Extension talk:LDAPProvider/2021

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

Enable both local and domain login

Latest comment: 5 years ago4 comments3 people in discussion

I've got my LDAP authentication and authorization working just fine. However, I though that imported 'local' accounts would still work given that the option below was configured.

$LDAPAuthentication2AllowLocalLogin = true;

But when I choose "local" and use a local account. I get prompted for a 'local' domain configuration. What am I missing? 131.215.250.121 (talk) 02:45, 20 January 2021 (UTC)Reply

<[da5f9cf1f8b900e06e74ed16] /Special:PluggableAuthLogin MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'local'!> 131.215.250.121 (talk) 02:45, 20 January 2021 (UTC)Reply

Is this the same request as https://www.mediawiki.org/w/index.php?title=Extension%20talk%3APluggableAuth/2021#h-%27local%27_domain_configuration_error-2021-01-22T02%3A26%3A00.000Z? Osnard (talk) 14:15, 26 January 2021 (UTC)Reply

Yes it is the same request. After some further troubleshooting I believe the LDAPAuthorization extension is the issue. I've posted in the extension talk there. 131.215.252.216 (talk) 22:20, 12 February 2021 (UTC)Reply

Can't login into mediawiki | User is not authorized

Latest comment: 5 years ago3 comments3 people in discussion

I have the problem, that i cant login into the Mediawiki: Error: "User is not authorized".

I connected the LDAP with an AD.

The CheckLogin.php says OK.

The ShowUsersGroups.php displays all groups of the user.

The ShowUsersInfo.php displays the Userinfo.

I updated from 1.27 to 1.35 and followed the migration for LDAPAuthentication to LDAPAuthentication2.

###############################################

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo'

] );

$wgGroupPermissions['*']['createaccount'] = true;

$LDAPProviderDomainConfigProvider = function() {

$config = [

'company.local' => [

'connection' => [

"server" => "Domaincontroller",

"user" => "cn=ldap,ou=Systemkonten,ou=company,dc=company,dc=local",

"pass" => '*****************',

"options" => [

"LDAP_OPT_DEREF" => 1

],

"basedn" => "dc=company, dc=local",

"groupbasedn" => "ou=Sicherheitsgruppen,ou=company,dc=company,dc=local",

"userbasedn" => "ou=company,dc=company,dc=local",

"searchattribute" => "sAMAccountName",

"usernameattribute" => "sAMAccountName",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

"authorization" => [

"rules" => [

"groups" => [

"required" => [

"cn=Alle,ou=Sicherheitsgruppen,ou=company,dc=company,dc=local"

]

],

'userinfo' => [

'attributes-map' => [

'email' => 'mail',

'realname' => 'fullname'

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray ($config);

}; Mschamber (talk) 13:10, 26 February 2021 (UTC)Reply

So "ShowUsersGroups.php" also lists "cn=Alle,ou=Sicherheitsgruppen,ou=company,dc=company,dc=local"? Osnard (talk) 13:25, 24 March 2021 (UTC)Reply

Try setting the "sAMAccountName" to lower case: "samaccountname" Xdaveyx (talk) 18:08, 8 April 2021 (UTC)Reply

Invalid credentials when trying to run ShowUserInfo.php

Latest comment: 5 years ago4 comments2 people in discussion

I'm getting MWException from line 168 of .../source/src/Client.php: Could not bind to LDAP: (49) Invalid credentials when running ShowUserInfo.php with the following config:

{ "<domain>": {
  "connection": {
    "server": "localhost",
    "port": "389",
    "user": "uid=mediawiki,ou=Access,dc=domain,dc=de",
    "pass": "redacted",
    "enctype": "clear",
    "options": { "LDAP_OPT_DEREF": 1 },
    "basedn": "dc=domain,dc=de",
    "userbasedn": "ou=Users,dc=domain,dc=de",
    "groupbasedn": "ou=Groups,dc=domain,dc=de",
    "searchattribute": "uid",
    "usernameattribute": "uid",
    "realnameattribute": "cn",
    "emailattribute": "mail",
    "grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
    "presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
  },
  "userinfo": [], "authorization": [], "groupsync": { ... }
}

In the LDAP log, I see this:

ldap_connect( $hostname = 'ldap://localhost:389', $port = 389 );
# __METHOD__ returns Resource id #762
Setting LDAP_OPT_PROTOCOL_VERSION to 3
ldap_set_option( $linkID, $option = 17, $newval = 3 );
# returns 1
Setting LDAP_OPT_REFERRALS to 0
ldap_set_option( $linkID, $option = 8, $newval = 0 );
# returns 1
Setting LDAP_OPT_DEREF to 1
ldap_set_option( $linkID, $option = 2, $newval = 1 );
# returns 1
ldap_bind( $linkID, $bindRDN =  'uid=mediawiki,ou=Access,dc=domain,dc=de', $bindPassword = 'XXXX' );
# returns
ldap_error( $linkID );
# returns Invalid credentials
ldap_errno( $linkID );
# returns 49

But trying to bind as that same user with e.g. ldapsearch works fine. Here's some 'acl trace' logs from openldap, running ldapsearch:

