Erweiterung:LDAPAuthorization

This extension is part of the LDAP Stack and requires the LDAPProvider extension to be installed first.

This extension requires the PluggableAuth extension to be installed first.

This extensions checks for certain authorization requirements when logging into a wiki by using Erweiterung:PluggableAuth or Erweiterung:Auth remoteuser . If one of the requirements are not satisfied the login process will be cancelled.

MediaWiki-Erweiterungen

LDAPAuthorization Freigabestatus: stabil
Autor(en)	Cindy Cicalese, Mark A. Hershberger, Robert Vogel
Letzte Version	1.0.0
Kompatibilitätspolitik	Snapshots werden zusammen mit MediaWiki veröffentlicht. Der Master ist nicht abwärtskompatibel.
MediaWiki	1.31+
Lizenz	GNU General Public License 2.0 oder später
Herunterladen	Erweiterung herunterladen Git [?]: Git master herunterladen Repository durchsuchen (Phabricator · GitHub) Ergänzungen und Änderungen Repository-Mitwirkende (GitHub) Code-Review
Parameter $wgAutoAuthUsernameNormalizer $wgAutoAuthRemoteUserStringParser $wgAutoAuthRemoteUserStringParserRegistry $wgAutoAuthBypassWithCookieUsernameRemoteAddrs
Verwendete Hooks AuthRemoteuserFilterUserName PluggableAuthUserAuthorization
Quarterly downloads	277 (Ranked 17th)
Übersetze die LDAPAuthorization-Erweiterung, wenn sie auf translatewiki.net verfügbar ist

Installation

• Install the LDAPProvider and PluggableAuth extensions.
• Die Erweiterung herunterladen und die Datei(en) in ein Verzeichnis namens LDAPAuthorization im Ordner extensions/ ablegen.
  Entwickler und Code-Beitragende sollten stattdessen die Erweiterung von Git installieren, mit:cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/LDAPAuthorization
• Folgenden Code am Ende deiner LocalSettings.php -Datei einfügen:

  wfLoadExtension( 'LDAPAuthorization' );
  

  Configure as required.
•  Erledigt – Navigiere zu Special:Version in deinem Wiki, um zu überprüfen, ob die Erweiterung erfolgreich installiert wurde.

Erweiterungskonfigurationseinstellungen

When using them in LocalSettings.php, these variables need to be prefixed with $LDAPAuthorization

Name	Standard	Beschreibung
AutoAuthRemoteUserStringParserRegistry	{ "domain-backslash-username": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\DomainBackslashUsername::factory", "username-at-domain": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\UsernameAtDomain::factory" }	A registry of factory callbacks for different parsers, that extract domain and username from a provided domain-username. Must return IRemoteUserStringParser object. Only used in case of auto-authentication provided by Erweiterung:Auth remoteuser .
AutoAuthRemoteUserStringParser	"domain-backslash-username"	Configures which parser is needed to extract domain and username from a provided domain-username. Erlaubte Werte sind: "domain-backslash-username" (Use this if $_SERVER['REMOTE_USER'] = "SOMEDOMAIN\\Some username") "username-at-domain" (Use this if $_SERVER['REMOTE_USER'] = "some.username@somedomain.local") Only used in case of auto-authentication provided by Auth remoteuser.
AutoAuthUsernameNormalizer	""	A callback that allows to modify the username when Erweiterung:Auth remoteuser is used for network based authentication. E.g. "strtolower". If form based authentication is also enabled though Erweiterung:LDAPAuthentication2 this should have the same value as $LDAPAuthentication2UsernameNormalizer. Only used in case of auto-authentication provided by Erweiterung:Auth remoteuser .

Domain config settings

Name	Standard	Beschreibung
rules.groups.required	[]	Array of group DNs that are required to complete the login process. Belonging to one group is sufficient (logical OR) to be authorized.
rules.groups.excluded	[]	Array of group DNs that the user may not be member of to complete the login process. Belonging to one group is sufficient (logical OR) to be forbidden to log in.
rules.attributes	{}	This implements the "attributes mapping" rule from Extension:LDAP Authentication Example: { "&" : { "status": "active", "|": { "department": [ "100", "200" ], "level": [ "5", "6" ] } } }
rules.query	""	Allows to provide a standard LDAP query to be tested against the user. Comparable to $wgLDAPAuthAttribute from Extension:LDAP Authentication Example: &(active=TRUE)(permissionAlias=cn=X,ou=Y,ou=accounts,dc=company,dc=local)

Example 1

If you want to configure this in LocalSettings.php you can extend the configuration for LDAPProvider like in this example:

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				...
			],
			'authorization' => [
				'rules' => [
					'groups' => [
						'required' => [ "groupname" ]
					]
				]
			]
		]
	];
...

Example 2

Here is a complete example LocalSettings.php configuration for Active Directory:

$LDAPProviderDomainConfigProvider = function()
{
	$config =
	[
		"example.com" =>
		[
			"connection" =>
			[
				"server" => "ldap.example.com",
				"user" => "cn=ldap,cn=Users,dc=example,dc=com",
				"pass" => "password",
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "samaccountname",
				"searchstring" => "USER-NAME@example.com",
				"usernameattribute" => "samaccountname",
				"realnameattribute" => "cn",
				"emailattribute" => "mail",
				"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
			],
			"authorization" =>
			[
				"rules" =>
				[
					"groups" =>
					[
						"required" => [ "cn=Developers,cn=Users,dc=example,dc=com" ]
					]
				]
			],
			"groupsync" =>
			[
				"mechanism" => "mappedgroups",
				"mapping" =>
				[
					"sysop" => "cn=Developers,cn=Users,dc=example,dc=com",
					"bureaucrat" => "cn=Developers,cn=Users,dc=example,dc=com"
				]
			],
			"userinfo" =>
			[
				"email" => "mail",
				"realname" => "cn",
				"properties.gender" => "gender"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versionierung

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
However, this table helps to determine which extension-releases to use across all recent versions.

MediaWiki Release	Recommended Extension Version	Test Status	Latest Test Date
1.35 (LTS)	LDAPxxx_master	Tested	März 2020