Mediawiki LDAP setup issues

Question

I have Mediawiki setup on a fedora machine and am attempting to get it working with our AD credentials. It is successfully connecting to our AD server and you can log into mediawiki fine with them. However now I am trying to restrict it so that only our IT department users can logon. I cant seem to get the setup correct though, the relevant section to my LocalSettings file is below:

require_once("/directo/LdapAuthentication.php");
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDomainNames = array("MYDOMAIN");
$wgLDAPServerNames = array("MYDOMAIN" => "DOMAINIP");
$wgLDAPSearchStrings = array("MYDOMAIN" => "MYDOMAIN\\USER-NAME);
$wgLDAPEncryptionType = array("MYDOMAIN" => "ssl");

$wgLDAPBaseDNs = array("MYDOMAIN" => "dc=MYDOMAIN","dc=com");
$wgLDAPSearchAttributes = array("MYDOMAIN"=>"sAMAccountName");
$wgLDAPRetrievePrefs = array("MYDOMAIN" =>true);
$wgLDAPPreferences = array("MYDOMAIN" =>array('email' => 'mail','realname'=>'displayname'));
$wgLDAPDebug =3;
$wgLDAPExceptionDetails = true;

$wgLDAPRequiredGroups = array("MYDOMAIN" => array("OU=Users,OU=IT,OU=Admin,DC=MYDOMAIN,DC=com"));

If I remove that last line about required groups i can log in fine. Our setup in AD for folders is as follows from top to bottom MYDOMAIN-> Admin -> IT ->Users ->John Doe. But like i said if i implement that last line no one can log in to our mediawiki.

Answer 1

As stated in the comment the wiki should only be accessed (read/written) by a group.

The way we have solved this is using a combination of apache basic authentication first. So in the vhost of the wiki you set a Directory directive:

    <Directory /srv/apacheprod/html/mediawiki >
    AllowOverride All
    AuthBasicProvider ldap
    AuthType Basic
    AuthzLDAPAuthoritative off
    AuthName "Wiki Operations"

    AuthLDAPUrl "ldap://domain.local:3268/DC=DOMAIN,DC=LOCAL?sAMAccountName?sub?(objectClass=*)" NONE

    # bind as wiki user
    AuthLDAPBindDN "cn=wiki,ou=service_accounts,dc=domain,dc=local"
    AuthLDAPBindPassword pwd

    # members of these groups may log in
    # do not use inverted comma's in the group distinguished name or it won't work!
    require ldap-group CN=ICT - Operations,OU=Security Groepen,DC=domain,DC=local
    require ldap-group CN=ICT - devs,ou=security groepen,DC=domain,DC=local

</Directory>

This protects the wiki from users not belonging to those groups, but we want that once logged in, the users already have a mediawiki account. That's the next step using the ldap authentication extension for mediawiki

So download the extension and modify your LocalSettings.php. Ours looks like this:

##### LdapAuth plugin #####

## load the library
require_once( "$IP/extensions/LdapAuthentication/LdapAuthentication.php" );
require_once( "$IP/extensions/LdapAuthentication/LdapAutoAuthentication.php" );

## create an object
$wgAuth = new LdapAuthenticationPlugin();

# we are using AD, so define it here
$wgLDAPDomainNames = array(
    "AD",
);

# ldap servers for AD
$wgLDAPServerNames = array(
    "AD" => "dc01.domain.local dc02.domain.local dc03.domain.local"
);

$wgLDAPEncryptionType = array(
    "AD" => "clear"
);

$wgLDAPProxyAgent = array(
    "AD" => "CN=mediawiki,OU=Service_accounts,DC=domain,DC=local"
);

$wgLDAPProxyAgentPassword = array(
    "AD" => "pwd"
);

$wgLDAPBaseDNs = array(
    "AD" => "dc=domain,dc=local"
);

$wgLDAPSearchAttributes = array(
    "AD" => "sAMAccountName",
);

//Option for allowing the retrieval of user preferences from LDAP.
//Only pulls a small amount of info currently.
//Default: false
//DEPRECATED in 1.2a
$wgLDAPRetrievePrefs = array(
    "AD"=>false
);

//Option for pulling specific preferences. Available options
//are "email", "realname", "nickname", "language"
//Ensure all attribute names given are in lower case.
//Default: none; disabled
//Available in 1.2a
$wgLDAPPreferences = array(
    "AD"=>array( "email"=>"mail","realname"=>"displayname","nickname"=>"cn","language"=>"preferredlanguage")
);

$wgLDAPAutoAuthUsername = preg_replace( '/@.*/', '', $_SERVER["REMOTE_USER"] );

$wgLDAPAutoAuthDomain = "AD" ;

# debugging this extension, uncomment if needed
#$wgLDAPDebug = 1;
#$wgDebugLogGroups['ldap'] = '/srv/apacheprod/html/mediawiki/tmp/ldap_debug.log';

AutoAuthSetup();

With these settings we achieve what you intend to do.