Extension talk:PluggableAuth/2021

When reporting an error, please be sure to include version information for MediaWiki and all relevant extensions as well as configuration information. Also, please turn on debug logging as described at Manual:How to debug#Logging and include the relevant portions of the debug log.

Fatal Eroor - pluggableAuth after login

Hi,

I have a problem with pluggableAuth extenssion. When it is active, I have an error after login : "Fatal error". I use this whith ldapprovider.

I use mediawiki 1.35 LTS.

On my apache log :

"GET /index.php/Sp%C3%A9cial:PluggableAuthLogin HTTP/1.1" 500

Any Idea?

Regards 85.31.195.162 (talk) 14:15, 18 January 2021 (UTC)

Do you have the debug log active? Are there any errors in your webserver's logs? ☠MarkAHershberger☢(talk)☣ 22:52, 20 January 2021 (UTC)

'local' domain configuration error

I have a working LDAP configuration using PluggableAuth, LDAPAuthentication2, LDAPProvider, LDAPAuthorization and LDAPUserInfo.

However, I also have a need to manage local accounts. This includes a local 'Admin' account as well as legacy local user accounts which are not in LDAP.

I've tried the various 'enable local' configurations with no luck.

       $wgPluggableAuth_ButtonLabel = "Domain Log In";

       $wgPluggableAuth_EnableLocalLogin = true;

       $wgPluggableAuth_EnableLocalProperties = true;

       $LDAPAuthentication2AllowLocalLogin = true;

I'm persistently getting an error about an unconfigured 'local' domain. See error below. The only way for me to login with a local account without LDAP is to disable the LDAP* extensions. We need to have both options available. Please advise. I'm using MediaWiki 1.35.

<[f90402a644c3c663020eca3e] /Special:PluggableAuthLogin MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'local'!> Dancabcaltech (talk) 02:26, 22 January 2021 (UTC)

Is it possible to move the Local users to LDAP? I just released WikiToLDAP that could help in this regard.

Otherwise, I'm not sure what to tell you. Using Local and LDAP logins worked for me. Maybe @Osnard has a hint? ☠MarkAHershberger☢(talk)☣ 15:16, 22 January 2021 (UTC)

Thanks for the quick reply. We also need to keep the local login option in order to add new users that are not part of our LDAP.

Here's the full error message with Backtrace...

< [3a2917944f5439fb20ec8bcc] /Special:PluggableAuthLogin MediaWiki\Extension\LDAPProvider\LDAPNoDomainConfigException from line 61 of /var/www/html/extensions/LDAPProvider/src/DomainConfigFactory.php: No configuration available for domain 'local'!

Backtrace:

#0 /var/www/html/extensions/LDAPProvider/src/ClientFactory.php(61): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(55): MediaWiki\Extension\LDAPProvider\ClientFactory->getForDomain(string)

#2 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(69): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->__construct(User, boolean)

#3 /var/www/html/includes/Hooks.php(174): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::callback(User, boolean)

#4 /var/www/html/includes/Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#5 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(54): Hooks::run(string, array)

#6 /var/www/html/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#7 /var/www/html/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)

#8 /var/www/html/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#9 /var/www/html/includes/MediaWiki.php(900): MediaWiki->performRequest()

#10 /var/www/html/includes/MediaWiki.php(527): MediaWiki->main()

#11 /var/www/html/index.php(44): MediaWiki->run()

#12 {main}> Dancabcaltech (talk) 19:17, 22 January 2021 (UTC)

@Osnard @MarkAHershberger

I'm trying to troubleshoot this further. Is there anywhere else in the database that the 'local' domain is configured for the extensions?

I'm using a test site which has exactly one 'local' user and one LDAP 'Caltech' user. As I mentioned, if I disable the LDAP extensions then I'm able to login using the 'local'. I can leave PluggableAuth enabled and use the local login button instead of the "Use Pluggable Auth" button.

Also, fwiw, I have a separate, older wiki installation using MW 1.32 and the simpler LDAPAuthentication extension. I have no problems there with being able to login using either 'local' or LDAP accounts.

Thanks for your help.

select * from "wikis_ldap_domains" \G

*************************** 1. row ***************************

domain_id: 1

   domain: local

  user_id: 1

*************************** 2. row ***************************

domain_id: 2

   domain: Caltech

  user_id: 2 Dancabcaltech (talk) 19:27, 25 January 2021 (UTC)

I'm looking over your config above and I notice that you have two local login config parameters. What happens if you take out:

$wgPluggableAuth_EnableLocalLogin = true; ☠MarkAHershberger☢(talk)☣ 18:21, 27 January 2021 (UTC)

I get the same error. I didn't have that initially but added that hoping it would help but no change. Dancabcaltech (talk) 18:54, 27 January 2021 (UTC)

@Osnard @MarkAHershberger does that error message or backtrace help at all? Could this be a bug of some kind? Let me know if you need more information.

Thanks for your help. Dancabcaltech (talk) 19:25, 2 February 2021 (UTC)

I was able to spend more time on troubleshooting this today by setting up a fresh test installation of MediaWiki 1.35.

I am using the LDAPAuthorization extension to restrict access to a specific LDAP group. If I disable LDAPAuthorization and allow any LDAP user then 'local' login works for the admin (sysop) user once again.

In addition, it seems the error about a 'local' domain is coming from the ldap_domains table which has that entry in my production database. My production database was upgraded from earlier versions of MediaWiki so that 'local' domain entry may just be an artefact from older wiki versions.

I'm not sure what can be done to have LDAPAuthorization enabled and still allow local logins for the admin/sysop user. Dancabcaltech (talk) 02:28, 9 February 2021 (UTC)

I see ... LDAPAuthorization will check the requirements regardless of where the user is coming from. We will probably need to patch this behavior. Could you create a Phabricator task here? Osnard (talk) 07:38, 18 February 2021 (UTC)

I'm seeing this exact issue after upgrading from 1.32 where I was also previously using the simple ldap plugin. 73.142.152.222 (talk) 21:42, 29 June 2021 (UTC)

Previous post was mine.

Another interesting behavioral item... when:

$LDAPAuthentication2AllowLocalLogin = true;

$wgPluggableAuth_EnableLocalLogin = true;

Not only does the error about no "local" domain pop up, but entering an LDAP username and password and hitting <enter> on the keyboard fails to authenticate to the domain in the dropdown box below and attempts to use local authentication instead. However, if you click the actual login button, LDAP authentication will be used. Changing these to:

$LDAPAuthentication2AllowLocalLogin = false;

$wgPluggableAuth_EnableLocalLogin = false;

removes this behavior and hitting <enter> with LDAP credentials uses LDAP authentication correctly. DaveMow (talk) 13:27, 30 June 2021 (UTC)

It's potentially also worth noting that, when upgrading from previous version of the LDAPAuthentication plugin to the LDAP Authentication2 plugin, you specified domain name must be the same as it was in the previous configuration as the user accounts are tied to THAT, not to the actual LDAP domain name.

E.g. If I previously specified an entry for my.domain.com as:

$wgLDAPDomainNames = array(

  'My_Domain_com'

);

My new ldap.json file should be:

{

        "My_Domain_com": {

                "connection": {

These items ARE case-sensitive. If you create the new ldap.json using my.domain.com instead of the originally specified domain name and try to login, you will receive errors. DaveMow (talk) 13:35, 30 June 2021 (UTC)

I had the same issue for my local accounts. Temporarily disabling LDAPProvider would get rid of the error message for the local accounts.