60674a22 >>> dnPrettyNormal: <uid=mediawiki,ou=Access,dc=domain,dc=de>
60674a22 <<< dnPrettyNormal: <uid=mediawiki,ou=Access,dc=domain,dc=de>, <uid=mediawiki,ou=access,dc=domain,dc=de>
60674a22 do_bind: version=3 dn="uid=mediawiki,ou=Access,dc=domain,dc=de" method=128
60674a22 mdb_dn2entry("uid=mediawiki,ou=access,dc=domain,dc=de")
60674a22 => mdb_dn2id("uid=mediawiki,ou=access,dc=domain,dc=de")
60674a22 <= mdb_dn2id: got id=0x1b
60674a22 => mdb_entry_decode:
60674a22 <= mdb_entry_decode
60674a22 => access_allowed: result not in cache (userPassword)
60674a22 => access_allowed: auth access to "uid=mediawiki,ou=Access,dc=domain,dc=de" "userPassword" requested
60674a22 => acl_get: [1] attr userPassword
60674a22 => acl_mask: access to entry "uid=mediawiki,ou=Access,dc=domain,dc=de", attr "userPassword" requested
60674a22 => acl_mask: to value by "", (=0)
60674a22 <= check a_dn_pat: self
60674a22 <= check a_dn_pat: anonymous
60674a22 <= acl_mask: [2] applying auth(=xd) (stop)
60674a22 <= acl_mask: [2] mask: auth(=xd)
60674a22 => slap_access_allowed: auth access granted by auth(=xd)
60674a22 => access_allowed: auth access granted by auth(=xd)
60674a22 do_bind: v3 bind: "uid=mediawiki,ou=Access,dc=domain,dc=de" to "uid=mediawiki,ou=Access,dc=domain,dc=de"
60674a22 send_ldap_result: conn=1016 op=0 p=3
60674a22 send_ldap_response: msgid=1 tag=97 err=0
ber_flush2: 14 bytes to sd 12
60674a22 connection_get(12): got connid=1016

and the same for ShowUserInfo:

60674ac8 >>> dnPrettyNormal: <uid=mediawiki,ou=Access,dc=domain,dc=de>
60674ac8 <<< dnPrettyNormal: <uid=mediawiki,ou=Access,dc=domain,dc=de>, <uid=mediawiki,ou=access,dc=domain,dc=de>
60674ac8 do_bind: version=3 dn="uid=mediawiki,ou=Access,dc=domain,dc=de" method=128
60674ac8 mdb_dn2entry("uid=mediawiki,ou=access,dc=domain,dc=de")
60674ac8 => mdb_dn2id("uid=mediawiki,ou=access,dc=domain,dc=de")
60674ac8 <= mdb_dn2id: got id=0x1b
60674ac8 => mdb_entry_decode:
60674ac8 <= mdb_entry_decode
60674ac8 => access_allowed: result not in cache (userPassword)
60674ac8 => access_allowed: auth access to "uid=mediawiki,ou=Access,dc=domain,dc=de" "userPassword" requested
60674ac8 => acl_get: [1] attr userPassword
60674ac8 => acl_mask: access to entry "uid=mediawiki,ou=Access,dc=domain,dc=de", attr "userPassword" requested
60674ac8 => acl_mask: to value by "", (=0)
60674ac8 <= check a_dn_pat: self
60674ac8 <= check a_dn_pat: anonymous
60674ac8 <= acl_mask: [2] applying auth(=xd) (stop)
60674ac8 <= acl_mask: [2] mask: auth(=xd)
60674ac8 => slap_access_allowed: auth access granted by auth(=xd)
60674ac8 => access_allowed: auth access granted by auth(=xd)
60674ac8 send_ldap_result: conn=1017 op=0 p=3
60674ac8 send_ldap_response: msgid=1 tag=97 err=49
ber_flush2: 14 bytes to sd 12
60674ac8 connection_get(12): got connid=1017

the first different thing I'm seeing here is the line containing do_bind... The password should really be correct, because I've copy-pasted it from the config for the ldapsearch tests.

Any hints for what I'm doing wrong would be greatly appreciated. I've been banging my head against this for a while :) Apodroelf (talk) 16:54, 2 April 2021 (UTC)Reply

Forgot the version info:

mediawiki 1.35.1, php 7.4.16, LDAPProvider REL1_35 Apodroelf (talk) 20:32, 2 April 2021 (UTC)Reply

Argh! The password had a backslash. Guess what happens with the json that doesn't happen when I copy/paste the string... Apodroelf (talk) 12:30, 3 April 2021 (UTC)Reply

Thanks for the feedback! Osnard (talk) 09:33, 6 April 2021 (UTC)Reply

Could not authenticate credentials against domain "LDAP"

Latest comment: 5 years ago3 comments2 people in discussion

Hi,

I'm getting a "Could not authenticate credentials against domain "LDAP"" error when trying to log in my wiki with LDAP.

I'm using Azure AD DS as my LDAP server. Note that when logging in O365 I use firstname@company.com but ShowUserInfo.php only works with "Firstname Lastname".

Could you help me spot the issue? Please let me know if you need other infos.

Thanks!

LocalSettings.php (customisations only):

###########################################################################

putenv('LDAPTLS_REQCERT=never');

$LDAPProviderCacheType = CACHE_NONE;

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

'LDAPUserInfo',

'LDAPGroups'

] );

$wgDebugLogFile = "/var/log/wiki/debugLDAP-{$wgDBname}.log";

$wgDebugLogGroups['PluggableAuth'] = "/var/log/wiki/PluggableAuth.log";

$wgDebugLogGroups['LDAP'] = "/var/log/wiki/LDAP.log";

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = "/var/log/wiki/LDAPProvider.log";

$wgDebugLogGroups['LDAPGroups'] = "/var/log/wiki/LDAPGroups.log";

$wgDebugLogGroups['LDAPUserInfo'] = "/var/log/wiki/LDAPUserInfo.log";

$wgDebugLogGroups['LDAPAuthorization'] = "/var/log/wiki/LDAPAuthorization.log";

$wgGroupPermissions['*']['autocreateaccount'] = true;

$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$LDAPAuthentication2AllowLocalLogin = false;

$wgAuthRemoteuserAllowUserSwitch = false;

$wgPluggableAuth_EnableLocalLogin = true;

$wgAuthRemoteuserUserName = function() {

$user = '';

if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {

$user = strtolower( $_SERVER[ 'REMOTE_USER' ] );

}

return $user;

};

$LDAPProviderDomainConfigProvider = function() {

$config = [

'LDAP' => [

'connection' => [

"server" => "A.B.C.D",

"port" => "nnn",

"enctype" => "ssl",

"user" => "ldap-read@company.com",

"pass" => "****",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"basedn" => "OU=AADDC Users,DC=company,DC=com",

