Topic on Project:Support desk

Last week our Mediawiki was upgraded from 1.18 to 1.33. One user is receiving "Fatal error authenticating user". Our wiki is configured with local logon disabled and authentication with LDAP. I had Skype session with this user and he was able to login using my browser, but cannot on his desktop trying Firefox, Chrome, etc.. The pluggableeauth.log returns "Authentication failure, ERROR: Please choose a valid domain, ERROR: return to URL is null or empty" and found this in debug.log "[DBQuery] SELECT  lc_value  FROM `l10n_cache`    WHERE lc_lang = 'en' AND lc_key = 'messages:pluggableauth-fatal-error'  LIMIT 1". Thanks in advance for any help!

Could you paste your ldap provider json file (without passwords, of course)?

Also, what are the debug log lines leading up to the DBQuery line you posted?

// LDAPProvider

$LDAPProviderDomainConfigProvider = function() {

        $config = [

                'EDC' => [

                        'connection' => [

                                "server" => "edc.ds1.usda.gov",

                                "user" => "cn=s_wikiuser,ou=service,ou=accounts,ou=nitc,dc=edc,dc=ds1,dc=usda,dc=gov",

                                "pass" => '########',

                                "options" => [

                                        "LDAP_OPT_DEREF" => 1

                                ],

                                "basedn" => "OU=Privileged,OU=Accounts,OU=NITC,DC=EDC,DC=DS1,DC=USDA,DC=GOV",

                                "userbasedn" => "OU=Privileged,OU=Accounts,OU=NITC,DC=EDC,DC=DS1,DC=USDA,DC=GOV",

                                "searchattribute" => "samaccountname",

                                "usernameattribute" => "samaccountname",

                                "realnameattribute" => "cn",

                                "emailattribute" => "mail"

                        ]

                ]

        ];

        return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );

};

[DBQuery] DELETE FROM `objectcache` WHERE keyname = 'wiki_db:messages:en:lock'

[MessageCache] MessageCache::load: Loading en... local cache is empty, global cache is expired/volatile, loading from database

[DBQuery] SELECT  lc_value  FROM `l10n_cache`    WHERE lc_lang = 'en' AND lc_key = 'messages:ldapauthentication2-no-domain-chosen'  LIMIT 1

[session] SessionBackend "5ghgav4ehrd13lmk794bkmulf1njv6g8" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "5ghgav4ehrd13lmk794bkmulf1njv6g8" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "5ghgav4ehrd13lmk794bkmulf1njv6g8" save: dataDirty=1 metaDirty=0 forcePersist=0

[DBQuery] SELECT  lc_value  FROM `l10n_cache`    WHERE lc_lang = 'en' AND lc_key = 'messages:pluggableauth-fatal-error'  LIMIT 1

What do you use for your session store (e.g. $wgSessionCacheType)? How about $wgMainCacheType?

That still isn't enough of the debug log. Could you paste the entire request that includes this bit?

Sorry, I'm fairly new to Mediawiki. Looks like $wgSessionCacheType = CACHE_DB; and $wgMainCacheType    = CACHE_NONE;

Is the below enough? There is more if you need it.

Thanks, that looks like the entire request, but it is apparently the GET request for when you first visit the login page. Could you get the log from your user's (it is only one, right?) POST request when the login fails?

Also, you should really be using Memcached for session handling. Then you would set both those variables to CACHE_MEMCACHE:

$wgMainCacheType = CACHE_MEMCACHED;
$wgMemCachedServers = [ "127.0.0.1:11211" ];
$wgSessionCacheType = CACHE_MEMCACHED;

Putting session handling into Memcached can resolve some session issues all by itself.

If you are using a Linux distribution like Redhat or Debian, it should be simple to install.

Okay, I will try your suggestion for session handling. It is only one user that I know of. Here is the post:

The debug log is still missing something. There should be references to "LDAP" in it but I don't see any. Are there any references to "LDAP" in your debug log file?

Also, could you post any configuration items related to to the LDAP* or PluggableAuth extensions from your LocalSettings.php?

Below is the only the only LDAP or PluggableAuth config items I can find, And below is the only reference to "LDAP" and it is a GET but not a POST. Should it be a POST with reference toLDAP? Thanks for your time!

// PluggableAuth
$wgPluggableAuth_EnableLocalLogin = false;
//LDAPAuthentication2
$LDAPAuthentication2UsernameNormalizer = 'strtolower';
$LDAPAuthentication2AllowLocalLogin = false;
$wgPluggableAuth_ButtonLabel = 'Log in with P account';

I think you should get Memcached set up and then let us know if things change.

I do see one reference to ldap in that trace: ldapauthentication2-no-domain-chosen

That would only show up when there was more than one domain in your ldapprovider or if you had local logins enabled.

I'm going to have to ask @Osnard if he sees anything here that he could point to.

Besides the issue with the localization cache, the ldapauthentication2-no-domain-chosen error indicates that the domain that was set in the hidden field domain on Special:UserLogin is either empty, or does not match what is configured in the "DomainConfig": https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/8b043184ede3a458a8500f8807c250a6629bfbb1/src/PluggableAuth.php#L70-L76

Could you please verify that on Special:UserLogin, there is a hidden field domain with the value EDC?