As @Dancabcaltech mentioned, the error message only popped up for users that had a "local" row in the ldap_domains table. So in the end, I was able to solve the issue by removing rows for these users in the table: DELETE FROM ldap_domains WHERE user_id=13 OR user_id=14 OR user_id=15;

My local users and LDAP users can now log in normally. Platinops (talk) 12:37, 29 April 2022 (UTC)

ErrorException from line 23 of C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\src\UserInfoProvider\Username.php: PHP Warning: Illegal offset type in isset or empty

Hi all,

We are using a windows (10) platform with

- MediaWiki 1.34.0

- PluggableAuth 5.7

- SimpleSamlPHP 4.5.2/1.19 together with Azure AD.

Login in with a local account is possible.

Login in with Azure AD is not working. I see the Azure login screen, and can enter my credentials including 2FA, but after that I get the message (at the login screen) "Could not find username attribute: Array".

SimpleSamlPHP shows that I get the correct information from Azure

In the logfile I see the following:

<Start Log>

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[error] [107b7a726dff00e2ca585728] /mediawiki/index.php/Speciaal:PluggableAuthLogin   ErrorException from line 23 of C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\src\UserInfoProvider\Username.php: PHP Warning: Illegal offset type in isset or empty

#0 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\src\UserInfoProvider\Username.php(23): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\includes\SimpleSAMLphp.php(68): MediaWiki\Extension\SimpleSAMLphp\UserInfoProvider\Username->getValue(array)

#2 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\includes\SimpleSAMLphp.php(115): SimpleSAMLphp->initUsernameAndId()

#3 C:\xampp\htdocs\mediawiki\extensions\PluggableAuth\includes\PluggableAuthLogin.php(36): SimpleSAMLphp->authenticate(NULL, NULL, NULL, NULL, NULL)

#4 C:\xampp\htdocs\mediawiki\includes\specialpage\SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#5 C:\xampp\htdocs\mediawiki\includes\specialpage\SpecialPageFactory.php(611): SpecialPage->run(NULL)

#6 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#7 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(900): MediaWiki->performRequest()

#8 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(527): MediaWiki->main()

#9 C:\xampp\htdocs\mediawiki\index.php(44): MediaWiki->run()

#10 {main}

[error] [107b7a726dff00e2ca585728] /mediawiki/index.php/Speciaal:PluggableAuthLogin   ErrorException from line 24 of C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\src\UserInfoProvider\Username.php: PHP Notice: Array to string conversion

#0 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\src\UserInfoProvider\Username.php(24): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\includes\SimpleSAMLphp.php(68): MediaWiki\Extension\SimpleSAMLphp\UserInfoProvider\Username->getValue(array)

#2 C:\xampp\htdocs\mediawiki\extensions\SimpleSAMLphp\includes\SimpleSAMLphp.php(115): SimpleSAMLphp->initUsernameAndId()

#3 C:\xampp\htdocs\mediawiki\extensions\PluggableAuth\includes\PluggableAuthLogin.php(36): SimpleSAMLphp->authenticate(NULL, NULL, NULL, NULL, NULL)

#4 C:\xampp\htdocs\mediawiki\includes\specialpage\SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#5 C:\xampp\htdocs\mediawiki\includes\specialpage\SpecialPageFactory.php(611): SpecialPage->run(NULL)

#6 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#7 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(900): MediaWiki->performRequest()

#8 C:\xampp\htdocs\mediawiki\includes\MediaWiki.php(527): MediaWiki->main()

#9 C:\xampp\htdocs\mediawiki\index.php(44): MediaWiki->run()

#10 {main}

[SimpleSAMLphp] Could not find username attribute: Array

[PluggableAuth] Authentication failure.

[PluggableAuth] ERROR: Could not find username attribute: Array

<End of log file>

It looks like the username is not passed from SimpleSamlphp to PluggableAuth.

What can I do to get this working?

Best regards,

Jan. RoboNewFun (talk) 15:30, 1 February 2021 (UTC)

Did you test the simpleSAMLphp library configuration using https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_5 to see what attributes are returned?

What is your configuration for the name of the username attribute, $wgSimpleSAMLphp_UsernameAttribute? Do you have that set to a string? It looks from the debugging output that it is getting an array rather than a string there. It should be the name of whatever attribute is being returned from the SimpleSAMLphp library for the username. Cindy.cicalese (talk) 02:49, 2 February 2021 (UTC)

Failed to auto-creation of a local account failed: You have not specified a valid username

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I have MediaWiki 1.3.4 installed, and users request to add SSO w/ keycloak9.3 + AD, using PluggableAuth v5.7 & OpenIDConnect v5.4,

Testing AD account is created & active, so assuming the missing part is after user authenticated, failed to created Mediawiki user account;

keycloak 9.0.3 are using fined w/ other systems, so currently isolated problem about keycloak & our AD;

On MediaWiki login page, click "log in using eeeeee SSO" button, forward to keycloak login page, input my AD credential, & return to MediaWiki login page but a red error box error box with message "Auto-creation of a local account failed: You have not specified a valid username."

Problem: In debug log seen, PluggableAuth authorized credential successfully, but no local user account is created;

Error message: ErrorException from line 77 of /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

Findings: check db, local user doesn't exists in DB before & after login;

Localsettings.php configured as below:

# test integrate w/ o365

# =======================================================================================================================

# Extensions:PluggableAuth

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = false;

#$wgPluggableAuth_ButtonLabelMessage  = 'eeeeee SSO test button label';

$wgPluggableAuth_ButtonLabel = 'Login using eeeeee SSO...';

#$wgPluggableAuth_ExtraLoginFields = [];

$wgPluggableAuth_Class = 'OpenIDConnect';

# Extensions: OpenIDConnect

wfLoadExtension( 'OpenIDConnect' );

$wgOpenIDConnect_Config['https://sso.sit-k8s.eeeeee.cn/auth/realms/eeeeee'] = [

    'clientID' => 'eeeeee',

    'clientsecret' => 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

    'scope' => [ 'openid', 'profile', 'email' ]

];

$wgOpenIDConnect_UseRealNameAsUserName = true;

$wgOpenIDConnect_UseEmailNameAsUserName = true;

$wgOpenIDConnect_MigrateUsersByUserName = true;

$wgOpenIDConnect_MigrateUsersByEmail = true;

$wgOpenIDConnect_ForceLogout = false;

$wgDebugLogFile = '/var/www/html/wiki/debug_log.log';

Debug log:

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: OpenIDConnect

[DBQuery] OpenIDConnect::getName [0.001s] database: SELECT  user_name  FROM `user`    WHERE subject = '51688066-dc4c-4425-9272-dba12c315a42' AND issuer = 'https://sso.sit-k8s.esquel.cn/auth/realms/esquel'  LIMIT 1  

Matching user to email chenghug@eeeeee.com

[DBQuery] OpenIDConnect::getMigratedIdByEmail [0s] database: SELECT  user_id,user_name  FROM `user`    WHERE user_email = 'chenghug@eeeeee.com' AND subject IS NULL AND issuer IS NULL  ORDER BY user_registration LIMIT 1  

[DBQuery] User::idFromName [0s] database: SELECT  user_id  FROM `user`    WHERE user_name = 'Chenghug@eeeeee.com'  LIMIT 1  

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" data dirty due to dirty(): OpenIDConnect->authenticate/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" data dirty due to dirty(): OpenIDConnect->authenticate/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth] Authenticated new user: Chenghug@eeeeee.com

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "m2jac4oj1r0pr9dq14v6jdiiciqufb7g" save: dataDirty=1 metaDirty=0 forcePersist=0

[error] [17f20c78103fa530d15e5ccd] /index.php/Special:PluggableAuthLogin?state=5b5336e6b34b242c64f5e15aa3eb69da&session_state=43f0f7af-464e-46c5-92e5-71e8e59d001d&code=1b7009dc-9946-4aad-8cf0-b5d2a8b51a82.43f0f7af-464e-46c5-92e5-71e8e59d001d.009b1d1a-e0f3-42c9-91b1-3f786cfee891   ErrorException from line 77 of /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

Extensions downloaded:

PluggableAuth-REL1_31-eb1b638.tar

OpenIDConnect-REL1_31-f56e118.tar Lamjon (talk) 08:23, 10 February 2021 (UTC)

You are using a very old version of both extensions. You should download the latest "master" version of both. Cindy.cicalese (talk) 15:14, 10 February 2021 (UTC)

@Cindy.cicalese upgraded both extensions to latest version, another error caught:

I will try a couple of days later.