"userbasedn" => "OU=AADDC Users,DC=company,DC=com",

"searchattribute" => "cn",

"searchstring" => "CN=USER-NAME,OU=AADDC Users,DC=company,DC=com",

"usernameattribute" => "cn",

"realnameattribute" => "displayname",

"emailattribute" => "userprincipalname",

"groupbasedn" => "OU=AADDC Users,DC=company,DC=com",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

'authorization' => [

'rules' => [

'groups' => [

'required' => [

'CN=company,OU=AADDC Users,DC=company,DC=com'

]

],

"groupsync" =>

[

"mechanism" => "mappedgroups",

"mapping" =>

[

"sysop" => "CN=company,OU=AADDC Users,DC=company,DC=com",

"bureaucrat" => "CN=company,OU=AADDC Users,DC=company,DC=com"

]

],

"userinfo" =>

[

"email" => "mail",

"realname" => "displayname",

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

###########################################################################

LDAPProvider.log

###########################################################################

2021-05-28 13:37:50 ip-xxxx wikidb: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-05-28 13:37:50 ip-xxxx wikidb: Setting LDAP_OPT_REFERRALS to 0

2021-05-28 13:37:50 ip-xxxx wikidb: Setting LDAP_OPT_DEREF to 1

2021-05-28 13:37:50 ip-xxxx wikidb: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'OU=AADDC Users,DC=company,DC=com',

'filter' => '(cn=Firstname Lastname)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2021-05-28 13:37:50 ip-xxxx wikidb: Found user DN: 'CN=Firstname Lastname,OU=AADDC Users,DC=company,DC=com'

2021-05-28 13:37:50 ip-xxxx wikidb: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'CN=Firstname Lastname,OU=AADDC Users,D

C=company,DC=com'

###########################################################################

$ php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain LDAP --username "Firstname Lastname" // (I removed irrelevant lines)

objectclass =>

0 => top

1 => person

2 => organizationalPerson

3 => user

cn => Firstname Lastname

sn => Lastname

givenname => Firstname

distinguishedname => CN=Firstname Lastname,OU=AADDC Users,DC=company,DC=com

instancetype => 4

displayname => Firstname Lastname

memberof =>

0 => CN=company,OU=AADDC Users,DC=company,DC=com

1 => CN=TestGroup2,OU=AADDC Users,DC=company,DC=com

usnchanged => 10689942

proxyaddresses => SMTP:firstname@company.com

name => Firstname Lastname

useraccountcontrol => 544

badpwdcount => 0

codepage => 0

countrycode => 0

logoncount => 0

samaccountname => firstname

samaccounttype => 805306368

userprincipalname => firstname@company.com

objectcategory => CN=Person,CN=Schema,CN=Configuration,DC=company,DC=com

mail => firstname@company.com

msds-azureadmailnickname => firstname

msds-generationseq => 0

dn => CN=Firstname Lastname,OU=AADDC Users,DC=company,DC=com

$ php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain LDAP --username "firstname@company.com"

// empty result

$ php extensions/LDAPProvider/maintenance/CheckLogin.php --domain LDAP --username "Firstname Lastname"

Password:********

FAILED

$ php extensions/LDAPProvider/maintenance/CheckLogin.php --domain LDAP --username "firstname@company.com"

Password:********

FAILED Jidey (talk) 14:37, 28 May 2021 (UTC)Reply

The "authentication" is done by "binding" to the LDAP resource. Maybe you user is not allowed to bind?

Can you check one of those examples in a standalone script to verify that binding works in general? https://www.php.net/manual/en/function.ldap-bind.php Osnard (talk) 08:57, 7 June 2021 (UTC)Reply

Is there anything in the logs? Like the user DN the extension tries to use for binding? Osnard (talk) 08:02, 30 August 2021 (UTC)Reply

Could not get UserDN

Latest comment: 5 years ago6 comments2 people in discussion

I have moved my mediawiki server to the AWS cloud and in the process, updated the server OS (Ubuntu 20.04.2 LTS). I previously was using LDAPAuthentication and am struggling to transition to the newer LDAP Stack configuration. I am able to connect to my LDAP server (verified via ldapsearch), but my login on the mediawiki consistently comes up with the error Could not authenticate credentials against domain "XXX".

Product	Version
MediaWiki	1.35.2
PHP	7.4.3 (apache2handler)
MySQL	5.7.33
ICU	66.1

Extension	Version	License	Description	Authors
LDAPAuthentication2	1.0.2 (118486b) 19:46, 25 May 2021	GPL-2.0	Allows authentication against a LDAP resource	Cindy Cicalese, Mark A. Hershberger and Robert Vogel
LDAPProvider	1.0.5 (6404505) 20:25, 25 May 2021	GPL-2.0+	Provides a common infratructure to connect to a LDAP resource and run queries against it	Cindy Cicalese, Mark A. Hershberger and Robert Vogel
PluggableAuth	5.7 (78cb499) 14:37, 27 May 2021	MIT	Provides framework for pluggable authentication and authorization	Cindy Cicalese

I ran the Config conversion tool to convert my old LDAP Authentication code to a new json file. I have tweaked this a bit from that conversion, but have had no success. My ldapprovider.json is as follows:

{

"XXX": {

"connection": {

"server": "xxx.xxx.xxx.EDU",

"port": 636,

"enctype": "ssl",

"basedn": "ou=active,ou=users,ou=data,o=isu",

"userbasedn": "ou=active,ou=users,ou=data,o=isu",

"userdnsearchattribute": "uid"

}

I have the following in my LocalSetting.php:

#---------------LDAP---------------

#---------------Extension LDAPProvider---------------

#provides classes and configuration to query data from LDAP resources

wfLoadExtension( 'LDAPProvider' );

