Topic on Manual talk:Active Directory Integration/Flow

Hello, dear support!

I am trying to connect my instance of MW to our AD exactly as explained in this page, to which I am adding this topic. I spent a lot of time, reading such discussions on the subject, but cannot get it working.

Here, to save your time, I am attaching my ldap.json and LocalSettings.php (sure, with dummy data replaced sensitive information).

The symptoms:

1. I still see both username and password fields on the login page, but without the standard button "Log in", only with the LDAP log in button, which is.. strange
2. On clicking the LDAP login button I see error message: Could not authenticate credentials against domain "mydomainname.com"
3. php extensions/LDAPProvider/maintenance/ShowUserGroups.php --domain ldap.service  --username ldap.user returns only this: Full DNs:     Short names:
4. php extensions/LDAPProvider/maintenance/CheckConnection.php --config /path/to/ldap.json --domain ldap.service "(samaccountname=*)" returns tons of information, related to our LDAP server (DNs)
5. php extensions/LDAPProvider/maintenance/CheckLogin.php --domain ldap.service  --username ldap.user when then I enter correct password it said FAILD, but if I just hit Enter on the password prompt it says OK
6. php extensions/LDAPProvider/maintenance/ShowUserInfo.php --domain ldap.service  --username ldap.user returns nothing

ldapsearch returns correct output on test connection.

We restarted Apache after adding PHP modules, we did update.php after applying this new LDAP extensions, as advised in the topic.

Please, help!

---

ldap.json:

{

  "ldap.service": {

   "connection": {

     "server": "01.myldapservice.com",

     "port": "389",

     "use-tls": "false",

     "user": "CN=ldap.user,OU=IT,DC=myldapservice,DC=com",

     "pass": "passwordtoprotectmygreatldapnetwork",

     "enctype": "clear",

     "options": {

       "LDAP_OPT_DEREF": 1

     },

     "basedn": "DC=myldapservice,DC=com",

     "userbasedn": "DC=myldapservice,DC=com",

     "groupbasedn": "DC=myldapservice,DC=com",

     "searchattribute": "samaccountname",

     "usernameattribute": "samaccountname",

     "realnameattribute": "cn",

     "searchstring": "samaccountname",

     "emailattribute": "mail",

     "grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",

     "presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]

   },

   "userinfo": [],

   "authorization": [],

   "groupsync": {

     "mechanism": "mappedgroups",

     "mapping": {

       "developer": "CN=WIKI - Сообщество,OU=Группы доступа Wiki,OU=IT,DC=myldapservice,DC=com"

     }

   }

  }

}

---

The system and plugins information:

Installed software

Product	Version
MediaWiki	1.39.3 (1a4ca63) 12:21, 12 August 2023
PHP	8.2.10 (fpm-fcgi)
MySQL	8.0.34-0ubuntu0.22.04.1
ICU	70.1
Lua	5.1.5
Pygments	2.11.2

Entry point URLs

Entry point	URL
Article path	/index.php?title=$1
Script path	/
index.php	/index.php
api.php	/api.php
rest.php	/rest.php

Installed extensions

Special pages
Extension	Version
CiteThisPage	–
Interwiki	3.2
Nuke	–
Renameuser	–
Replace Text	1.7
UserMerge	1.10.1 (a6fd7d8) 05:50, 1 August 2023
Editors
Extension	Version
CodeEditor	–
VisualEditor	0.1.2
WikiEditor	0.5.3
Parser hooks
Extension	Version
CategoryTree	–
Cite	–
CSS	3.5.0 (035e731) 03:47, 4 December 2022
ImageMap	–
InputBox	0.3.0
Math	3.0.0
ParserFunctions	1.6.0
Poem	–
Scribunto	–
SyntaxHighlight	2.0
TemplateData	0.1.2
Media handlers
Extension	Version
PDF Handler	–
API
Extension	Version
PageImages	–
Other
Extension	Version
Gadgets	–
LDAPAuthentication2	2.0.2 (b83f5d1) 07:23, 4 September 2023
LDAPAuthorization	2.0.1 (fbb1c3b) 07:23, 4 September 2023
LDAPGroups	2.0.1 (1f945ca) 07:23, 4 September 2023
LDAPProvider	2.0.1 (dc89b2f) 07:23, 4 September 2023
LDAPUserInfo	2.0.0 (01a4b9e) 10:03, 14 June 2023
MultimediaViewer	–
OATHAuth	0.5.0
PluggableAuth	7.0.0 (1cbf448) 05:33, 29 August 2023
SecureLinkFixer	–
TextExtracts	–

