Topic on Project:Support desk

I have been going around in circles with trying to get this to work. I had installed 1.29.1 then I read that active directory works better with 1.26.3. Extension:LDAP Authentication

So I removed 1.29.1 and downloaded and setup 1.26.3. So I go to setup the ldap options and I see that I have to use AuthPlugin so I go to this site AuthPlugin where it says it is deprecated and for backwards compatibility up to version 1.27 and to use Manual:SessionManager and AuthManager.

What is the recommended approach to use where I can have users login with their active directory credentials and I can add them to a group to just be able to edit?

Thank you

You're right that the situation is confusing right now.

The version for 1.29.x may work depending on your needs or not. Try it and then ask for help here if you run into problems.

If it fails and you need this immediately, go with 1.26.x and Extension:LDAP Authentication since that will most likely work.

Finally, we are working on a replacement for the LDAP authentication. You can follow our progress: LDAP hub.

Hi Mark,

Thank you for the reply. I'm trying to use 1.26.x since I have to have it completed by today.

I'm running this on

MediaWiki 1.26.3

IIS 8.5

php 7.0 (I think this needs to change since I'm using 1.26.3)

mySQL 5.5.57

Windows Server 2012 R2

Here is what I have in LocalSettings.php for connecting to Active Directory:

require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array( "TMP" );

$wgLDAPServerNames = array( "TMP" => "tmp01.ab.cde.fghi.edu" );

$wgLDAPSearchStrings = array( "TMP" => "TMP\\USER-NAME" );

$wgLDAPEncryptionType = array( "TMP" => "tls" );

$wgLDAPUseLocal = false;

$wgMinimalPasswordLength = 1;

$wgLDAPBaseDNs = array( "TMP" => "dc=tmp01,dc=ab,dc=cde,dc=fghi,dc=edu" );

$wgLDAPSearchAttributes = array( "TMP" => "sAMAccountName" );

$wgLDAPRetrievePrefs = array( "TMP" => "true" );

$wgLDAPPreferences = array('TMP' => array( 'email' => 'mail','realname' => 'displayname'));

$wgLDAPDebug = 3; //for debugging LDAP

$wgShowExceptionDetails = true; //for debugging MediaWiki

$wgDebugLogFile = "C:\inetpub\wwwroot\NewWiki\w\debug.log" ;

$wgDebugLogGroups["ldap"] = "C:\inetpub\wwwroot\NewWiki\w\debugldap.log" ;

$wgLDAPProxyAgent = array(

'TMP' => 'cn=TMP\userLDAP,dc=tmp01,dc=ab,dc=cde,dc=fghi,dc=edu',

);

$wgLDAPProxyAgentPassword = array(

'TMP' => 'tmpLDAPpassword',

);

I know that the ldap server has a certificate and it is not self signed but from a third party. Do I still need to use openssl and create a cert file? If so where do I put this file in a windows server 2012 computer? Should I use SSL?

All I want to do is have my users use their current login information to log into my MediaWiki setup and just allow them to edit. I need to give myself and another user top level control. Anyone else who uses the site will just be a user and just viewing the wiki.

Thank you again for your help. I look forward to hearing from you.l

I've used SSL without a client certificate. Unless you are told you need one, you shouldn't have to create one. Yes, you should use SSL.

Curious where you got the 1.26.3 version. I too have a need today to incorporate AD auth for our MediaWiki to allow users to view and edit on the platform. I am running MediaWiki 1.29.1 and tried with LdapAuthentication release 1.29 and 1.30. Lowest version I could find on the site was 1.27. You also mentioned AuthManager, is that needed too?

If you could, let me know what all extensions you are using to get the AD stuff to work. It would be greatly appreciated.

Here you go.

Ok, I thought you were using the 1.26 plugin version for the LdapAuthentication. In order to get that to work you need to downgrade the version of MediaWiki. Got it and thank you!!