$ldapJsonFile = "$IP/extensions/LDAPProvider/docs/ldapprovider.json";

$LDAPProviderDomainConfigProvider = "\\MediaWiki\\Extension\\LDAPProvider\\DomainConfigProvider\\LocalJSONFile::newInstance";

$LDAPProviderDomainConfigs = $ldapJsonFile;

$LDAPProviderDefaultDomain="REDACTED";

$LDAPProviderCacheType = CACHE_NONE;

#---------------Extension PluggableAuth---------------

#provides a framework for creating and using authentication and authorization extensions

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableAutoLogin = false; #if true, disables the logout option

$wgPluggableAuth_EnableLocalLogin = false;

$wgPluggableAuth_ButtonLabel = "Login...";

#---------------Extension LDAPAuthentication2---------------

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2AllowLocalLogin = false;

I have turned on debugging and will get the following:

LDAPAuth2.log error log

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_connect( $uri = 'ldaps://IDA.ITS.ISU.EDU:636' );

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: # __METHOD__ returns a link id

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: Setting LDAP_OPT_REFERRALS to 0

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-16 21:46:31 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'ou=active,ou=users,ou=data,o=isu',

'filter' => '(=serrkind)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_search( $linkID, $baseDN = 'ou=active,ou=users,ou=data,o=isu', $filter = '(=serrkind)', $attri>

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: # returns an error (Bad search filter)

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_count_entries( $linkiID, $result = [resource] );

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: # returns

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: Could not get user DN!

2021-06-16 21:46:32 ip-10-252-16-148 iacwikidb-iacwiki_: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: ''

Any help is greatly appreciated! Serrkind (talk) 21:47, 16 June 2021 (UTC)Reply

Looks like you may lack some entries in the "connection" section. Like "usernameattribute". Osnard (talk) 08:44, 17 June 2021 (UTC)Reply

Thanks for the input. I added lines for

"usernameattribute": "uid"

"realnameattribute": "cn",

But am still getting the same message. Is there a bare bones example of what is needed in the .json file? Serrkind (talk) 13:46, 17 June 2021 (UTC)Reply

I've done a bit more editing and have gotten some different error messages as a result. Hopefully, this means I am on the right track.

My ldapprovider.json file now looks like this:

{

"XXX": {

"connection": {

"server": "XXX.XXX.ISU.EDU",

"port": 636,

"enctype": "ssl",

"basedn": "ou=active,ou=users,ou=data,o=isu",

"userbasedn": "ou=active,ou=users,ou=data,o=isu",

"searchstring": "cn=USER-NAME,ou=active,ou=users,ou=data,o=isu",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail"

}

And I now get the following error message:

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_connect( $uri = 'ldaps://XXX.ITS.ISU.EDU:636' );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # __METHOD__ returns a link id

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: Setting LDAP_OPT_REFERRALS to 0

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_bind( $linkID, $bindRDN = '', $bindPassword = 'XXXX' );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'cn=serrkind,ou=active,ou=users,ou=data,o=isu'

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_bind( $linkID, $bindRDN = 'cn=serrkind,ou=active,ou=users,ou=data,o=isu', $bindPassword = 'XXXX' );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns true

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_search( $linkID, $baseDN = 'ou=active,ou=users,ou=data,o=isu', $filter = '(=serrkind)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit >

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns an error (Bad search filter)

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: ldap_error( $linkID );

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: # returns Bad search filter

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: Error fetching userinfo: Error in LDAP search: Bad search filter

2021-06-17 15:14:13 ip-10-252-16-148 iacwikidb-iacwiki_: #0 /wikidata/wikis/mediawiki/extensions/LDAPProvider/src/UserInfoRequest.php(61): MediaWiki\Extension\LDAPProvider\Client->search()

#1 /wikidata/wikis/mediawiki/extensions/LDAPProvider/src/Client.php(267): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo()

#2 /wikidata/wikis/mediawiki/includes/libs/objectcache/BagOStuff.php(149): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}()

#3 /wikidata/wikis/mediawiki/extensions/LDAPProvider/src/Client.php(268): BagOStuff->getWithSetCallback()

#4 /wikidata/wikis/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(178): MediaWiki\Extension\LDAPProvider\Client->getUserInfo()

#5 /wikidata/wikis/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(48): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin()

#6 /wikidata/wikis/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate()

#7 /wikidata/wikis/mediawiki/includes/specialpage/SpecialPage.php(600): PluggableAuthLogin->execute()

#8 /wikidata/wikis/mediawiki/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run()

#9 /wikidata/wikis/mediawiki/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath()

#10 /wikidata/wikis/mediawiki/includes/MediaWiki.php(940): MediaWiki->performRequest()

#11 /wikidata/wikis/mediawiki/includes/MediaWiki.php(543): MediaWiki->main()

#12 /wikidata/wikis/mediawiki/index.php(53): MediaWiki->run()

#13 /wikidata/wikis/mediawiki/index.php(46): wfIndexMain()

#14 {main}

Any more tweaks suggested? Serrkind (talk) 16:40, 17 June 2021 (UTC)Reply

It says "Bad search filter", and the filter is clearly bad: "$filter = '(=serrkind)'". It is missing the key to the value "serrkind". This key would be specified by "searchattribute", not "usernameattribute". Sorry. my bad. Try '"searchattribute": "uid"'. Osnard (talk) 11:45, 18 June 2021 (UTC)Reply

Osnard,

Adding the "searchattribute:": "uid" did the trick. I was able to successfully log into my wiki using LDAP. Thank you for your guidance!

Kindra Serrkind (talk) 18:13, 21 June 2021 (UTC)Reply

Hint For Solution for table ldap_domains does not get Filled

Latest comment: 5 years ago2 comments2 people in discussion

I had the Problem, that the Table ldap_domains was not filled when users logged in, which led to both Groups and UserInfos not being synced.

