Extension talk:LDAPProvider/2022

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

LDAP connection with Mediawiki 1.37

Latest comment: 4 years ago12 comments5 people in discussion

Hello everyone !

I am trying to set ldap connection on mediawiki, but when I am trying to connect with my ldap id et password I have this error : id or password is not correct. Try again.

But this is correct ... I don't understant why...

Here is my ldap configuration on /etc/mediawiki/ldapprovider.json :

{

"dom.lan": {

"connection": {

"server": "ip",

"user": "cn=mediawiki,ou=grp,ou=user,dc=xxx,dc=xxx",

"pass": "pass",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "ou=user,dc=xxx,dc=xxx",

"groupbasedn": "ou=user,dc=xxx,dc=xxx",

"userbasedn": "ou=user,dc=xxx,dc=xxx",

"searchattribute": "sAMAccountName",

"searchstring": "sAMAccountName=USER-NAME",

"usernameattribute": "sAMAccountName",

"realnameattribute": "cn",

"emailattribute": "mail"

},

"userinfo": [],

"authorization": [],

"groupsync": {

"mapping": {

"engineering": "OU=user,DC=xxx,DC=xxx",

"bureaucrat": "OU=user,DC=xxx,DC=xxx",

"interface-admin": "OU=user,DC=xxx,DC=xxx",

"sysop": "OU=user,DC=xxx,DC=xxx"

}

I also run

php update.php

everything works perfectly.

I don't understand why .. 2A01:E0A:8E2:5080:CC25:FC40:A18:E35 (talk) 11:38, 6 January 2022 (UTC)Reply

I did :

php extensions/LDAPProvider/maintenance/ShowUserInfo.php -d domain.lan -u user

I have all the information about the user. So, I can suppose that my configuration is correct and it can bind the ldap server.

But I still can't connect via my wiki page... Usermediawik (talk) 14:35, 6 January 2022 (UTC)Reply

Hi!

Please enable debugging and share the logs here. Thanks. Osnard (talk) 08:31, 7 January 2022 (UTC)Reply

I tried to debug but there is nothing in my log file.

So I tried to connect I have this error now :

MediaWiki internal error.

Original exception: [62171e6a9d373c3fe5944725] /index.php/Sp%C3%A9cial:PluggableAuthLogin TypeError: Return value of User::getName() must be of the type string, null returned

Backtrace:

from /var/www/mediawiki/includes/user/User.php(2127)

#0 /var/www/mediawiki/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(83): User->getName()

#1 /var/www/mediawiki/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(71): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->process()

#2 /var/www/mediawiki/includes/HookContainer/HookContainer.php(338): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::callback(User, boolean)

#3 /var/www/mediawiki/includes/HookContainer/HookContainer.php(137): MediaWiki\HookContainer\HookContainer->callLegacyHook(string, array, array, array)

#4 /var/www/mediawiki/includes/Hooks.php(137): MediaWiki\HookContainer\HookContainer->run(string, array, array)

#5 /var/www/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(54): Hooks::run(string, array)

#6 /var/www/mediawiki/includes/specialpage/SpecialPage.php(647): PluggableAuthLogin->execute(NULL)

#7 /var/www/mediawiki/includes/specialpage/SpecialPageFactory.php(1366): SpecialPage->run(NULL)

#8 /var/www/mediawiki/includes/MediaWiki.php(314): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, RequestContext)

#9 /var/www/mediawiki/includes/MediaWiki.php(930): MediaWiki->performRequest()

#10 /var/www/mediawiki/includes/MediaWiki.php(564): MediaWiki->main()

#11 /var/www/mediawiki/index.php(53): MediaWiki->run()

#12 /var/www/mediawiki/index.php(46): wfIndexMain()

#13 {main}

Exception caught inside exception handler: [62171e6a9d373c3fe5944725] /index.php/Sp%C3%A9cial:PluggableAuthLogin TypeError: Return value of User::getName() must be of the type string, null returned

Backtrace:

from /var/www/mediawiki/includes/user/User.php(2127)

#0 /var/www/mediawiki/includes/user/User.php(3655): User->getName()

#1 /var/www/mediawiki/includes/skins/SkinTemplate.php(97): User->getUserPage()

#2 /var/www/mediawiki/includes/skins/SkinMustache.php(52): SkinTemplate->setupTemplateContext()

#3 /var/www/mediawiki/includes/skins/SkinTemplate.php(144): SkinMustache->generateHTML()

#4 /var/www/mediawiki/includes/OutputPage.php(2644): SkinTemplate->outputPage()

#5 /var/www/mediawiki/includes/exception/MWExceptionRenderer.php(158): OutputPage->output()

#6 /var/www/mediawiki/includes/exception/MWExceptionRenderer.php(77): MWExceptionRenderer::reportHTML(TypeError)

#7 /var/www/mediawiki/includes/exception/MWExceptionHandler.php(107): MWExceptionRenderer::output(TypeError, integer)

#8 /var/www/mediawiki/includes/exception/MWExceptionHandler.php(202): MWExceptionHandler::report(TypeError)

#9 /var/www/mediawiki/includes/MediaWiki.php(586): MWExceptionHandler::handleException(TypeError, string)

#10 /var/www/mediawiki/index.php(53): MediaWiki->run()

#11 /var/www/mediawiki/index.php(46): wfIndexMain()

#12 {main}

Thanks 37.170.94.39 (talk) 14:21, 7 January 2022 (UTC)Reply

What I have to put in usernameattribute please ? Apparently it's not correct

Thank you 2A01:E0A:8E2:5080:CC25:FC40:A18:E35 (talk) 16:10, 7 January 2022 (UTC)Reply

The output of ShowUserInfo.php should contain all field. Make sure to use the proper casing of the fieldnames in the configuration. Set them in the exact way as shown by ShowUserInfo.php Osnard (talk) 17:03, 7 January 2022 (UTC)Reply

Hello !

My ldap configuration works now I didn't set correctly the username attribute !

Can I set two ldap in the ldapprovider.json ? And how can we do it

Thank you for your help 37.173.87.235 (talk) 09:26, 12 January 2022 (UTC)Reply

Yes you can. Just add another "Domain" at the root level of the JSON file. Osnard (talk) 10:34, 13 January 2022 (UTC)Reply

It works thanks !

