LDAP hub

From MediaWiki.org
Jump to navigation Jump to search
MediaWiki Stakeholders' Group Logo.svg

This page has been created as a result of Future of "Extension:LDAP Authentication" sessions held on Wikimedia Hackathon 2017/ (T165270) and SMWCon. It will contain resources about different topics concerning MediaWiki and LDAP.

LDAPProviderLDAPGroupsLDAPUserInfoPluggableAuthLDAPAuthenticationLDAPAuthorizationMWStake LDAP Stack.png

Basic overview[edit]

The stack provides a multi-step process:

# Description Track: Implicit login Track: Explicit login
1 Request for Login Extension:Auth_remoteuser via SessionProvider

e.g. $_SERVER['REMOTE_USER'] = 'someoser@domain.local'

Username and domain are being extracted from "REMOTE_USER"

Extension:LDAPAuthentication together with Extension:PluggableAuth via HTML form on "Special:UserLogin"

Input fields for username, password and domain

2 Authorization ("group based restrictions") Extension:LDAPAuthorization together with Extension:Auth_remoteuser. After authentication a check for certain group membership is being performed. If it fails, login is being aborted. User is not created in database. If it succeeds, user is being created if necessary and domain is being added to database.

HINT: This is not implemented yet! There is an outstanding change to "Auth_remoteuser" that is required. See T203752

Extension:LDAPAuthorization together with Extension:PluggableAuth. After authentication a check for certain group membership is being performed. If it fails, login is being aborted. User is not created in database. If it succeeds, user is being created if necessary and domain is being added to database.
3 Group synchronization Extension:LDAPGroups via UserLoggedIn hook; username and domain (table ldap_domains from Extension:LDAPAuthentication) are being read from the database.
4 User info synchronization (e-mail, realname, ...) Extension:LDAPUserInfo via UserLoggedIn hook; username and domain (table ldap_domains from Extension:LDAPAuthentication) are being read from the database.

Working with Groups[edit]

Group based login restrictions[edit]

The LDAP-Stack can be configured to allow only certain user groups to actually log into the wiki. This means that if a group requirement is not met, a user can not even log into the wiki and no user account is being created in the wiki database. The functionality is implemented in Extension:LDAPAuthorization (new)

There are two configuration options:

Required groups (authorization.rules.groups.required)
Excluded groups (authorization.rules.groups.excluded)

Group synchronization[edit]

Local wiki user groups can automatically be synchronized with groups that are set in LDAP. Extension:LDAPGroups (new) takes care of this. By default there are two mechanisms available:

MappedGroups
All local user groups that should be synced must be configured explicitly within a mapping in the form of <localusergroup> --> <group-DN>. Groups that are not listed in this mapping will not be synced even if the user is a member on LDAP.
AllGroups
All user groups that a user is assigned to in LDAP will be synced to the local database. Instead of the full group DN only the CN part of the DN will be used. It is possible to exclude certain groups (e.g. the sysop from being synced)
Mapped groups[edit]

A mapping can be set up like this:

"groupsync": {
	"mapping": {
		"mathematicians": "ou=mathematicians,dc=example,dc=com",
		"scientists": "ou=scientists,dc=example,dc=com"
	}
All groups[edit]

If all groups should be synced, one must configure

"groupsync": {
	"mechanism": "MediaWiki\\Extension\\LDAPGroups\\SyncMechanism\\AllGroups::factory"

To prevent certain groups (e.g. "sysop") to be synced, use

"groupsync": {
	"locally-managed": [ "sysop" ]

Additional[edit]