---

LocalSettings.php:

<?php

//error_reporting( -1 ); // Debug

//ini_set( 'display_errors', 1 ); / Debug

# Protect against web entry

if ( !defined( 'MEDIAWIKI' ) ) {

exit;

}

## Uncomment this to disable output compression

# $wgDisableOutputCompression = true;

$wgSitename = "Wiki name";

$wgMetaNamespace = "wiki_name";

$wgScriptPath = "";

## The protocol and server name to use in fully-qualified URLs

$wgServer = "https://myserver.com";

## The URL path to static resources (images, scripts, etc.)

$wgResourceBasePath = $wgScriptPath;

## The URL paths to the logo. Make sure you change this from the default,

## or else you'll overwrite your logo when you upgrade!

$wgLogos = [

'1x' => "$wgResourceBasePath/resources/assets/logo.png",

'icon' => "$wgResourceBasePath/resources/assets/logo.png",

];

$wgDebugLogFile = "$wgResourceBasePath/logs/mw.log";

## UPO means: this is also a user preference option

$wgEnableEmail = false;

$wgEnableUserEmail = true; # UPO

$wgEmergencyContact = "";

$wgPasswordSender = "";

$wgEnotifUserTalk = false; # UPO

$wgEnotifWatchlist = false; # UPO

$wgEmailAuthentication = true;

## Database settings

$wgDBtype = "mysql";

$wgDBserver = "localhost";

$wgDBname = "dbname";

$wgDBuser = "dbuser";

$wgDBpassword = "thestrongestpasswordinthewordforthedatabaseandmediawikionecouldeverguess";

# MySQL specific settings

$wgDBprefix = "wiki_";

# MySQL table options to use during installation or update

$wgDBTableOptions = "ENGINE=InnoDB, DEFAULT CHARSET=binary";

# Shared database table

# This has no effect unless $wgSharedDB is also set.

$wgSharedTables[] = "actor";

## Shared memory settings

$wgMainCacheType = CACHE_NONE;

$wgMemCachedServers = [];

## To enable image uploads, make sure the 'images' directory

## is writable, then set this to true:

$wgEnableUploads = true;

#$wgUseImageMagick = true;

#$wgImageMagickConvertCommand = "/usr/bin/convert";

$wgUseInstantCommons = false;

$wgPingback = false;

# Site language code, should be one of the list in ./includes/languages/data/Names.php

$wgLanguageCode = "gb";

# CSS path

$wgCSSPath = '';

$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

  $out->addScriptFile( '/js/jquery.js' );

};

$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

  $out->addScriptFile( '/js/bpmn-navigated-viewer.development.js' );

};

#$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

#    $out->addScriptFile( '/js/bpmn-viewer.development.js' );

#};

$wgHooks['MimeMagicInit'][] = static function ( MimeAnalyzer $mime ) {

$mime->addExtraTypes( 'application/xml bpmn' );

};

$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

  $out->addStyle( '/css/fontawesome/css/fontawesome.css' );

};

$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

  $out->addStyle( '/css/fontawesome/css/solid.css' );

};

$wgHooks['BeforePageDisplay'][] = function( OutputPage &$out, Skin &$skin ) {

  $out->addStyle( '/css/fontawesome/css/regular.css' );