Since My Setup runs on multiple Domains I could not just set a DefaultDomain.

This might have been because my Setup runs on Windows/IIS so I want to post the solution I went with:

I Modified UserDomainStore.php, so that It extracts the Domain from $_SERVER[REMOTE_USER] and inserts it into ldap_domains if it doesn't find a corresponding entry, as I Named the domains in my config the same:

<?php

namespace MediaWiki\Extension\LDAPProvider;

use Wikimedia\Rdbms\LoadBalancer;

use User;

use MediaWiki\MediaWikiServices;

class UserDomainStore {

/**

*

* @var LoadBalancer

*/

protected $loadbalancer = null;

/**

*

* @var Config

*/

protected $config = null;

/**

* @param LoadBalancer $loadbalancer to use

* @param Config|null $config

*/

public function __construct( LoadBalancer $loadbalancer, $config = null ) {

$this->loadbalancer = $loadbalancer;

$this->config = $config;

if ( $this->config === null ) {

$this->config = MediaWikiServices::getInstance()

->getConfigFactory()

->makeConfig( 'ldapprovider' );

}

/**

* @param User $user to get domain for

* @return string|null

*/

public function getDomainForUser( User $user ) {

$userId = $user->getId();

if ( $userId != 0 ) {

$dbr = $this->loadbalancer->getConnection( DB_REPLICA );

$row = $dbr->selectRow(

'ldap_domains',

[ 'domain' ],

[ 'user_id' => $userId ],

__METHOD__ );

if ( $row ) {

return $row->domain;

}

$Remoteparts = explode('\\', $_SERVER[REMOTE_USER] )[0] ;

$this->setDomainForUser($user, $Remoteparts);

return $Remoteparts;

$defaultDomain = $this->config->get( Config::DEFAULT_DOMAIN );

if ( !empty( $defaultDomain ) ) {

return $defaultDomain;

}

return null;

}

/**

* @param string $user to set

* @param string $domain to set user to

* @return bool

*/

public function setDomainForUser( $user, $domain ) {

$userId = $user->getId();

if ( $userId != 0 ) {

$dbw = $this->loadbalancer->getConnection( DB_MASTER );

$olddomain = $this->getOldDomainForUser( $user );

if ( $olddomain ) {

return $dbw->update(

'ldap_domains',

[ 'domain' => $domain ],

[ 'user_id' => $userId ],

__METHOD__

);

} else {

return $dbw->insert(

'ldap_domains',

[

'domain' => $domain,

'user_id' => $userId

],

__METHOD__

);

}

return false;

}

public function getOldDomainForUser( User $user ) {

$userId = $user->getId();

if ( $userId != 0 ) {

$dbr = $this->loadbalancer->getConnection( DB_REPLICA );

$row = $dbr->selectRow(

'ldap_domains',

[ 'domain' ],

[ 'user_id' => $userId ],

__METHOD__ );

if ( $row ) {

return $row->domain;

}

return null;

}

@Osnard fyi 88.217.84.59 (talk) 14:17, 5 August 2021 (UTC)Reply

Thanks! I will check it! Osnard (talk) 11:08, 6 August 2021 (UTC)Reply

Can't contact LDAP server since Mediawiki 1.35.3 (Docker)

Latest comment: 4 years ago9 comments2 people in discussion

The LDAP authentication works fine using Mediawiki 1.35.2. When upgrading to 1.35.3 or 1.35.4, I get the following error:

[63826e5c0ca4e6e22441953f] /wiki/Spezial:PluggableAuthLogin MWException from line 168 of /var/www/html/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server

Backtrace:

#0 /var/www/html/extensions/LDAPProvider/src/Client.php(91): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /var/www/html/extensions/LDAPProvider/src/Client.php(328): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(184): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /var/www/html/extensions/LDAPAuthentication2/src/PluggableAuth.php(55): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin(string, string, string, NULL, NULL, NULL)
#4 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#5 /var/www/html/includes/specialpage/SpecialPage.php(600): PluggableAuthLogin->execute(NULL)
#6 /var/www/html/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run(NULL)
#7 /var/www/html/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)
#8 /var/www/html/includes/MediaWiki.php(940): MediaWiki->performRequest()
#9 /var/www/html/includes/MediaWiki.php(543): MediaWiki->main()
#10 /var/www/html/index.php(53): MediaWiki->run()
#11 /var/www/html/index.php(46): wfIndexMain()
#12 {main}

And from the DebugLog:

[LDAP] ldap_connect( $hostname = 'ldaps://XXXX.XXXX.XXXX.XXXX.de:636', $port = 389 );
[LDAP] # __METHOD__ returns Resource id #16
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_PROTOCOL_VERSION to 3
[LDAP] ldap_set_option( $linkID, $option = 17, $newval = 3 );
[LDAP] # returns 1
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_REFERRALS to 0
[LDAP] ldap_set_option( $linkID, $option = 8, $newval = 0 );
[LDAP] # returns 1
[LDAP] ldap_bind( $linkID, $bindRDN = 'cn=XXXX,ou=XXXX,ou=XXXX,ou=XXXX,dc=XXXX,dc=XXXX,dc=XXXX,dc=de', $bindPassword = 'XXXX' );
[LDAP] # returns
[LDAP] ldap_error( $linkID );
[LDAP] # returns Can't contact LDAP server
[LDAP] ldap_errno( $linkID );
[LDAP] # returns -1

Which is similar to the working version in 1.35.2:

[LDAP] ldap_connect( $hostname = 'ldaps://XXXX.XXXX.XXXX.XXXX.de:636', $port = 389 );
[LDAP] # __METHOD__ returns Resource id #6
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_PROTOCOL_VERSION to 3
[LDAP] ldap_set_option( $linkID, $option = 17, $newval = 3 );
[LDAP] # returns 1
[MediaWiki\Extension\LDAPProvider\Client] Setting LDAP_OPT_REFERRALS to 0
[LDAP] ldap_set_option( $linkID, $option = 8, $newval = 0 );
[LDAP] # returns 1
[LDAP] ldap_bind( $linkID, $bindRDN = 'cn=XXXX,ou=XXXX,ou=XXXX,ou=XXXX,dc=XXXX,dc=XXXX,dc=XXXX,dc=de', $bindPassword = 'XXXX' );
[LDAP] # returns 1

