Extension talk:LDAPProvider/2023

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

LDAP Login isn't present

Latest comment: 3 years ago8 comments1 person in discussion

RESOLVED

Update LDAP stack to 1.39 error:

[authentication] Login failed in primary authentication because no provider accepted

(Missing a memberof entry for Domain Users, changed the usage to a new group.)

go back to PluggableAuth 1.35 (not 1.37) (version 5.7 was irritating, because 5.7 is also 1.37 and incompatible) and the Login fields reappear.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Hello, I had trouble with the login since a half of a year. Had hope, if I update, it would be fixed.

My mediawiki had a session open from an earlier login, so I could all time use my wiki. If I want to change something, there is shown the message that I should log in again, I repeat the request one or two times, then the changes are accepted. Other Users can't log in.

Since the update to 1.39 I also don't see the login fields for username and password. There is only the message on loginpage: "Die angegebenen Anmeldeinformationen konnten nicht überprüft werden." (The credentials provided could not be verified.)

I got that error msgs:

LDAPUserInfo.log

2023-01-14 11:45:04 mn-vm-lamp mywikidb: Could not bind to LDAP: (-1) Can't contact LDAP server

php ShowUserGroups.php --domain mydomain.tld --username myUsername

...

PHP Notice: Undefined index: memberof in /var/lib/mediawiki/extensions/LDAPProvider/src/UserGroupsRequest/UserMemberOf.php on line 17

by users who are admins there is not this error, group could be found.

I had updated the extension all to 1.39 (LDAP stack).

My old LocalSettings is since 1.31 not very different, may there have to set something new?

php CheckLogin.php --domain mydomain.tld --username myUsername

was alright, also executed as web user

...

attempting to connect:

connect success

ldap_open_defconn: successful

ldap_send_server_request

ldap_result ld 0x55fcb14490f0 msgid 1

wait4msg ld 0x55fcb14490f0 msgid 1 (infinite timeout)

wait4msg continue ld 0x55fcb14490f0 msgid 1 all 1

** ld 0x55fcb14490f0 Connections:

* host: myDC.mydomain.tld port: 636 (default)

refcnt: 2 status: Connected

...

LDAP Server is reachable with

ldapsearch -x -H ldaps://myDC.mydomain.tld -D "MYDOMAIN\\Adminuser" -W -b "CN=Users,DC=mydomain,DC=tld" -s sub "(cn=*)" cn mail sn

I can log in the Server with SSH and Domain Users. The DC is a NAS with samba, certs I have renewed, without change. Sometimes there are too many data connections to the database, may I have to change the database settings, but that won't fix the log in problems.

How can I find the problem?

Manual:How to debug | Manual:How to debug/Login problems | I read but don't see how it can help me

Anyone knows how I can fix my login problem, or what I could try? Divinobeer (talk) 15:02, 15 January 2023 (UTC)Reply

~~After a change of apache2.conf / mediawiki.conf some right have corrected and the log in fields user/pass reappear.~~ No, thats wrong, only the LDAP Stack wasn't loaded because ldap.json were not reachable.

~~Log in with correct User/Pass fails with message that Username or Pass would be wrong and try again.~~

~~I only find this in debug-mywikidb.log~~

~~[authentication] Login failed in primary authenticatio~~n ~~by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider~~ Divinobeer (talk) 13:15, 17 January 2023 (UTC)Reply

I found this:

[authentication] Login failed in primary authentication because no provider accepted Divinobeer (talk) 10:38, 18 January 2023 (UTC)Reply

There is missing a memberof entry for Domain Users.

Equal, how many groups a user has, group "Domain Users" are never visible.

However, I changed the usage to a new group. But the log in problem isn't solved. Divinobeer (talk) 15:06, 18 January 2023 (UTC)Reply

All test scripts here shown no error, all run correctly

LDAP hub/Migration from extension LDAPAuthentication Divinobeer (talk) 15:09, 18 January 2023 (UTC)Reply

with the following in LocalSettings.php

$wgPluggableAuth_EnableLocalLogin true

the Login fields reappear. But the Error now is again username or pass would be wrong.

The message [authentication].. see above, may say that I have to define that anywhere? Divinobeer (talk) 21:09, 19 January 2023 (UTC)Reply

not needed (be true): is for non ldap users

$wgPluggableAuth_EnableLocalLogin false

Then go back to PluggableAuth 1.35 (not 1.37, not 1.39) (5.7 / 6.0 was irritating, because 5.7 stay in 1.37 files and isn't compatible)

And the LDAP Log in is functional.

but one error is left, maybe ignorable, because it's only a debug directory

/var/lib/mediawiki/includes/HookContainer/HookContainer.php at line 137] in /var/lib/mediawiki/includes/debug/MWDebug.php on line 381 Divinobeer (talk) 15:23, 20 January 2023 (UTC)Reply

Thanks Divinobeer, you have fixed my issue, you are my hero, you are the best, I gift you a goodlike beer. Divinobeer (talk) 15:26, 20 January 2023 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Could not bind to LDAP: (49) Invalid credentials

Latest comment: 3 years ago2 comments1 person in discussion

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

My aim is to login to mywiki with "myname\localdomain" hosted at local Data Center

Error message is clear. But I can't find the mistake. Confused!

i've done some testing:

TEST 1 success:

//$ldaprdn = "cn=myname,dc=localdomain";

//$ldappass = 'mypass';

$ldapconn=ldap_connect("ldaps://localdatacenter.localdomain:3269");

