Extension talk:LDAP Authentication/2018

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

This extension or skin has been archived.

This extension or skin has not been maintained for some time, and no longer supports recent releases of MediaWiki. It was archived per T376097.
The following other choices are available:

LDAPAuthentication2

See this page before archival

How to ask for support

There's a couple key pieces of info I always need:

The MediaWiki version you are using
The LdapAuthentication extension version you are using

I very often will need to see two other things when you ask for support, so you should have them prepared:

Your configuration, with sensitive stuff snipped out
The extension's debug log, with sensitive stuff snipped out

When you are trying to debug an authentication problem, you should always use the most basic configuration possible. For instance, if you don't have basic authentication working yet, you shouldn't have group restrictions or group synchronization enabled yet. I will generally ask you to disable these things when debugging.

Also, $wgLDAPUseLocal is almost never what you want to use. It's a frequent cause of configuration issues, and unless you really know what you are doing, it should not be set (or explicitly set to false, which is the default).

Most importantly of all: ensure you are using the newest version of the extension. From the extension distributor, that's the "master" version. If you are using git, just make sure you use git pull && git reset --hard origin/master. This is one of the more common cause of problems.

How to submit a bug

If you've found a bug, please submit it here.

RHEL6 - MW 1.21.1 - httpd.x86_64 2.2.15-60.el6_9.5 - php.x86_64 5.3.3-49.el6

Latest comment: 8 years ago2 comments2 people in discussion

[Tue Jan 23 11:57:26 2018] [error] [client 10.x.x.x PHP Parse error: syntax error, unexpected '[' in /var/www/wiki/mywiki/extensions/LdapAuthentication/LdapAuthentication.php on line 39

On this page Extension:LDAP Authentication it says that this version of the extension should be compatible with this version of php and mediawiki. Please advise 2620:107:9000:2200:0:0:0:110 (talk) 17:01, 23 January 2018 (UTC)Reply

MediaWiki 1.21 is unsupported. If you want to still using it despite the security risks, you should download the extension for the MediaWiki 1.21, not a recent version. Ciencia Al Poder (talk) 10:31, 24 January 2018 (UTC)Reply

Support for LDAP Authentication on MW 1.23

Latest comment: 8 years ago2 comments1 person in discussion

MediaWiki 1.23

PHP 5.4.45

MySQL 5.5

LDAP setting is in progress. The following error message is output. Can you see the cause?

PHP Parse error: syntax error, unexpected 'class' (T_CLASS), expecting identifier (T_STRING) or variable (T_VARIABLE) or '{' or '$' in /var/www/html/mwiki/extensions/LdapAuthentication/LdapAuthentication.php on line 140 210.162.177.129 (talk) 12:11, 27 February 2018 (UTC)Reply

i resolve.fix below

// if ( class_exists( MediaWiki\Auth\AuthManager::class ) && empty( $wgDisableAuthManager ) ) {

if ( class_exists( 'MediaWiki\\Auth\\AuthManager' ) && empty( $wgDisableAuthManager ) ) { 210.162.177.129 (talk) 06:52, 28 February 2018 (UTC)Reply

LDap on server 2016

Latest comment: 8 years ago1 comment1 person in discussion

Does Ldap work on windows server 2016 with MediaWiki? 192.198.63.22 (talk) 19:23, 26 March 2018 (UTC)Reply

Authentication with Windows Server 2016, IIS.

Latest comment: 8 years ago1 comment1 person in discussion

I'm trying to get LDAP to function on my media wiki running on Windows Server 2016. This is in my local settings file. Is the correct?

require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array( "ad" );

$wgLDAPServerNames = array( "ad" => "ad-09.ad.jacks.com ad-08.ad.jacks.com" );

$wgLDAPSearchStrings = array( "ad" => "JCK\USER-NAME" );

$wgLDAPEncryptionType = array( "ad" => "ssl" ); 192.198.63.22 (talk) 20:38, 26 March 2018 (UTC)Reply

Version 1.30 compatability + PHP 7.1

Latest comment: 8 years ago2 comments2 people in discussion

I'm having trouble getting functionality to work with the latest version of the plugin and media wiki 1.30 running on RHES with PHP 7.1

Is it officially compatible yet or is it still in development? Brandoncw (talk) 23:21, 8 April 2018 (UTC)Reply

From Manual:Installation requirements: PHP 7 is generally supported, but PHP 7.1 causes various warnings for MediaWiki 1.28 when some extensions are enabled, see task T153505.