But since I upgraded and set the wiki if in the title we have the character "é","è" it can't find the file I don't understant why ... 2A01:E0A:8E2:5080:CC25:FC40:A18:E35 (talk) 16:11, 13 January 2022 (UTC)Reply

Are you sure this is related to any LDAPExtension? Osnard (talk) 16:20, 13 January 2022 (UTC)Reply

I searched but I found nothing for the moment that's why I am asking .. 2A01:E0A:8E2:5080:CC25:FC40:A18:E35 (talk) 07:59, 14 January 2022 (UTC)Reply

If you completely disable all LDAP Stack extensions and try to access the respective pages, does the issue still occur? Osnard (talk) 15:12, 14 January 2022 (UTC)Reply

wildcard searching

Latest comment: 4 years ago4 comments2 people in discussion

Hi

I am trying to use the following:

"searchstring": "cn=USER-NAME,ou=Users,ou=*,ou=abc,dc=mydom,dc=com"

It works if I do not have the * but as soon as I put the star in it does not work.

I also tried (!(ou=abc)(ou=xyz)) but this also does not work.

Is there some other option that needs to be set?

Regards 156.8.246.11 (talk) 08:09, 21 January 2022 (UTC)Reply

MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'cn=myADaccountName,ou=Users,ou=*,ou=abc,dc=mydom,dc=com'

ldap_bind( $linkID, $bindRDN = 'cn=myADaccountName,ou=Users,ou=*,ou=abc,dc=mydom,dc=com', $bindPassword = 'XXXX' );

# returns false

Authentication failure.

ERROR: Could not authenticate credentials against domain "mydom"

It seems that it is binding on the search string, this is not supported on ldap_bind, I would think that the distinguishedName will first be searched (using the AD query account) and it would bind on the distinguishedName 156.8.246.11 (talk) 08:42, 21 January 2022 (UTC)Reply

I changed the searchstring to

"searchstring": "mydom\\USER-NAME"

and seems to be working now. 156.8.246.11 (talk) 11:11, 24 January 2022 (UTC)Reply

Thanks for sharing! Osnard (talk) 07:44, 27 January 2022 (UTC)Reply

Mediawiki 1.31 support

Latest comment: 4 years ago2 comments2 people in discussion

Do we still have support for 1.31 MW? I tried installing the stable releases for master and 1.35 but they both require a MW version of >= 1.32?

I am trying to get LDAP working and this is the last piece of the puzzle for me as PluggableAuth and LDAPExt2 install fine.

Thanks! Zenalc (talk) 14:43, 3 February 2022 (UTC)Reply

The LDAP Stack extensions work for MW 1.31. You should be able to use either REL1_31 branch or Versions 1.* Osnard (talk) 14:24, 4 February 2022 (UTC)Reply

Object of class LDAP\Connection could not be converted to string

Latest comment: 3 years ago9 comments6 people in discussion

Operating System: Debian Bookworm

MediaWiki Version: 1.35.5

PHP: 8.1.2 (fpm-fcgi)

SQLite: 3.37.2

ICU: 67.1

I have the following OpenLDAP config (slapcat output):

dn: dc=thisbox

objectClass: top

objectClass: dcObject

objectClass: organization

o: nodomain

dc: thisbox

structuralObjectClass: organization

entryUUID: d2f0ae14-095c-103c-9e77-cb764f86fbcb

creatorsName: cn=admin,dc=thisbox

createTimestamp: 20220114080755Z

entryCSN: 20220114080755.826876Z#000000#000#000000

modifiersName: cn=admin,dc=thisbox

modifyTimestamp: 20220114080755Z

dn: ou=users,dc=thisbox

objectClass: top

objectClass: organizationalUnit

ou: users

structuralObjectClass: organizationalUnit

entryUUID: d3f32a80-095c-103c-82e9-a94ebc78528d

creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

createTimestamp: 20220114080757Z

entryCSN: 20220114080757.520913Z#000000#000#000000

modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

modifyTimestamp: 20220114080757Z

dn: ou=groups,dc=thisbox

objectClass: top

objectClass: organizationalUnit

ou: groups

structuralObjectClass: organizationalUnit

entryUUID: d3f4d20e-095c-103c-82ea-a94ebc78528d

creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

createTimestamp: 20220114080757Z

entryCSN: 20220114080757.531769Z#000000#000#000000

modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

modifyTimestamp: 20220114080757Z

dn: cn=freedombox-share,ou=groups,dc=thisbox

objectClass: posixGroup

cn: freedombox-share

gidNumber: 10000

description: Group account

structuralObjectClass: posixGroup

entryUUID: d40607fe-095c-103c-82eb-a94ebc78528d

creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

createTimestamp: 20220114080757Z

entryCSN: 20220114080757.644560Z#000000#000#000000

modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

modifyTimestamp: 20220114080757Z

dn: uid=benedek,ou=users,dc=thisbox

objectClass: account

objectClass: posixAccount

cn: benedek

uid: benedek

uidNumber: 10000

gidNumber: 100

homeDirectory: /home/benedek

loginShell: /bin/bash

gecos: benedek

description: User account

structuralObjectClass: account

entryUUID: 5bd92d26-2c0f-103c-8b6e-a950fd324e07

creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

createTimestamp: 20220227115135Z

userPassword:: e1NTSEF9U0hxd1VISGNWb0d1UXU2WmdaVUI1UDdFcHNNaXJ5M2w=

entryCSN: 20220228220646.589864Z#000000#000#000000

modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

modifyTimestamp: 20220228220646Z

dn: cn=admin,ou=groups,dc=thisbox

objectClass: posixGroup

cn: admin

gidNumber: 10001

description: Group account

structuralObjectClass: posixGroup

entryUUID: 5c3119f0-2c0f-103c-8b6f-a950fd324e07

creatorsName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

createTimestamp: 20220227115136Z

memberUid: benedek

entryCSN: 20220227115136.105200Z#000000#000#000000

modifiersName: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth

modifyTimestamp: 20220227115136Z

LocalSettings.php:

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigProvider = function() {

$config = [

'LDAP' => [

'connection' => [

"server" => "localhost",

"user" => "cn=admin,dc=thisbox",

"pass" => '',

"options" => [

"LDAP_OPT_DEREF" => 1

],

"basedn" => "dc=thisbox",

"groupbasedn" => "cn=admin,ou=groups,dc=thisbox",

"userbasedn" => "ou=users,dc=thisbox",

"searchattribute" => "uid",

"searchstring" => "cn=USER-NAME ou=users,dc=thisbox",

"usernameattribute" => "uid",

"realnameattribute" => "cn"

