Extension talk:LDAP Authentication

About this board

About - Requirements - Examples - Configuration Options - Changelog - Roadmap - Suggestions - User provided info - FAQ - Support

How to ask for support

There's a couple key pieces of info I always need:

The MediaWiki version you are using
The LdapAuthentication extension version you are using

I very often will need to see two other things when you ask for support, so you should have them prepared:

Your configuration, with sensitive stuff snipped out
The extension's debug log, with sensitive stuff snipped out

When you are trying to debug an authentication problem, you should always use the most basic configuration possible. For instance, if you don't have basic authentication working yet, you shouldn't have group restrictions or group synchronization enabled yet. I will generally ask you to disable these things when debugging.

Also, $wgLDAPUseLocal is almost never what you want to use. It's a frequent cause of configuration issues, and unless you really know what you are doing, it should not be set (or explicitly set to false, which is the default).

Most importantly of all: ensure you are using the newest version of the extension. From the extension distributor, that's the "master" version. If you are using git, just make sure you use git pull && git reset --hard origin/master. This is one of the more common cause of problems.

How to submit a bug

If you've found a bug, please submit it here.

Trying to use Windows AD ldap for authentication.

5 comments • 22:55, 15 November 2018 2 days ago

5

Jac09876 (talkcontribs)

Good day,

I try to authenticate against Windows Server 2012 R2. But whatever I tried, it does not work. Mediawiki is running, and I can login with a local account. But not with an Active Directory account.

I run Mediawiki on CentOS Linux release 7.2.1511, and use the following versions:

Product Version

MediaWiki 1.26.2

PHP 5.4.16 (apache2handler)

MariaDB 5.5.47-MariaDB

ICU 50.1.2

This the ldap configuration from LocalSettings.php::

require_once ("$IP/extensions/LdapAuthentication/LdapAuthentication.php");

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array(

'acme'

);

$wgLDAPServerNames = array(

'acme' => 'acme-hq-AD1.internal.acme.com'

);

$wgLDAPBaseDNs = array(

'acme' => 'DC=internal,DC=acme,DC=com'

);

#$wgLDAPActiveDirectory = array(

# "acme"=>true

#);

$wgLDAPSearchAttributes = array(

"acme"=>"sAMAccountName"

);

$wgLDAPRetrievePrefs = array(

"acme" => "true"

);

$wgLDAPPreferences = array(

'acme' => array(

'email' => 'mail',

'realname' => 'displayname'

)

);

$wgLDAPEncryptionType = array(

# 'acme' => 'clear'

'acme' => 'ssl'

# 'acme' => 'tls'

);

$wgLDAPSearchStrings = array(

#'acme' => 'acme\\USER-NAME'

'acme' => 'USER-NAME@acme'

);

$wgLDAPUseLocal = false;

$wgMinimalPasswordLength = 1;

$wgLDAPProxyAgent = array(

'acme' => 'CN=acme-hq-mediawiki,OU=Service Accounts,OU=HeadQuarters,DC=internal,DC=acme,DC=com'

);

$wgLDAPProxyAgentPassword = array(

'acme' => 'p@sSw0rD'

);

ldapsearch works:

[root@wiki]# ldapsearch -x -LLL -h acme-hq-ad1.internal.acme.com -D 'CN=acme-hq-mediawiki,OU=Service Accounts,OU=HeadQuarters,DC=internal,DC=acme,DC=com' -w p@sSw0rD -b"DC=internal,DC=acme,DC=com" -s sub "(objectClass=user)" givenName

dn: CN=acme-hq-AD1,OU=Domain Controllers,DC=internal,DC=acme,DC=com

etc...

This is the Mediawiki logging

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 Entering validDomain

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 User is using a valid domain (acme).

2016-04-21 19:40:33 wiki.acme.com

localhost.localdomain acme_wiki: 2.1.0 Setting domain as: acme