I'm not sure how accurate is this for the latest MediaWiki version and this extension, though. Ciencia Al Poder (talk) 09:18, 9 April 2018 (UTC)Reply

Error authenticating on 1.30 with AD

Latest comment: 8 years ago3 comments1 person in discussion

RESOLVED

Now the problem is solved and encrypted authentication works without issues.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Hi, I've got a problem while configuring an encrypted authentication with mediawiki 1.30 in CentOS 7.

Here is the part of my LocalSettings.php which configures the AD:

# Use ADDOMAIN AD
require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDomainNames = array( "ADDOMAIN" );
$wgLDAPServerNames = array( "ADDOMAIN" => "dc.ADDOMAIN.local" );
$wgLDAPSearchStrings = array( "ADDOMAIN" => "ADDOMAIN\\USER-NAME" );
$wgLDAPEncryptionType = array( "ADDOMAIN" => "ssl" );
$wgLDAPUseLocal = false;
$wgMinimalPasswordLength = 8;
$wgLDAPBaseDNs = array( "ADDOMAIN" => "ou=people,dc=ADDOMAIN,dc=local" );
$wgLDAPSearchAttributes = array( "ADDOMAIN" => "sAMAccountName" );
$wgLDAPRetrievePrefs = array( "ADDOMAIN" => "true" );
$wgLDAPPreferences = array( 'ADDOMAIN' => array( 'email' => 'mail','realname' => 'displayname') );
$wgLDAPLowerCaseUsername = array( "ADDOMAIN" => "true" );
$wgLDAPDebug = 2;
$wgDebugLogGroups["ldap"] = "/var/www/mediawiki/debug.log" ;
$wgShowExceptionDetails = true;

I've already configured my CA certificate at /etc/openldap/ldap.conf:

TLS_CACERTDIR   /etc/pki/tls/mediawiki/
TLS_CACERTFILE  /etc/pki/tls/mediawiki/ca.crt
TLS_CACERT      /etc/pki/tls/mediawiki/ca.crt

But when I try to authenticate, this is the output produced:

2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering allowPasswordChange
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering modifyUITemplate
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is an IP, not munging.
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering validDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 User is using a valid domain (ADDOMAIN).
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Setting domain as: ADDOMAIN
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering userExists
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering authenticate for username aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering Connect
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Using SSL
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Using servers: ldaps://dc.ADDOMAIN.local:636
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 PHP's LDAP connect method returned true (note, this does not imply it connected to the server).
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getSearchString
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Doing a straight bind
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 userdn is: ADDOMAIN\aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Binding as the user
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Failed to bind as ADDOMAIN\aduser  <- I think problem is here
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering allowPasswordChange
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering modifyUITemplate
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 11:55:14 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().

As can be seen, the problem seems to be that the user can't be binded. At the web interface, the server says the password is not correct. But if I change the following line at LocalSettings.php:

$wgLDAPEncryptionType = array( "ADDOMAIN" => "clear" );

Then, the authentication completes successfully with this log file:

2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering allowPasswordChange
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering modifyUITemplate
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is an IP, not munging.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering validDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 User is using a valid domain (ADDOMAIN).
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Setting domain as: ADDOMAIN
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering userExists
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering authenticate for username aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering Connect
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Using TLS or not using encryption.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Using servers: ldap://dc.ADDOMAIN.local:389
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 PHP's LDAP connect method returned true (note, this does not imply it connected to the server).
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getSearchString
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Doing a straight bind
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 userdn is: ADDOMAIN\aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Binding as the user
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Bound successfully
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getUserDN
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Created a regular filter: (sAMAccountName=aduser)
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getBaseDN
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 basedn is not set for this type of entry, trying to get the default basedn.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getBaseDN
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Using base: ou=people,dc=ADDOMAIN,dc=local
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Fetched UserDN: CN=RealName AD user,OU=people,DC=ADDOMAIN,DC=local
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getGroups
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering checkGroups
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getPreferences
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Retrieving preferences
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Retrieved email (aduser@ADDOMAIN.com) using attribute (mail)
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Retrieved realname (RealName AD user) using attribute (displayname)
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Authentication passed
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering updateUser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Setting user preferences.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Setting realname.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Setting email.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 User has a token, setting domain in user options.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Saving user settings.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering updateExternalDB
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Either the user is using a local domain, or the wiki isn't allowing updates
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:01:59 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getCanonicalName
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Username is: aduser
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Munged username: aduser
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering strict.
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Entering getDomain
2018-05-02 12:02:00 mywikiserver.domain.com wikidb: 2.1.0 Returning true in strict().