Is there any known change to Mediawiki from 1.35.2 to 1.35.3 which might have caused this? I suspect, there could also be a change in the Docker image which could cause this fail. Tuebel (talk) 09:26, 12 October 2021 (UTC)Reply

No idea, sorry. Which Docker image are you using? As far as I know those are only for development purposes, not for production. Osnard (talk) 06:23, 13 October 2021 (UTC)Reply

I'm using the DockerHub "official" mediawiki image and extend it with the LDAP extensions like this:

# Does not work for 1.35.3 and later
FROM mediawiki:1.35.2
# LDAP library
RUN \
  apt-get update && \
  apt-get install libldap2-dev wget -y && \
  rm -rf /var/lib/apt/lists/* && \
  docker-php-ext-configure ldap --with-libdir=lib/x86_64-linux-gnu/ && \
  docker-php-ext-install ldap
# LDAP (https://www.mediawiki.org/wiki/Extension:LDAPAuthentication2#Configuration)
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-PluggableAuth.git /var/www/html/extensions/PluggableAuth
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-LDAPProvider.git /var/www/html/extensions/LDAPProvider
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2.git /var/www/html/extensions/LDAPAuthentication2
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization.git /var/www/html/extensions/LDAPAuthorization
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-LDAPUserInfo.git /var/www/html/extensions/LDAPUserInfo
RUN git clone -b REL1_35 --depth 1 https://github.com/wikimedia/mediawiki-extensions-LDAPGroups.git /var/www/html/extensions/LDAPGroups

Tuebel (talk) 06:18, 14 October 2021 (UTC)Reply

I see. Looks good. I am not aware of any issues with newer patch level versions of MediaWiki. I will see if I can find any installation with such a version. Osnard (talk) 12:36, 14 October 2021 (UTC)Reply

Well, I have an internal wiki with 1.35.3 and LDAP stack running. It looks more like something in the Docker environment may have changed. Or in the networking options of the container. The error message "Could not bind to LDAP: (-1) Can't contact LDAP server" is basically coming directly from the PHP ldap extension functions. So I don't think it is related to the actual implementation of the extensions. Osnard (talk) 12:39, 14 October 2021 (UTC)Reply

This sounds reasonable, as the base image PHP Version was bumped from 7.3 to 7.4. It's good to hear that it works in principle, so I will try to install the php-ldap extension manually. Tuebel (talk) 13:18, 18 October 2021 (UTC)Reply

I have tried different PHP Versions but this does not make a difference. I suppose that your guess is correct and the breaking change is in one of the Dockerfiles. However, I do not have that much to dig deeper into it, so I will probably just use 1.35.2 for a while. Thanks for your help! Tuebel (talk) 08:52, 25 October 2021 (UTC)Reply

I have just updated to 1.35.5 with all the latest updates from the LDAP repositories and it seems to work fine again. Tuebel (talk) 07:42, 16 December 2021 (UTC)Reply

Thanks for reporting. Osnard (talk) 08:09, 16 December 2021 (UTC)Reply

Could not authenticate credentials against domain "DOMAIN"

Latest comment: 4 years ago14 comments2 people in discussion

I actually set in LocalSetting.php my ldap configuration but I have this error : Could not authenticate credentials against domain "DOMAIN" when I try to log in.

After multiple changement in LocalSetting.php nothing seems to work.

Thank you for helping. 80.15.154.59 (talk) 08:18, 29 October 2021 (UTC)Reply

Please share your configuration. Strip sensitive data beforehand. Please try to provide debug information Osnard (talk) 08:20, 29 October 2021 (UTC)Reply

mediawiki version : 1.33

There is my configuration :

wfLoadExtensions( [

'PluggableAuth',

'Auth_remoteuser',

'LDAPProvider',

'LDAPAuthentication2',

'LDAPAuthorization',

] );

$LDAPProviderDomainConfigProvider = function() {

$config =

[

"DOMAIN"=>

[

"connection" =>

[

"server" => "server.x.lan",

"port" => "389",

"basedn" => "dc=x", "dc=lan",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"groupbasedn" => "dc=x", "dc=lan",

"userbasedn" => "dc=x", "dc=lan",

"searchattribute" => "sAMAccountName",

"searchstring" => "sAMAccountName=USER-NAME","OU=Utilisateurs","dc=x","dc=lan",

"usernameattribute" => "sn",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"

],

"authorization" =>

[

"rules" =>

[

"groups" =>

[ "required" => "CN=Utilisateurs","DC=x","DC=lan",

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

I also put :

$wgDebugLogGroups['PluggableAuth'] = '/tmp/ldap.log';

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/tmp/ldap.log';

$wgDebugLogGroups['LDAPAuthentication2'] = '/tmp/ldap.log';

$wgDebugLogGroups['LDAPAuthorization'] = '/tmp/ldap.log';

I have this :

2021-10-29 08:42:34 mediawiki: In execute()

2021-10-29 08:42:34 mediawiki: Getting PluggableAuth singleton

2021-10-29 08:42:34 mediawiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

2021-10-29 08:42:34 mediawiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-10-29 08:42:34 mediawiki: Setting LDAP_OPT_REFERRALS to 0

2021-10-29 08:42:34 mediawiki: Setting LDAP_OPT_DEREF to 1

2021-10-29 08:42:39 mediawiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'sAMAccountName=username'

2021-10-29 08:42:39 mediawiki: Authentication failure.