[DBQuery] User::load [0s] database: SELECT  actor_id,actor_user,actor_name  FROM `actor`    WHERE actor_name = 'Lamjon@esquel.com'  LIMIT 1  

[authentication] Auto-creating Lamjon@eeeeee.com on login

[DBQuery] User::idFromName [0s] database: SELECT  user_id  FROM `user`    WHERE user_name = 'Lamjon@eeeeee.com'  LIMIT 1  

[authentication] MediaWiki\Auth\AuthManager::autoCreateUser: blacklisted in session qdf8mp4fh6cnhtcqhi6np5aeiegi5f1c

[session] SessionBackend "qdf8mp4fh6cnhtcqhi6np5aeiegi5f1c" data dirty due to dirty(): AuthManagerSpecialPage->handleFormSubmit/AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->continueAuthentication/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "qdf8mp4fh6cnhtcqhi6np5aeiegi5f1c" save: dataDirty=1 metaDirty=0 forcePersist=0

[authevents] Login attempt

[DBQuery] LCStoreDB::get [0s] database: SELECT  lc_value  FROM `l10n_cache`    WHERE lc_lang = 'en' AND lc_key = 'messages:pt-login-button'  LIMIT 1  

User::getBlockedStatus: checking... 203.85.79.142 (talk) 07:11, 11 February 2021 (UTC)

@Cindy.cicalese, in no luck, this seems the auto-creating user is not working, it still get the AuthManager::autoCreateUser: blacklisted in session error.

The parameter must be an array Error will cause the autocreateuser failure?

[session] SessionBackend "tloo4j7j1q65e9q9tk5nr05prd9k4h92" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "tloo4j7j1q65e9q9tk5nr05prd9k4h92" save: dataDirty=1 metaDirty=0 forcePersist=0

[error] [4ab2ab88ba165c2a3d6e668d] /index.php/Special:PluggableAuthLogin?state=1088d51ade57c6aa26f20bd328821ddb&session_state=9165f2ce-760b-4edb-8341-0662b8d60c78&code=309562c7-5c18-4131-a684-c4c74f640cdc.9165f2ce-760b-4edb-8341-0662b8d60c78.009b1d1a-e0f3-42c9-91b1-3f786cfee891   ErrorException from line 77 of /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

#0 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(77): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/html/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#2 /var/www/html/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)

#3 /var/www/html/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#4 /var/www/html/includes/MediaWiki.php(900): MediaWiki->performRequest()

#5 /var/www/html/includes/MediaWiki.php(527): MediaWiki->main()

#6 /var/www/html/index.php(44): MediaWiki->run()

#7 {main}

[DBQuery] MediaWiki::preOutputCommit [0s] database: COMMIT Lamjon (talk) 04:34, 16 February 2021 (UTC)

You are still using an old version of PluggableAuth, given the line number and message of the exception:

ErrorException from line 77 of /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable.

That bug was fixed in https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/PluggableAuth/+/254742d21964a36a48ae8b13001b2dd07c6f10ed. Cindy.cicalese (talk) 04:45, 16 February 2021 (UTC)

Thanks, @Cindy.cicalese the error is gone, but it still failed to auto-create user. Lamjon (talk) 09:02, 16 February 2021 (UTC)

I believe it has to do with caching the previous failed autocreation attempt. Maybe some of the suggestions at Extension talk:PluggableAuth/2019#h-LDAP_-_"Auto-creation_of_a_local_account_failed:_Automatic_account_creation_is_n-2019-10-30T14:56:00.000Z will be useful to you. Cindy.cicalese (talk) 13:30, 16 February 2021 (UTC)

After disable cache on LocalSettings.php, it works.

Thanks. Lamjon (talk) 07:19, 17 February 2021 (UTC)

Excellent. Cindy.cicalese (talk) 14:45, 17 February 2021 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

logout on AzureAD on mediawiki 1.35.1

When using simplesamlphp + AzureAD and pluggable auth on mediawiki 1.35, logging out throws the generic network error message: "Could not connect to the server. Make sure you have a working internet connection and try again."

In the web console the error is more specific:

"Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at login.microsoftonline.com"

Logging in redirects fine, and accounts are created and populated with info from the SSO. Only logging out is the problem. Tried messing around with some of the CORS variables in settings, no change.

On Mediawiki 1.31 Everything is the same, and logout works as expected. Any ideas?

Thanks 136.165.222.116 (talk) 17:52, 22 March 2021 (UTC)

I'll post my experience with this in case it helps anybody.

I think this is related to task T222626 which turned the Logout link into an API request and maybe task T246350. Azure AD only seems to support HTTP-Redirect for its single log out(SLO) binding, and does not return the CORS header needed to allow the browser to complete the logout process. Not sure if this is only the case with Azure AD or with any IDP using HTTP-Redirect.

Best Wmattingly (talk) 18:57, 5 April 2021 (UTC)

It does not work with my Shibboleth 4.0.1 IDP 205.250.243.184 (talk) 01:06, 12 June 2021 (UTC)

Anyone happen to find a solution for this? Cheers! Ajjithu (talk) 16:30, 26 October 2021 (UTC)

I am seeing the same behavior when using https://hub.docker.com/r/kristophjunge/test-saml-idp/ as IdP. Jeroen De Dauw (talk) 21:17, 23 November 2021 (UTC)

I can confirm this issue also occurs with other IdPs and that it is actually related to T222626, which performs logout via an XHR to the "logout" action API. SAML is not build to work with XHRs at all. It relies on a regular HTTP redirect workflow, which doesn't go well with XHR calls. If you access "Special:UserLogout" manually and submit the form, everything will work just fine.

A quick workaround could be to knock out the code at /resources/src/mediawiki.page.ready/ready.js#L71-L93, e.g. by JavaScript like $( '#pt-logout a[data-mw="interface"]' ).off( 'click' ); in "MediaWiki:Common.js".

Of course this is not a good solution, as the user will also be asked to confirm the logout on "Special:UserLogout". Osnard (talk) 09:46, 24 November 2021 (UTC)

I can confirm this workaround functions, though it is indeed not ideal. Now the user needs to click the logout link, AND then the logout button on Special:UserLogout. Still better than a confusing error message though. Jeroen De Dauw (talk) 16:44, 25 November 2021 (UTC)

I have now created a Phabricator task for this https://phabricator.wikimedia.org/T305031 Osnard (talk) 07:33, 5 April 2022 (UTC)

The JS solution provided above didn't work for me unfortunately, not sure why. Another workaround can be found in changing the id attribute of the 'log out hyperlink'. The following can be copied to LocalSettings.php:

$wgHooks['PersonalUrls'] = static function ( &$personal_urls, $title, $skin ) {
        if ( $skin->getUser()->isLoggedIn() ) {
                $personal_urls['logout2'] = $personal_urls['logout'];
                unset( $personal_urls['logout'] );
        }
        return true;
};

Clicking yet another button after clocking on the log out hyperlink is not ideal, but it's better than breaking the support for SAML Single Logout. Southparkfan (talk) 19:48, 24 April 2022 (UTC)

Thanks for sharing Osnard (talk) 07:57, 25 April 2022 (UTC)

How to get query containing auth key?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hello @Cindy.cicalese and @MarkAHershberger,

I have a quick question to clarify the documentation.

I'm working on a custom auth system for a client who is using a bespoke authentication system. This auth system has its own sign in page, after which it will POST an authentication key to a page on the wiki. Then, we will take the auth key and check it against the API in order to get the username and other info of this user. No PHP library exists for this bespoke auth system, so we have to write this from scratch.

