
[edit]No file in the maintenance folder called update.php. Please advise. 216.116.87.110 (talk) 16:40, 3 November 2020 (UTC)
- Why should any file in the
maintenance/ folder of LDAPProvider call the update.php? Can you please point me to the related documentation? Osnard (talk) 18:54, 3 November 2020 (UTC)
LDAP authentication failed against Active Directory
[edit]Hello,
I'm encountering an error when trying to bind to my Active Directory server with the LDAP plugin.
Here is the redacted output of the debug :
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_connect( $hostname = 'ldap://ldap01.my.domain:389', $port = 389 );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # __METHOD__ returns Resource id #745
2020-11-16 15:52:16 mywikiname mywikiname-t_: Setting LDAP_OPT_PROTOCOL_VERSION to 3
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_set_option( $linkID, $option = 17, $newval = 3 );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: Setting LDAP_OPT_REFERRALS to 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_set_option( $linkID, $option = 8, $newval = 1 );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: Setting LDAP_OPT_DEREF to 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_set_option( $linkID, $option = 2, $newval = 1 );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_bind( $linkID, $bindRDN = 'CN=username,OU=aaa,OU=bbb
,OU=ccc,DC=my,DC=domain', $bindPassword = 'XXXX' );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns 1
2020-11-16 15:52:16 mywikiname mywikiname-t_: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (
'base' => 'OU=aaa,DC=my,DC=domain',
'filter' => '(sAMAccountName=my_username)',
'attributes' =>
array (
0 => '*',
1 => 'memberof',
),
)
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_search( $linkID, $baseDN = 'OU=aaa,DC=my,DC=domain', $filter = '(sAMAccountName=my_username)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $dere
f = );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_count_entries( $linkiID, $result = '' );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns
2020-11-16 15:52:16 mywikiname mywikiname-t_: Could not get user DN!
2020-11-16 15:52:16 mywikiname mywikiname-t_: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: ''
I did a tcpdump to check what might be the issue and this is what appears in the dump :
Frame 8: 228 bytes on wire (1824 bits), 228 bytes captured (1824 bits)Ethernet II, Src: 02:42:f8:d6:54:9a (02:42:f8:d6:54:9a), Dst: 02:42:ac:10:b1:09 (02:42:ac:10:b1:09)Internet Protocol Version 4, Src: 217.117.35.49, Dst: 172.16.177.9Transmission Control Protocol, Src Port: 389, Dst Port: 43488, Seq: 23, Ack: 189, Len: 174Lightweight Directory Access ProtocolLDAPMessage searchResDone(2) operationsError (000004DC: LdapErr: DSID-0C090A69, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563) [0 results]messageID: 2protocolOp: searchResDone (5)searchResDoneresultCode: operationsError (1)matchedDN:errorMessage: 000004DC: LdapErr: DSID-0C090A69, comment:
Strange thing is that if I put a false password to check if there is a difference, everytime the debug shows the same result for the binding :
2020-11-16 15:52:16 mywikiname mywikiname-t_: ldap_bind( $linkID, $bindRDN = 'CN=username,OU=aaa,OU=bbb
,OU=ccc,DC=my,DC=domain', $bindPassword = 'XXXX' );
2020-11-16 15:52:16 mywikiname mywikiname-t_: # returns 1
I did the same test with an ldap browser and the credentials and search are working fine. 217.117.43.8 (talk) 16:00, 16 November 2020 (UTC)
- Finally I was able to make it work, I didn't see that as I enabled the local login, there were 2 login buttons,I was just not pressing the correct one.... 217.117.43.8 (talk) 10:06, 17 November 2020 (UTC)
- Faced same problem.
- How did you make it work? Tell more please. 109.252.68.148 (talk) 12:26, 21 December 2020 (UTC)
Can connect without TLS, not after enabling
[edit]Recently upgrade an existing instance to 1.35 from 1.31. Had been using the original LDAPAuthentication app. Can authenticate successfully without TLS, but not after turning on. Trying to hit an AD server.
When I run the debug test (php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain YourDomain --username SomeUser), I get this error stack:
MWException from line 139 of /var/lib/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php: Could not start TLS!
#0 /var/lib/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php(90): MediaWiki\Extension\LDAPProvider\Client->maybeStartTLS()
#1 /var/lib/mediawiki-1.35.0/extensions/LDAPProvider/src/Client.php(229): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/lib/mediawiki-1.35.0/extensions/LDAPProvider/maintenance/ShowUserInfo.php(49): MediaWiki\Extension\LDAPProvider\Client->getUserInfo()
#3 /var/lib/mediawiki-1.35.0/maintenance/doMaintenance.php(107): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()
#4 /var/lib/mediawiki-1.35.0/extensions/LDAPProvider/maintenance/ShowUserInfo.php(72): require_once('/var/lib/mediaw...')
