Extension talk:LDAP Authentication

About this board

How to ask for support

There's a couple key pieces of info I always need:

  1. The MediaWiki version you are using
  2. The LdapAuthentication extension version you are using

I very often will need to see two other things when you ask for support, so you should have them prepared:

  1. Your configuration, with sensitive stuff snipped out
  2. The extension's debug log, with sensitive stuff snipped out

When you are trying to debug an authentication problem, you should always use the most basic configuration possible. For instance, if you don't have basic authentication working yet, you shouldn't have group restrictions or group synchronization enabled yet. I will generally ask you to disable these things when debugging.

Also, $wgLDAPUseLocal is almost never what you want to use. It's a frequent cause of configuration issues, and unless you really know what you are doing, it should not be set (or explicitly set to false, which is the default).

Most importantly of all: ensure you are using the newest version of the extension. From the extension distributor, that's the "master" version. If you are using git, just make sure you use git pull && git reset --hard origin/master. This is one of the more common cause of problems.

How to submit a bug

If you've found a bug, please submit it here.

Archives

Local account creation for non LDAP users

1
Makeaweliweli (talkcontribs)

The LDAP auth works great for my wiki. However, we also need to support local account creation for users that aren't in LDAP.

Is there a way for users to create local accounts that aren't bound to LDAP?

Here's the installation versioning:

Product Version
MediaWiki 1.37.1
LDAPAuthentication2 1.0.3
LDAPAuthorization 1.1.0
LDAPProvider 1.0.4
LDAPUserInfo 1.0.0
PluggableAuth 5.7
Reply to "Local account creation for non LDAP users"

How to get user's profile picture from AD?

1
192.82.77.143 (talkcontribs)
Reply to "How to get user's profile picture from AD?"

Auto-creation of a local account failed: You have not specified a valid username.

1
Capino1980 (talkcontribs)

We have multiple MediaWiki sites. Some of them are using LDAP authentication.

Now I created a new site and used the following json.


{

    "local.domain": {

        "connection": {

            "server": "ldap.local.domain",

            "enctype": "ssl",

            "port": 636,

        "options": {

                "LDAP_OPT_DEREF": 1

        },

            "user": "cn=ldap,ou=users,dc=local,dc=domain",

            "pass": "password",

            "basedn": "dc=local,dc=domain",

            "userbasedn": "dc=local,dc=domain",

            "groupbasedn": "dc=local,dc=domain",

            "searchattribute": "samaccountname",

            "usernameattribute": "samaccountname",

            "realnameattribute": "cn",

            "emailattribute": "mail",

            "grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory",

            "nestedgroups": "true"

        },

        "authorization": {

            "rules": {

                "groups": {

                    "required": [

                        "CN=wikigroup,OU=Distribution list,DC=local,DC=domain"

                    ]

                }

            }

        }

    }

}


But in de debug log, I see a weird notification: [authentication] Auto-creating 192.168.1.100 on login

Reply to "Auto-creation of a local account failed: You have not specified a valid username."
134.147.28.232 (talkcontribs)

The login takes up to 2 minutes or longer, if group restriction is enabled. A look in the debug log (log level: 3) shows, that the user is searched in every group to authenticate it. This step takes a lot of time, because there are over 100.000 users and many groups. Is there a way to improve the speed or a workaround, like just checking if the user is in the required group? The Mediawiki version is: 1.20.2 Configuration and log are below:

require_once( 'extensions/Ldap-Authentification/LdapAuthentication.php' );
$wgAuth = new LdapAuthenticationPlugin();
$wgUseLDAP = true;

#SERVER
$wgLDAPDomainNames = array(
'groupname'
 );
 
$wgLDAPServerNames = array(
'groupname' => 'server'
 );

$wgLDAPUseLocal = false;

$wgLDAPEncryptionType = array(
'groupname' => "clear"
 );


#PROXY
$wgLDAPProxyAgent = array(
'groupname' => "cn=,ou=,dc=,dc=de"
 );
   
$wgLDAPProxyAgentPassword = array(
'groupname' => "password"
 );

$wgLDAPSearchAttributes = array(
'groupname' => "uid"
 );

$wgLDAPBaseDNs = array(
'groupname' => "dc=,dc=de"
 );
   
$wgLDAPGroupBaseDNs = array(
'groupname' => "ou=groups,dc=,dc=de"
 );

$wgLDAPUserBaseDNs = array(
'groupname' => "ou=users,dc=,dc=de"
 );


#GROUPS
$wgLDAPGroupUseFullDN = array(
'groupname' => true
 );

