Extension:LDAPProvider

This page is a translated version of the page Extension:LDAPProvider and the translation is 91% complete.
Other languages:
English • ‎français • ‎日本語
MediaWiki Stakeholders' Group Logo.svg This extension is maintained by a member of the Groupe des acteurs de MediaWiki .

En tant que successeur de LDAP Authentication un stack of LDAP related extensions a été créé. They all need to interact with a remote LDAP resource. To ease and unify configuration and maintenance, this extension was created. It provides classes and configuration to query data from LDAP resources.

Manuel des extensions MediaWiki
OOjs UI icon advanced.svg
LDAPProvider
État de la version : stable
MWStake LDAPStack Icon.svg
Description Provides a common infrastructure to connect to a LDAP resource and run queries against it.
Auteur(s) Cindy Cicalese, Mark A. Hershberger, Robert Vogel
Dernière version 1.0.3
Politique de compatibilité branches de version
MediaWiki 1.31+
Modifie la base de données Oui
Licence Licence publique générale GNU v2.0 ou ultérieur
Téléchargement
  • $LDAPProviderCacheTime
  • $LDAPProviderCacheType
  • $LDAPProviderPreSearchUsernameModifierRegistry
  • $LDAPProviderDefaultDomain
  • $LDAPProviderDomainConfigs
  • $LDAPProviderDomainConfigProvider
  • $LDAPProviderClientRegistry
Traduisez l’extension LDAPProvider sur translatewiki.net
Vérifiez la matrice des utilisations et des versions.
Problèmes Tâches ouvertes · Signalez un bogue

Installation

  • Téléchargez et placez le(s) fichiers (s) dans un répertoire appelé LDAPProvider dans votre dossier extensions/.
  • Ajoutez le code suivant à la fin de votre fichier LocalSettings.php :
    wfLoadExtension( 'LDAPProvider' );
    
  • Run php maintenance/update.php to create the necessary database table(s).
  • Configure as required
  •   Fait – Accédez à Special:Version sur votre wiki pour vérifier que l'extension a bien été installée.

« Extension config » avec « Domain config »

This extensions features two kinds of configuration. On the one side there is the classic "extension configuration". It can be set up by using global variables within the LocalSettings.php. Be aware that those variables do not have a wg prefix. Those settings affect the extension as a whole.

On the other side there is a configuration that is specific to a remote LDAP resource, like connection settings, group membership query mechanism or base DNs. Multiple domains can be configured independently. These settings only affect the communication to the LDAP resource, based on the domain that this resource serves.

Paramètres de configuration des extensions

When using them in LocalSettings.php, these variables need to be prefixed with $LDAPProvider
Nom Valeur par défaut Description
CacheType "CACHE_ANYTHING" The sort of cache to use for the connection information.
CacheTime 500 How long cached items should stick around in seconds.
ClientRegistry [] Allows registration of custom clients. The key is the domain to be handled, the value is a callback that returns an objects which derives from Client.
DomainConfigs "/etc/mediawiki/ldapprovider.json" Stores per domain configuration. Only evaluated if $LDAPProviderDomainConfigProvider is set to use the default LocalJSONFile. See below.
DomainConfigProvider "\\MediaWiki\\Extension\\LDAPProvider\\DomainConfigProvider\\LocalJSONFile::newInstance" Specifies the mechanism for obtaining the domain configuration. Must be a callback that returns an IDomainConfigProvider.
DefaultDomain "" Specifies the domain to fall back in case no domain was found for a user. This is often the case when using Extension:Auth_remoteuser for network based authentication.
PreSearchUsernameModifierRegistry
[
	"removespaces": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\RemoveSpaces::newInstance",
	"spacetounderscore": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\SpacesToUnderscores::newInstance",
	"spacestounderscores": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\SpacesToUnderscores::newInstance",
	"strtolower": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\ToLower::newInstance",
	"lowercase": "\\MediaWiki\\Extension\\LDAPProvider\\PreSearchUsernameModifier\\ToLower::newInstance"
]
Specifies factory callbacks for objects of type MediaWiki\\Extension\\LDAPProvider\\IPreSearchUsernameModifier. The keys can be used in the domain configuration in the field connection.presearchusernamemodifiers. Example for a custom modifier:
$LDAPProviderPreSearchUsernameModifierRegistry
['custom-prefix-modifier'] = function() {
  return new MediaWiki\Extension\LDAPProvider
  \PreSearchUsernameModifier\GenericCallback(
    function( $username ) {
      return "some_prefix_$username";
  } );
};