Can we point the auth system to POST to Special:UserLogin or will we have to have it post to our own special page? If the former, how do we accept the auth key and proceed to the authentication() hook phase without making it into a displayed field for the user to enter the auth key?

Thank you very much for any help you can provide! Jeffrey Wang 19:06, 22 March 2021 (UTC)

Hi, @MyWikis-JeffreyWang! I'm glad you reached out! I am literally listening to your episode of Between the Brackets right now and was discussing your Self Service Portal with @MarkAHershberger about an hour ago :-)

In answer to your question, you probably want to create your own special page. You could look at Special:PluggableAuthLogin as a model. It is an UnlistedSpecialPage and is never displayed but could serve as a place to put the logic to handle the auth key. I'm happy to discuss this further once you've had a chance to look at that code.

Ooh, you just mentioned the MediaWiki Stakeholders' Group in the podcast :-) Mark and I are on the Board of the group, and we would love for you to get involved! Cindy.cicalese (talk) 19:35, 22 March 2021 (UTC)

Thanks so much Cindy! Special:PluggableAuthLogin looks like exactly what I needed to see. Thanks for walking me through the extension! I'm really glad PluggableAuth exists now—I still remember the "dark ages" when there was only Ryan Lane's LDAP auth extension :) Jeffrey Wang 01:40, 23 March 2021 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Exception after upgrade to MW 1.36

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

My Installation

MW 1.36 / LDAPProvider 1.0.5 / PluggableAuth 5.7 / LDAPAuthentication2 1.0.2

Running OpenLDAP on a remote host Feb 14 2021 on Debian 9. OpenLDAP static backends :: config ldif

The LDAPserver is NOT running the memberof

My full shell access users are organized in the DN="cn=givenname last_name, ou=users,o=privat,c=de". objectClass=posixAccount, person, inetOrgPerson, organizationalPerson

My limited access users are organized in the DN="uid=WikiSysop,ou=users,o=privat,c=de". objectClass=simpleSecurityObject, account

When I login using the Safari (or Firefox) as WikiSysop the first time all works fine and the user is entered automatically to the database table user. Any other simpleSecurityObject works fine.

When ever I try to logon using a normal full access account the Wiki crashes with the following exception

MediaWiki internal error.

Original exception: [b810ba9918c25b111d1aad82] /index.php/Spezial:PluggableAuthLogin TypeError: Return value of User::getName() must be of the type string, array returned

Backtrace:

from /var/www/html/includes/user/User.php(2132)

#0 /var/www/html/includes/user/User.php(1637): User->getName()

#1 /var/www/html/includes/user/User.php(1958): User->getBlockedStatus(boolean, boolean)

#2 /var/www/html/includes/block/BlockManager.php(484): User->getBlock()

#3 /var/www/html/includes/MediaWiki.php(771): MediaWiki\Block\BlockManager->trackBlockWithCookie(User, WebResponse)

#4 /var/www/html/includes/MediaWiki.php(637): MediaWiki::preOutputCommit(RequestContext, Closure)

#5 /var/www/html/includes/MediaWiki.php(936): MediaWiki->doPreOutputCommit(Closure)

#6 /var/www/html/includes/MediaWiki.php(546): MediaWiki->main()

#7 /var/www/html/index.php(53): MediaWiki->run()

#8 /var/www/html/index.php(46): wfIndexMain()

#9 {main}

Exception caught inside exception handler: [b810ba9918c25b111d1aad82] /index.php/Spezial:PluggableAuthLogin TypeError: Return value of User::getName() must be of the type string, array returned

Backtrace:

from /var/www/html/includes/user/User.php(2132)

#0 /var/www/html/includes/user/User.php(3772): User->getName()

#1 /var/www/html/includes/skins/SkinTemplate.php(99): User->getUserPage()

#2 /var/www/html/includes/skins/SkinMustache.php(132): SkinTemplate->setupTemplateContext()

#3 /var/www/html/includes/skins/SkinTemplate.php(146): SkinMustache->generateHTML()

#4 /var/www/html/includes/OutputPage.php(2634): SkinTemplate->outputPage()

#5 /var/www/html/includes/exception/MWExceptionRenderer.php(147): OutputPage->output()

#6 /var/www/html/includes/exception/MWExceptionRenderer.php(66): MWExceptionRenderer::reportHTML(TypeError)

#7 /var/www/html/includes/exception/MWExceptionHandler.php(106): MWExceptionRenderer::output(TypeError, integer)

#8 /var/www/html/includes/exception/MWExceptionHandler.php(185): MWExceptionHandler::report(TypeError)

#9 /var/www/html/includes/MediaWiki.php(568): MWExceptionHandler::handleException(TypeError, string)

#10 /var/www/html/index.php(53): MediaWiki->run()

#11 /var/www/html/index.php(46): wfIndexMain()

#12 {main} 78.94.162.39 (talk) 19:52, 1 June 2021 (UTC)

Additional comment ::

The WikiSysop is of objectClass simpleSecurityObject

Zuul (talk) 06:11, 2 June 2021 (UTC)

What does your ldapprovider.json look like?

There is no need for passwords, but it would be good to know how it is configured because the string vs array errors you are getting seem strange.

I'm pinging @Osnard since he may be able to help here, too. ☠MarkAHershberger☢(talk)☣ 01:51, 3 June 2021 (UTC)

Hello Mark

Thank you for your reply. Here is the requested /etc/mediawiki/ldapprovider.json

{

    "fritz.box": {

        "connection": {

            "server": "dns01.fritz.box",

            "user": "cn=admin,ou=admins,o=privat,c=de",

            "pass": "XXXX-XXXX-XXXX",

            "options": {

                "LDAP_OPT_DEREF": 1

            },

            "basedn": "ou=users,o=privat,c=de",

            "groupbasedn": "ou=groups,o=privat,c=de",

            "userbasedn": "ou=users,o=privat,c=de",

            "searchattribute": "uid",

            "usernameattribute": "uid",

            "realnameattribute": "cn",

            "emailattribute": "mail"

        },

        "userinfo": {

            "attributes-map": {

                "email": "mail",

                "realname": "cn",

                "nickname": "uid",

                "language": "preferredlanguage"

            }

        }

    }

}

fritz.box is my private DNS domain

dns01 is not only the dns (bind9) server but also the OpenLDAP server

Thank - any help is appreciated Zuul (talk) 10:20, 3 June 2021 (UTC)

Additional information that my be help solving this issue

in LDAPProvider.log the following is logged

2021-06-03 15:37:46 wiki01 wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-06-03 15:37:46 wiki01 wiki: Setting LDAP_OPT_REFERRALS to 0

2021-06-03 15:37:46 wiki01 wiki: Setting LDAP_OPT_DEREF to 1

2021-06-03 15:37:46 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

  'base' => 'ou=users,o=privat,c=de',

  'filter' => '(uid=Harry)',

  'attributes' =>

  array (

    0 => '*',

    1 => 'memberof',

  ),

)

2021-06-03 15:37:46 wiki01 wiki: Found user DN: 'uid=Harry,ou=users,o=privat,c=de'

2021-06-03 15:37:46 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=Harry,ou=users,o=privat,c=de'

2021-06-03 15:37:46 wiki01 wiki: Ran LDAP search for '(uid=Harry)' in 0.010584831237793 seconds.