// "emailattribute" => "mail"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

$wgShowExceptionDetails = true;

When trying to log in I get:

[e9d3c4b50920e80bdefd48f7] /mediawiki/Special:PluggableAuthLogin Error from line 245 of /var/lib/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Object of class LDAP\Connection could not be converted to string

Backtrace:

#0 /var/lib/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php(261): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->connect()

#1 /var/lib/mediawiki/extensions/LDAPProvider/src/Client.php(100): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper::getConnection()

#2 /var/lib/mediawiki/extensions/LDAPProvider/src/Client.php(88): MediaWiki\Extension\LDAPProvider\Client->makeNewConnection()

#3 /var/lib/mediawiki/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()

#4 /var/lib/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(184): MediaWiki\Extension\LDAPProvider\Client->canBindAs()

#5 /var/lib/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(55): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin()

#6 /var/lib/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate()

#7 /usr/share/mediawiki/includes/specialpage/SpecialPage.php(600): PluggableAuthLogin->execute()

#8 /usr/share/mediawiki/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run()

#9 /usr/share/mediawiki/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath()

#10 /usr/share/mediawiki/includes/MediaWiki.php(945): MediaWiki->performRequest()

#11 /usr/share/mediawiki/includes/MediaWiki.php(548): MediaWiki->main()

#12 /usr/share/mediawiki/index.php(53): MediaWiki->run()

#13 /usr/share/mediawiki/index.php(46): wfIndexMain()

#14 {main}

I made sure to install php-ldap which I also enable in php.ini.

I also set the file permissions on LDAPProvider, PluggableAuth and LDAPAuthentication2 to be the same as the rest of the extensions that MediaWiki is shipped with.

I updated the Mediawiki database.

Can you help me figure this out? Once I have the correct configuration, I will start working on packaging the extension for Debian/FreedomBox.

Nbenedek (talk) 22:32, 28 February 2022 (UTC)Reply

Is there maybe a callstack available that could indicate the origin of the error message? Osnard (talk) 16:26, 4 March 2022 (UTC)Reply

Per Manual:Active Directory Integration this is LTS mediawiki with the REL1_35 of each extension:

PHP 8.1.2


mediawiki-1.35.8.tar.gz
LDAPAuthentication2-REL1_35-3e72a8f.tar.gz
LDAPGroups-REL1_35-183876c.tar.gz
LDAPUserInfo-REL1_35-3ab25cf.tar.gz
LDAPAuthorization-REL1_35-a0d1a5b.tar.gz
LDAPProvider-REL1_35-961cd88.tar.gz
PluggableAuth-REL1_35-ad00c99.tar.gz


[exception] [d635cb803852f64a929ee105] /w/index.php?title=Special:Version   Error from line 245 of /opt/mediawiki/w/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Object of class LDAP\Connection could not be converted to string
0 /opt/mediawiki/w/extensions/LDAPProvider/src/PlatformFunctionWrapper.php(261): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->connect()
1 /opt/mediawiki/w/extensions/LDAPProvider/src/Client.php(100): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper::getConnection()
2 /opt/mediawiki/w/extensions/LDAPProvider/src/Client.php(88): MediaWiki\Extension\LDAPProvider\Client->makeNewConnection()
3 /opt/mediawiki/w/extensions/LDAPProvider/src/Client.php(347): MediaWiki\Extension\LDAPProvider\Client->init()
4 /opt/mediawiki/w/extensions/LDAPGroups/src/GroupSyncProcess.php(63): MediaWiki\Extension\LDAPProvider\Client->getUserGroups()
5 /opt/mediawiki/w/extensions/LDAPGroups/src/Hook/UserLoadAfterLoadFromSession/SyncUserGroupsAfterLoadSession.php(25): MediaWiki\Extension\LDAPGroups\GroupSyncProcess->run()
6 /opt/mediawiki/w/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(186): MediaWiki\Extension\LDAPGroups\Hook\UserLoadAfterLoadFromSession\SyncUserGroupsAfterLoadSession->doSync()
7 /opt/mediawiki/w/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(104): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->doProcess()
8 /opt/mediawiki/w/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(90): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->process()
9 /opt/mediawiki/w/includes/HookContainer/HookContainer.php(329): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession::callback()
10 /opt/mediawiki/w/includes/HookContainer/HookContainer.php(132): MediaWiki\HookContainer\HookContainer->callLegacyHook()
11 /opt/mediawiki/w/includes/HookContainer/HookRunner.php(4348): MediaWiki\HookContainer\HookContainer->run()
12 /opt/mediawiki/w/includes/user/User.php(393): MediaWiki\HookContainer\HookRunner->onUserLoadAfterLoadFromSession()
13 /opt/mediawiki/w/includes/user/User.php(2156): User->load()
14 /opt/mediawiki/w/includes/MediaWiki.php(594): User->getName()
15 /opt/mediawiki/w/includes/MediaWiki.php(545): MediaWiki->setDBProfilingAgent()
16 /opt/mediawiki/w/index.php(53): MediaWiki->run()
17 /opt/mediawiki/w/index.php(46): wfIndexMain()
18 {main}

63.77.19.196 (talk) 19:42, 24 October 2022 (UTC)Reply

Fixed the above situation on Ubuntu 22.04LTS by purging jammy php8.1-* packages and installing php7.4-* packages from ppa:ondrej/php 63.77.19.196 (talk) 22:03, 24 October 2022 (UTC)Reply

Hi, could you get it to work? I'm having exactly the same problem here 2806:2F0:51E1:82F5:15AE:67D6:DA87:C3EC (talk) 00:55, 31 May 2022 (UTC)Reply

I had the same problem. I could make it work with the latest master snapshot of LDAPProvider plugin. Lweller (talk) 10:09, 12 June 2022 (UTC)Reply

PHP 8.1 is neither supported by MediaWiki Core, nor by the LDAP stack extensions. Osnard (talk) 08:37, 25 October 2022 (UTC)Reply

I had the same problem. I used Download extensions (that was the problem).