$wgLDAPLowerCaseUsername = array(
'groupname' => true
 );

$wgLDAPGroupObjectclass = array(
'groupname' => "groupOfUniqueNames"
 );
$wgLDAPGroupAttribute = array(
'groupname' => "uniqueMember"
 );

$wgLDAPGroupNameAttribute = array(
'groupname' => "cn"
 );

$wgLDAPRequiredGroups = array(
'groupname' =>  array("cn=groupname,ou=groups,dc=,dc=de")
 );

2013-11-12 12:50:51  : 2.0f Entering validDomain
2013-11-12 12:50:51  : 2.0f User is not using a valid domain ().
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:51  : 2.0f Setting domain as: domain
2013-11-12 12:50:51  : 2.0f Entering allowPasswordChange
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:51  : 2.0f Entering modifyUITemplate
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:51  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Entering validDomain
2013-11-12 12:50:52  : 2.0f User is not using a valid domain ().
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Setting domain as: domain
2013-11-12 12:50:52  : 2.0f Entering allowPasswordChange
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Entering modifyUITemplate
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:52  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering validDomain
2013-11-12 12:50:56  : 2.0f User is using a valid domain (domain).
2013-11-12 12:50:56  : 2.0f Setting domain as: domain
2013-11-12 12:50:56  : 2.0f Entering getCanonicalName
2013-11-12 12:50:56  : 2.0f Username is: login
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Munged username: login
2013-11-12 12:50:56  : 2.0f Entering authenticate for username login
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering Connect
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Using TLS or not using encryption.
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Using servers:  ldap://server:389
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f PHP's LDAP connect method returned true (note, this does not imply it connected to the server).
2013-11-12 12:50:56  : 2.0f Entering getSearchString
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getUserDN
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Doing a proxy bind
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Created a regular filter: (uid=login)
2013-11-12 12:50:56  : 2.0f Entering getBaseDN
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f basedn is ou=users,dc=,dc=de
2013-11-12 12:50:56  : 2.0f Using base: ou=users,dc=,dc=de
2013-11-12 12:50:56  : 2.0f Setting the LDAPUsername based on fetched wgLDAPSearchAttributes: login
2013-11-12 12:50:56  : 2.0f userdn is: uid=login,ou=users,dc=,dc=de
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Binding as the user
2013-11-12 12:50:56  : 2.0f Bound successfully
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getGroups
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Retrieving LDAP group membership
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Searching for the groups
2013-11-12 12:50:56  : 2.0f Entering searchGroups
2013-11-12 12:50:56  : 2.0f Entering getBaseDN
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f basedn is ou=groups,dc=,dc=de
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Binding as the proxyagent
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Entering getDomain
2013-11-12 12:50:56  : 2.0f Search string: (&(uniqueMember=uid=login,ou=users,dc=,dc=de)(objectclass=groupOfUniqueNames))
2013-11-12 12:52:59  : 2.0f Returned groups: cn=group1,ou=groups,dc=,dc=de::cn=group2,ou=groups,dc=,dc=de::cn=group3,ou=groups,dc=,dc=de::cn=group4,ou=groups,dc=,dc=de::cn=sgroup5,ou=groups,dc=,dc=de::cn=group6,ou=groups,dc=,dc=de::cn=group7,ou=groups,dc=,dc=de::cn=group8,ou=groups,dc=,dc=de::cn=group9,ou=groups,dc=,dc=de::cn=group10,ou=groups,dc=,dc=de::cn=group11,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Entering checkGroups
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Checking for (new style) group membership
2013-11-12 12:52:59  : 2.0f Required groups: cn=group9,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group1,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group2,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group3,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group4,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group5,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group6,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group7,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group8,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Checking against: cn=group9,ou=groups,dc=,dc=de
2013-11-12 12:52:59  : 2.0f Found user in a group.
2013-11-12 12:52:59  : 2.0f Entering getPreferences
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Authentication passed
2013-11-12 12:52:59  : 2.0f Entering updateUser
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f Entering getDomain
2013-11-12 12:52:59  : 2.0f User has a token, setting domain in user options.
2013-11-12 12:52:59  : 2.0f Saving user settings.
198.181.18.21 (talkcontribs)

This problem is still present in the plugin. Users with a large number of groups are very slow to login because of the poor implementation for searching the groups.