//$ldapbind=ldap_bind($ldapconn,$ldaprdn,$ldappass);

//if ($ldapbind) {

// echo "LDAP bind successful.\n";

// } else {

// echo "LDAP bind failed.";

// }

<b>Output: LDAP bind at-port 3269 successful.</b>

TEST 2 failed:

>php extensions/LDAPProvider/maintenance/ShowUserInfo.php -d mydomain -u myname

MWException from line 196 of /var/lib/mediawiki-1.39.2/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials

#0 /var/lib/mediawiki-1.39.2/extensions/LDAPProvider/src/Client.php(119): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#1 /var/lib/mediawiki-1.39.2/extensions/LDAPProvider/src/Client.php(257): MediaWiki\Extension\LDAPProvider\Client->init()

#2 /var/lib/mediawiki-1.39.2/extensions/LDAPProvider/maintenance/ShowUserInfo.php(49): MediaWiki\Extension\LDAPProvider\Client->getUserInfo()

#3 /var/lib/mediawiki-1.39.2/maintenance/includes/MaintenanceRunner.php(309): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()

#4 /var/lib/mediawiki-1.39.2/maintenance/doMaintenance.php(85): MediaWiki\Maintenance\MaintenanceRunner->run()

#5 /var/lib/mediawiki-1.39.2/extensions/LDAPProvider/maintenance/ShowUserInfo.php(72): require_once('...')

#6 {main}

--

ldap.json

{

"localdomain": {

"connection": {

"server": "localdatercenter.localdomain",

"port": "3269",

"user": "CN=myname,OU=Users,DC=localdomain",

"pass": "mypass",

"enctype": "ssl",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "dc=uni-kl,dc=de",

"userbasedn": "DC=localdomain",

"groupbasedn": "DC=localdomain",

"searchattribute": "samaccountname",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail",

"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": [],

"groupsync": {

"mapping": {

"Mitglied": "CN=...",

"bureaucrat": "CN=...",

"interface-admin": "CN=...",

"sysop": "CN=..."

}

Version info:

LDAPAuthentication2 1.0.31.0.3 (54d804e) 09:48, 13. Mär. 2023

LDAPAuthorization 1.1.0 (8a98b7d) 09:50, 13. Mär. 2023

LDAPGroups 1.0.3 (17bfc3f) 09:52, 13. Mär. 2023

LDAPProvider 1.0.5 (d2084d2) 09:46, 13. Mär. 2023

LDAPUserInfo 1.0.0 (47dc6d3) 09:54, 13. Mär. 2023

PluggableAuth 5.7 Hlsisadm2023 (talk) 16:13, 22 March 2023 (UTC)Reply

Solution:"user": "CN=myname,OU=Users,DC=localdomain"

changed to

"CN=myname,CN=Users,DC=localdomain"

now it works! Hlsisadm2023 (talk) 13:56, 23 March 2023 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Cannot connect mediawiki 1.35 to LDAP (Freeipa) : Invalid server index index #DB_PRIMARY

Latest comment: 2 years ago1 comment1 person in discussion

Here is the error I have when I try to log in, I can't find this error anywhere in the discussion:

[84b4394dcf697de5d5ff9459] /index.php?title=Special:UserLogin&returnto=Mode+Wiki UnexpectedValueException from line 486 of /opt/bitnami/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php: Invalid server index index #DB_PRIMARY

Backtrace:

#0 /opt/bitnami/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(899): Wikimedia\Rdbms\LoadBalancer->getConnectionIndex(string, array, string)

#1 /bitnami/mediawiki/extensions/LDAPProvider/src/UserDomainStore.php(73): Wikimedia\Rdbms\LoadBalancer->getConnection(string)

#2 /bitnami/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(249): MediaWiki\Extension\LDAPProvider\UserDomainStore->setDomainForUser(User, string)

#3 /bitnami/mediawiki/extensions/PluggableAuth/includes/PluggableAuthPrimaryAuthenticationProvider.php(123): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->saveExtraAttributes(integer)

#4 /opt/bitnami/mediawiki/includes/auth/AuthManager.php(2470): PluggableAuthPrimaryAuthenticationProvider->autoCreatedAccount(User, string)

#5 /opt/bitnami/mediawiki/includes/auth/AuthManager.php(1764): MediaWiki\Auth\AuthManager->callMethodOnProviders(integer, string, array)

#6 /opt/bitnami/mediawiki/includes/auth/AuthManager.php(637): MediaWiki\Auth\AuthManager->autoCreateUser(User, string, boolean)

#7 /opt/bitnami/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(374): MediaWiki\Auth\AuthManager->continueAuthentication(array)

#8 /opt/bitnami/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(502): AuthManagerSpecialPage->performAuthenticationStep(string, array)

#9 /opt/bitnami/mediawiki/includes/htmlform/HTMLForm.php(707): AuthManagerSpecialPage->handleFormSubmit(array, VFormHTMLForm)

#10 /opt/bitnami/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(435): HTMLForm->trySubmit()

#11 /opt/bitnami/mediawiki/includes/specialpage/LoginSignupSpecialPage.php(319): AuthManagerSpecialPage->trySubmit()

#12 /opt/bitnami/mediawiki/includes/specialpage/SpecialPage.php(600): LoginSignupSpecialPage->execute(NULL)

#13 /opt/bitnami/mediawiki/includes/specialpage/SpecialPageFactory.php(635): SpecialPage->run(NULL)

#14 /opt/bitnami/mediawiki/includes/MediaWiki.php(307): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)

