Topic on Extension talk:LDAP Authentication

MediaWiki 1.17.0
MySql 5.5.15
Web Server : IIS 7.5 -> PHP 5.3.8
OS : Windows Server 2008 R2 (Domain Controller)

Since it's the domain controller, and that LDP.exe works with SSL, I believe my configuration is correct. More so, taking into account that I've already configured a few services to connect via SSL to AD like Collabnet Subversion Edge, My own Windows Service, IIS, FTP.

I've been able to make it work in clear mode, on port 389... However, as soon as I switch back to 636, and mode to 'ssl', I get a "bad password" error.

Also, I've been unable to get the logging to work... No file appear where I've set the directory! Here is my current configuration that I'm trying to get to work:

require_once ('extensions/LdapAuthentication/LdapAuthentication.php');
$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array(
	'Jeremfg Active Directory'
);

$wgLDAPSearchStrings = array(
	'Jeremfg Active Directory' => 'USER-NAME@moon.jeremfg.com'
);

$wgLDAPServerNames = array(
	'Jeremfg Active Directory' => 'moon.jeremfg.com'
);

$wgLDAPEncryptionType = array(
	'Jeremfg Active Directory' => 'ssl'
);

$wgLDAPPort = array(
	'Jeremfg Active Directory'=>636
);

$wgLDAPBaseDNs = array(
	'Jeremfg Active Directory' => 'dc=moon,dc=jeremfg,dc=com'
);

$wgLDAPSearchAttributes = array(
	'Jeremfg Active Directory' => 'sAMAccountName'
);

$wgLDAPDisableAutoCreate = array(
	'Jeremfg Active Directory' => false
);

$wgLDAPDebug = 1;
$wgDebugLogGroups["ldap"] = "C:\inetpub\wwwroot\quadwiki\logs" ;
$wgLDAPUseLocal = false;
$wgMinimalPasswordLength = 1;

I don't have any other php application so far that uses LDAP, but I've enabled it, as with SSL (SSL is confirmed to work with PEAR mail smtp send)... In any case, you can see the current configuration: https://jeremfg.com/phpinfo.php

Any idea how to enable logging, or why I can't connect via ssl? Thanks!

Edit : I use my own self-signed certificate, generated with the Certification Service of Windows Server

I decided, for the time being, to give up with SSL... It shouldn't be too bad since the AD and PHP Server run on the same machine (aka localhost)

As for logging, I've been able to enable it... Giving IIS_USER write access wasn't enough.. I gave "Everyone" write access to the folder were logs are written. This shouldn't be a problem since only logs are stored there!

My new problem now is trying to establish group based authorization. I beleive the problem resides with PHP function "ldap_search(), ldap_list() and ldap_read()" which doesn't use the correct scope (Not subtree for ldap_search() for example) on my system... I had the same problem while configuring Mantis Bug Tracker...

For mantis, I rewrote part of the code, to circuvent this problem... I intend to do the same for LDAP_Authentication.php

Well, I'll take patches, if you write it in a backwards compatible way, and do it consistently throughout the plugin.

I began writing my patch, but didn't go very far... I ran in a few problems since Mantis doesn't do authentication exactly in the same way...

In the end, I just gave up, and put the Full DN to a single group, and added all the users to that group. Since it isn't a big group, it wasn't too bad. As long as no subtree search was required, I'm ok!

The problem lies with the ldap extension in PHP, and it's that component that should be fixed in the end...

Plus, my patch wouldn't have been really great, putting a much larger load on LDAP. What I did for mantis, is to configure an array of DNs in the config file, and try them all, one after the other, until I get a good result, or returned the last failure. Not a great patch, just a quick and dirty workaround, which is all I needed!