Reply to "LDAP-Authentication is slow"

Automatic account creation is not allowed

20
TroySettle (talkcontribs)

extension for mediawiki 1.28

I'm getting closer to figuring this out, but stuck on automatically creating accounts. Here's my current (sanitized) configuration. I can authenticate, but I then get the message:

Auto-creation of a local account failed: Automatic account creation is not allowed.

require_once ("$IP/extensions/LdapAuthentication/LdapAuthentication.php");
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPUseLocal = true;

$wgLDAPDebug = 3;
$wgDebugLogGroups['ldap'] = '/tmp/debug.log';

$wgLDAPDomainNames       = array('LOCAL');
$wgLDAPServerNames       = array('LOCAL' => 'local-dc2.local.domain');
$wgLDAPEncryptionType    = array('LOCAL' => 'clear');
$wgMinimalPasswordLength = 1;
$wgLDAPBaseDNs           = array('LOCAL' => 'ou=Users,ou=LOCAL,dc=domain,dc=local');

$wgLDAPSearchStrings     = array('LOCAL' => 'LOCAL\\USER-NAME');
$wgLDAPSearchAttributes  = array('LOCAL' => 'sAMAccountName' );

$wgLDAPDisableAutoCreate = array('LOCAL' => false);

Any help would be greatly appreciated!

Tz1971 (talkcontribs)

currently I am using Centos 7.3, MySql 5.7 and PHP 7.1 LDAP TLS

LdapAuthentication: REL1_28 2016-11-18T19:08:52 770c89e

in /etc/openldap/ldap.conf

I add

TLS_REQCERT allow    

TLS hard

and LocalSettings.php setting

$wgLDAPEncryptionType  = array('domain.com' => 'tls');

at this point cannot authenticate

so i tweak and change some code in LdapAuthenticationPlugin at line 547

if ( !ldap_start_tls( $this->ldapconn ) ) {

add @

if ( !@ldap_start_tls( $this->ldapconn ) ) {

for autocreation, I stuck at /includes/auth/AuthManager.php between line 1612 and 1626

// Is the IP user able to create accounts?

$anon = new User;

/*

if ( !$anon->isAllowedAny( 'createaccount', 'autocreateaccount' ) ) {

.....

}

*/

comment out this block, now working. (need better solution rather than comment out)

for group permission

# Implicit group for all visitors

$wgGroupPermissions['*']['createaccount'] = false; // ??? not working

$wgGroupPermissions['*']['autocreateaccount'] = false;  // ???

$wgGroupPermissions['*']['read'] = false;

$wgGroupPermissions['*']['edit'] = false;

$wgGroupPermissions['*']['createpage'] = false;

$wgGroupPermissions['*']['createtalk'] = false;

$wgGroupPermissions['*']['writeapi'] = false;

Aarango1 (talkcontribs)

Same here. Any help is appreciated. My config:

require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array("iRedMail");

$wgLDAPServerNames = array("iRedMail" => "192.168.XX.XX");

$wgLDAPPort = array("iRedMail" => 389);

$wgLDAPEncryptionType = array( "iRedMail" => "clear");

$wgLDAPBaseDNs = array( "iRedMail"=>"o=domains,dc=example,dc=com");

$wgLDAPProxyAgent = array("iRedMail"=>"cn=vmail,dc=example,dc=com");

$wgLDAPProxyAgentPassword = array( "iRedMail"=>"*****");

$wgLDAPUserBaseDNs = array( "iRedMail"=>"o=domains,dc=example,dc=com");

$wgLDAPSearchAttributes = array( "iRedMail" => "mail");

$wgLDAPLowerCaseUsername = array( "iRedMail"=>true);

$wgLDAPUseLocal = true;

$wgLDAPDebug = 3;

$wgDebugLogGroups['ldap'] = '/tmp/debug.log';

Legaulph (talkcontribs)

Same issue

TroySettle (talkcontribs)

FWIW, I finally got it working. Not sure what the difference is here... the $wgGroupPermissions item is not listed on the LDAP extension instructions, but I think this is what did it.

require_once ("$IP/extensions/LdapAuthentication/LdapAuthentication.php");
$wgAuth = new LdapAuthenticationPlugin();
#$wgLDAPUseLocal = true;
$wgLDAPDomainNames       = array('LOCAL');
$wgLDAPServerNames       = array('LOCAL' => 'local-dc2.mydomain.local');
$wgLDAPEncryptionType    = array('LOCAL' => 'clear');
$wgMinimalPasswordLength = 1;
$wgLDAPBaseDNs           = array('LOCAL' => 'ou=Users,ou=LOCAL,dc=mydomain,dc=local');
$wgLDAPSearchStrings     = array('LOCAL' => 'LOCAL\\USER-NAME');
$wgLDAPSearchAttributes  = array('LOCAL' => 'sAMAccountName' );
$wgLDAPRetrievePrefs     = array('LOCAL' => true );
$wgGroupPermissions['*']['autocreateaccount'] = true;
Aarango1 (talkcontribs)

I tried with that TroySettle but not luck. I receive same fails, what versions do you have installed? (Mediawiki and LDAP please) Thanks.

