Extension talk:LDAP Authentication

About this board

About - Requirements - Examples - Configuration Options - Changelog - Roadmap - Suggestions - User provided info - FAQ - Support

How to ask for support

There's a couple key pieces of info I always need:

The MediaWiki version you are using
The LdapAuthentication extension version you are using

I very often will need to see two other things when you ask for support, so you should have them prepared:

Your configuration, with sensitive stuff snipped out
The extension's debug log, with sensitive stuff snipped out

When you are trying to debug an authentication problem, you should always use the most basic configuration possible. For instance, if you don't have basic authentication working yet, you shouldn't have group restrictions or group synchronization enabled yet. I will generally ask you to disable these things when debugging.

Also, $wgLDAPUseLocal is almost never what you want to use. It's a frequent cause of configuration issues, and unless you really know what you are doing, it should not be set (or explicitly set to false, which is the default).

Most importantly of all: ensure you are using the newest version of the extension. From the extension distributor, that's the "master" version. If you are using git, just make sure you use git pull && git reset --hard origin/master. This is one of the more common cause of problems.

How to submit a bug

If you've found a bug, please submit it here.

works on mediawiki --branch REL1_31 for us

3 comments • 18:16, 15 January 2019 2 days ago

3

RobFantini (talkcontribs)

spent some hours upgrading from mw v29 to v31 . without any changes to LocalSettings.php LDAP Authentication to debian 9 OpenLDAP server (slapd) works.

after reviewing my incomplete notes and apt install logs, the only thing I see we did was:

apt install php-ldap

our existing LocalSettings.php had:

require_once 'extensions/LdapAuthentication/LdapAuthentication.php';

$wgAuth = new LdapAuthenticationPlugin();

Reply Edited 00:05, 20 October 2018 2 months ago

MarkAHershberger (talkcontribs)

Note that the second require_once should not be needed.

Reply 20:10, 23 September 2018 3 months ago

RobFantini (talkcontribs)

thanks - i removed the second require_once and no issue logging in.

Reply 11:53, 29 September 2018 3 months ago

Reply to "works on mediawiki --branch REL1_31 for us"

How do I grant SysOp privileges to a certain LDAP group?

One comment • 02:31, 10 January 2019 8 days ago

1

134.223.230.151 (talkcontribs)

Let's say that in my LDAP server I have a group called "trainers". Of all the members of that group there are a select few that are also in a group called "aces". In other words, all users that are in the group "aces" are also in "trainers" but not all "trainers" are "aces".

I have my MediaWiki set up so that you cannot create a new account and that only and all "trainers" are able to log in using LDAP Authentication. However, now I want "aces" to have SysOp privilege without the Bureaucrat manually granting each "ace" the privilege using the interface.

How do I go about doing this?

Reply 02:31, 10 January 2019 8 days ago

Reply to "How do I grant SysOp privileges to a certain LDAP group?"

How do i set this up with Simple Active Directory from AWS

One comment • 12:48, 4 December 2018 1 month ago

1

Nolan Perry (talkcontribs)

MediaWiki	1.31.0
PHP	7.1.7 (cgi-fcgi)
MySQL	5.7.21-log

Windows Server 2016 Datacenter Edition with Amazon Web Services EC2 Instance

How do i set this up with Simple AD, I'm only 14, and am confused after trying for 3 days to install

Reply 14:15, 24 June 2018 6 months ago

Reply to "How do i set this up with Simple Active Directory from AWS"

Trying to use Windows AD ldap for authentication.

5 comments • 22:55, 15 November 2018 2 months ago

5

Jac09876 (talkcontribs)

Good day,

I try to authenticate against Windows Server 2012 R2. But whatever I tried, it does not work. Mediawiki is running, and I can login with a local account. But not with an Active Directory account.

I run Mediawiki on CentOS Linux release 7.2.1511, and use the following versions:

Product Version

MediaWiki 1.26.2

PHP 5.4.16 (apache2handler)

MariaDB 5.5.47-MariaDB

ICU 50.1.2

This the ldap configuration from LocalSettings.php::

require_once ("$IP/extensions/LdapAuthentication/LdapAuthentication.php");

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array(

'acme'

);

$wgLDAPServerNames = array(

'acme' => 'acme-hq-AD1.internal.acme.com'

);

$wgLDAPBaseDNs = array(

'acme' => 'DC=internal,DC=acme,DC=com'

);

#$wgLDAPActiveDirectory = array(

# "acme"=>true

#);

$wgLDAPSearchAttributes = array(

"acme"=>"sAMAccountName"

);

$wgLDAPRetrievePrefs = array(

"acme" => "true"

);

$wgLDAPPreferences = array(

'acme' => array(

'email' => 'mail',

'realname' => 'displayname'

)

);

$wgLDAPEncryptionType = array(

# 'acme' => 'clear'

'acme' => 'ssl'

# 'acme' => 'tls'

);

$wgLDAPSearchStrings = array(

#'acme' => 'acme\\USER-NAME'

'acme' => 'USER-NAME@acme'

);

$wgLDAPUseLocal = false;

$wgMinimalPasswordLength = 1;

$wgLDAPProxyAgent = array(

'acme' => 'CN=acme-hq-mediawiki,OU=Service Accounts,OU=HeadQuarters,DC=internal,DC=acme,DC=com'

);

$wgLDAPProxyAgentPassword = array(

'acme' => 'p@sSw0rD'

);

ldapsearch works:

[root@wiki]# ldapsearch -x -LLL -h acme-hq-ad1.internal.acme.com -D 'CN=acme-hq-mediawiki,OU=Service Accounts,OU=HeadQuarters,DC=internal,DC=acme,DC=com' -w p@sSw0rD -b"DC=internal,DC=acme,DC=com" -s sub "(objectClass=user)" givenName

dn: CN=acme-hq-AD1,OU=Domain Controllers,DC=internal,DC=acme,DC=com

etc...

This is the Mediawiki logging

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 Entering validDomain

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 User is using a valid domain (acme).

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 Setting domain as: acme