Topic on Extension talk:LDAP Authentication/Archive 4

Hello,
I managed to etablish the authentication of a LDAP user to mediawiki,
And now i'm looking for the way to create and modify users in LDAP via mediawiki
how do i configure the LocalSettings.php

LocalSettings.php

$wgLDAPWriterDN = array("LOCALLDAP"=>"cn=Eva,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");
$wgLDAPWriterPassword = array("LOCALLDAP"=>"pwd");
$wgLDAPWriteLocation = array("LOCALLDAP"=>"ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");
$wgLDAPAddLDAPUsers = array("LOCALLDAP"=>true);
$wgLDAPUpdateLDAP = array("LOCALLDAP"=>true);

Debug.log

2010-07-01 11:21:44  bd_mediawiki: Entering validDomain
2010-07-01 11:21:44  bd_mediawiki: User is using a valid domain.
2010-07-01 11:21:44  bd_mediawiki: Setting domain as: LOCALLDAP
2010-07-01 11:21:44  bd_mediawiki: Entering validDomain
2010-07-01 11:21:44  bd_mediawiki: User is using a valid domain.
2010-07-01 11:21:44  bd_mediawiki: Entering getCanonicalName
2010-07-01 11:21:44  bd_mediawiki: Username isn't empty.
2010-07-01 11:21:44  bd_mediawiki: Munged username: Toto
2010-07-01 11:21:44  bd_mediawiki: Entering addUser
2010-07-01 11:21:44  bd_mediawiki: Entering getPasswordHash
2010-07-01 11:21:44  bd_mediawiki: Entering Connect
2010-07-01 11:21:44  bd_mediawiki: Using TLS or not using encryption.
2010-07-01 11:21:44  bd_mediawiki: Using non-standard port: 389
2010-07-01 11:21:44  bd_mediawiki: Using servers:  ldap://localhost:389
2010-07-01 11:21:44  bd_mediawiki: Successfully connected
2010-07-01 11:21:44  bd_mediawiki: Entering getSearchString
2010-07-01 11:21:44  bd_mediawiki: Doing a straight bind
2010-07-01 11:21:44  bd_mediawiki: userdn is: cn=Toto,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com
2010-07-01 11:21:44  bd_mediawiki: Binding as the writerDN
2010-07-01 11:21:44  bd_mediawiki: Adding user
2010-07-01 11:21:44  bd_mediawiki: Failed to add user
2010-07-01 11:21:44  bd_mediawiki: Entering allowPasswordChange
2010-07-01 11:21:44  bd_mediawiki: Entering modifyUITemplate
2010-07-01 11:21:44  bd_mediawiki: Allowing the local domain, adding it to the list.

(i've tried to create a new User: toto)

I use mediawiki 1.15.4
OS : windows xp pro 2003
Apache server 2.2.11
MySql :5.1.36
PHP : 5.2.11
i work with a local configuration on wampserver2

thanks for your answers

This post was posted by Eva~mediawikiwiki, but signed as Eva.

So, it looks like the schema I'm using for this is hardcoded, and uses the following attributes and objectclasses:

uid: <username provided>
sn: <username provided>
mail: <email address provided>
cn: <real name provided>
userpassword: <password provided>
<$wgLDAPAuthAttribute["LOCALLDAP"]>: "true"
objectclass: inetorgperson

Note that the auth attribute only gets set if you set a value for it.

If you are using Active Directory, this schema doesn't exist, and the add will fail. This, of course, is unfortunate, as you'd be the first person to request this :). If you need it, I'll add in a new option to fix this for you.

I use OpenLDAP .This schema seems not to exist either for OpenLDAP, i don't find the objectclass inetorgperson.

do you mean that with your schema, my users must be objectclass inetorgperson, with an uid,sn,mail,cn, and userpassword?

Actually my users are objetclass person and they have only cn, sn, and userpassword,and hereafter, I plan to add other attributes

I really need to add a person works

I will be really pleased if you could fix this for me

thanks for your help

This post was posted by Eva~mediawikiwiki, but signed as Eva.

Hello,
I ve found inetOrgPerson and i managed to create a new user : when i create a new account in my wiki the new user is automatically add in LDAP.
But i've a new problem, when i try to authenticate with a user who is in LDAP but not in the wiki, the creation of a new account don't work any more (before it worked)