Did you create Wiki as Open? private?

NOTE: I solved using wiki 1.23 version.

Legaulph (talkcontribs)

I had to set $wgGroupPermissions['*']['createaccount'] = true;

130.219.8.234 (talkcontribs)

That still did not work for me.

My other anonymous permissions are set to false.

$wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['read'] = false;

I want this to be a private wiki.

130.219.8.234 (talkcontribs)

It would seem I had to clear all session data and remove cookies from previous logon attempts with my test user as well as comment out self::saveDomain( $user, $_SESSION['wsDomain'] ); from one of the extension's configuration files. It now works.

153.96.128.5 (talkcontribs)

I had this problem, too. In my case, the solution was the one that has already been mentioned above:

1. switch back to local auth in LocalSettings.php; then login with a *local* admin/bureaucrat account (the one you set up when installing the wiki).

2. create a local user with the same name as one that exists in LDAP (give him a bullsh*t password, no need to match the LDAP one). Not mandatory, but if you are smart, this user should be a bureaucrat as you need at least one LDAP-based bureaucrat anyways. Lets call this user "Ldapboss".

3. switch again to LDAP auth in LocalSettings.php; then login with the user Ldapboss you just created. Of course you need to use the user's actual LDAP password this time. Btw, your local admin is now locked out of the system (unless you set wgLDAPUseLocal to true). This is why you need an LDAP-based bureaucrat.

From this point on, weirdly enough, auto account creation works. It's like, you need at least one successful login to make it work. Not sure why, doesn't make sense.

Ask a colleague to log on, or alternatively, rename your Ldapboss user to Ldapboss_Trash (Renameuser extension) and logout. Then login again with Ldapboss using again the LDAP credentials. Now, you Ldapboss is auto-created (this time as a simple user, as it should).

Actually, on Ryan D Lane (creator and ex-maintainer of the plugin) has this written on a 2009 blog post --- Quote:

"Before enabling the plugin, you should create a user in the local wiki database that exists in AD, and promote that user to sysop. After the plugin is enabled, you will not be able to log in as any user who does not exist in AD."

Brain wang (talkcontribs)

Hi,

While I executed step 3, then use Ldapboss login with LDAP password, I got the following error:

[WMFhIqwRAAIAABOptNUAAAAG] 2017-03-09 14:05:24: Fatal exception of type "DBQueryError"

Is it normal?

But it looks I have already logged in.

223.166.93.186 (talkcontribs)

Hi,

Any news on Brain Wang's problem? I experience the same issue. The user seems to be logged in, however logging in with an other user from LDAP still fails.

195.212.29.162 (talkcontribs)

Today I ran into the same issue, and found that the LDAP plugin does not have the right to autocreate users, despite the allowed autocreateaccount Group Permission setting. Then I found that the referred table (ldap_domains) did not exist in the database (and thus throwing the authmanager-autocreate-noperm errors). Creating the table in the right database based on the extensions/LdapAuthentication/schema/ldap-mysql.sql seems to fixed the issue:

# mysql -u root -p

Enter password:

mysql> use my_wiki

Reading table information for completion of table and column names

You can turn off this feature to get a quicker startup with -A

Database changed

mysql> CREATE TABLE ldap_domains (domain_id int not null primary key auto_increment,domain varchar(255) binary not null,user_id int not null);

Query OK, 0 rows affected (0.00 sec)

85.220.204.126 (talkcontribs)

This worked for me. Thanks

145.109.211.76 (talkcontribs)

I am running a private Wiki

$wgGroupPermissions['*']['autocreateaccount'] = true;

fixed it for me. If you read the changelog of 1.27:

* MediaWiki will now auto-create users as necessary, removing the need for

  extensions to do so. An 'autocreateaccount' right is added to allow

  auto-creation when 'createaccount' is not granted to all users.

31.221.114.66 (talkcontribs)

I resolved the problem by setting the $wgGroupPermissions['*']['autocreateaccount'] = true but also assigning CHMOD permissions to all .php files in /mediawiki to 777 for the local account I was using.