2021-06-03 15:39:20 wiki01 wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-06-03 15:39:20 wiki01 wiki: Setting LDAP_OPT_REFERRALS to 0

2021-06-03 15:39:20 wiki01 wiki: Setting LDAP_OPT_DEREF to 1

2021-06-03 15:39:20 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

  'base' => 'ou=users,o=privat,c=de',

  'filter' => '(uid=zuul)',

  'attributes' =>

  array (

    0 => '*',

    1 => 'memberof',

  ),

)

2021-06-03 15:39:20 wiki01 wiki: Found user DN: 'cn=Wolf-Agathon Schaly,ou=users,o=privat,c=de'

2021-06-03 15:39:20 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'cn=Wolf-Agathon Schaly,ou=users,o=privat,c=de'

2021-06-03 15:39:20 wiki01 wiki: Ran LDAP search for '(uid=zuul)' in 0.015131950378418 seconds.

2021-06-03 15:46:04 wiki01 wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-06-03 15:46:04 wiki01 wiki: Setting LDAP_OPT_REFERRALS to 0

2021-06-03 15:46:04 wiki01 wiki: Setting LDAP_OPT_DEREF to 1

2021-06-03 15:46:04 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getUserDN: search with array (

  'base' => 'ou=users,o=privat,c=de',

  'filter' => '(uid=Jupp)',

  'attributes' =>

  array (

    0 => '*',

    1 => 'memberof',

  ),

)

2021-06-03 15:46:04 wiki01 wiki: Found user DN: 'uid=Jupp,ou=users,o=privat,c=de'

2021-06-03 15:46:04 wiki01 wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=Jupp,ou=users,o=privat,c=de'

2021-06-03 15:46:04 wiki01 wiki: Ran LDAP search for '(uid=Jupp)' in 0.010910034179688 seconds.

where '(uid=Harry)' and '(uid=Jupp)' are both objectClass=simplesecurityObject

the '(cn=Wolf-Agathon Schaly,ou=user,o=privat,c=de)' equals the '(uid=zuul)' is the objectClass=posixAccount etc as described on top of this issue. Zuul (talk) 15:59, 3 June 2021 (UTC)

I'm a bit confused.

You say "When ever I try to logon using a normal full access account the Wiki crashes with the following exception", but from the log you post, it looks like the login is working correctly, at least for zuul and Jupp.

Maybe you're saying that logging in with WikiSysop is the user that produces the error?

If that is the case, what do the logs show when you log in with WikiSysop? ☠MarkAHershberger☢(talk)☣ 16:39, 3 June 2021 (UTC)

Oh I'm sorry for any confusion caused.

I mean the users dn='(uid=Jupp,ou=users,o=privat,c=de)' and cn='(uid=Harry,ou=users,o=privat,c=de)' are both simpleserurityObjects and they can logon. The first time they logon the user information is transferred in the database to user table.

The User dn='(CN=Wolf-Agathon Schaly,ou=users,o=privat,c=de)' what equals to '(uid=zuul)' is raising the exception. Zuul (talk) 17:42, 3 June 2021 (UTC)

The WikiSysop is of simpleSecurityObject and works fine Zuul (talk) 17:55, 3 June 2021 (UTC)

I really do not understand why you're getting an array error.

However, in looking at this, I think, maybe, that the lowercase initial "z" may be causing a problem. Do other names with an initial lower case letter work?

What if you add the line

"presearchusernamemodifiers": [ "lowercase" ]

after your emailattribute line, so that it looks like this:

            "emailattribute": "mail",
            "presearchusernamemodifiers": [ "lowercase" ]
        },
        "userinfo": {

☠MarkAHershberger☢(talk)☣ 18:24, 3 June 2021 (UTC)

Thank you for the news - What I've tried.

1st login :: harry -> fine

2nd login :: jupp -> fine

3rd login :: zuul -> exception

4th login :: Zuul -> exception

then changed the presearchusernamemodifiers and tried the same logins. All exactly the same so I changed the presearchusernamemodifiers back to original. Zuul (talk) 19:33, 3 June 2021 (UTC)

You've shared the logged results from the LDAP connections. Could you generate a debug log and see what it logs just before and just after the errors? ☠MarkAHershberger☢(talk)☣ 23:35, 3 June 2021 (UTC)

Hi Mark - can you provide an eMail address where I can send the debug file to. the total size of the logfile is approx 72k and it contains binary data. From my point it's easier to send out per eMail - if you don't mind.

There is no sensitive data in it because the users are all only testuser so as the database. Zuul (talk) 07:42, 4 June 2021 (UTC)

I have had the same Problem.

Enclosed my log:

mediawiki_1  | [error] [e12bf15a7d668cced556821c] /orga/index.php/Spezial:PluggableAuthLogin   ErrorException: Use of MediaWiki\Auth\AuthManager::singleton was deprecated in MediaWiki 1.35. [Called from MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::initDomainFromAuthenticationSessionData]
mediawiki_1  | #0 [internal function]: MWExceptionHandler::handleError(integer, string, string, string, array)
mediawiki_1  | #1 /var/www/html/includes/debug/MWDebug.php(376): trigger_error(string, integer)
mediawiki_1  | #2 /var/www/html/includes/debug/MWDebug.php(350): MWDebug::sendRawDeprecated(string, boolean, string)
mediawiki_1  | #3 /var/www/html/includes/debug/MWDebug.php(230): MWDebug::deprecatedMsg(string, string, string, integer)
mediawiki_1  | #4 /var/www/html/includes/GlobalFunctions.php(1036): MWDebug::deprecated(string, string, string, integer)
mediawiki_1  | #5 /var/www/html/includes/auth/AuthManager.php(187): wfDeprecated(string, string)
mediawiki_1  | #6 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(115): MediaWiki\Auth\AuthManager::singleton()
mediawiki_1  | #7 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(100): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->initDomainFromAuthenticationSessionData()
mediawiki_1  | #8 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(53): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->initDomain()
mediawiki_1  | #9 /var/www/html/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(69): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->__construct(User, boolean)
mediawiki_1  | #10 /var/www/html/includes/HookContainer/HookContainer.php(338): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::callback(User, boolean)
mediawiki_1  | #11 /var/www/html/includes/HookContainer/HookContainer.php(137): MediaWiki\HookContainer\HookContainer->callLegacyHook(string, array, array, array)
mediawiki_1  | #12 /var/www/html/includes/Hooks.php(137): MediaWiki\HookContainer\HookContainer->run(string, array, array)
mediawiki_1  | #13 /var/www/html/extensions/PluggableAuth/includes/PluggableAuthLogin.php(54): Hooks::run(string, array)
mediawiki_1  | #14 /var/www/html/includes/specialpage/SpecialPage.php(646): PluggableAuthLogin->execute(NULL)
mediawiki_1  | #15 /var/www/html/includes/specialpage/SpecialPageFactory.php(1386): SpecialPage->run(NULL)
mediawiki_1  | #16 /var/www/html/includes/MediaWiki.php(309): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)
mediawiki_1  | #17 /var/www/html/includes/MediaWiki.php(913): MediaWiki->performRequest()
mediawiki_1  | #18 /var/www/html/includes/MediaWiki.php(546): MediaWiki->main()
mediawiki_1  | #19 /var/www/html/index.php(53): MediaWiki->run()
mediawiki_1  | #20 /var/www/html/index.php(46): wfIndexMain()
mediawiki_1  | #21 {main}

In the file extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php* the test with method_exists does not work correctly:

        protected function initDomainFromAuthenticationSessionData() {
                if ( !class_exists( '\MediaWiki\Extension\LDAPAuthentication2\PluggableAuth' ) ) {
                        return false;
        }
                if ( method_exists( MediaWikiServices::class, 'getAuthManager' ) ) {
                // MediaWiki 1.35+
                        $authManager = MediaWikiServices::getInstance()->getAuthManager();
                } else {
                        $authManager = AuthManager::singleton();
                }

The following change fixes the Problem:

                if ( method_exists( \MediaWiki\MediaWikiServices::class, 'getAuthManager' ) ) {
                // MediaWiki 1.35+
                        $authManager = \MediaWiki\MediaWikiServices::getInstance()->getAuthManager();
                } else {
                        $authManager = AuthManager::singleton();
                }

Sluven (talk) 11:50, 4 June 2021 (UTC)

Thank you Sluven for the code snippet but unfortunately it is in my case not the solution it still crashes with the exception.