Download extensions for 1.35 gives me LDAPProvider 1.0.7 (c1a6148)

Download extensions for 1.40 gives me LDAPProvider 1.0.5 (c1a6148)

To make it work on MediaWiki 1.35, I had to use:

PluggableAuth for version 1.35
LDAPProvider for version 1.40
LDAPAuthentication2 for version 1.35

The result was:

LDAPAuthentication2	1.0.5 (ae57d72) 06:24, 12 May 2023
LDAPProvider	1.0.5 (c1a6148) 05:51, 5 June 2023
PluggableAuth	5.7 (bc6b20e) 05:52, 5 June 2023

Jgrocha (talk) 15:44, 17 July 2023 (UTC)Reply

LDAP-Stack extensions only support LTS releases. That's why REL1_40 branch had an outdated version.

Btw. There are 2.0 versions of the stack extenions that should work with MW 1.39 and PHP 8 Osnard (talk) 16:08, 17 July 2023 (UTC)Reply

Couldn't find constant 0 in Client.php

Latest comment: 4 years ago8 comments2 people in discussion

Product	Version
MediaWiki	1.34.1
PHP	7.2.24-0ubuntu0.18.04.11 (fpm-fcgi)
MariaDB	10.4.22-MariaDB-1:10.4.22+maria~bionic-log
ICU	60.2
Lua	5.1.5

Hello,

I am seeing this issue with our internal wiki installation. I am a new admin of this server, and not fully up to speed on how to manage wiki's yet. This error shows up in nginx when we try to "move" pages in the wiki. Can you please assist me with troubleshooting it? Thanks!

Chris

2022/03/18 15:26:08 [error] 1649#1649: *2844 FastCGI sent in stderr: "PHP message: PHP Notice: Array to string conversion in /data/wiki/webroot/mediawiki/extensions/LDAPProvider/src/Client.php on line 122

PHP message: PHP Warning: constant(): Couldn't find constant 0 in /data/wiki/webroot/mediawiki/extensions/LDAPProvider/src/Client.php on line 123

PHP message: PHP Notice: Array to string conversion in /data/wiki/webroot/mediawiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php on line 52" while reading response header from upstream, client: 1.2.3.4, server: mywikidomain, request: "GET /Test_Page HTTP/1.1", upstream: "fastcgi://unix:/var/run/php/php7.2-fpm.sock:", host: "mywikidomain", referrer: "mywikidomain/index.php?title=Special:UserLogin&returnto=Test+Page" 75.172.98.144 (talk) 16:04, 18 March 2022 (UTC)Reply

Can you please share the (redacted) domain config? (JSON or PHP) Osnard (talk) 17:13, 18 March 2022 (UTC)Reply

Hi Osnard,

I'd be happy to do so. Apologies that I don't fully understand what you're looking for. Can you explain a little more what info I can send? Thanks,

Chris 75.172.98.144 (talk) 22:29, 22 March 2022 (UTC)Reply

You should have some configuration set up for the LDAP-Stack extensions. Usually they either live in a JSON file (ldapprovider.json by default) or in a PHP array.

They contain a section called "connection", where you give information about the remote LDAP server.

Can you please share this config? Make sure to remove any sensitive information,like usernames and passwords. Osnard (talk) 07:39, 23 March 2022 (UTC)Reply

Here is the ldapprovider.json file, redacted.

{

"LDAP": {

"connection": {

"server": "ipa2.mydomain.net",

"port": 636,

"enctype": "ssl",

"user": "uid=ldapadmin,cn=users,cn=accounts,dc=mydomain,dc=net",

"pass": "mypassword",

"options": [

{"LDAP_OPT_DEREF": 1}

],

"basedn": "dc=mydomain,dc=net",

"groupbasedn": "cn=groups,cn=accounts,dc=mydomain,dc=net",

"userbasedn": "cn=users,cn=accounts,dc=mydomain,dc=net",

"searchattribute": "uid",

"searchstring": "uid=USER-NAME,cn=users,cn=accounts,dc=mydomain,dc=net",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"

},

"authorization": {

"rules": {

"groups": {

"required": ["cn=engtool_users,cn=groups,cn=accounts,dc=mydomain,dc=net"]

}

},

"groupsync": {

"mechanism": "mappedgroups",

"mapping": {

"engtool_users": "cn=engtool_users,cn=groups,cn=accounts,dc=mydomain,dc=net",

"wge_users": "cn=wge_users,cn=groups,cn=accounts,dc=mydomain,dc=net",

"sysop": "cn=admins,cn=groups,cn=accounts,dc=mydomain,dc=net",

"interface-admin": "cn=admins,cn=groups,cn=accounts,dc=mydomain,dc=net"

}

},

"userinfo": {

"email": "mail",

"realname": "cn"

}

} 75.172.98.144 (talk) 16:43, 24 March 2022 (UTC)Reply

Can you please change

"options": [
    {"LDAP_OPT_DEREF": 1}
],

to

"options": {
    "LDAP_OPT_DEREF": 1
},

Osnard (talk) 11:14, 28 March 2022 (UTC)Reply

Hello Osnard,

I have made this change, and am still seeing this error message when I try to move a page. Thanks!

Chris 75.172.98.144 (talk) 20:24, 30 March 2022 (UTC)Reply

Is there anything on the debug log? Osnard (talk) 07:06, 31 March 2022 (UTC)Reply

Can not ingest users mail attribute if it is an array of multiple addresses

Latest comment: 1 year ago4 comments2 people in discussion

In our ldap we allow users to have more than one "mailbox" or aliases or mail attribute values. When they do this property is returned as an array versus a string when there is only one value. So I get "array" returned instead of the mail[0] value...