#15 /opt/bitnami/mediawiki/includes/MediaWiki.php(940): MediaWiki->performRequest()

#16 /opt/bitnami/mediawiki/includes/MediaWiki.php(543): MediaWiki->main()

#17 /opt/bitnami/mediawiki/index.php(53): MediaWiki->run()

#18 /opt/bitnami/mediawiki/index.php(46): wfIndexMain()

#19 {main}

Here is the custom part of my config file:

{{Code | lang = php | 1 = # ======

Custom Plugin
======
Extension for better GUI

wfLoadExtension( 'WikiEditor'); # Provides an advanced, extensible wikitext editing interface

wfLoadExtension( 'SyntaxHighlight_GeSHi' ); #provides rich formatting of source code using the

 tag
wfLoadExtension( 'VisualEditor' ); #extension allows for editing pages as rich conten


# ======
# LDAP
# ======
// Create Wiki-Group 'wikiusers' from default user group
$wgGroupPermissions['wikiusers'] = $wgGroupPermissions['user'];

// Private Wiki. External LDAP login. Default NS requires login.
$wgEmailConfirmToEdit = false;
$wgBlockDisablesLogin = true;
$wgGroupPermissions['*']['read'] = true;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;

// Load LDAP Config from JSON
$ldapJsonFile = "/etc/httpd/ldap.json" ;

$ldapConfig = false;

if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
  $testJson = @json_decode(file_get_contents($ldapJsonFile),true);
  if (is_array($testJson)) {
    $ldapConfig = true;
  } else {
    error_log("Found invalid JSON in file: /etc/httpd/ldap.json");
  }
}

// Activate Extension
if ( $ldapConfig ) {

  wfLoadExtension( 'PluggableAuth' );
  wfLoadExtension( 'LDAPProvider' );
  wfLoadExtension( 'LDAPAuthentication2' );
  wfLoadExtension( 'LDAPAuthorization' );
  wfLoadExtension( 'LDAPUserInfo' );
  wfLoadExtension( 'LDAPGroups' );

  $wgPluggableAuth_ButtonLabel = "Log In with FreeIPA";
  $LDAPProviderDomainConfigs = $ldapJsonFile;
  $LDAPAuthentication2AllowLocalLogin = true;
  
  //DEBUG SECTION
  $wgDebugLogGroups['PluggableAuth'] = '/tmp/LDAP-Pluggable.log';
  $wgDebugLogGroups['LDAP'] = '/tmp/LDAP.log';
  $wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = '/tmp/LDAP-Provider.log';
  $wgDebugLogGroups['LDAPGroups'] = '/tmp/LDAP-Groups.log';
  $wgDebugLogGroups['LDAPUserInfo'] = '/tmp/LDAP-UserInfo.log';
  $wgDebugLogGroups['LDAPAuthentication2'] = '/tmp/LDAP-Auth2.log';
  $wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP-Auth.log';
}

$wgShowExceptionDetails = true ;
}}

My ldap.json file looks like this:

{{Code
| lang = json
| 1 = {
        "MODE.INTERNAL": {
                "connection": {
                        "server": "<serverurl>",
                        "port":"389",
                        "user": "uid=svc-wiki,cn=users,cn=accounts,dc=<domain>,dc=com",
                        "pass": "<password>",
                        "enctype": "clear",
                        "options": {
                                "LDAP_OPT_DEREF": 1
                        },
                        "basedn": "dc=<domain>,dc=com",
                        "userbasedn": "cn=users,cn=accounts,dc=<domain>,dc=com",
                        "groupbasedn": "cn=groups,cn=accounts,dc=<domain>,dc=com",
                        "searchattribute": "uid",
                        "usernameattribute": "uid",
                        "realnameattribute": "displayname",
                        "emailattribute": "mail",
                        "grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
                        "groupobjectclass": "group",
                        "groupattribute": "member"
                },
                "authorization": {
                        "rules": {
                                "groups": {
                                        "required": [ "cn=ipausers,cn=groups,cn=accounts,dc=<domain>,dc=com" ]
                                }
                        }
                },
                "userinfo": {
                        "attributes-map": {
                                "email": "mail",
                                "realname": "cn",
                                "nickname": "uid",
                                "language": "preferredlanguage"
                        },
                        "groupsync": {
                                "mapping": {
                                        "wikiusers": "cn=ipausers,cn=groups,cn=accounts,dc=<domain>,dc=com",
                                        "sysop": "cn=wiki-sysops,cn=groups,cn=accounts,dc=<domain>,dc=com"
                                }
                        }
                }
        }
<nowiki>}</nowiki>
}}

All extension are version 1.35.

Even if I don't think this plays anything in the issue, I am using Bitnami Mediawiki docker container.