70.67.200.45 (talkcontribs)

For anyone else with this error:

Do set $wgGroupPermissions['*']['autocreateaccount'] = true;

Then delete your session cookie and reload the page to get a new session before trying again. Your session gets added to an account auto-creation blacklist when it fails the first time, which happens to give the exact same error message.

213.33.64.46 (talkcontribs)

This exact method worked for me too, thanks! Removing the session-cookie was the one thing I missed after unsuccessfully adding the configuration-option

73.44.250.189 (talkcontribs)

I had the same issue - I did not need to add any particular wgGroupPermissions, I just followed responses from:

153.96.128.5

and 195.212.29.162


Was racking my brain as to why it wasn't working, thanks for your help.

This comes up quite high on the search for issue, so I thought I'd add my 2 cents.

I am running on mediaWiki 1.29 due to legacy php/database and other things related - we're not in a position to do much upgrades and were stuck in using this, which is fine for us, thanks.

187.41.31.85 (talkcontribs)

It worked for me. -> 153.96.128.5

Reply to "Automatic account creation is not allowed"

Group restrictions works, but what about allowing an indvidual user?

1
118.210.39.78 (talkcontribs)

Hi,


Our LDAP group based restriction is working, but we have a contractor coming on board who falls outside of all these groups. However, I can't see a way to allow a particular user through the gate once the group restrictions are being used.

Is it possible?

Thanks...

Reply to "Group restrictions works, but what about allowing an indvidual user?"

Does this extension work on MediaWiki 1.36.1?

1
Lebenshilfe.offenburg (talkcontribs)

If yes, please tell me exactly how to install it from scratch because all other descriptions i found at the web are for older versions.


Thank you very much in advance!

(I use MediaWiki 1.36.1 and LdapAuthentication extension version 2.1.0)

Reply to "Does this extension work on MediaWiki 1.36.1?"
Ana.carvalho (talkcontribs)

Hi all,

Not all users in LDAP are authorized to own an user account in my MediaWiki. I already have users logging in because I created their accounts before installing LDAP Plugin. Now, I need to create accounts for new employees and I always receive the message "Username entered already in use. Please choose a different name.", through Special:CreateAccount.

Obviously, If I disable all LDAP configuration in LocalSettings, I'm able to create a local user account with the same LDAP username. Then , if I enable LDAP configuration again, the user is recognized with LDAP password and he can log in. The fact is that I don't want to edit LocalSettings every time I have a new employee.

My configuration is below. Thanks in advance.

require_once ('.../extensions/LdapAuthentication/LdapAuthentication.php');

$wgAuth = new LdapAuthenticationPlugin();

$wgLDAPDomainNames = array( 'AD' );

$wgLDAPServerNames = array( 'AD' => 'url' );

$wgLDAPUseLocal = false;

$wgLDAPEncryptionType = array( 'AD' => 'clear' );

$wgLDAPPort = array( 'AD' => 389 );

$wgLDAPProxyAgent = array( 'AD' => 'CN=a,OU=b,DC=c,DC=d' );

$wgLDAPProxyAgentPassword = array( 'UFPE-AD' => 'password' );

$wgLDAPSearchAttributes = array( 'AD' => 'description' );

$wgLDAPBaseDNs = array( 'AD' => 'DC=c,DC=d' );

$wgLDAPDisableAutoCreate = array( 'AD' => true );

$wgLDAPPreferences = array( 'AD' => array( 'email' => 'mail', 'realname' => 'cn','nickname' => 'givenname') );

$wgLDAPLowerCaseUsername = array( 'AD' => true);

$wgGroupPermissions['*']['createaccount'] = false;

MediaWiki: 1.29.1

PHP: 5.5.21 (apache2handler)

PostgreSQL: 9LDAP

Lesscomplex (talkcontribs)

If I understand correctly, the `Special:CreateAccount` page will actually atempt to create an account (in your AD!). But the account already exists (in the AD)..

But if I understand correctly, with `$wgGroupPermissions['*']['autocreateaccount'] = true;` the accounts will be auto-created in the database on first log in. So you just need to make sure the account is available in AD and then tell the user to sign in to you wiki instance.

118.210.39.78 (talkcontribs)

This is confusing. Are you saying that once you have LDAP connected that you can't create local accounts in the wiki instance? We have users that need to access the wiki that don't belong to our LDAP groups. So I was hoping to create accounts directly on the wiki server...

Reply to "Account Creation"
This post was hidden by Serrkind (history)
Reply to "Could not get user DN!"