How can I change:

"email" => "mail"

To be a valid setting which will return either the normal single value or the first array element, Something like:

"email" => "mail[0]" || "mail"

If "mail[0]" returns, use that, if not then use "mail"

This is in our $LDAPProviderDomainConfigProvider as $config = [ "LDAP" => [ "usserinfo" => [ "attributes-map" => [ "email" => "mail" ] ] ] ]

Thanks for any ideas on a solution. D0li0 (talk) 08:33, 26 May 2022 (UTC)Reply

Thanks for reporting. I have created a Task on phabricator. I will try to have this in the next version.

https://phabricator.wikimedia.org/T309493 Osnard (talk) 08:25, 30 May 2022 (UTC)Reply

As a workaround, you may hack LDAPProvider/src/UserInfoRequest.php and add the following to line 95 (https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/blob/1.0.4/src/UserInfoRequest.php#L95)):

UNTESTED example:

if ( is_array( $res['mail'] ) ) {
    $res['mail'] = $res['mail'][0];
}

Osnard (talk) 08:37, 30 May 2022 (UTC)Reply

This is most likely fixed by a change created for Extension talk:PluggableAuth/2023#h-after_login:_Internal_error_.._Argument_#2_($subject)_must_be_of_type_string,_ar-20231014001600 Osnard (talk) 05:49, 14 October 2024 (UTC)Reply

Could not authenticate credentials against domain "LDAP"

Latest comment: 4 years ago6 comments2 people in discussion

RESOLVED

Turns out my use of cn = "whatever" in the basedn row was not necessary like it was in the old LDAPAuthentication. I just needed the DC's. Plus I needed to specify groupbasedn, userbasedn, usernameattribute, realnameattribute and emailattribute for added clarity. It works now.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

I recently upgraded from Mediawiki 1.27 to 1.35.6 and I am having trouble migrating over LDAPAuthentication. I know that LDAPAuthentication is out of service and now we are supposed to use LDAPAuthentication2. With this comes using the the extension LDAPProvider and PluggableAuth. I have them all installed and I am basically trying to copy over my info from the old version which used LDAPAuthentication original to LDAPAuthentication2. Here is what I did.

Here is my original LDAPAuthentication settings: (note I subbed out actual server address and password)

$wgLDAPUseLocal = false;

$wgLDAPDomainNames = [ 'padl' ];

$wgLDAPServerNames = [ 'padl' => 'A.B.C.D' ];

$wgLDAPEncryptionType = [ 'padl' => 'tls' ];

#$wgLDAPPort = [ 'padl' => 389 ];

$wgLDAPProxyAgent = [ 'padl' => 'cn=admin,dc=ceas,dc=wmich,dc=edu>

$wgLDAPProxyAgentPassword = [ 'padl' => 'password' ];

$wgLDAPSearchAttributes = [ 'padl' => 'uid' ];

$wgLDAPBaseDNs = [ 'padl' => 'cn=users,dc=ceas,dc=wmich,dc=edu>

$wgLDAPLowerCaseUsername = [ 'padl' => true ];

I should mention "padl" is a personally setup ldap config

For LDAPAuthentication2 you set up a .json file for LDAPProvider to use. Here is that file: (with same things subbed out)

{

"LDAP": {

"connection": {

"server": "A.B.C.D",

"port": "389",

"enctype": "tls",

"user": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"pass": "password",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"groupbasedn": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"userbasedn": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"searchattribute": "uid",

"searchstring": "",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail"

}

This gives me the error "Could not authenticate credentials against domain "LDAP""

Turned on debug logs after trying to log in and I get this:

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_connect( $hostname = 'ldap://server name', $port = 389 );

2022-06-21 18:01:28 wiki mediawiki-mw_: # __METHOD__ returns Resource id #746

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns 1

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns 1

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_start_tls( $linkID );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns 1

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_bind( $linkID, $bindRDN = 'cn=admin,dc=ceas,dc=wmich,dc=edu', $bindPassword = 'XXXX' );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns 1

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_search( $linkID, $baseDN = '', $filter = '(=username)', $attributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref = );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns

2022-06-21 18:01:28 wiki mediawiki-mw_: ldap_error( $linkID );

2022-06-21 18:01:28 wiki mediawiki-mw_: # returns Bad search filter

Not sure what this Bad Search filter is. I can confirm my DN's are valid. Is there some setting I am missing here.

ALSO: I don't have LDAPAuthorization. Is that necessary? Mpb8877 (talk) 19:14, 21 June 2022 (UTC)Reply

It searches with (=username). Try to remove "searchstring": "" from your config. Osnard (talk) 06:47, 22 June 2022 (UTC)Reply

Went as simple as possible. Here is the old settings in LocalSettings.php:

$wgLDAPDomainNames = [ 'padl' ];

$wgLDAPServerNames = [ 'padl' => 'A.B.C.D' ];

$wgLDAPEncryptionType = [ 'padl' => 'tls' ];

$wgLDAPProxyAgent = [ 'padl' => 'cn=admin,dc=ceas,dc=wmich,dc=edu>

$wgLDAPProxyAgentPassword = [ 'padl' => 'password' ];

$wgLDAPSearchAttributes = [ 'padl' => 'uid' ];

$wgLDAPBaseDNs = [ 'padl' => 'cn=users,dc=ceas,dc=wmich,dc=edu' ];

$wgLDAPLowerCaseUsername = [ 'padl' => true ];

wfLoadExtension ( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPProvider' );

wfloadExtension( 'PluggableAuth' );

$LDAPProviderDomainConfigs = "/var/www/html/ldapprovider.json";

and here is my new ldapprovider.json:

{

"padl": {

"connection": {

"server": "A.B.C.D",

"enctype": "tls",

"user": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"pass": "password",

"basedn": "cn=admin,dc=ceas,dc=wmich,dc=edu",

"searchattribute": "uid",

"presearchusernamemodifiers": [ "lowercase" ]

}

These are essentially 1-to-1. I follow the direct instructions form these two pages and still no luck:

LDAP hub/Migration from extension LDAPAuthentication

LDAP hub/Migration from extension LDAPAuthentication/Config conversion

I have LDAPProvider configured and pointed at the file. What the heck am I doing wrong? Mpb8877 (talk) 14:49, 22 June 2022 (UTC)Reply

Mpb8877 (talk) 14:33, 22 June 2022 (UTC)Reply

And the error message is still the same? Osnard (talk) 15:24, 22 June 2022 (UTC)Reply

Yep still the same error message of:

"Could not authenticate credentials against domain "padl":

Any other hidden settings that could be messing with this. I just don't get how this could work on the old config and not the new. Some sort of permissions I don't know about. Some sort of security setting? Anything?

Edit: I know it is connecting to my server because any change of ip or credentials will give me a can't connect error. So I feel like it either has to be the last three lines or some other setting Mpb8877 (talk) 15:58, 22 June 2022 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

There is no login at all if I disable local login.