};

// Adding help to the footer

$wgHooks['SkinAddFooterLinks'][] = function ( Skin $skin, string $key, array &$footerlinks ) {

if ( $key === 'places' ) {

  $footerlinks['helper-page'] = $skin->footerLink( 'Help-link-text', 'Help-Link' );

  $footerlinks['glossary-page'] = $skin->footerLink( 'Glossary-link-text', 'Glossary-Link' );

};

};

$wgUploadDirectory = 'uploads';

$wgUploadPath = 'uploads';

$wgFileExtensions[] = 'bpmn';

# Time zone

$wgLocaltimezone = "UTC";

## Set $wgCacheDirectory to a writable directory on the web server

## to make your wiki go slightly faster. The directory should not

## be publicly accessible from the web.

#$wgCacheDirectory = "$IP/cache";

$wgSecretKey = "mysecretkeyforthisgreatwikiofalltimes";

# Changing this will log out all existing sessions.

$wgAuthenticationTokenVersion = "1";

# Site upgrade key. Must be set to a string (default provided) to turn on the

# web installer while LocalSettings.php is in place

$wgUpgradeKey = "myupgradekeyforthiswiki";

## For attaching licensing metadata to pages, and displaying an

## appropriate copyright notice / icon. GNU Free Documentation

## License and Creative Commons licenses are supported so far.

$wgRightsPage = ""; # Set to the title of a wiki page that describes your license/copyright

$wgRightsUrl = "";

$wgRightsText = "";

$wgRightsIcon = "";

# Path to the GNU diff3 utility. Used for conflict resolution.

$wgDiff3 = "/usr/bin/diff3";

# The following permissions were set based on your choice in the installer

$wgAddGroups['sysop'] = ['bureaucrat', 'sysop'];

$wgRemoveGroups['sysop'] = ['bureaucrat', 'sysop'];

## Default skin: you can change the default skin. Use the internal symbolic

## names, e.g. 'vector' or 'monobook':

$wgDefaultSkin = "Medik";

$wgMedikColor = "#347291";

# Enabled skins.

# The following skins were automatically enabled:

wfLoadSkin( 'Medik' );

// DEBUG //

$wgShowExceptionDetails = true;

$wgDebugToolbar = true;

$wgShowDebug = true;

$wgDevelopmentWarnings = true;

// <ActiveDirectorty integration> //

// Safe IP or not (for bypassing external login via AD)

$safeIPs = array('127.0.0.1','localhost');

$ipsVars = array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR');

foreach ($ipsVars as $ipsVar) {

if (isset($_SERVER[$ipsVar]) && mb_strlen($_SERVER[$ipsVar]) > 3 ) { $wikiRequestIP = $_SERVER[$ipsVar]; break; }

}

$wikiRequestSafe = ( isset($wikiRequestIP ) && ( in_array($wikiRequestIP,$safeIPs) ));

// Create Wiki-Group 'engineering' from default user group

$wgGroupPermissions['developer'] = $wgGroupPermissions['user'];

// Private Wiki. External LDAP login. Default NS requires login.

$wgPluggableAuth_EnableLocalLogin = false;

$wgPluggableAuth_EnableAutoLogin = false;

$wgPluggableAuth_EnableLocalProperties = false;

$wgEmailConfirmToEdit = false;

$wgGroupPermissions['*']['edit'] = false;

$wgGroupPermissions['*']['read'] = false;

$wgGroupPermissions['*']['createaccount'] = false;

$wgGroupPermissions['sysop']['createaccount'] = true;

$wgGroupPermissions['*']['autocreateaccount'] = true;

$wgBlockDisablesLogin = true;

// Load LDAP Config from JSON

$ldapJsonFile = "/path/to/ldap.json";

$ldapConfig = false;

if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {

$testJson = @json_decode(file_get_contents($ldapJsonFile),true);

if (is_array($testJson)) {

  $ldapConfig = true;