my LocalSettings.php

require_once( "extensions/ScriptManager/SM_Initialize.php" );
require_once( "$IP/extensions/LDAP/LdapAuthentication.php" ); 
$wgAuth = new LdapAuthenticationPlugin(); 
$wgLDAPDomainNames = array( "LOCALLDAP" ); 
$wgLDAPServerNames = array( "LOCALLDAP"=>"localhost" ); 
$wgLDAPUseLocal = true; 
$wgLDAPEncryptionType = array( "LOCALLDAP"=>"clear" ); 
$wgLDAPPort = array("LOCALLDAP"=>389);
$wgLDAPSearchStrings = array( "LOCALLDAP"=>"cn=USER-NAME,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");
$wgLDAPGroupNameAttribute = array("LOCALLDAP"=>"cn");
$wgLDAPUserBaseDNs = array("LOCALLDAP"=>"ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");   
$wgLDAPDisableAutoCreate = array("LOCALLDAP"=>false);
$wgMinimalPasswordLength = 1;
$wgLDAPDebug = 3;
$wgDebugLogFile = "C:\log.txt";
$wgLDAPBaseDNs = array("LOCALLDAP" => "dc=my-domain,dc=com" );
$wgDebugLogGroups["ldap"] = "/tmp/debug.log" ;
$wgLDAPGroupBaseDNs = array( "LOCALLDAP"=>"ou=Groupes,dc=my-domain,dc=com" );
$wgUseLDAP = true;
$wgLDAPWriterDN = array("LOCALLDAP"=>"cn=Eva,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");
$wgLDAPWriterPassword = array("LOCALLDAP"=>"a190504");
$wgLDAPWriteLocation = array("LOCALLDAP"=>"ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com");
$wgLDAPAddLDAPUsers = array("LOCALLDAP"=>true);
$wgLDAPUpdateLDAP = array("LOCALLDAP"=>true);
$wgLDAPPasswordHash = array("LOCALLDAP"=>"clear");
$wgLDAPPreferences = array("LOCALLDAP"=>array( "nickname"=>"cn"));
$wgLDAPRetrievePrefs = array( "LOCALLDAP" => true );

Debug.log

When i create a new account in the wiki (a user who doesn't exist in LDAP)

2010-07-08 06:36:19  bd_mediawiki: Entering validDomain
2010-07-08 06:36:19  bd_mediawiki: User is not using a valid domain.
2010-07-08 06:36:19  bd_mediawiki: Setting domain as: invaliddomain
2010-07-08 06:36:19  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:36:19  bd_mediawiki: Entering modifyUITemplate
2010-07-08 06:36:19  bd_mediawiki: Allowing the local domain, adding it to the list.
2010-07-08 06:36:21  bd_mediawiki: Entering validDomain
2010-07-08 06:36:21  bd_mediawiki: User is not using a valid domain.
2010-07-08 06:36:21  bd_mediawiki: Setting domain as: invaliddomain
2010-07-08 06:36:21  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:36:21  bd_mediawiki: Entering modifyUITemplate
2010-07-08 06:36:21  bd_mediawiki: Allowing the local domain, adding it to the list.
2010-07-08 06:36:35  bd_mediawiki: Entering validDomain
2010-07-08 06:36:35  bd_mediawiki: User is using a valid domain.
2010-07-08 06:36:35  bd_mediawiki: Setting domain as: LOCALLDAP
2010-07-08 06:36:35  bd_mediawiki: Entering validDomain
2010-07-08 06:36:35  bd_mediawiki: User is using a valid domain.
2010-07-08 06:36:35  bd_mediawiki: Entering getCanonicalName
2010-07-08 06:36:35  bd_mediawiki: Username isn't empty.
2010-07-08 06:36:35  bd_mediawiki: Munged username: New
2010-07-08 06:36:35  bd_mediawiki: Entering addUser
2010-07-08 06:36:35  bd_mediawiki: Entering getPasswordHash
2010-07-08 06:36:35  bd_mediawiki: Entering Connect
2010-07-08 06:36:35  bd_mediawiki: Using TLS or not using encryption.
2010-07-08 06:36:35  bd_mediawiki: Using non-standard port: 389
2010-07-08 06:36:35  bd_mediawiki: Using servers:  ldap://localhost:389
2010-07-08 06:36:35  bd_mediawiki: Successfully connected
2010-07-08 06:36:35  bd_mediawiki: Entering getSearchString
2010-07-08 06:36:35  bd_mediawiki: Doing a straight bind
2010-07-08 06:36:35  bd_mediawiki: userdn is: cn=New,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com
2010-07-08 06:36:35  bd_mediawiki: Binding as the writerDN
2010-07-08 06:36:35  bd_mediawiki: Adding user
2010-07-08 06:36:35  bd_mediawiki: Successfully added user
2010-07-08 06:36:35  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:36:35  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:36:35  bd_mediawiki: Entering setPassword
2010-07-08 06:36:35  bd_mediawiki: Entering getPasswordHash
2010-07-08 06:36:35  bd_mediawiki: Entering Connect
2010-07-08 06:36:35  bd_mediawiki: Using TLS or not using encryption.
2010-07-08 06:36:35  bd_mediawiki: Using non-standard port: 389
2010-07-08 06:36:35  bd_mediawiki: Using servers:  ldap://localhost:389
2010-07-08 06:36:35  bd_mediawiki: Connected successfully
2010-07-08 06:36:35  bd_mediawiki: Entering getSearchString
2010-07-08 06:36:35  bd_mediawiki: Doing a straight bind
2010-07-08 06:36:35  bd_mediawiki: userdn is: cn=New,ou=Utilisateurs,ou=Personnes,dc=my-domain,dc=com
2010-07-08 06:36:35  bd_mediawiki: Binding as the writerDN
2010-07-08 06:36:35  bd_mediawiki: Successfully modified the user's password
2010-07-08 06:36:35  bd_mediawiki: Entering initUser
2010-07-08 06:36:35  bd_mediawiki: Entering updateUser
2010-07-08 06:36:35  bd_mediawiki: Setting user preferences.
2010-07-08 06:36:35  bd_mediawiki: Saving user settings.