#5 {main}
Here's my ldap.json, which for now I keep in the main MediaWiki folder:
{
"lc": {
"connection": {
"server": "lc.luther.edu",
"user": "CN=hdwiki,OU=Vendor,DC=lc,DC=luther,DC=edu",
"pass": "***secret***",
"port": 1389,
"enctype": "tls",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "DC=lc, DC=luther, DC=edu",
"userbasedn": "DC=lc, DC=luther, DC=edu",
"groupbasedn": "OU=Groups,DC=lc, DC=luther, DC=edu",
"searchattribute": "samaccountname",
"usernameattribute": "samaccountname",
"realnameattribute": "cn",
"emailattribute": "mail",
"grouprequest":"MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
},
"userinfo": [],
"authorization": [],
"groupsync": {
"mapping": {
"bureaucrat": "CN=Help_Desk_Managers,OU=Groups,DC=lc, DC=luther, DC=edu"
}
}
}
}
Here's the relevant portion of my LocalSettings.php:
error_reporting( -1 ); //debugging. Comment out when in production
ini_set( 'display_errors', 1 ); //debugging. Comment out when in production
$wgDebugLogGroups['PluggableAuth'] =
$wgDebugLogGroups['LDAP'] =
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] =
$wgDebugLogGroups['LDAPAuthentication2'] =
$wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log';
.
.
.
$wgGroupPermissions['*']['autocreateaccount'] = true;
// Load LDAP Config from JSON
$ldapJsonFile = "$IP/ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
$testJson = @json_decode(file_get_contents($ldapJsonFile),true);
if (is_array($testJson)) {
$ldapConfig = true;
} else {
error_log("Found invalid JSON in file: $IP/ldap.json");
}
}
// Activate Extension
if ( $ldapConfig ) {
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
$LDAPProviderDomainConfigs = $ldapJsonFile;
$wgPluggableAuth_ButtonLabel = "Log In";
$LDAPAuthentication2AllowLocalLogin = true;
}Error logs at /tmp/LDAP.log look like:
2020-11-24 16:51:11 wiki hdwiki_test: ldap_connect( $hostname = 'ldap://lc.luther.edu:1389', $port = 389 );
2020-11-24 16:51:11 wiki hdwiki_test: # __METHOD__ returns Resource id #773
2020-11-24 16:51:11 wiki hdwiki_test: Setting LDAP_OPT_PROTOCOL_VERSION to 3
2020-11-24 16:51:11 wiki hdwiki_test: ldap_set_option( $linkID, $option = 17, $newval = 3 );
2020-11-24 16:51:11 wiki hdwiki_test: # returns 1
2020-11-24 16:51:11 wiki hdwiki_test: Setting LDAP_OPT_REFERRALS to 0
2020-11-24 16:51:11 wiki hdwiki_test: ldap_set_option( $linkID, $option = 8, $newval = 0 );
2020-11-24 16:51:11 wiki hdwiki_test: # returns 1
2020-11-24 16:51:11 wiki hdwiki_test: Setting LDAP_OPT_DEREF to 1
2020-11-24 16:51:11 wiki hdwiki_test: ldap_set_option( $linkID, $option = 2, $newval = 1 );
2020-11-24 16:51:11 wiki hdwiki_test: # returns 1
2020-11-24 16:51:11 wiki hdwiki_test: ldap_start_tls( $linkID );
We thought it was odd that first line of the last error code uses one port for $hostname and then another in the $port. We tried not specifying the port in the ldap.json file, same result.
I have php7.4-ldap installed.
Thanks to anyone who read this far. :) Realsalt (talk) 17:12, 24 November 2020 (UTC)
- I have seen the same issue where my TLS fails. I have done a lot of configuration and been running mediawiki since 1.26 in production. I can test PHP client program from my linux server to the LDAP/AD server just fine; bind and connect.
- Yet the server fails every login and gives the same odd message of port configuration error . Emikulic (talk) 01:41, 25 November 2020 (UTC)
- Here is the requirement, when you use SSL or TLS against an LDAP server.
- - The Server-Cert in the LDAPS response will be verified by the php-ldap openssl library.
- - The Server-Cert is provided by an MS-AD DC when hitting 389 with SmartTLS enabled, or 636 SSL
- - Also, your can use Global Catalog Ports 3268 with SmartTLS enabled, or 3269 SSL.
- PHP LDAPS
- - PHP LDAPS uses openssl under the hood - e.g. the system-wide CA-Bundle, a set of trusted Cert-Authorities.