Can someone help me figure out my error? [[User:ModeUser|ModeUser]] ([[User talk:ModeUser|talk]]) 01:26, 24 March 2023 (UTC)
:Which MediaWiki version are you using? Bitnami Mediawiki is currently on 1.39
:LDAP-Extensions are currently being updated to this version. 1.35 versions of them may not be compatible to MediaWiki 1.39 [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 11:00, 28 March 2023 (UTC)
:an answer about this error using mediawiki 1.35 ?? 
:[bb6311e257102ffb87d1a9ed] /index.php?title=Special:UserLogin&returnto=Main+Page UnexpectedValueException from line 486 of /home/wiki/www/includes/libs/rdbms/loadbalancer/LoadBalancer.php: Invalid server index index #DB_PRIMARY [[Special:Contributions/184.162.135.28|184.162.135.28]] ([[User talk:184.162.135.28|talk]]) 22:29, 11 July 2023 (UTC)
:I've created an account :) .. it's better to track this question
:an answer about this error using mediawiki 1.35 ??
:[bb6311e257102ffb87d1a9ed] /index.php?title=Special:UserLogin&returnto=Main+Page UnexpectedValueException from line 486 of /home/wiki/www/includes/libs/rdbms/loadbalancer/LoadBalancer.php: Invalid server index index #DB_PRIMARY [[User:Awolf76|Awolf76]] ([[User talk:Awolf76|talk]]) 22:34, 11 July 2023 (UTC)
:more info from the logs.  my question is. from where we are getting this DB_PRIMARY .. it should be DB_MASTER.. no? 
:[error] [1882330b5c49794ef1a9e52a] /index.php?title=Special:UserLogin&returnto=Main+Page   ErrorException from line 73 of /home/wiki/www/extensions/LDAPPr    ovider/src/UserDomainStore.php: PHP Warning: Use of undefined constant DB_PRIMARY - assumed 'DB_PRIMARY' (this will throw an Error in a future version of     PHP) [[User:Awolf76|Awolf76]] ([[User talk:Awolf76|talk]]) 22:36, 11 July 2023 (UTC)
:You are probably using a MediaWiki 1.35.3. Please update to a more recent version:
:https://github.com/wikimedia/mediawiki/blob/1.35.11/includes/libs/rdbms/defines.php#L25-L29 [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 05:50, 14 July 2023 (UTC)

== LDAPProvider 2.0.0 - error when signing using LDAP ==
{{Archive top|result=The whole problem was in missing configuration (section groupsync) in ldap.json|status=resolved}}

Hello, 
I would like to ask for some advice with authentication to our LDAP server. I've been struggling with this problem for a couple of days, but without success. 

Our current environment:

MediaWiki	1.39.3
PHP		    8.1.20 (apache2handler)
MariaDB		10.3.39-MariaDB-0+deb10u1
ICU		    65.1


LDAPAuthentication2	2.0.0 (125b09a) 14. 6. 2023, 15:16
LDAPGroups		    2.0.0 (590afec) 14. 6. 2023, 12:00
LDAPProvider		2.0.0 (12bd838) 14. 6. 2023, 11:57
LDAPUserInfo		2.0.0 (01a4b9e) 14. 6. 2023, 12:03
PluggableAuth		7.0.0 (068be5d) 13. 6. 2023, 07:53


My ldap.json is followning:

<pre>

"cca.cz": {

"connection": {

"server": "xxx.cca.cz",

"port": "636",

"user": "cn = ldapbrowse,cn=users,dc=cca,dc=cz",

"pass": "<password>",

"enctype": "ssl",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "dc=cca,dc=cz",

"userbasedn": "ou=uzivatele,ou=cca group bez kit,dc=cca,dc=cz",

"searchattribute": "samaccountname",

"usernameattribute": "samaccountname",

"realnameattribute": "cn",

"emailattribute": "mail",

"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

},

"userinfo": [],

"authorization": []

</pre>


My LocalSettings.php - only LDAP part:
<pre>
// Private Wiki. External LDAP login. Default NS requires login.
$wgEmailConfirmToEdit = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['*']['createaccount'] = true;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgBlockDisablesLogin = true;</code>


// Load LDAP Config from JSON
$ldapJsonFile = "/var/www/mediawiki/ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
  $testJson = @json_decode(file_get_contents($ldapJsonFile),true);
  if (is_array($testJson)) {
    $ldapConfig = true;
  } else {
    error_log("Found invalid JSON in file: $IP/ldap.json");
  }
}


$wgShowExceptionDetails = true;
$wgShowExceptionDetails = true;

$wgDebugToolbar = true;

$wgShowDebug = true;

$wgDevelopmentWarnings = false;

$wgDebugDumpSql = false;


//$wgShowSQLErrors = true;

$wgShowDBErrorBacktrace = false;

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = false;

$wgPluggableAuth_ExtraLoginFields=[];

$wgPluggableAuth_Class = "MediaWiki\\Extension\\LDAPAuthentication2\\PluggableAuth";

$wgPluggableAuth_ButtonLabel = "Log In";

$LDAPAuthentication2AllowLocalLogin=true;

$LDAPAuthentication2UsernameNormalizer= 'strtolower';

$wgPluggableAuth_Config['Log In (cca.cz)'] = [

    'plugin' => 'LDAPAuthentication2',

    'data' => [

        'domain' => 'cca.cz'

    ]

];

// Activate Extension
if ( $ldapConfig ) {

  wfLoadExtension( 'PluggableAuth' );
  wfLoadExtension( 'LDAPProvider' );
  wfLoadExtension( 'LDAPAuthentication2' );

## wfLoadExtension( 'LDAPAuthorization' );

  wfLoadExtension( 'LDAPUserInfo' );
  wfLoadExtension( 'LDAPGroups' );

  $LDAPProviderDomainConfigs = $ldapJsonFile;


# $LDAPProviderDefaultDomain = "cca.cz";
</pre>



When I run CheckLogin.php (php CheckLogin.php --username sir --domain=cca.cz) everything is correct - script returns OK.