} else {

  error_log("Found invalid JSON in file: /path/to/ldap.json");

}

}

// Activate Extension

if ( $ldapConfig ) {

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'LDAPAuthentication2' );

wfLoadExtension( 'LDAPAuthorization' );

wfLoadExtension( 'LDAPUserInfo' );

wfLoadExtension( 'LDAPGroups' );

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigs = $ldapJsonFile;

$wgPluggableAuth_Config['Enter, using LDAP service'] = [

  'plugin' => 'LDAPAuthentication2',

  'data' => [

    'domain' => 'ldap.service'

  ]

];

$wgPluggableAuth_Class = "MediaWiki\\Extension\\LDAPAuthentication2\\PluggableAuth";

//  $wgPluggableAuth_Config = array(

//    array('plugin' => 'LDAPAuthentication2'),

//    array('plugin' => 'LDAPAuthorization'),

////    array('plugin' => 'LDAPUserInfo'),

////    array('plugin' => 'LDAPGroups'),

////    array('plugin' => 'LDAPProvider')

//  );

// Force LDAPGroups to sync by choosing a domain (e.g. first JSON object in ldap.json)

$LDAPProviderDefaultDomain = "ldap.service";

if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }

}

// </ActiveDirectorty integration> //

$wgUserMergeProtectedGroups = [];

$wgGroupPermissions['sysop']['usermerge'] = true;

$wgGroupPermissions['sysop']['usermerge'] = true;

$wgGroupPermissions['sysop']['deletelogentry'] = true;

$wgGroupPermissions['sysop']['deleterevision'] = true;

# Enabled extensions. Most of the extensions are enabled by adding

# wfLoadExtension( 'ExtensionName' );

# to LocalSettings.php. Check specific extension documentation for more details.

# The following extensions were automatically enabled:

wfLoadExtension( 'CategoryTree' );

wfLoadExtension( 'Cite' );

wfLoadExtension( 'CiteThisPage' );

wfLoadExtension( 'CodeEditor' );

wfLoadExtension( 'CSS' );

wfLoadExtension( 'Gadgets' );

wfLoadExtension( 'ImageMap' );

wfLoadExtension( 'InputBox' );

wfLoadExtension( 'Interwiki' );

wfLoadExtension( 'Math' );

wfLoadExtension( 'MultimediaViewer' );

wfLoadExtension( 'Nuke' );

wfLoadExtension( 'OATHAuth' );

wfLoadExtension( 'PageImages' );

wfLoadExtension( 'ParserFunctions' );

wfLoadExtension( 'PdfHandler' );

wfLoadExtension( 'Poem' );

wfLoadExtension( 'Renameuser' );

wfLoadExtension( 'ReplaceText' );

wfLoadExtension( 'Scribunto' );

wfLoadExtension( 'SecureLinkFixer' );

wfLoadExtension( 'SyntaxHighlight_GeSHi' );

wfLoadExtension( 'TemplateData' );

wfLoadExtension( 'TextExtracts' );

wfLoadExtension( 'UserMerge' );

wfLoadExtension( 'VisualEditor' );

wfLoadExtension( 'WikiEditor' );

# End of automatically generated settings.

# Add more configuration options below.

$wgShowExceptionDetails = true;

Solved.

Hi, how did you solved?

Hi Arsenii Gorkin,

I'm getting the same exact error as you had. In the CheckLogin.php, if I entered my password it returns Failed. But if I just press enter, it returns OK. ShowUserInfo.php was giving correct results.

Can you please tell us on how you solve the issue on your side? Thank you very much

@Arsenii Gorkin

Hi Arsenii Gorkin,

I'm getting the same exact error as you had. In the CheckLogin.php, if I entered my password it returns Failed. But if I just press enter, it returns OK. ShowUserInfo.php was giving correct results.

Can you please tell us on how you solve the issue on your side? Thank you very much