I changed line 261 in the file extensions\LDAPAuthentication2\src\PluggableAuth.php as described above. Zuul (talk) 12:27, 4 June 2021 (UTC)

Oh, sorry I forgot to confirm that I made both of the recommended changes in line 256 and 261

made a failback to the original version because the exception remains the same. Zuul (talk) 12:40, 4 June 2021 (UTC)

Another idea is to change the grouprequest-factory. I saw that you used memberof but the default factory is GroupUniqueMember::factory. Please try to change the attribute grouprequest with the following value:

                    "realnameattribute" => "cn",
                    "emailattribute" => "mail",
                    "grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
                    "presearchusernamemodifiers" => ["lowercase"]

For more information see Extension:LDAPProvider Sluven (talk) 18:05, 4 June 2021 (UTC)

Nope

My incident opener was my configuration

---

My Installation

MW 1.36 / LDAPProvider 1.0.5 / PluggableAuth 5.7 / LDAPAuthentication2 1.0.2

Running OpenLDAP on a remote host Feb 14 2021 on Debian 9. OpenLDAP static backends :: config ldif

The LDAPserver is NOT running the memberof

--- Zuul (talk) 18:33, 4 June 2021 (UTC)

Good morning fellows

What I'm trying to do today is to enable and configure the LDAP add-on memberOf. Zuul (talk) 07:12, 5 June 2021 (UTC)

Good morning fellows

In my OpenLDAP server I yesterday implemented the Overlay='memberOf'. I suspected that the absence of memberOf could have effect on the behavior of the wiki extension.

To bad memberOf does not have an effect - in this case.

have send the log files to Marks eMail address. I'm sorry on mistake I've send it three times 78.94.162.39 (talk) 08:43, 6 June 2021 (UTC)

Yeeeeeeeha

I've found the issue !!!

The exception message " ... must be of the type string, array returned ... " was totally correct.

What was causing the issue

It was a misconfiguration in my LDAP server.

The user 'uid=Zuul' == dn='cn=Wolf-Agathon Schaly,ou=users,o=privat,c=de' had a 2nd uid entry. '(uid=zuul)' and '(uid=waschaly)' From LDAP point of view it is fully legal - but having 2uid s would be a kind of weird.

Took off the uid=waschaly - tataaaaa all fine!!!

Thank you Mark very much for the support and the help provided. Zuul (talk) 19:20, 6 June 2021 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Composer broken due to typo

composer failed with this error: "Failed to execute git clone" all my other Extensions have no problem with composer. i already mailed Cindy Cicalese but got no response.....maybe its the wrong to speak to? "Hello Cindy Cicalese, i think i found an typo in <nowiki>"packagist.org/packages/mediawiki/pluggable-auth"

this link says:  "Not Found"

gerrit.wikimedia.org/r/mediawiki/extensions/PluggableAuth

this looks legit

gerrit.wikimedia.org/g/mediawiki/extensions/PluggableAuth 88.130.111.24 (talk) 11:57, 3 June 2021 (UTC)

I forwarded your message on to @MarkAHershberger who maintains the packagist information. Cindy.cicalese (talk) 13:04, 3 June 2021 (UTC)

thank you :) btw: i found your mail at the bottom of the packagist site > packagist.org/packages/mediawiki/pluggable-auth

so this needs to be updated as well. 87.123.145.152 (talk) 09:55, 4 June 2021 (UTC)

Note that the URL that returns "Not found" is not a browse-able URL. It is the URL gerrit provides for an anonymous clone. ☠MarkAHershberger☢(talk)☣ 20:23, 4 June 2021 (UTC)

but it just does not work. As you can see in my consoleoutput...composer is asking for authentication.....pls try for yourself:

$ sudo composer require mediawiki/pluggable-auth
Using version ^5.7 for mediawiki/pluggable-auth
./composer.json has been updated
Running composer update mediawiki/pluggable-auth
> ComposerHookHandler::onPreUpdate
Loading composer repositories with package information
Updating dependencies
Lock file operations: 1 install, 0 updates, 0 removals
  - Locking mediawiki/pluggable-auth (5.7)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 1 install, 0 updates, 0 removals
  - Syncing mediawiki/pluggable-auth (5.7) into cache
    Authentication required (gerrit.wikimedia.org):
      Username:

87.122.109.87 (talk) 10:24, 7 June 2021 (UTC)

Allow local account or anonymous login while I have wgPluggableAuth_EnableAutoLogin = true

OS Windows 2019

MediaWiki 1.35.2

PHP 7.4.15 (apache2handler)

MySQL 8.0.23

I have PluggableAuth working with SimpleSAMLphp

wfLoadExtension( 'PluggableAuth' );
   $wgPluggableAuth_EnableAutoLogin = true;
   $wgPluggableAuth_EnableLocalLogin = false;
   $wgPluggableAuth_ButtonLabel = "Login SSO";
wfLoadExtension( 'SimpleSAMLphp' );
   $wgSimpleSAMLphp_InstallDir="/simplesamlphp";
   $wgSimpleSAMLphp_AuthSourceId= "default-sp";
   $wgSimpleSAMLphp_RealNameAttribute='realname';
   $wgSimpleSAMLphp_EmailAttribute='mail';
   $wgSimpleSAMLphp_UsernameAttribute='username';

What I need is to automate the import of pages from csv file on a daily bases. Is this possible? Legaulph (talk) 11:35, 4 June 2021 (UTC)

You should be able to do this with a bot password. See Manual:Bot passwords. Cindy.cicalese (talk) 14:09, 4 June 2021 (UTC)

Thanks! Legaulph (talk) 13:11, 7 June 2021 (UTC)

Internal Error: Fatal exception of type "Error

I recently built a mediawiki server and we want to integrate SSO using the LDAP stack,

I have the following plugs enabled:

LDAPProvider

LDAPAuthentication2

PluggableAuth

I am pointing it to a json located in /etc/mediawiki/'filename' in the LocalSettings.php

Whenever I try to login in via mediawiki I get an error "Internal Error:  Fatal exception of type "Error" without a description of what the issue is, I validated that I can query LDAP by running: php ShowUserInfo.php --domain "domain" --username "username/uid"

Has anyone else ran into this type of issue?

Mediawiki 1.36.1

PHP 7.3.20

MariaDB 10.3 Harvey.09050 (talk) 16:01, 24 September 2021 (UTC)

Pplease turn on debug logging as described at Manual:How to debug#Logging and include the relevant portions of the debug log. That should give you more information about where the error is occurring with a stack trace. Cindy.cicalese (talk) 20:31, 26 September 2021 (UTC)

Turned on logging and I am getting a pluggableauth error, see below the error:

Error log when attempting a login using my uid:#######@domain.com and password.

2021-10-11 15:26:39 'server' my_wiki: In execute()

2021-10-11 15:26:39 'server' my_wiki: Getting PluggableAuth singleton

2021-10-11 15:26:39 'server' my_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

2021-10-11 15:26:39 'server' my_wiki: Authentication failure.