But I'm getting this error message in Debug log:
<pre>
[7f2a04eeb8d13e57884c4309] /index.php/Hlavn%C3%AD_strana TypeError: HashConfig::__construct(): Argument #1 ($settings) must be of type array, null given, called in /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php on line 76
Backtrace:
from /var/www/mediawiki/includes/config/HashConfig.php(49)

# 0 /var/www/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php(76): HashConfig->__construct()
# 1 /var/www/mediawiki/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(154): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory()
# 2 /var/www/mediawiki/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(102): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->setSuitableDomainConfig()
# 3 /var/www/mediawiki/extensions/LDAPProvider/src/Hook/UserLoadAfterLoadFromSession.php(90): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession->process()
# 4 /var/www/mediawiki/includes/HookContainer/HookContainer.php(338): MediaWiki\Extension\LDAPProvider\Hook\UserLoadAfterLoadFromSession::callback()
# 5 /var/www/mediawiki/includes/HookContainer/HookContainer.php(137): MediaWiki\HookContainer\HookContainer->callLegacyHook()
# 6 /var/www/mediawiki/includes/HookContainer/HookRunner.php(4252): MediaWiki\HookContainer\HookContainer->run()
# 7 /var/www/mediawiki/includes/user/User.php(442): MediaWiki\HookContainer\HookRunner->onUserLoadAfterLoadFromSession()
# 8 /var/www/mediawiki/includes/user/User.php(1658): User->load()
# 9 /var/www/mediawiki/includes/user/User.php(2310): User->getId()
# 10 /var/www/mediawiki/includes/Permissions/PermissionManager.php(1549): User->isRegistered()
# 11 /var/www/mediawiki/includes/Permissions/PermissionManager.php(1477): MediaWiki\Permissions\PermissionManager->getRightsCacheKey()
# 12 /var/www/mediawiki/includes/Permissions/PermissionManager.php(1432): MediaWiki\Permissions\PermissionManager->getUserPermissions()
# 13 /var/www/mediawiki/includes/Permissions/PermissionManager.php(656): MediaWiki\Permissions\PermissionManager->userHasRight()
# 14 /var/www/mediawiki/includes/Permissions/PermissionManager.php(538): MediaWiki\Permissions\PermissionManager->checkReadPermissions()
# 15 /var/www/mediawiki/includes/Permissions/PermissionManager.php(345): MediaWiki\Permissions\PermissionManager->getPermissionErrorsInternal()
# 16 /var/www/mediawiki/includes/Permissions/UserAuthority.php(259): MediaWiki\Permissions\PermissionManager->getPermissionErrors()
# 17 /var/www/mediawiki/includes/Permissions/UserAuthority.php(205): MediaWiki\Permissions\UserAuthority->internalCan()
# 18 /var/www/mediawiki/includes/user/User.php(3494): MediaWiki\Permissions\UserAuthority->authorizeRead()
# 19 /var/www/mediawiki/includes/MediaWiki.php(227): User->authorizeRead()
# 20 /var/www/mediawiki/includes/MediaWiki.php(904): MediaWiki->performRequest()
# 21 /var/www/mediawiki/includes/MediaWiki.php(562): MediaWiki->main()
# 22 /var/www/mediawiki/index.php(50): MediaWiki->run()
# 23 /var/www/mediawiki/index.php(46): wfIndexMain()
# 24 {main}
</pre>

Signing with local account works well.

I would be very glad for any help.

Thanks a lot
Milan Široký [[User:Stp-cca|Stp-cca]] ([[User talk:Stp-cca|talk]]) 10:59, 16 June 2023 (UTC)
:Hello,
:I was able to fix this error. In case anyone has the same problem, I'll describe here the solution.
:The whole problem was in missing configuration (section groupsync) in ldap.json:
:{
:"cca.cz": {
:"connection": {
:"server": "xxx.cca.cz",
:"user": "cn=ldapuser,cn=users,dc=cca,dc=cz",
:"pass": "<password>",
:"options": {
:"LDAP_OPT_DEREF": 1
:},
:"basedn": "dc=cca,dc=cz",
:"groupbasedn": "dc=cca,dc=cz",
:"userbasedn": "ou=uzivatele,ou=cca group bez kit,dc=cca,dc=cz",
:"searchattribute": "cn",
:"searchstring": "cn=USER-NAME,ou=uzivatele,ou=cca group bez kit,dc=cca,dc=cz",
:"usernameattribute": "cn",
:"realnameattribute": "cn",
:"emailattribute": "mail"
:},
:"userinfo": {
:"attributes-map": {
:"email": "mail",
:"realname": "cn",
:"nickname": "uid"
:}
:},
:"groupsync": []
:}
:}
:Best regards,
:Milan [[User:Stp-cca|Stp-cca]] ([[User talk:Stp-cca|talk]]) 05:34, 20 June 2023 (UTC)
{{Archive bottom}}

== LDAPProvider (3.0.0-alpha) compatibility issues with LDAPAuthentication2 ==
{{Archive top|result=It does not belong here, as it was mistakenly posted here instead of LDAPAuthentication2 discussion board|status=resolved}}

php maintenance/update.php

PHP Fatal error:  Uncaught ExtensionDependencyError: LDAPAuthentication2 is not compatible with the current installed version of LDAPProvider (3.0.0-alpha), it requires: 2.*.


I have looked into the documentation and there wasnt any mentioning of this issue.