- - For SmartTLS or SSL methods to work, your box must trust the MS-AD CA, which signed the Server-Cert.
- - This means the MS-AD CA certificate needs to be merged with your system's CA bundle.
- - This is usually done with a tool named 'update-ca-certificates' or similar.
- One way of determining whether your box is verifying TLS with the DC, is to use openssl at the CLI.
echo "" | openssl s_client -connect foobar-dc:389 -starttls ldap -prexit -showcerts- Firstly, look at the last line: "Verify return code" - it will be 0, when the TLS/SSL is all OK.
- The CA Cert ( e.g. the Certificate Chain ) is included at the top of the output.
- You need to place the CA Cert into your system-wide CA import directory.
- Then run 'update-ca-certificates'
- Then test again with openssl, the CA must be trusted for the TLS verify return code to be 0.
- Adding the Additional CA File for DC:
- Example dir, for placing extra CA files into: /usr/local/share/ca-certificates/
- Check man update-ca-certificates to see if your directory is different...
- Simply copy-and-paste the Cert header, content, and footer lines, into a new file.
- /usr/local/share/ca-certificates/foobar-dc.ca2020.cert
-----BEGIN CERTIFICATE-----cert content, in base64 format-----END CERTIFICATE------ And run 'update-ca-certificates'.
- This checks for new CA files in a location like /usr/local/share/ca-certificates/, and merges into the global bundle file, usually somewhere within /etc/ssl/
- Long story short, when the openssl verify works against a DC, you should find that PHP LDAPS also works using SmartTLS on TCP389. Or, SSL on 636.
- I automate this process in some of my PHP applications, by using a non-TLS LDAP query, to obtain the TLS CA Certificate via LDAP, and then write the certificate to filesystem, and run 'update-ca-certificates' under the hood. It's complex, but allows for automatic import of the MS-AD CA, because the CA can often change if PKI changes occur in the domain, or after a CA Certificate is renewed. Nick Parrott (talk) 10:21, 25 November 2020 (UTC)
- That was helpful and well thought out, thanks. I do have both my system and my openssl standard certs location have my CA cert in their lists and the update ca command. The two do not really share locations well today, w/o symlinks in one direction or the other.
- In the end I was able to get this to work w/AD. There was some real insight needed that I only obtained through enabling all the logs and watching that output. Emikulic (talk) 19:41, 21 December 2020 (UTC)
- @Emikulic I'm experiencing a similar issue as we're now staring to enforce TLS on all our LDAP servers. However all the debugging I've done shows that the operating system is able to connect "start TLS". But still MediaWiki is giving the error below. What exactly did you do to fix the problem? I've even pointed php.ini at our known good CA certificate file for PHP to use it. openssl.cafile=/etc/ssl/certs/ca-bundle.crt
- [48099cecdbcdab00e2a66cbd] /Special:PluggableAuthLogin MWException: Could not start TLS!
- We run another PHP application "Booked Scheduler" and connect with TLS enabled using this exact same CA file. I'm stuck. Dancabcaltech (talk) 16:22, 24 May 2022 (UTC)
- @Osnard I just noticed that the MediaWiki Docker image I'm using includes PHP 7.4.29 which isn't currently supported. Could that be causing the problem I'm seeing?
- I've done quite a bit of debugging both on the client and LDAP server side. I'm able to bind and use TLS using LDAP utilities, openssl cli and a rudimentary PHP script. But no luck getting the enctype 'tls' to work.
- I'm using the 1.37.2 MediaWiki image from here: https://hub.docker.com/_/mediawiki Dancabcaltech (talk) 21:10, 25 May 2022 (UTC)
- We run another PHP application "Booked Scheduler" and connect with TLS enabled using this exact same CA file. I'm stuck.
- This "Booked Scheduler", does it run in the same environment (server/container) as MediaWiki?
- Sorry, I don't have much expierience with running the LDAP-Stack applications in the MediaWiki Docker environment. Osnard (talk) 08:42, 30 May 2022 (UTC)
- Thanks. The Booked Scheduler software runs on a similar container. It uses the Docker Hub PHP image which is Debian based and uses the docker-php-ext-* scripts also found on the MediaWiki container for installing and configuring PHP modules.
- https://hub.docker.com/_/php
- https://hub.docker.com/_/mediawiki Dancabcaltech (talk) 22:33, 2 June 2022 (UTC)
- But is is two separated environments then. Well, the LDAP-Stack extensions to not implement anything special regarding tue use of CA files, but rely completely on the environment.
- Can you maybe try to create a little testing script like https://www.php.net/manual/en/function.ldap-bind.php#example-4353 in the MediaWiki environment and run ti from within?