2021-10-29 08:42:39 mediawiki: ERROR: Could not authenticate credentials against domain "DOMAIN"

Thank you 80.15.154.59 (talk) 08:45, 29 October 2021 (UTC)Reply

'sAMAccountName=username' is not a valid DN. Please use either "searchattribute" or "searchstring" Osnard (talk) 10:21, 29 October 2021 (UTC)Reply

okay so I delete searchstring and let searchattribute but it's not working I have the same error I had at first

what to do ? 80.15.154.59 (talk) 11:48, 29 October 2021 (UTC)Reply

You are still getting MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'sAMAccountName=username' and nothing else? If the extensions tries to create the use DN from something else than searchattribute, you should see something like "MediaWiki\Extension\LDAPProvider\Client::getUserDN search with ..." Osnard (talk) 12:28, 29 October 2021 (UTC)Reply

I have :

2021-10-29 11:46:54 mediawiki: In execute()

2021-10-29 11:46:54 mediawiki: Getting PluggableAuth singleton

2021-10-29 11:46:54 mediawiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

2021-10-29 11:46:54 mediawiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-10-29 11:46:54 mediawiki: Setting LDAP_OPT_REFERRALS to 0

2021-10-29 11:46:54 mediawiki: Setting LDAP_OPT_DEREF to 1

2021-10-29 11:46:59 mediawiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

'base' => 'dc=x',

'filter' => '(sAMAccountName=username)',

'attributes' =>

array (

0 => '*',

1 => 'memberof',

),

)

2021-10-29 11:46:59 mediawiki: Could not get user DN!

2021-10-29 11:46:59 mediawiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: ''

2021-10-29 11:46:59 mediawiki: Authentication failure.

2021-10-29 11:46:59 mediawiki: ERROR: Could not authenticate credentials against domain "DOMAIN" 80.15.154.59 (talk) 13:02, 29 October 2021 (UTC)Reply

This means the lookup did not find the user. Please check the output of LDAPProvider/maintenance/ShowUserInfo.php for that particular user. Make sure the configured attribute name has the proper casing and the base DN is also okay. Osnard (talk) 13:52, 29 October 2021 (UTC)Reply

Okay so I tried :

php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain DOMAIN --username username

And this is what I got :

MWException from line 234 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Error in LDAP search: Operations error

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/UserInfoRequest.php(61): MediaWiki\Extension\LDAPProvider\Client->search(string, string, array)

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(267): MediaWiki\Extension\LDAPProvider\UserInfoRequest->getUserInfo(string)

#2 /var/www/html/mediawiki/includes/libs/objectcache/BagOStuff.php(158): MediaWiki\Extension\LDAPProvider\Client->MediaWiki\Extension\LDAPProvider\{closure}()

#3 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(268): BagOStuff->getWithSetCallback(string, integer, Closure)

#4 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(49): MediaWiki\Extension\LDAPProvider\Client->getUserInfo(string)

#5 /var/www/html/mediawiki/maintenance/doMaintenance.php(96): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()

#6 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(72): require_once(string)

#7 {main} 80.15.154.59 (talk) 08:35, 3 November 2021 (UTC)Reply

Apparently the LDAP user is not allowed to execute a "search" query against the LDAP server. Osnard (talk) 09:32, 4 November 2021 (UTC)Reply

But when I do a ldapsearch :

ldapsearch -H ldap://server.x.lan -b 'dc=x,dc=lan' -x -D 'cn="media wiki", ou=Utilisateurs,dc=x,dc=lan' -w 'passwd' -s sub "(cn=\

*user)" samaccountname

I got the outpout with the correct information but in mediawiki it doesn't work ... why ? and I don't understand where is the problem 80.15.154.59 (talk) 15:56, 4 November 2021 (UTC)Reply

Do you have `cn="media wiki", ou=Utilisateurs,dc=x,dc=lan` set up as a proxy user in your DOMAIN-config in the `connection` section? I can not see it in the example shared above. Osnard (talk) 11:19, 6 November 2021 (UTC)Reply

sorry for the late, and yes I actually have this in the connection section I share with you the connection section here :

"connection" =>

[

"server" => "x.x.lan",

"port" => "389",

"user" =>"cn=media wiki","ou=Utilisateurs","dc=x", "dc=lan",

"pass" =>"password",

"enctype" => "clear",

//"basedn" =>"ou=Utilisateurs", "dc=x", "dc=lan",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"groupbasedn" => "ou=Utilisateurs","dc=x", "dc=lan",

"userbasedn" => "ou=Utilisateurs","dc=x", "dc=lan",

"searchattribute" => "sAMAccountName",

//"searchstring" => "sAMAccountName=USER-NAME",

"usernameattribute" => "sAMAccountName",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory" 80.15.154.59 (talk) 10:27, 10 November 2021 (UTC)Reply

Can you please provide a full log from a run of ShowUserInfo?

Please check the regular PHP error log
Please provide everything logged by the applications debug log Osnard (talk) 07:14, 11 November 2021 (UTC)Reply

Can't login with local accounts

Latest comment: 4 years ago5 comments2 people in discussion

Hello everyone.

After suffering on setting ldaps i managed to login onto mediawiki with users that belong to a certain Group.

I still want to be able to login as admin (local user)

ldap.json {

       "mydomain.com": {
               "connection": {
                       "server": "dc1.mydomain.com dc2.mydomain.com dc3.mydomain.com dc4.mydomain.com",
                       "port" : "636",
                       "user": "myusername",
                       "pass": "mypassword",
                       "enctype": "ssl",
                       "options": {
                               "LDAP_OPT_DEREF": 1,
                               "LDAP_OPT_PROTOCOL_VERSION": 3
                       },
                       "basedn": "DC=mydomain,DC=com",
                       "groupbasedn": "CN=Ldap-Wiki-Test,OU=Groups-Services,OU=Users-Groups-Services,DC=mydomain,DC=com",
                       "userbasedn": "DC=mydomain,DC=com",
                       "searchattribute": "samaccountname",
                       "searchstring": "",
                       "usernameattribute": "samaccountname",
                       "realnameattribute": "samaccountname",
                       "emailattribute": "mail",
                       "grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"
               },
               "authorization": {
                               "rules": {
                                       "groups" :{
                                               "required": ["CN=Ldap-Wiki-Test,OU=Groups-Services,OU=Users-Groups-Services,DC=mydomain,DC=com"]
                               }
                       }
               },
               "groupsync": {
                       "mapping": {
                               "Ldap-Wiki-Test": "CN=Ldap-Wiki-Test,OU=Groups-Services,OU=Users-Groups-Services,DC=mydomain,DC=com"
                       }
               },
               "userinfo": []
       }

}

LocalSettings.php //LDAP wfLoadExtension( 'LDAPProvider' ); wfLoadExtension( 'PluggableAuth' ); wfLoadExtension( 'LDAPAuthentication2' ); wfLoadExtension( 'LDAPAuthorization' ); wfLoadExtension( 'LDAPUserInfo' ); wfLoadExtension( 'LDAPGroups' );

$LDAPAuthentication2AllowLocalLogin = true; $wgPluggableAuth_EnableLocalLogin = true; $wgPluggableAuth_EnableLocalProperties = true;

$LDAPProviderDomainConfigs = "/mediawiki/ldapprovider.json";

$wgDebugLogGroups['PluggableAuth'] = $wgDebugLogGroups['LDAP'] = $wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = $wgDebugLogGroups['LDAPGroups'] = $wgDebugLogGroups['LDAPUserInfo'] = $wgDebugLogGroups['LDAPAuthentication2'] = $wgDebugLogGroups['LDAPAuthorization'] = '/mediawiki/log/LDAP.log';

$wgGroupPermissions['Ldap-Wiki-Test']['read'] = true; $wgGroupPermissions['Ldap-Wiki-Test']['edit'] = false; $wgGroupPermissions['user']['edit'] = false; $wgGroupPermissions['administrators']['edit'] = true;

When i try to login as admin and of course choosing "local" in the dropdown menu, I get this error: Authorization failure. 2021-12-07 13:44:03 rip-test wiki_database: In execute() 2021-12-07 13:44:03 rip-test wiki_database: Getting PluggableAuth singleton 2021-12-07 13:44:03 rip-test wiki_database: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth 2021-12-07 13:44:03 rip-test wiki_database: Authenticated existing user: Admin 2021-12-07 13:44:03 rip-test wiki_database: ldap_connect( $uri = 'ldaps://dc1.mydomain.com:636 ldaps://dc2.mydomain.com:636 ldaps://dc3.mydomain.com:636 ldaps://dc4.mydomain.com:636' ); 2021-12-07 13:44:03 rip-test wiki_database: # __METHOD__ returns a link id 2021-12-07 13:44:03 rip-test wiki_database: Setting LDAP_OPT_PROTOCOL_VERSION to 3 2021-12-07 13:44:03 rip-test wiki_database: ldap_set_option( $linkID, $option = 17, $newval = 3 ); 2021-12-07 13:44:03 rip-test wiki_database: # returns true 2021-12-07 13:44:03 rip-test wiki_database: Setting LDAP_OPT_REFERRALS to 0 2021-12-07 13:44:03 rip-test wiki_database: ldap_set_option( $linkID, $option = 8, $newval = 0 ); 2021-12-07 13:44:03 rip-test wiki_database: # returns true 2021-12-07 13:44:03 rip-test wiki_database: Setting LDAP_OPT_DEREF to 1 2021-12-07 13:44:03 rip-test wiki_database: ldap_set_option( $linkID, $option = 2, $newval = 1 ); 2021-12-07 13:44:03 rip-test wiki_database: # returns true 2021-12-07 13:44:03 rip-test wiki_database: ldap_bind( $linkID, $bindRDN = 'myusername', $bindPassword = 'XXXX' ); 2021-12-07 13:44:03 rip-test wiki_database: # returns true 2021-12-07 13:44:03 rip-test wiki_database: ldap_search( $linkID, $baseDN = 'DC=mydomain,DC=com', $filter = '(samaccountname=Admin)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = ); 2021-12-07 13:44:03 rip-test wiki_database: # returns a resource 2021-12-07 13:44:03 rip-test wiki_database: ldap_get_entries( $linkID, $resultID ); 2021-12-07 13:44:03 rip-test wiki_database: # returns: array (

 'count' => 0,

)
2021-12-07 13:44:03 rip-test wiki_database: Ran LDAP search for '(samaccountname=Admin)' in 0.00055098533630371 seconds.
2021-12-07 13:44:03 rip-test wiki_database: Authorization failure.

dc2.mydomain.com dc3.mydomain.com dc4.mydomain.com

93.57.21.240 (talk) 13:48, 7 December 2021 (UTC)Reply

I believe there is either an open task on Phabricator regarding this, or maybe already a patch. Which versions are you using? Osnard (talk) 14:05, 7 December 2021 (UTC)Reply

Hi

MediaWiki 1.35.2

LDAPProvider 1.0.5 (ff8e4fd) 01:00, 17 April 2021

PluggableAuth 5.7 (57c549a) 00:35, 14 April 2021

LDAPAuthentication2 1.0.2 (848192f) 00:36, 17 April 2021

LDAPAuthorization 1.1.0 (82463a4) 00:36, 17 April 2021

LDAPUserInfo 1.0.0 (ffee646) 11:29, 17 April 2021

LDAPGroups 1.0.3 (118aecb) 08:08, 3 September 2021 93.57.21.240 (talk) 14:26, 7 December 2021 (UTC)Reply

so redownloaded every extensions used for ldap (cause got this server inherited) and now it works 93.57.21.240 (talk) 17:10, 7 December 2021 (UTC)Reply

Glad to hear. Osnard (talk) 10:56, 8 December 2021 (UTC)Reply