Latest comment: 4 years ago3 comments3 people in discussion

My settings are the following:

MediaWiki	1.38.1
PHP	7.4.30 (apache2handler)

LDAPAuthentication2	1.0.3 (c6a342f) 15:22, 26 May 2022
LDAPProvider	1.0.5 (85dfd78) 15:22, 26 May 2022
PluggableAuth	6.1 (f609448) 19:00, 16 Jun. 2022

LocalSettings.php has:

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigs = "/var/www/html/extensions/ldapprovider.json";

$LDAPProviderCacheType = CACHE_NONE;

$LDAPProviderDefaultDomain = "my-domain.local";

$wgPluggableAuth_EnableLocalLogin = true;$LDAPAuthentication2AllowLocalLogin = true;

$wgPluggableAuth_ButtonLabel = "Log In";

$wgPluggableAuth_EnableAutoLogin = false;

$wgGroupPermissions['*']['createaccount'] = true;

$LDAPAuthentication2AllowLocalLogin = true;

The content of ldapprovider.json is irrelevant because I do not come to the point where LDAP is used. With this configuration I see the normal login fields but there is no login button any more. There also no label saying "Log in". If I set local login to false, I see no login at all but the message authmanager-authn-no-primary "The supplied credentials could not be authenticated." All log for LDAP are empty. But the wiki logs say that there was a login attempt although the page was only loaded. In the logs there are also data base queries with username equals some IP address. That sounds far from normal. Is there something missing? Maybe $wgPluggableAuth_Config, but I don't know how to set this correctly. 213.168.81.98 (talk) 14:17, 30 June 2022 (UTC)Reply

LDAPAuthentication 2 is no compatible with PluggableAuth 6 yet. Please use V5 instead. Osnard (talk) 13:04, 1 July 2022 (UTC)Reply

I first tried using using the version tagged 5.7 of PluggableAuth, but that one didn't work. Then I used the REL1_37 release of PluggableAuth (which is also 5.7) and that one did work!

Conclusion: On MediaWiki 1.38, use PluggableAuth REL1_37 with the newest version of the LDAP extensions, as long as PluggableAuth 6 is not yet supported. Robert van Dijk 123 (talk) 12:21, 12 July 2022 (UTC)Reply

LDAP Login for some user not working

Latest comment: 4 years ago3 comments2 people in discussion

Hello,

i have upgraded our Mediawiki from 1.33.0 to the 1.35.6 Version.

After the upgrade, the new version of the Active Directory Integration was installed:

Manual:Active Directory Integration

Currently i have the following problem: Some User can perform an AD login, some not.

The access to the wiki is permited for the members of the AD group xxx-WIKI.

ldap.json (without security information):

{

"xxxxxxx": {

"connection": {

"server": "xxx-dc3.xxxxx-xxxxx.local",

"port": "389",

"user": "ldap_ro",

"pass": "top-secret",

"enctype": "clear",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "OU=MyBusiness,DC=xxxxx-xxxxx,DC=local",

"userbasedn": "OU=xxxxx-xxxxx,OU=MyBusiness,DC=xxxxx-xxxxx,DC=local",

"groupbasedn": "OU=MyBusiness,DC=xxxxx-xxxxx,DC=local",

"searchattribute": "samaccountname",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": {

"rules": {

"groups": {

"required": ["CN=xxx-WIKI,OU=Security Groups,OU=MyBusiness,DC=xxxxx-xxxxx,DC=local"]

}

},

"groupsync": {

"mapping": {

"sysop": ["CN=xxx-WIKI,OU=Security Groups,OU=MyBusiness,DC=xxxxx-xxxxx,DC=local"]

}

here are the results of the ldap provider ShowUserGrroups.php (i have removed the other groups from the output, for security reasons):

User where the ldap login works:

Full DNs:

CN=xxx-WIKI,OU=Security Groups,OU=MyBusiness,DC=xxxxx-xxxxx,DC=local

Short names:

xxx-wiki

User where the ldap login doesn't works:

PHP Notice: Undefined index: memberof in /home/dokuwiki/mediawiki-1.35.6/extensions/LDAPProvider/src/UserGroupsRequest/UserMemberOf.php on line 17

Full DNs:

Short names:

When i run ShowUserInfo.php with the user, witch is not able to login, i got cryptic characters:

objectclass =>

0 => top

1 => person

2 => organizationalPerson

3 => user

cn => Test Hugo

sn => Hugo

description => Testuser

givenname => Test

distinguishedname => CN=Test Hugo,OU=xxx-IT,OU=xxxxx-xxxxx,OU=MyBusiness,DC=xxxxx-xxxxx,DC=local

displayname => Test Hugo

proxyaddresses => x500:/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=5fd3030abdaf40238f02390b8c6aa835-Test Hugo

targetaddress => SMTP:testuser.hugo@steyrmotors365.mail.onmicrosoft.com

mailnickname => testuser.hugo

name => Test Hugo

objectguid => ▒▒#▒_▒J▒?▒l▒4܍

Please help & thank you P.kotrba (talk) 11:47, 11 August 2022 (UTC)Reply

You have set up group based login restrictions and the user that is not in the group can not log in. That's what it is supposed to do.

You have configured the plugin to look into the "memberof" field of the user. Apparently this is not set properly.

See:

PHP Notice:  Undefined index: memberof in /home/dokuwiki/mediawiki-1.35.6/extensions/LDAPProvider/src/UserGroupsRequest/UserMemberOf.php on line 17

Check on you LDAP why this user is not in the proper groups. Osnard (talk) 10:09, 12 August 2022 (UTC)Reply

The user with the not working login, has the required AD Group.

I've checked the membership again in der active directory.

We have an active directory with german language. Is it possible, that there are encoding problems?

When i run the following command, i will get a lot of cryptic keys as result:

dokuwiki@xxx-WIKI:~/public_html$php extensions/LDAPProvider/maintenance/ShowUserInfo.php -d xxxxx-xxxxx -u testuser.hugo

objectclass =>

0 => top

1 => person

2 => organizationalPerson

3 => user

cn => Test Hugo

sn => Hugo

description => Testuser

givenname => Test

displayname => Test Hugo

proxyaddresses => x500:/o=ExchangeLabs/ou=Exchange Administrative Group (FYDIBOHF23SPDLT)/cn=Recipients/cn=5fd3030abdaf40238f02390b8c6aa835-Test Hugo

targetaddress => SMTP:testuser.hugo@steyrmotors365.mail.onmicrosoft.com

mailnickname => testuser.hugo

name => Test Hugo

objectguid => ▒▒#▒_▒J▒?▒l▒4܍

codepage => 0

countrycode => 0

primarygroupid => 14167

c▒▒Z▒▒▒▒#id => *▒~

samaccountname => testuser.hugo P.kotrba (talk) 05:52, 16 August 2022 (UTC)Reply

Local login blocks LDAP login

Latest comment: 3 years ago1 comment1 person in discussion

Hi everyone

I've been trying to enable login to my wiki via the AD and I've installed LDAPProvider, PluggableAuth, LDAPAuthentication2, LDAPAuthorization, LDAPUserInfo, LDAPGroups.