OpenLdap: Did not find a matching user in LDAP

2
Dbavedb (talkcontribs)

I had been using OpenLdap already so when I install MediaWiki I hoped to use the Extension:LDAP Authentication to bridge the user hurdle for a site we could all share.

I installed
CentOS CentOS Linux release 8.2.2004 (Core)
OpenLdap openldap-2.4.50
Apache2 httpd-2.4.37-21.module_el8.2.0
PHP php-7.2.24-1.module_el8.2.0
MariaDB mariadb-server-10.3.17-1.module_el8.1.0
MediaWiki 1.34.2
LdapAuthentication LdapAuthentication-REL1_34-b97a26e.tar.gz

Here was my basic config:

# Basic search criteria
$wgLDAPDomainNames = array('extra-extra.com');
$wgLDAPServerNames = array('extra-extra.com' => 'ldapmaster.extra-extra.com.com');
$wgLDAPSearchAttributes = array('extra-extra.com' => 'uid');
$wgLDAPSearchStrings =  array('extra-extra.com' => 'uid=USER-NAME,ou=people,dc=ldapmaster,dc=extra-extra.com,dc=com');
$wgLDAPBaseDNs = array('extra-extra.com' => 'dc=ldapmaster,dc=extra-extra.com,dc=com');
$wgLDAPProxyAgent = array('extra-extra.com' => 'cn=readonly,ou=system,dc=ldapmaster,dc=extra-extra.com,dc=com');
$wgLDAPProxyAgentPassword = array('extra-extra.com' => 'password');
$wgLDAPLowerCaseUsername = array('extra-extra.com' => true);
$wgLDAPEncryptionType = array('extra-extra.com' => 'tls');
$wgMinimalPasswordLength = 1;
$wgLDAPUseLocal = false;
$wgLDAPDebug = 3; //for debugging LDAP

I then tried logging in quite a bit until I discovered how to enable debug logging:

$wgDebugLogFile = "/var/log/php-fpm/mw.log";
$wgDebugLogGroups["ldap"] = "/var/log/php-fpm/ldapdebug.log";
$wgShowExceptionDetails = true; //for debugging MediaWiki

Here was the debug log output:

2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Setting domain as: extra-extra
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering userExistsReal
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering Connect
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Using TLS or not using encryption.
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Using non-standard port: 389
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Using servers: ldap://ldapmaster.extra-extra.com:389
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 PHP's LDAP connect method returned true (note, this does not imply it connected to the server).
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getSearchString
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Doing a straight bind
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 userdn is: uid=Wiho,ou=people,dc=ldapmaster,dc=extra-extra,dc=com
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Did not find a matching user in LDAP
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering strict.
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Returning true in strict().

Obviously this line was the deal breaker:

2020-07-31 00:21:23 wiki.extra-extra.com my_wiki: 2.1.0 Did not find a matching user in LDAP

I was encouraged by this comment Bernhardsmw to start looking into the basic code (always great to do when troubleshooting), and that is when I found a fix for the problem I was seeing:

diff ~/src/LdapAuthentication/LdapAuthenticationPlugin.php extensions/LdapAuthentication/
532a533,536
>
>                                 // If we are going to find and entry we need to bind first?
>                                 $bindval = self::ldap_bind( $this->ldapconn, $this->getConf('ProxyAgent'), $this->getConf('ProxyAgentPassword') );

as can be seen in the next debug log snippet:

2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Setting domain as: extra-extra
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering userExistsReal
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering Connect
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Using TLS or not using encryption.
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Using non-standard port: 389
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Using servers: ldap://ldapmaster.extra-extra.com:389
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Using TLS
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 PHP's LDAP connect method returned true (note, this does not imply it connected to the server).
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getSearchString
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Doing a straight bind
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 userdn is: uid=Wiho,ou=people,dc=ldapmaster,dc=extra-extra,dc=com
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Found a matching user in LDAP
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering authenticate for username Wiho
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain
2020-07-31 07:07:27 wiki.extra-extra.com my_wiki: 2.1.0 Entering getDomain

However I am not an expert with any of this, so I am wondering if this is worth a patch, or is there something else wrong with my config. Perhaps a bind against the Proxy might have worked, if my config was slightly different?

132.230.195.223 (talkcontribs)

Hey,

How exactly did you fix this? I cannot follow your explanation from the diff command on to the end. Did you fix something within the LdapAuthenticationPlugin.php?

Reply to "OpenLdap: Did not find a matching user in LDAP"
Return to "LDAP Authentication" page.