Paramètres de configuration du domaine

Nom Valeur par défaut Description
server - One or more hostnames of the LDAP backend. Seperated by a single space.
port 389 The port the LDAP server is listening to
user "" The FQDN of a user who has at least read rights
pass "" The password for the user above
options {} (JSON object or indexed PHP array) LDAP specific options. Must be string literals as key.
enctype clear Must be one of 'ldapi', 'ssl', 'tls', or 'clear'
groupbasedn "" Used for group membership queries
userbasedn "" Used for user info queries. Also for resolving a local username into an appropriate user DN.
searchattribute ""
searchstring ""
grouprequest "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory" Mechanism to fetch user group data. There are four types available:
  • "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
  • "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupUniqueMember::factory"
  • "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory"
  • "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\Configurable::factory"

Which one to choose depends on the LDAP backend.

groupobjectclass "" In case Configurable is used in grouprequest the groupobjectclass can be specified here. E.g. group
groupattribute "member" In case Configurable is used in grouprequest the groupattribute can be specified here. E.g. member
presearchusernamemodifiers [] Username modifiers, for the purpose of LDAP-query.
Useful when LDAP usernames do not match Mediawiki username format.
( e.g. LDAP accounts use underscores-instead-of-spaces, or need to be lower-cased )

Use one-or-more of the available modifiers:
  • lowercase
  • removespaces
  • spacestounderscores


Sample Usage:
[ "lowercase" ]
[ "removespaces" ]
[ "spacestounderscores", "lowercase" ]

Working Example: Login-User Joe Bloggs will be translated to joe_bloggs LDAP search query,
with config of: [ "spacestounderscores", "lowercase" ]

Additional modifiers can be registered through the $LDAPProviderPreSearchUsernameModifierRegistry (see above) variable.

Fournisseurs de configuration de domaines

By default the domain specific configuration is held in a static JSON file. But one can also use a PHP based (dynamic) configuration. The relevant extension configuration is $LDAPProviderDomainConfigProvider. It needs to be a callback that returns an object of type IDomainConfigProvider.

Fichier JSON statique

This is the default way. Just set up the extension configuration $LDAPProviderDomainConfigs to point to a valid JSON file (should be outside of web root).

$LDAPProviderDomainConfigs = "$IP/../ldapprovider.json";

Example:

{
	"LDAP": {
		"connection": {
			"server": "ldap.forumsys.com",
			"user": "cn=read-only-admin,dc=example,dc=com",
			"pass": "password",
			"options": [
				{"LDAP_OPT_DEREF": 1}
			],
			"basedn": "dc=example,dc=com",
			"groupbasedn": "dc=example,dc=com",
			"userbasedn": "dc=example,dc=com",
			"searchattribute": "uid",
			"searchstring": "uid=USER-NAME,dc=example,dc=com",
			"usernameattribute": "uid",
			"realnameattribute": "cn",
			"emailattribute": "mail"
		}
	}
}

Tableau PHP dynamique

As an alternative to the JSON file one can use a PHP array to configure the domains. In this case, just have the $LDAPProviderDomainConfigs callback return an instance of InlinePHPArray.

Example

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				"server" => "ldap.forumsys.com",
				"user" => "cn=read-only-admin,dc=example,dc=com",
				"pass" => 'password',
				"options" => [
					"LDAP_OPT_DEREF" => 1
				],
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "uid",
				"searchstring" => "uid=USER-NAME,dc=example,dc=com",
				"usernameattribute" => "uid",
				"realnameattribute" => "cn",
				"emailattribute" => "mail"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versions

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
However, this table helps to determine which extension-releases to use across all recent versions.

Versions MediaWiki Recommended Extension Version Etat du test Date du dernier test
1.31 (LTS) LDAPxxx_REL1_31 Testé, recommandé mars 2020
1.32 LDAPxxx_REL1_31 Non testé -
1.33 LDAPxxx_REL1_31 Testé mars 2020
1.34 LDAPxxx_REL1_31 Testé mars 2020
1.35 (LTS envisagé) LDAPxxx_master Testé mars 2020

Guide de dépannage

Exception: « Pas de configuration disponible pour le domaine 'XYZ'! »

Please make sure, that the values in the database field ldap_domains.domain_id match with the values set in the first level of the domain-configuration (e.g. in ldapprovider.json). If they don't, you can either change the entries in the database using UPDATE ldap_domains SET domain_id = "DomainNameAsInConfiguration"; or adapt the configuration. Attention: In the current version, the domain name is case sensitive.

Exception: « Pas de section 'authorization' trouvée dans la configuration pour le domaine 'LDAP' »

If you enabled the LDAPAuthorization extension (as recommended in the PluggableAuth documentation), you need to add the authorization configuration in the LDAPProvider domain config (more info here)

Exemples de bout en bout