I've configured the LDAP Provider correctly (I think), however I can't seem to login with my AD account and when I login with a local account there is a successfull connection to the AD.

Here is the content of my JSON:

{

"domain": {

"connection": {

"server": "server",

"user": "CN=accountName,OU=Tech users,OU=Users,OU=PROD,DC=test1,DC=test1",

"pass": "password",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "dc=test1, dc=test2",

"groupbasedn": "dc=test1, dc=test2",

"userbasedn": "dc=test1, dc=test2",

"searchattribute": "samaccountname",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"

},

"userinfo": [],

"authorization": []

}

Thanks in advance ! 85.169.92.10 (talk) 07:39, 14 September 2022 (UTC)Reply

Validated certificates become invalid in client.php

Latest comment: 3 years ago4 comments2 people in discussion

Hi all,

I've been struggling with getting the LDAP stack to work with an AD controller using self signed certificates. The CA is imported in the OS (container), refered to in /etc/ldap/ldap.conf as follows:

TLS_CACERT /etc/ssl/certs/myserv.lan.pem

This works fine for the openssl lib tested with this command:

echo "" | openssl s_client -connect ZW01ADDC1601.geoxyz.lan:389 -starttls ldap -prexit -showcerts

resulting in the necessary output line:

Verify return code: 0 (ok)

Also the PHP LDAP stack should work fine and has been tested using this command:

php extensions/LDAPProvider/maintenance/ShowUserInfo.php -d mynet.lan -u pdd

resulting in a correct display of all nice information about the requested user.

However, trying to log in into the wiki results in these debug lines:

wiki-wiki-1 | request done: ld 0x55bb561181c0 msgid 1

wiki-wiki-1 | res_errno: 0, res_error: <>, res_matched: <>

wiki-wiki-1 | ldap_free_request (origid 1, msgid 1)

wiki-wiki-1 | ldap_parse_extended_result

wiki-wiki-1 | ldap_parse_result

wiki-wiki-1 | ldap_msgfree

wiki-wiki-1 | TLS: peer cert untrusted or revoked (0x42)

wiki-wiki-1 | TLS: can't connect: (unknown error code).

wiki-wiki-1 | ldap_err2string

wiki-wiki-1 | ldap_free_connection 1 1

Why do the different modules of the LDAPProvider extension act differently on the same configuration?

I'm using MW 1.35.7 in the standard docker container with the LDAP stack from the same version with the template ldap.json adapted to my setup.

Thans! Peddecke (talk) 05:17, 29 September 2022 (UTC)Reply

Maybe the webserver user does not have access to the certs or the configuration for the webserver is different from the CLI. Osnard (talk) 08:17, 29 September 2022 (UTC)Reply

It must have been something like that...

However, we can close this issue: I was getting bored with it and wanted to start all over again, integrated my changes (trusted cert, ldap.json, extensions,...) in a Dockerfile to make a new image out of it, deployed the image as a test and everything suddenly works :-)

thanks! Peddecke (talk) 20:36, 29 September 2022 (UTC)Reply

Good to hear. Thanks for the feedback. Osnard (talk) 06:53, 10 October 2022 (UTC)Reply

LDAPProvider TypeError: ($settings) must be of type array, null given

Latest comment: 3 years ago3 comments2 people in discussion

I am trying to connect my mediawiki (Version 1.35) to my existing Active Directory via the LDAP-Stack. The connection and the synchronisation with the existing LDAP-User works and the login is successful. I can see my Username on the top right corner, as if I'm logged in.

Unfortunately I can't see the Startpage of my wiki, but get the error-message:

[Y2EPLsQDlV0mhVcp9jO2QAAAAMI] /index.php?title=Spezial:PluggableAuthLogin TypeError from line 47 of /var/www/html/includes/config/HashConfig.php: HashConfig::__construct(): Argument #1 ($settings) must be of type array, null given, called in /var/www/html/extensions/LDAPProvider/src/DomainConfigFactory.php on line 74

Is there a misconfiguration in my LocalSettings.php? Or did I get the wrong AD-value back?

Extensions Version:

PluggableAuth: 5.7 (e2589cd)

LDAPAuthorization: 1.1.0 (a0d1a5b)

LDAPAuthentication2: 1.0.3 (3e72a8f)

LDAPUserInfo: 1.0.0 (3ab25cf)

LDAPProvider: 1.0.5 (961cd88)

Here is my LocalSettings.php:

wfLoadExtensions( [

'LDAPProvider',

'PluggableAuth',

'LDAPAuthorization',

'LDAPAuthentication2',

'LDAPGroups',

'LDAPUserInfo'

] );

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalProperties = false;

$wgPluggableAuth_ButtonLabel = "LDAP Log in";

$wgPluggableAuth_Config = array(

array('plugin' => 'LDAPAuthentication2'),

array('plugin' => 'LDAPAuthorization'),

);

$wgShowExceptionDetails = true;

#Konfig Extension:LDAPAuthorization

$LDAPProviderDomainConfigProvider = function()

{

$config =

[

"local.lab.net" =>

[

"connection" =>

[

"server" => "WWW.XX.YY.ZZ",

"options" => [

"LDAP_OPT_DEREF" => 1

],

"user" => "CN=LDAP Group,OU=Konten,OU=Benutzer,DC=local,DC=lab,DC=net",

"pass" => "XXXXXXXXXXX",

"basedn" => "dc=local,dc=lab,dc=net",

"groupbasedn" => "OU=Gruppen,dc=local,dc=lan,dc=net",

"userbasedn" => "OU=Benutzer-admins,OU=Benutzer,dc=local,dc=lab,dc=net",

"searchattribute" => "samaccountname",

"searchstring" => "USER-NAME@local.lab.net",

"usernameattribute" => "samaccountname",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"

],

"groupsync" =>

[

"mechanism" => "mappedgroups",

"mapping" =>

[

"NKP" => "CN=AdminWiki-User,OU=Gruppen,DC=local,DC=lab,DC=net",

"sysop" => "CN=AdminWiki-User,OU=Gruppen,DC=local,DC=lab,DC=net"

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

}; DennisT90 (talk) 14:11, 1 November 2022 (UTC)Reply

As far as I can see you have extensions "LDAPUserInfo" and "LDAPAuthorization" enabled but there are no entries for them in the domain config.