Could someone help me please? I don't want to send my users passwords in plaintext.

Thanks in advance. Nicovell3 (talk) 12:06, 2 May 2018 (UTC)Reply

Oh, and I forgot to append my LdapAuthentication extension version:

# cat /var/www/mediawiki/extensions/LdapAuthentication/version
LdapAuthentication: REL1_30
2017-09-21T22:10:51
907953e

Nicovell3 (talk) 15:36, 2 May 2018 (UTC)Reply

Finally I got this working. All I had to do was add this line to the /etc/openldap/ldap.conf file and restart the web server:

TLS_REQCERT allow

Nicovell3 (talk) 15:18, 3 May 2018 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

How do i set this up with Simple Active Directory from AWS

Latest comment: 7 years ago2 comments2 people in discussion

MediaWiki	1.31.0
PHP	7.1.7 (cgi-fcgi)
MySQL	5.7.21-log

Windows Server 2016 Datacenter Edition with Amazon Web Services EC2 Instance

How do i set this up with Simple AD, I'm only 14, and am confused after trying for 3 days to install Nolan Perry (talk) 14:15, 24 June 2018 (UTC)Reply

I think it's been mentioned that this extension isn't compatible with Mediawiki versions above 1.27, could that be the source of your troubles? Mbrooksham (talk) 09:10, 7 February 2019 (UTC)Reply

How to disable edit persmission for a group (or set a group to readonly)

Latest comment: 8 years ago2 comments2 people in discussion

Hi there,

We are using mediawiki 1.26.2. We are using the extension for quite some time. Recently we have the need to give a certain (ldap-)group "readonly" permissions (default you are able to edit). I am unable to figure out how to do that. Is this possible and if so how do I manage that? 159.46.196.35 (talk) 07:14, 10 July 2018 (UTC)Reply

You should be able to do this configuring User rights, assuming this extension get the user groups correctly. Ciencia Al Poder (talk) 08:18, 14 July 2018 (UTC)Reply

Issues with both LDAP/required groups as well as logging

Latest comment: 8 years ago1 comment1 person in discussion

Hey all,

I've migrated Mediawiki 1.21 from one server to another with 1.31 running (nginx + PHP 7.0 on a virtual Debian machine). Everything seems to be fine, I've managed to get LDAP-logon to work, but not with wgLDAPRequiredGroups. Furthermore, unlike some people here in this community, I don't even get any errors in the logfile. What am I missing? As soon as I comment out

$wgLDAPRequiredGroups = array( 'internal.domain.com' => array( 'cn=employees,cn=users,dc=internal,dc=domain,dc=com' ));

everything is working as it should.

Here is my config:

_{require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );}

_{$wgAuth = new LdapAuthenticationPlugin();}

_{$wgLDAPDomainNames = array( 'internal.domain.com');}

_{$wgLDAPServerNames = array( 'internal.domain.com' => 'dc1.internal.domain.com');}

_{$wgLDAPPort = array( 'internal.domain.com' => 389, );}

_{$wgLDAPProxyAgent = array( 'internal.domain.com' => 'CN=LDAP Read-only,CN=Users,DC=INTERNAL,DC=domain,dc=com',);}

_{$wgLDAPProxyAgentPassword = array( 'internal.domain.com' => 'D7WBKQgsFEPcuajA3zHb',);}

_{$wgLDAPSearchAttributes = array( 'internal.domain.com' => 'sAMAccountName');}

_{$wgLDAPEncryptionType = array( 'internal.domain.com' => 'start_tls');}

_{$wgLDAPGroupObjectclass = array( 'internal.domain.com'=>'group' );}

_{$wgLDAPGroupAttribute = array( 'internal.domain.com'=>'member' );}

_{$wgLDAPBaseDNs = array( 'internal.domain.com' => 'CN=Users,DC=internal,DC=domain,dc=com');}