Edit: I am tested this with LDAPAuthentication2-master-b6f37c6 and LDAPAuthentication2-REL1_40-2864ae9.tar.gz but same error [[User:Lordgarmadon77|Lordgarmadon77]] ([[User talk:Lordgarmadon77|talk]]) 19:50, 20 September 2023 (UTC)
{{Archive bottom}}

== LDAPauthentication2 not working with MW 1.39.4 ==

Hi,

I am trying to configure LDAP authentication using PluggableAuth and LDAPAuthentication2 extensions in our private wiki. When I open the wiki page, it is not logged in automatically as expected. But If I click on the login, it says - "The supplied credentials could not be authenticated"

I checked logs, only authentication log is created and below is the only error I can see.

"wiki: Login failed in primary authentication because no provider accepted"

Other logs are not created, I dont understand why?

I am not sure if the configuration is correct. is there an option to test the connection to verify it is able to authenticate? can someone help with this?

Below codes added in LocalSettings.php:

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableAutoLogin = false; #if true, disables the logout option

$wgPluggableAuth_ButtonLabelMessage = "Log In";

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigProvider = function () {

$config = [

    "steps.net" => [

         "connection" => [

           "server" => "steps.net",

           "port" => 636,

           "enctype" => "ssl",

           "user" => 'user1@steps.net',

           "pass" => 'password',

           "options" => [

             "LDAP_OPT_DEREF" => 1

           ],

           "basedn" => "dc=steps,dc=net",

           "userbasedn" => "dc=steps,dc=net",

           "groupbasedn" => "dc=steps,dc=net",

           "searchattribute" => "sAMAccountName",

           "usernameattribute" => "cn",

           "realnameattribute" => "cn",

           "emailattribute" => "mail",

           "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

           "presearchusernamemodifiers" => [ "spacestounderscores", "lowercase" ],

         ],

         "authorization" => [ ],

         "userinfo" => [ ],

         "groupsync" => [ ],

      ]

  ];

  return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

$LDAPProviderDefaultDomain = "steps.net";

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPGroups' );

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2AllowLocalLogin=true;

$wgShowExceptionDetails=true;

$wgDebugToolbar=true;

$wgDebugLogFile = "/var/log/mediawiki/Debug-LDAPTest.log";

$wgDebugLogGroups['session'] = "/var/log/mediawiki/session-LDAPTest.log";

$wgDebugLogGroups['authentication'] = "/var/log/mediawiki/authentication-LDAPTest.log";

$wgDebugLogGroups['PluggableAuth'] = "/tmp/PluggableAuth-LDAPTest.log";

$wgDebugLogGroups['LDAP'] = "/tmp/LDAP-LDAPTest.log";

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = "/tmp/LDAPProviderClient-LDAPTest.log";

$wgDebugLogGroups['LDAPGroups'] = "/tmp/LDAPGroup-LDAPTest.log";

$wgDebugLogGroups['LDAPUserInfo'] = "/tmp/LDAPUserInfo-LDAPTest.log";

$wgDebugLogGroups['LDAPAuthentication2'] = "/tmp/LDAPAuthentication2-LDAPTest.log";

$wgDebugLogGroups['LDAPAuthorization'] = "/tmp/LDAPAuthorization-LDAPTest.log";

Software Versions:

MediaWiki 1.39.4

PHP 8.0.25 (apache2handler)

