Hello,
Following the Manual:Active_Directory_Integration documentation I connected the mediawiki to my LDAP
The user connection works but I can't do:
- Restriction on groups (to allow a group of persons)
- Manage rights by groups
My users is :
- wiki_admin is in the group : grpwikiadmin
- wiki_utilisateur is in the group : grpwikiutilisateur
- wiki_interdit have no group
My groups :
- Grpwikiadmin : I want them to be admin
- Grpwikiutilisateur : I want basic user rights on wiki
Grpwikiutilisateur have the member : Grpwikiadmin and wiki_utilisateur
how to do it?
Thank you for your help
The LDAP connexion don't work if the options "authorization => "rules" => "groups" => "required" is présent
My domain is test.local and my groups and users is in the OU=test,DC=test,DC=local
################### ldap.json ###################
{
"test.local": {
"connection": {
"server": "192.168.1.50",
"port": "3268",
"user": "CN=svc_wiki,OU=test,DC=test,DC=local",
"pass": "MYpassword",
"enctype": "clear",
"options": {
"LDAP_OPT_DEREF": 1
},
"basedn": "DC=test,DC=local",
"userbasedn": "DC=test,DC=local",
"groupbasedn": "DC=test,DC=local",
"searchattribute": "samaccountname",
"searchstring": "USER-NAME@test.local",
"usernameattribute": "samaccountname",
"realnameattribute": "cn",
"emailattribute": "mail",
"grouprequest": "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\UserMemberOf::factory",
"presearchusernamemodifiers": [ "spacestounderscores", "lowercase" ]
},
"userinfo": [],
"authorization": {
"rules": {
"groups": {
"required": ["CN=grpwikiutilisateur,OU=test,DC=test,DC=local"]
}
}
}
},
"groupsync": {
"mapping": {
"engineering": "CN=grpwikiutilisateur,OU=test,DC=test,DC=local",
"bureaucrat": "CN=grpwikiadmin,OU=test,DC=test,DC=local",
"interface-admin": "CN=grpwikiadmin,OU=test,DC=test,DC=local",
"sysop": "CN=grpwikiadmin,OU=test,DC=test,DC=local"
}
}
}
}
################### localconfig.php ###################
// Safe IP or not (for bypassing external login via AD)
$safeIPs = array('127.0.0.1','localhost');
$ipsVars = array('HTTP_X_FORWARDED_FOR','HTTP_X_REAL_IP','REMOTE_ADDR');
foreach ($ipsVars as $ipsVar) {
if (isset($_SERVER[$ipsVar]) && mb_strlen($_SERVER[$ipsVar]) > 3 ) { $wikiRequestIP = $_SERVER[$ipsVar]; break; }
}
$wikiRequestSafe = (isset($wikiRequestIP) && ( in_array($wikiRequestIP,$safeIPs) ));
// Create Wiki-Group 'engineering' from default user group
$wgGroupPermissions['engineering'] = $wgGroupPermissions['user'];
// Privatisation du Wiki
$wgEmailConfirmToEdit = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['sysop']['createaccount'] = false;
$wgGroupPermissions['*']['autocreateaccount'] = true;
$wgBlockDisablesLogin = true;
// Chargement du fichier Json si il existe sans erreur
$ldapJsonFile = "$IP/ldap.json";
$ldapConfig = false;
if (is_file($ldapJsonFile) && is_dir("$IP/extensions/LDAPProvider")) {
$testJson = @json_decode(file_get_contents($ldapJsonFile),true);
if (is_array($testJson)) {
$ldapConfig = true;
} else {
error_log("Found invalid JSON in file: $IP/ldap.json");
}
}
//////////// Active l'extension
if ( $ldapConfig ) {
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'LDAPAuthentication2' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPUserInfo' );
wfLoadExtension( 'LDAPGroups' );
$LDAPProviderDomainConfigs = $ldapJsonFile;
$wgPluggableAuth_ButtonLabel = "Connexion LDAP";
if ($wikiRequestSafe) { $LDAPAuthentication2AllowLocalLogin = true; }
}
################### My configuration ###################
Mediawiki : 1.34
PHP7.3.14-1~deb10u1 (apache2handler)
DAPAuthentication2 1.0.1 (4836429) 20 mars 2020 à 07:29
LDAPAuthorization 1.1.0 (c7d1c50) 18 mars 2020 à 22:23
LDAPGroups 1.0.2 (d8f8e90) 18 mars 2020 à 22:24
LDAPProvider 1.0.3 (ecf3c2d) 18 mars 2020 à 22:37
LDAPUserInfo 1.0.0 (ea18199) 18 mars 2020 à 22:38
PluggableAuth 5.7 (17fb1ea) 13 septembre 2019 à 10:20