when i try to log with a AD user who has no account in the wiki

2010-07-08 06:37:44  bd_mediawiki: Entering validDomain
2010-07-08 06:37:44  bd_mediawiki: User is not using a valid domain.
2010-07-08 06:37:44  bd_mediawiki: Setting domain as: invaliddomain
2010-07-08 06:37:44  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:37:44  bd_mediawiki: Entering modifyUITemplate
2010-07-08 06:37:44  bd_mediawiki: Allowing the local domain, adding it to the list.
2010-07-08 06:37:53  bd_mediawiki: Entering validDomain
2010-07-08 06:37:53  bd_mediawiki: User is using a valid domain.
2010-07-08 06:37:53  bd_mediawiki: Setting domain as: LOCALLDAP
2010-07-08 06:37:53  bd_mediawiki: Entering getCanonicalName
2010-07-08 06:37:53  bd_mediawiki: Username isn't empty.
2010-07-08 06:37:53  bd_mediawiki: Munged username: User2
2010-07-08 06:37:53  bd_mediawiki: Entering userExists
2010-07-08 06:37:53  bd_mediawiki: Entering Connect
2010-07-08 06:37:53  bd_mediawiki: Using TLS or not using encryption.
2010-07-08 06:37:53  bd_mediawiki: Using non-standard port: 389
2010-07-08 06:37:53  bd_mediawiki: Using servers:  ldap://localhost:389
2010-07-08 06:37:53  bd_mediawiki: Failed to connect
2010-07-08 06:37:53  bd_mediawiki: Entering allowPasswordChange
2010-07-08 06:37:53  bd_mediawiki: Entering modifyUITemplate
2010-07-08 06:37:53  bd_mediawiki: Allowing the local domain, adding it to the list.

I don't know why the connection can't perform

thanks for your help

This post was posted by Eva~mediawikiwiki, but signed as Eva.

The following options shouldn't be set:

$wgLDAPUseLocal = true;
$wgLDAPPort = array("LOCALLDAP"=>389);
$wgLDAPDisableAutoCreate = array("LOCALLDAP"=>false);
$wgUseLDAP = true;

You really should never use "wgLDAPUseLocal". This setting has a very specific use case, which is migrating from a local store to an LDAP one, and usually causes more problems than it solves when used in other cases.

The other options are either defaults or non-existant options.

And when I say shouldn't be set, I mean you should remove them, not change their value.

I've removed these options but i've the same problem, if the AD user hasn't an account in the wiki he can't authenticate on the wiki

2010-07-09 07:23:19  bd_mediawiki: Entering validDomain
2010-07-09 07:23:19  bd_mediawiki: User is not using a valid domain.
2010-07-09 07:23:19  bd_mediawiki: Setting domain as: invaliddomain
2010-07-09 07:23:19  bd_mediawiki: Entering allowPasswordChange
2010-07-09 07:23:19  bd_mediawiki: Entering modifyUITemplate
2010-07-09 07:23:29  bd_mediawiki: Entering validDomain
2010-07-09 07:23:29  bd_mediawiki: User is using a valid domain.
2010-07-09 07:23:29  bd_mediawiki: Setting domain as: LOCALLDAP
2010-07-09 07:23:29  bd_mediawiki: Entering getCanonicalName
2010-07-09 07:23:29  bd_mediawiki: Username isn't empty.
2010-07-09 07:23:29  bd_mediawiki: Munged username: User2
2010-07-09 07:23:29  bd_mediawiki: Entering userExists
2010-07-09 07:23:29  bd_mediawiki: Entering Connect
2010-07-09 07:23:29  bd_mediawiki: Using TLS or not using encryption.
2010-07-09 07:23:29  bd_mediawiki: Using servers:  ldap://localhost
2010-07-09 07:23:29  bd_mediawiki: Failed to connect
2010-07-09 07:23:29  bd_mediawiki: Entering allowPasswordChange
2010-07-09 07:23:29  bd_mediawiki: Entering modifyUITemplate

This post was posted by Eva~mediawikiwiki, but signed as Eva.

Interesting. Let me take a look at the code. It is possible I broke something with the security fix I did recently.

ok thanks, i work on a local installation, with wampserver on windows and the version of the LDAP Authentication plugin is 1.2c if it can help you

i look forward to hearing from you

This post was posted by Eva~mediawikiwiki, but signed as Eva.