MySQL 8.0.26

PluggableAuth 7.0.0 (1cbf448) 05:33, 29 August 2023

LDAPAuthentication2 2.0.2 (b83f5d1) 07:23, 4 September 2023

LDAPAuthorization 2.0.1 (fbb1c3b) 07:23, 4 September 2023

LDAPGroups 2.0.1 (1f945ca) 07:23, 4 September 2023

LDAPProvider 2.0.1 (cc5cb2c) 14:06, 19 September 2023

LDAPUserInfo 2.0.0 (01a4b9e) 10:03, 14 June 2023


Thanks in advance... [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 10:22, 13 October 2023 (UTC)
:Hi! Please make sure to use the new PluggableAuth config: https://www.mediawiki.org/w/index.php?title=Extension:LDAPAuthentication2&oldid=6026580#Migration_from_PluggableAuth_5 [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 10:12, 16 October 2023 (UTC)
:Hi,
:I changed some settings as per the extensions. But its not logging in automatically.
:If I type username and password, its logging in. also I can see log created for successful login. For failed one, I cant see any.
:We need to enable the auto-login. but none of the variables helping here.... like $wgPluggableAuth_EnableAutoLogin = true; [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 12:07, 16 October 2023 (UTC)
:<code>$wgPluggableAuth_EnableAutoLogin</code> will not work here, as username/password must be entered somewhere. Unlike external Authn-Providers like SAML or OpenIDConnect, LDAP servers do not provide a web interface for doing that. Instead credentials must be entered on Special:userlogin page of the wiki, which then again will check back with the LDAP server.
:If you want "implicit login" you will probably need to set up Kerberos-Authn on your Webserver and the [[Extension:Auth_remoteuser]] extension in the wiki. See [[LDAP_hub]] for more information. [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 15:06, 16 October 2023 (UTC)
:I tried to enable auth_remoteuser and Ldapauthorization(with LdapaProvider and PluggableAuth), But it is not getting authenticated, in the ldapauthorization log, I see below message.
:<nowiki>##</nowiki>
:wiki139test: MediaWiki\Extension\LDAPAuthorization\Hook\AuthRemoteuserFilterUserName: Check authorization for user 'tester'.
:wiki139test: Could not check login requirements for tester
:wiki139test: Unsupported format!
:<nowiki>##</nowiki>
:if only auth-remoteuser is enabled, its authenticating automatically if user is present in wiki DB. But if the user is not present in wiki DB, then its not. Since its private wiki, we dont want anonymous user to login and need fetch user info from ldap if not present in DB.
:Any specific settings for these to work together? [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 10:23, 17 October 2023 (UTC)
:What have you set for <code>$LDAPAuthorizationAutoAuthRemoteUserStringParser</code>?
:Check the '''format''' of <code>$_SERVER['REMOTE_USER']</code>
:* <code>thedomain\\user.name</code> --><code>$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'domain-backslash-username';</code> (usually Windows servers)
:* <code>user.name@thedomain</code> --><code>$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';</code> (usually Linux servers) [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 11:19, 17 October 2023 (UTC)
:$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain'; 
:This is same as per the extension manual. No other things added. [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 13:05, 17 October 2023 (UTC)
:And what does the value from <code>$_SERVER['REMOTE_USER']</code> look like?
:HINT: You can check this by adding a file <code>info.php</code> With this content to the webroot
:<code> <?php</code>
:<code> phpinfo();</code>
:and access it in the browser. [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 10:21, 18 October 2023 (UTC)
:from phpinfo, I can see its just the short id like 'username' ( if I access the wiki within intranet). From outside world, its username@domain.
:So, some thing to be changed here ? [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 11:21, 18 October 2023 (UTC)
:So the value of <code>REMOTE_USER</code> ist just in the format of <code><username></code>? No domain included? [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 13:38, 18 October 2023 (UTC)
:its <username> when accessed within the intranet. If accessed from outside world, its <username@domain>
:I used this code to get it converted to <username> when connecting from outside world. So, app can process <username> always.
:ucwords(strtolower(preg_replace( '/@.*/', <nowiki>''</nowiki>, $_SERVER['REMOTE_USER'] )))
:But still authentication is not happening... [[User:Testergt1302|Testergt1302]] ([[User talk:Testergt1302|talk]]) 05:25, 19 October 2023 (UTC)
:Please try to normalize <code>$_SERVER['REMOTE_USER']</code> to be in the format of <code><username>@<domain></code> regardless of how you access the server and set <code>$LDAPAuthorizationAutoAuthRemoteUserStringParser = 'username-at-domain';</code> [[User:Osnard|Osnard]] ([[User talk:Osnard|talk]]) 16:09, 23 October 2023 (UTC)

== LDAPAuthentication2 is not working & no logs ==

Hi all,

I'm trying to configure LDAP authentication using PluggableAuth and LDAPAuthentication2 extensions. 

Here my (part of) LocalSettings.php:

''#log''

''#$wgDebugLogFile = "/var/log/debug-mediawiki.log";''

''$wgDebugLogFile = "/var/log/mediawiki/logs.log";''

''#$wgShowExceptionDetails = true;''

''#$wgDebugToolbar = true;''

''#$wgShowDebug = true;''

''#$wgDevelopmentWarnings = true;''

''$LDAPProviderCacheType = CACHE_NONE;''

''$wgDebugLogGroups['PluggableAuth']="/var/log/mediawiki/PluggableAuth.log";''

''$wgDebugLogGroups['LDAP']="/var/log/mediawiki/LDAP.log";''

''$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] ="/var/log/mediawiki/Client.log";''

''$wgDebugLogGroups['LDAPGroups']="/var/log/mediawiki/LDAPGroups.log";''

''$wgDebugLogGroups['LDAPUserInfo'] ="/var/log/mediawiki/LDAPUserInfo.log";''

''$wgDebugLogGroups['LDAPAuthentication2'] ="/var/log/mediawiki/LDAPAuthentication2.log";''

''$wgDebugLogGroups['LDAPAuthorization'] = "/var/log/mediawiki/LDAPAuthorization.log";''

''# LDAP''

''wfLoadExtension( 'PluggableAuth' );''

''$wgPluggableAuth_EnableAutoLogin = false; #if true, disables the logout option''

''$wgPluggableAuth_EnableLocalLogin = true;''

''wfLoadExtension( 'LDAPProvider' );''

''$LDAPProviderDomainConfigs = "${IP}/ldapprovider.json";''

''wfLoadExtension( 'LDAPAuthentication2' );''

''$LDAPAuthentication2AllowLocalLogin = true;''

''$wgLDAPDebug = 3; //for debugging LDAP''

''$wgDebugLogGroups['LDAP'] = "/var/log/mediawiki/ldap_debug.log";''

''$wgDebugLogGroups['LDAPGroups'] = "/var/log/mediawiki/LDAPGroups.log";''

''$wgDebugLogGroups['LDAPAuthentication2'] =  "/var/log/mediawiki/LDAPauth.log";''

''$wgShowExceptionDetails = true;''


Where ldapprovider.json:

''{''

''  "mydomain.com": {''

''    "connection": {''

''        "server": "srvdc01.mydomain",''

''        "port":"389",''

''        "user": "cn=myuser,dc=mydomain,dc=com",''

''        "pass": "password",''

''        "basedn": "dc=mydomain,dc=com",''

''        "groupbasedn": "dc=mydomain,dc=com",''

''        "userbasedn": "dc=mydomain,dc=com",''

''        "searchattribute": "sAMAccountName",''

''        "searchstring": "CN=USER-NAME,dc=mydomain,dc=com",''

''        "usernameattribute": "sAMAccountName",''

''        "realnameattribute": "cn",''

''        "emailattribute": "mail",''

''        "options": {''

''                "LDAP_OPT_DEREF": 1''