Please either disable those extensions or add configuration for them. Osnard (talk) 07:43, 4 November 2022 (UTC)Reply

It works!!! Thanks a lot to Osnard. DennisT90 (talk) 12:33, 8 November 2022 (UTC)Reply

Google LDAP PluggableAuthLogin Could not bind to LDAP: Invalid credentials

Latest comment: 3 years ago5 comments2 people in discussion

Hello, I am trying to switch to Google LDAP for authentication. The maintenance scripts for LDAPProvider are working fine with my configuration (ShowUserGroups, ShowUserInfo) but as soon as I try to login with the same user on site I get

[96ae4d586ae7f021481d21ec] 2022-11-14 13:14:01: Fatal exception of type "MWException"

and the debug log shows this

[exception] [afe8a6baefd9d4161ad80db9] /Special:PluggableAuthLogin MWException from line 196 of /usr/local/www/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to

LDAP: (49) Invalid credentials

#0 /usr/local/www/mediawiki/extensions/LDAPProvider/src/Client.php(119): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#1 /usr/local/www/mediawiki/extensions/LDAPProvider/src/Client.php(364): MediaWiki\Extension\LDAPProvider\Client->init()

#2 /usr/local/www/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(188): MediaWiki\Extension\LDAPProvider\Client->canBindAs()

#3 /usr/local/www/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(55): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin()

#4 /usr/local/www/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(36): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate()

#5 /usr/local/www/mediawiki/includes/specialpage/SpecialPage.php(600): PluggableAuthLogin->execute()

#6 /usr/local/www/mediawiki/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run()

#7 /usr/local/www/mediawiki/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath()

#8 /usr/local/www/mediawiki/includes/MediaWiki.php(947): MediaWiki->performRequest()

#9 /usr/local/www/mediawiki/includes/MediaWiki.php(547): MediaWiki->main()

#10 /usr/local/www/mediawiki/index.php(53): MediaWiki->run()

#11 /usr/local/www/mediawiki/index.php(46): wfIndexMain()

#12 {main}

This is my a part of my LocalSettings.php:

// Load LDAP Config from JSON

$ldapJsonFile = "$IP/ldap.json";

$ldapConfig = false;

if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {

$testJson = @json_decode(file_get_contents($ldapJsonFile),true);

if (is_array($testJson)) {

$ldapConfig = true;

} else {

error_log("Found invalid JSON in file: $IP/ldap.json");

}

// Activate Extension

if ( $ldapConfig ) {

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPGroups' );

$LDAPProviderDomainConfigs = $ldapJsonFile;

$wgPluggableAuth_ButtonLabel = "Log In";

$LDAPAuthentication2AllowLocalLogin = true;

$wgLDAPGroupSearchNestedGroups = array( "crazycomp.de"=>true );

if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }

}

and this is my ldap.json

{

"crazycomp.de": {

"connection": {

"server": "ldap.google.com",

"port": "636",

"user": "someuser",

"pass": "redacted",

"enctype": "ssl",

"options": {

"LDAP_OPT_DEREF": 1,

"LDAP_OPT_X_TLS_CERTFILE": "/usr/local/www/mediawiki/ldap.crt",

"LDAP_OPT_X_TLS_KEYFILE": "/usr/local/www/mediawiki/ldap.key"

},

"basedn": "dc=crazycomp,dc=de",

"userbasedn": "ou=Users,dc=crazycomp,dc=de",

"groupbasedn": "dc=crazycomp,dc=de",

"searchattribute": "uid",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": [],

"groupsync": {

"mapping": {

"buddyuser": "cn=cmbuddies,ou=Groups,dc=crazycomp,dc=de",

"bureaucrat": "CN=cmwiki-admins,OU=Groups,DC=crazycomp,DC=de",

"interface-admin": "CN=cmwiki-admins,OU=Groups,DC=crazycomp,DC=de",

"sysop": "CN=cmwiki-admins,OU=Groups,DC=crazycomp,DC=de"

}

} Henningkessler (talk) 13:45, 14 November 2022 (UTC)Reply

Please make sure $IP/ldap.json is readable by the webserver user. Usually when executing ShowUserGroups/ShowUserInfo on the CLI, this happens in a different user context than the webrequest processing.

ATTENTION: You should not store this file in the $IP, because it may be downloadable, if not protected explicitly by the webserver configuration. Osnard (talk) 15:14, 15 November 2022 (UTC)Reply

Sorry @Osnard for answering so late to your reply. These are the permissions on the file:

-rw-r----- 1 www wheel 1131 Nov 14 14:12 ldap.json

Thanks for the warning about the location for that file Henningkessler (talk) 09:57, 18 November 2022 (UTC)Reply

Have you tried to change permissions? Did that change anything?

Can you maybe enable the debug log and share it here? Osnard (talk) 14:32, 18 November 2022 (UTC)Reply

Hi,

actually above is a part of the debug log. I now even tried ist while setting the permissions to 777. Here is the part of the debug log

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

[session] SessionBackend "esaia7or4bq5sh063c8louk85t3pnps8" data dirty due to dirty(): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->checkLDAPLogin/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[LDAPProvider] Setting LDAP_OPT_PROTOCOL_VERSION to 3

[LDAPProvider] Setting LDAP_OPT_REFERRALS to 0

[LDAPProvider] Setting LDAP_OPT_DEREF to 1

[LDAPProvider] Setting LDAP_OPT_X_TLS_CERTFILE to /usr/local/www/mediawiki/ldap.crt

[LDAPProvider] Setting LDAP_OPT_X_TLS_KEYFILE to /usr/local/www/mediawiki/ldap.key

[DBQuery] MWExceptionHandler::rollbackMasterChangesAndLog [0s] 10.100.254.71: ROLLBACK

[DBQuery] Wikimedia\Rdbms\Database::ping [0s] 10.100.254.71: SELECT 1 AS ping

[exception] [0198f1af92237c32f1565eda] /Special:PluggableAuthLogin MWException from line 196 of /usr/local/www/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials