Extension:LDAPAuthentication2
LDAPAuthentication2 Release status: stable |
|
---|---|
File:MWStake LDAPStack Icon.svg | |
Implementation | User identity |
Author(s) | |
Latest version | 1.0.1 |
Compatibility policy | For every MediaWiki release that is a Long Term Support release there is a corresponding branch in the extension. |
MediaWiki | 1.31+ |
Composer | mediawiki/ldap-authentication-2 |
License | GNU General Public License 2.0 or later |
Download | |
|
|
|
|
Quarterly downloads | Lua error in Module:Extension at line 172: bad argument #1 to 'inNamespace' (unrecognized namespace name 'skin'). |
Public wikis using | Lua error in Module:Extension at line 172: bad argument #1 to 'inNamespace' (unrecognized namespace name 'skin'). |
Translate the LDAPAuthentication2 extension if it is available at translatewiki.net | |
Issues | Open tasks · Report a bug |
Installation
- <translate> [[<tvar name=2>Special:ExtensionDistributor/LDAPAuthentication2</tvar>|Download]] and move the extracted <tvar name=name>
LDAPAuthentication2
</tvar> folder to your <tvar name=ext>extensions/
</tvar> directory.</translate>
<translate> Developers and code contributors should install the extension [[<tvar name=git>Special:MyLanguage/Download from Git</tvar>|from Git]] instead, using:</translate>cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/LDAPAuthentication2 - <translate> Add the following code at the bottom of your <tvar name=1>LocalSettings.php </tvar> file:</translate>
wfLoadExtension( 'LDAPAuthentication2' );
- Configure as required.
- File:OOjs UI icon check-constructive.svg <translate> Done</translate> – <translate> Navigate to <tvar name=special>Special:Version</tvar> on your wiki to verify that the extension is successfully installed.</translate>
Configuration
Extension settings
$LDAPAuthentication2AllowLocalLogin
- Whether or not to display a "local" pseudo-domain in the domain selector on "Special:Login", thus allowing to authenticate against the local user database. (defaults to
false
) $LDAPAuthentication2UsernameNormalizer
- Use this function for normalizing username for LDAP, for example 'strtolower'. Needed after migration from earlier Version. (defaults to
""
)
Domain settings
authentication.usernameattribute
- The LDAP user object attribute name that should be used as a local wiki user username (defaults to
"samaccountname"
) authentication.realnameattribute
- The LDAP user object attribute name that should be used as a local wiki user realname (defaults to
"cn"
) authentication.emailattribute
- The LDAP user object attribute name that should be used as e-mail address for the local wiki user (defaults to
"mail"
)
Versioning
MediaWiki Release | Recommended Extension Version | Test Status | Latest Test Date |
---|---|---|---|
1.35 (LTS) | LDAPxxx_master | Tested | March 2020 |
Further Reading
Migration from PluggableAuth 5
In REL1_39 branch LDAPAuthentication2 was adapted to PluggableAuth 6.
So in case of migration from REL1_35-REL1_38 (PluggableAuth 5) to REL1_39 (PluggableAuth 6) some configuration needs to be changed. Here is the example of the old configuration:
// In any case we need to specify LDAP domain configs
$LDAPProviderDomainConfigs = "$IP/../ldapprovider.json";
// Local login is enabled
$wgPluggableAuth_EnableLocalLogin = true;
$LDAPAuthentication2AllowLocalLogin = true;
...
$wgPluggableAuth_Class = "MediaWiki\\Extension\\LDAPAuthentication2\\PluggableAuth";
$wgPluggableAuth_ButtonLabel = "Log In (PluggableAuth)";
As a result, "Log In (PluggableAuth)" login button will appear on login page, with "domains" dropdown.
Domains list is obtained from the domain configs file. Let's assume that we have "ldap1" and "ldap2" domains configured there, still it is not reflected in PluggableAuth 5 configuration.
Here is how such configuration should be changed to be compatible with PluggableAuth 6:
// In any case we need to specify LDAP domain configs
$LDAPProviderDomainConfigs = "$IP/../ldapprovider.json";
// If local login is supported as well, then these globals are still needed
$wgPluggableAuth_EnableLocalLogin = true;
$LDAPAuthentication2AllowLocalLogin = true;
...
$wgPluggableAuth_Config['Log In (LDAP1)'] = [
'plugin' => 'LDAPAuthentication2',
'data' => [
'domain' => 'ldap1'
]
];
$wgPluggableAuth_Config['Log In (LDAP2)'] = [
'plugin' => 'LDAPAuthentication2',
'data' => [
'domain' => 'ldap2'
]
];
Here "ldap1" and "ldap2" are domains which are configured in domain configs file.
As a result, "Log In (LDAP1)" and "Log In (LDAP2)" login buttons will appear on login page.
So the main difference is that:
- There is only one login button per LDAP domain.
- Now
$wgPluggableAuth_Config
global should be used. $wgPluggableAuth_Class
global is not used anymore.
File:OOjs UI icon information-progressive.svg | <translate> This extension is included in the following wiki farms/hosts and/or packages:</translate>
<translate> This is not an authoritative list.</translate> <translate> Some wiki farms/hosts and/or packages may contain this extension even if they are not listed here.</translate> <translate> Always check with your wiki farms/hosts or bundle to confirm.</translate> |
- Pages with script errors
- Pages with broken file links
- MediaWiki Stakeholders' Group
- LDAP Stack Member
- PluggableAuth plugins
- Stable extensions
- User identity extensions
- Extensions with long-term support release branches compatibility policy
- Extensions with manual MediaWiki version
- Extensions supporting Composer
- GPL licensed extensions
- Extensions in Wikimedia version control
- All extensions
- LDAP extensions
- Login extensions