_{$wgLDAPGroupObjectclass = array( 'internal.domain.comt' => 'posixGroup');}

_{$wgLDAPGroupNameAttribute = array( 'internal.domain.com' => 'cn');}

_{$wgLDAPRequiredGroups = array( 'internal.domain.com' => array( 'cn=employees,cn=users,dc=internal,dc=domain,dc=com' ));}

_{$wgLDAPGroupSearchNestedGroups = array("ad" => true);}

_{$wgLDAPActiveDirectory = array( "ad" => true);}

_{$wgLDAPDebug = 3;}

_{$wgDebugLogGroups['ldap'] = "/tmp/mediawiki.log";}

_{$wgShowExceptionDetails = true;}

I've been trying a lot of different options here, nothing helps really. So any ideas are welcome, especially if I can get that logging going!

Thank you in advance Oleg.blecher (talk) 15:07, 12 July 2018 (UTC)Reply

ldap debug

Latest comment: 8 years ago1 comment1 person in discussion

I setup ldap debug but I don't get any useful information... just the following...

2018-07-19 19:50:02 dtn13-vm wiki_demo: 2.1.0 Returning true in strict().

2018-07-19 19:51:02 dtn13-vm wiki_demo: 2.1.0 Entering strict.

Here is part of my config...

require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDebug = 3;

$wgDebugLogGroups['ldap'] = '/tmp/debug.log';

$wgLDAPDomainNames = array(

'quest',

);

$wgLDAPServerNames = array(

'domain' => 'domain.local',

);

$wgLDAPSearchStrings = array(

'domain' => 'domain\\USER-NAME'

); 139.169.8.154 (talk) 20:38, 19 July 2018 (UTC)Reply

works on mediawiki --branch REL1_31 for us

Latest comment: 8 years ago3 comments2 people in discussion

spent some hours upgrading from mw v29 to v31 . without any changes to LocalSettings.php LDAP Authentication to debian 9 OpenLDAP server (slapd) works.

after reviewing my incomplete notes and apt install logs, the only thing I see we did was:

apt install php-ldap

our existing LocalSettings.php had:

require_once 'extensions/LdapAuthentication/LdapAuthentication.php';

$wgAuth = new LdapAuthenticationPlugin();

RobFantini (talk) 21:25, 20 September 2018 (UTC)Reply

Note that the second require_once should not be needed. ☠MarkAHershberger☢(talk)☣ 20:10, 23 September 2018 (UTC)Reply

thanks - i removed the second require_once and no issue logging in. RobFantini (talk) 11:53, 29 September 2018 (UTC)Reply

MediaWiki Server 18.04 Failed to bind to user

Latest comment: 7 years ago3 comments3 people in discussion

Have an old Mediawiki Ubuntu server running Ubuntu 14.04, with MediaWiki 1.25, PHP 5.59 and mysql 5.7.23. This server was getting old and we wanted to add certain functionality past what 1.25 could run, so we spun up a new server running 18.04, transferred everything over and I was able to get the wiki up and running. It is now at MediaWiki 1.30, PHP 7.2 and mysql 5.7. My localsettings.php have not changed and as this is all internal I am running the encryption type as clear. I have the debug log set up and everything seems to be running correctly until

userdn is: user@domain

Entering getDomain

Binding as the user

Failed to bind as user@domain

I can access the ldap server as usual.

Any ideas? Enovyfalls (talk) 16:52, 24 October 2018 (UTC)Reply

did you installed the ldap module for php7.2

apt-get install -y php7.2-ldap

you can check it with a phpinfo() 62.14.255.236 (talk) 14:29, 6 February 2019 (UTC)Reply

Thanks. 41.143.138.131 (talk) 15:59, 30 April 2019 (UTC)Reply

How to ask for support

How to submit a bug

Archives

RHEL6 - MW 1.21.1 - httpd.x86_64 2.2.15-60.el6_9.5 - php.x86_64 5.3.3-49.el6

Support for LDAP Authentication on MW 1.23

LDap on server 2016

Authentication with Windows Server 2016, IIS.

Version 1.30 compatability + PHP 7.1

Error authenticating on 1.30 with AD

How do i set this up with Simple Active Directory from AWS

How to disable edit persmission for a group (or set a group to readonly)

Issues with both LDAP/required groups as well as logging

ldap debug

works on mediawiki --branch REL1_31 for us

MediaWiki Server 18.04 Failed to bind to user