''        }''

''    }''

''  }''

''}''


But If I try to run :

''php CheckLogin.php --domain "mydomain.com" --username "myuser"''

Here the error:

''MWException from line 196 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials''

''#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(119): MediaWiki\Extension\LDAPProvider\Client->establishBinding()''

''#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(366): MediaWiki\Extension\LDAPProvider\Client->init()''

''#2 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(51): MediaWiki\Extension\LDAPProvider\Client->canBindAs()''

''#3 /var/www/html/mediawiki/maintenance/includes/MaintenanceRunner.php(681): MediaWiki\Extension\LDAPProvider\Maintenance\CheckLogin->execute()''

''#4 /var/www/html/mediawiki/maintenance/doMaintenance.php(100): MediaWiki\Maintenance\MaintenanceRunner->run()''

''#5 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/CheckLogin.php(77): require_once('/var/www/html/m...')''

''#6 {main}''


Furthermore, I don't see any logs in my log folder:

''root@tawiki-test:/var/log/mediawiki# ls -l''

''total 12''

''-rw-r--r-- 1 root     root     5294 Dec 20 16:28 logs.log''

''-rw-r--r-- 1 www-data www-data  795 Dec 20 16:08 PluggableAuth.log''

In the logs there is no info about the LDAP, instead in the PluggableAuth.log:

''2023-12-20 15:07:10 tawiki-test my_wiki: Getting PluggableAuth instance''

''2023-12-20 15:07:10 tawiki-test my_wiki: Could not get authentication plugin instance.''

''2023-12-20 15:07:15 tawiki-test my_wiki: Getting PluggableAuth instance''

''2023-12-20 15:07:15 tawiki-test my_wiki: Could not get authentication plugin instance.''

''2023-12-20 15:07:32 tawiki-test my_wiki: Getting PluggableAuth instance''

''2023-12-20 15:07:32 tawiki-test my_wiki: Could not get authentication plugin instance.''

''2023-12-20 15:07:59 tawiki-test my_wiki: Getting PluggableAuth instance''

''2023-12-20 15:07:59 tawiki-test my_wiki: Could not get authentication plugin instance.''

''2023-12-20 15:08:10 tawiki-test my_wiki: Getting PluggableAuth instance''

''2023-12-20 15:08:10 tawiki-test my_wiki: Could not get authentication plugin instance.''


Is there some advice here? What am I wrong?

Thanks,

Stefano [[Special:Contributions/93.63.223.40|93.63.223.40]] ([[User talk:93.63.223.40|talk]]) 15:32, 20 December 2023 (UTC)
:I found the issue related to the user used for the login: you have to use all tree in order to specify the user (so all the OU group where the user is included must me present). [[Special:Contributions/93.63.223.40|93.63.223.40]] ([[User talk:93.63.223.40|talk]]) 16:24, 20 December 2023 (UTC)
:But I still not able to work with the extension, in particular this is the new error:
:php ShowUserInfo.php --domain "dc=mydomain,dc=com" --username "myuser"
:''PHP Warning:  count(): Parameter must be an array or an object that implements Countable in /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php on line 50''
:''Warning: count(): Parameter must be an array or an object that implements Countable in /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php on line 50''
:''MediaWiki\Extension\LDAPProvider\DomainConfigProvider\ConfigException from line 51 of /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php: ⧼ldapprovider-domain-config-invalid⧽''
:''#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigProvider/LocalJSONFile.php(70): MediaWiki\Extension\LDAPProvider\DomainConfigProvider\LocalJSONFile->__construct()''
:''#1 [internal function]: MediaWiki\Extension\LDAPProvider\DomainConfigProvider\LocalJSONFile::newInstance()''
:''#2 /var/www/html/mediawiki/extensions/LDAPProvider/src/DomainConfigFactory.php(101): call_user_func_array()''
:''#3 /var/www/html/mediawiki/extensions/LDAPProvider/src/ClientFactory.php(62): MediaWiki\Extension\LDAPProvider\DomainConfigFactory::getInstance()''
:''#4 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(48): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain()''
:''#5 /var/www/html/mediawiki/maintenance/includes/MaintenanceRunner.php(681): MediaWiki\Extension\LDAPProvider\Maintenance\ShowUserInfo->execute()''
:''#6 /var/www/html/mediawiki/maintenance/doMaintenance.php(100): MediaWiki\Maintenance\MaintenanceRunner->run()''
:''#7 /var/www/html/mediawiki/extensions/LDAPProvider/maintenance/ShowUserInfo.php(72): require_once('/var/www/html/m...')''
:''#8 {main}''
:Where is the error? [[Special:Contributions/93.63.223.40|93.63.223.40]] ([[User talk:93.63.223.40|talk]]) 16:25, 20 December 2023 (UTC)
:Looks like communication with the LDAP server does not work properly. Have you tried the <code>CheckLogin.php</code> or <code>CheckConnection.php</code> scripts already?
:Regarding the LDAP logs, please use 
:<syntaxhighlight lang="php">
$wgDebugLogGroups['PluggableAuth'] = 
$wgDebugLogGroups['LDAP'] = 
$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = 
$wgDebugLogGroups['LDAPGroups'] = 
$wgDebugLogGroups['LDAPUserInfo'] = 
$wgDebugLogGroups['LDAPAuthentication2'] = 
$wgDebugLogGroups['LDAPAuthorization'] = '/tmp/LDAP.log';

Osnard (talk) 07:27, 22 December 2023 (UTC)Reply