- Also looking at the output of `phpinfo();` may reveal something about the environment specific configuration. You may compare this to the working environment.
- Also check the php.ini files on the MediaWiki container for differences to the "Booked Scheduler". Osnard (talk) 06:36, 7 June 2022 (UTC)
- @Osnard thanks for the tips. I've been working on other projects but just came back to this. It's very strange. Today I tried setting up the 1.37.2 MediaWiki on a standard RHEL7 virtual machine and connected to the database with tls enabled just fine. I've also got another MediaWiki instance which has even more extensions like "Math" and "Semantic" enabled. I can only reproduce the problem intermittently there. It's very odd. Anyway, since this appears to be operating system or otherwise related to the Linux environment I'll keep debugging on my end. Thanks again. Dancabcaltech (talk) 00:23, 16 June 2022 (UTC)
Cannot connect with TLS
[edit]I have seen the same issue where my TLS fails. I have done a lot of configuration and been running mediawiki since 1.26 in production. I can test PHP client program from my linux server to the LDAP/AD server just fine; bind and connect.
Note I have written brief php test programs to run ldap bind, ldap connect, ldaps, and ldap starttls. I test them against our AD servers fine and the only one the fails is the STARTTLS test from port 389.
Maybe the mediawiki PHP code uses STARTTLS by default and fails there?
I would like to just use port 636 and TLS and not bother with 389 or StartTLS . How do we do that?
We have legacy apps that use clear 389 and we cannot setup StartTLS on that port for a while yet. We do support TLS/636 and can use that, but mediawiki needs to support that as a unique option; more than just StartTLS.
I have ran my own php tests the same, and also the extensions/LDAPProvider/maintenance/ShowUserInfo.php and extensions/LDAPProvider/maintenance/ShowUserGroups.php and they throw the same errors.
I can run PHP tests with 'clear'/389 and TLS/636 which work , but even those fail when I try a 'StartTLS' connection.
What setting can we change to just set it at 636/TLS?
The server fails every login and gives the same odd message of port configuration error it looks like:
2020-11-25 01:15:56 wikidb: In execute()
2020-11-25 01:15:56 wikidb: Getting PluggableAuth singleton
2020-11-25 01:15:56 wikidb: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth
2020-11-25 01:15:56 wikidb: ldap_connect( $hostname = 'ldap://addc02.mydomain.com:636', $port = 389 );
2020-11-25 01:15:56 wikidb: # __METHOD__ returns Resource id #893
2020-11-25 01:15:56 wikidb: Setting LDAP_OPT_PROTOCOL_VERSION to 3
2020-11-25 01:15:56 wikidb: ldap_set_option( $linkID, $option = 17, $newval = 3 );
2020-11-25 01:15:56 wikidb: # returns 1
2020-11-25 01:15:56 wikidb: Setting LDAP_OPT_REFERRALS to 0
2020-11-25 01:15:56 wikidb: ldap_set_option( $linkID, $option = 8, $newval = 0 );
2020-11-25 01:15:56 wikidb: # returns 1
2020-11-25 01:15:56 wikidb: Setting LDAP_OPT_DEREF to 1
2020-11-25 01:15:56 wikidb: ldap_set_option( $linkID, $option = 2, $newval = 1 );
2020-11-25 01:15:56 wikidb: # returns 1
2020-11-25 01:15:56 wikidb: ldap_start_tls( $linkID );
2020-11-25 01:15:56 wikidb: # returns Emikulic (talk) 01:45, 25 November 2020 (UTC)
- Have you tried something like this in the "connection"-section of your domain config?
...
"port": 636,
"enctype": "clear",
...
- If this does not work, you may need to modify files in the
LDAPProvider extension [1-4]. Once you get it to work, please share the config you have used, or provide me with the changes on the codebase you have made so I can add them to the regular codebase and make sure future updates won't break you usecase.
- [1] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/Client.php#L100
- [2] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/Client.php#L134-L144
- [3] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/PlatformFunctionWrapper.php#L257-L265
- [4] https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/PlatformFunctionWrapper.php#L237-L247 Osnard (talk) 08:19, 25 November 2020 (UTC)
- I have not tried that combination of port and 'clear' I can give it a shot. Emikulic (talk) 18:16, 25 November 2020 (UTC)
- I can confirm that "implicit TLS" (i.e. skipping STARTTLS, no 389 port open) works fine. I plan on posting a docker compose of the configuration soon.
- Edit: Here it is: https://github.com/createyourpersonalaccount/openldap-mediawiki/ Peptidylprolyl (talk) 04:03, 13 March 2024 (UTC)