2021-10-11 15:26:39 'server' my_wiki: ERROR: Could not authenticate credentials against domain "domain.com"

Credentials work based on the test below with a php that tests an account bind to the directory services:

]# php test-ldap.php

LDAP bind successful to ldap://domain.com as uid=service account,ou=placeholder,o=domain.com,c=US

Current LDAP.json

LDAP.json file

{

"domain.com": {              

"connection": {

"server": "ldap.server.domain.com",  

"user": "uid=service account,ou=placeholder,o=domain.com,c=US",

"pass": "**********",

"options": {

"LDAP_OPT_DEREF": 1

},

"basedn": "ou=employee,ou=person,o=domain.com,c=us",

"groupbasedn": "ou=groups,o=domain.com,c=us",

"userbasedn": "ou=employee,ou=person,o=domain.com,c=us",

"searchattribute": "uid",

"searchstring": "uid",

"usernameattribute": "uid",

"realnameattribute": "cn",

"emailattribute": "mail"

        }

    }

} Harvey.09050 (talk) 13:31, 12 October 2021 (UTC)

In addition to this, does this extension provide support for LDAP/Open LDAP, we do not use Microsoft Active Directory so that is not an option.

Thanks! Harvey.09050 (talk) 16:04, 29 October 2021 (UTC)

@Osnard, do you have insight into this? Cindy.cicalese (talk) 16:44, 29 October 2021 (UTC)

Can you please share the log from running php ShowUserInfo.php --domain "domain" --username "username/uid"

The provided

2021-10-11 15:26:39 'server' my_wiki: Class name: MediaWiki\Extension\LDAPAuthentication2\PluggableAuth

2021-10-11 15:26:39 'server' my_wiki: Authentication failure.

can not be emitted by ShowUserInfo.php. Please make sure to enable all required logs. Osnard (talk) 09:22, 8 November 2021 (UTC)

I can only show part of the log due to the info contained about my company and what not it would be a lot to filter through so I left it out , however here is the top of the log:

my_wiki: ldap_connect( $uri = 'ldap://domain.com:389' );

my_wiki: # __METHOD__ returns a link id

2021-11-11 19:06:43 my_wiki: Setting LDAP_OPT_PROTOCOL_VERSION to 3

2021-11-11 19:06:43 my_wiki: ldap_set_option( $linkID, $option = 17, $newval = 3 );

2021-11-11 19:06:43 my_wiki: # returns true

2021-11-11 19:06:43 my_wiki: Setting LDAP_OPT_REFERRALS to 0

2021-11-11 19:06:43 my_wiki: ldap_set_option( $linkID, $option = 8, $newval = 0 );

2021-11-11 19:06:43 my_wiki: # returns true

2021-11-11 19:06:43 my_wiki: Setting LDAP_OPT_DEREF to 1

2021-11-11 19:06:43 my_wiki: ldap_set_option( $linkID, $option = 2, $newval = 1 );

2021-11-11 19:06:43 e my_wiki: # returns true

2021-11-11 19:06:43 my_wiki: ldap_bind( $linkID, $bindRDN = 'uid=bindacct,ou=container,o=domain.com,c=US', $bindPassword = 'XXXX' );

2021-11-11 19:06:43 my_wiki: # returns true

2021-11-11 19:06:43 my_wiki: ldap_search( $linkID, $baseDN = 'ou=employee,ou=person,o=domain.com,c=us', $filter = '(samaccountname=########)', $at

tributes = [ '*', 'memberof' ], $attrsonly = , $sizelimit = , $timelimit = , $deref =  );

2021-11-11 19:06:43 my_wiki: # returns a resource

2021-11-11 19:06:43 my_wiki: ldap_get_entries( $linkID, $resultID );

2021-11-11 19:06:43 my_wiki: # returns: array (

In the array there is lots of information about my user, OU, company etc but I left it out... And then the end of the log is:

'dn' => 'uid=#######,ou=employee,ou=person,o=domain.com,c=US',

  ),

)

2021-11-11 19:06:43 my_wiki: Ran LDAP search for '(samaccountname=########)' in 0.1800000667572 seconds.

So I'm led to believe that this is in fact working, at least for finding my user. Harvey.09050 (talk) 19:20, 11 November 2021 (UTC)

So ShowUserInfo.php does provide proper outout? Or does it fail with an error message?

Could you please also try the CLI script CheckLogin.php from the same directory? Osnard (talk) 09:17, 12 November 2021 (UTC)

The ShowUserInfo.php does show the proper output, however the CheckLogin.php does fail with this, I have verified that the credentials are being input properly:

ldap_bind( $linkID, $bindRDN = 'uid=app account,ou=apps,o=domain.com,c=US', $bindPassword = 'XXXX' );

2021-11-15 15:40:10 my_wiki: # returns true

2021-11-15 15:40:10 my_wiki: MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: '#######@domain.com'

2021-11-15 15:40:10 my_wiki: ldap_bind( $linkID, $bindRDN = '########@domain.com', $bindPassword = 'XXXX' );

2021-11-15 15:40:10 my_wiki: # returns false Harvey.09050 (talk) 15:43, 15 November 2021 (UTC)

Well, #######@domain.com is not a proper DN Please remove the "searchstring" entry from your domain config if there is any. Osnard (talk) 07:00, 16 November 2021 (UTC)

Aah, that was it! So after removing that entry, I was able to pass the CheckLogin.php test. However I have tried logging into the mediawiki and I get the following error: [YZO-hxbP1u8LmZk9XFww9gAAAAE] /mediawiki/index.php/Special:PluggableAuthLogin MWException: No section 'authorization' found in configuration for domain 'domain.com'!

Backtrace:

from /var/www/mediawiki-1.36.1/extensions/LDAPProvider/src/DomainConfigFactory.php(66)

#0 /var/www/mediawiki-1.36.1/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(58): MediaWiki\Extension\LDAPProvider\DomainConfigFactory->factory(string, string)

#1 /var/www/mediawiki-1.36.1/extensions/LDAPAuthorization/src/Hook/PluggableAuthUserAuthorization.php(70): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization->__construct(User, boolean)

#2 /var/www/mediawiki-1.36.1/includes/HookContainer/HookContainer.php(338): MediaWiki\Extension\LDAPAuthorization\Hook\PluggableAuthUserAuthorization::callback(User, boolean)

#3 /var/www/mediawiki-1.36.1/includes/HookContainer/HookContainer.php(137): MediaWiki\HookContainer\HookContainer->callLegacyHook(string, array, array, array)

#4 /var/www/mediawiki-1.36.1/includes/Hooks.php(137): MediaWiki\HookContainer\HookContainer->run(string, array, array)

#5 /var/www/mediawiki-1.36.1/extensions/PluggableAuth/includes/PluggableAuthLogin.php(54): Hooks::run(string, array)

#6 /var/www/mediawiki-1.36.1/includes/specialpage/SpecialPage.php(646): PluggableAuthLogin->execute(NULL)

#7 /var/www/mediawiki-1.36.1/includes/specialpage/SpecialPageFactory.php(1386): SpecialPage->run(NULL)

#8 /var/www/mediawiki-1.36.1/includes/MediaWiki.php(309): MediaWiki\SpecialPage\SpecialPageFactory->executePath(Title, RequestContext)

#9 /var/www/mediawiki-1.36.1/includes/MediaWiki.php(913): MediaWiki->performRequest()

#10 /var/www/mediawiki-1.36.1/includes/MediaWiki.php(546): MediaWiki->main()

#11 /var/www/mediawiki-1.36.1/index.php(53): MediaWiki->run()

#12 /var/www/mediawiki-1.36.1/index.php(46): wfIndexMain()

#13 {main}

I also want to extend my thanks, as this is my first time building a web server and you guys have been extremely helpful and patient with me. Harvey.09050 (talk) 14:20, 16 November 2021 (UTC)

Disregard, taking out LDAPAuthorization fixed my issue.

Thanks!

-Steve Harvey.09050 (talk) 15:20, 16 November 2021 (UTC)

You are welcome! Good to hear you were successful! Osnard (talk) 15:26, 16 November 2021 (UTC)

I install pluggableauth and Openidconnecct is fail

Hi

I install pluggableauth and Openidconnecct on my Mediawiki 1.3.2 on k8s .but It not work. when I Login is show There seems to be a problem with your login session; this action has been canceled as a precaution against session hijacking. Please resubmit the form.

and Media.log I can't found about pluggableauth detail on my log .

please help to suggestion 171.101.105.42 (talk) 07:33, 6 October 2021 (UTC)

Error, plugin not loading, why?

Windows Server 2012R2

MediaWiki	1.35.1
PHP	7.4.14 (cgi-fcgi)
MySQL	5.7.13-log

LDAPAuthentication2 1.0.2 (58e281c) 07:04, 7 January 2021

LDAPAuthorization 1.1.0 (e037664) 19:38, 9 July 2020

LDAPProvider 1.0.5 (ca854c1) 07:54, 14 December 2020

LDAPUserInfo 1.0.0 (39cca83) 19:58, 9 July 2020

PluggableAuth 5.7 (2a465ae) 15:07, 10 July 2020

---

LocalSettings.php:

wfLoadExtension( 'LDAPProvider' );

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPAuthorization' );

$LDAPProviderDomainConfigProvider = function() {

$config = [

'server.ssv.ww.lcl' => [

'connection' => [

"server" => "server.ssv.ww.lcl",

"port" => "389",

"user" => "pre\\account",

"pass" => 'password',

"options" => [ "LDAP_OPT_DEREF" => 1 ],

"basedn" => "CN=containerNameHere,DC=ssv,DC=ww,DC=lcl",

"groupbasedn" => "CN=Groups,CN=containerNameHere,DC=ssv,DC=ww,DC=lcl",

"userbasedn" => "CN=Users,CN=containerNameHere,DC=ssv,DC=ww,DC=lcl",

"searchattribute" => "sAMAccountName",

"searchstring" => "pre\\USER-NAME",

"usernameattribute" => "sAMAccountName",

"realnameattribute" => "cn",

"emailattribute" => "mail",

"nestedgroups" => true,

"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"

# ],

# "groupsync" => [ # ],

# "userinfo" => [ ]

]

];

return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

---

PluggableAuth error log shows the following:

2021-11-05 21:46:00 SERVER01 media_wiki-mwiki: In execute()

2021-11-05 21:46:00 SERVER01 media_wiki-mwiki: Getting PluggableAuth singleton

2021-11-05 21:46:00 SERVER01 media_wiki-mwiki: Class name: unset

2021-11-05 21:46:00 SERVER01 media_wiki-mwiki: Could not get authentication plugin instance.

What is the problem please? I'm trying to get Active Directory to auto login users but the accounts are not getting created in the database automatically and I think it's because this extension is not getting loaded for some reason. Any ideas? 147.55.130.153 (talk) 22:04, 5 November 2021 (UTC)

So the problem appears to be code in auth_remoteuser extension file UserNameSessionInfo.php and I had to comment out this code:

[code]

#if ( !Hooks::run( static::HOOKNAME, [ &$filteredUserName ] ) ) {

# $metadata[ 'filteredUserName' ] = $filteredUserName;

# $this->logger->warning(

# "Can't login remote user '{remoteUserName}' automatically. " .

# "Blocked this user when applying filter to '{filteredUserName}'.",

# $metadata

# );

# continue;

#}

[/code]

Not sure what it even tries to do, but it would never work properly and nobody could get authenticated via active directory and automatically logged in. When I commented this section out, everything works as expected! I manually stripped the domain from the front of the username info and allowed it to get properly stuffed into the filtered name array. Would be great if somebody would tell me what this HOOKNAME stuff is trying to do... 147.55.130.154 (talk) 19:14, 8 November 2021 (UTC)

Error: Call to undefined method MediaWiki\Auth\AuthManager::singleton()

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I have updated from Mediawiki 1.35.2 to 1.37.0.

When I try to login to 1.37 via LDAP I get the following error message:

[YbmxPJ2CJALkWZUzjrtq7QAAAAY] /mediawikiSWE/index.php/Spezial:PluggableAuthLogin Error: Call to undefined method MediaWiki\Auth\AuthManager::singleton()

Backtrace:

from /var/www/html/mediawikiSWE-1.37.0/extensions/PluggableAuth/includes/PluggableAuthLogin.php(25)

#0 /var/www/html/mediawikiSWE-1.37.0/includes/specialpage/SpecialPage.php(647): PluggableAuthLogin->execute(NULL)

#1 /var/www/html/mediawikiSWE-1.37.0/includes/specialpage/SpecialPageFactory.php(1366): SpecialPage->run(NULL)

#2 /var/www/html/mediawikiSWE-1.37.0/includes/MediaWiki.php(314): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, RequestContext)

#3 /var/www/html/mediawikiSWE-1.37.0/includes/MediaWiki.php(925): MediaWiki->performRequest()

#4 /var/www/html/mediawikiSWE-1.37.0/includes/MediaWiki.php(559): MediaWiki->main()

#5 /var/www/html/mediawikiSWE-1.37.0/index.php(53): MediaWiki->run()

#6 /var/www/html/mediawikiSWE-1.37.0/index.php(46): wfIndexMain()

#7 {main}

What can I do to log in with LDAP in version 1.37.0? Managedata (talk) 09:17, 15 December 2021 (UTC)

Thank you for reporting this error. I will work on a patch for this. Please feel free to create a bug report in Phabricator, tagging the MediaWiki-extensions-Pluggable-Auth project. Cindy.cicalese (talk) 16:34, 15 December 2021 (UTC)

Actually, this is already fixed on the REL1_35 and later branches. I see that a new version of the extension has not been tagged in a very long time (currently version 5.7), so I will work on a new 6.0 release. But, in the meantime, as long as you are on a more recent branch than what you currently have installed, you should be OK. Cindy.cicalese (talk) 22:06, 21 December 2021 (UTC)

Thanks for the info.

I have downloaded PluggableAuth: REL1_37 and copied it to my version of Mediawiki 1.37.1 but I still get the same error.

The Mediawiki version is definitely 1.37.1, but the plugin still uses the else-branch (singelton) which is deprecated.

Do I have to replace some other plugins or change setting values so that version 1.37.1 can be identified?

if ( method_exists( MediaWikiServices::class, 'getAuthManager' $

                       // MediaWiki 1.35+

                       $authManager = MediaWikiServices::getInstance()->getAut$

               } else {

                       $authManager = AuthManager::singleton();

               } Managedata (talk) 09:41, 4 January 2022 (UTC)

That should be sufficient. Please go to your Special:Version page and report the git hash of your MediaWiki and PluggableAuth versions here just to be absolutely sure which versions of the code is being executed. Thank you. Cindy.cicalese (talk) 22:46, 4 January 2022 (UTC)

Sorry, my mistake. After updating all other LDAP related plugins it works like a charm.

Thanks for your support. Managedata (talk) 09:54, 6 January 2022 (UTC)

Great! Cindy.cicalese (talk) 13:10, 6 January 2022 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

"Invalid response from server" error after logout

PluggableAuth + SimpleSAMLphp extensions are working fine, the session is correctly deauthenticated after logout, but the "Invalid response from server" error is annoying. I suppose this occur due to the title which it contains an underscore and which in returnto is replaced with space:

"GET /transmed-en/index.php?title=Special:UserLogin&returnto=Transmediterranean+History HTTP/1.1" 302 601 "https://wiki.uni-konstanz.de/transmed-en/index.php/Transmediterranean_History"

"GET /transmed-en/index.php?title=Special:UserLogin&returnto=Transmediterranean+History HTTP/1.1" 302 830 "-"

Is there any solution for this? Thanks in advance S0ring (talk) 14:10, 29 December 2021 (UTC)

I'd like to solve this, too. Currently using MediaWiki 1.35, latest SimpleSAMLphp version. Rp (talk) 08:11, 27 March 2022 (UTC)

My mistake, returnto returns the page title, not an URL. The error still occurs, don't know why, but not due to returnto. S0ring (talk) 15:06, 9 February 2022 (UTC)