Extension:LDAPAuthorization/ru

File:MediaWiki Stakeholders' Group Logo.svg <translate> This extension is maintained by a member of the <tvar name=1>MediaWiki Stakeholders' Group </tvar>.</translate>

File:MWStake LDAPStack Icon.svg This extension is part of the LDAP Stack and requires the LDAPProvider extension to be installed first.

File:PluggableAuth Icon.svg This extension requires the PluggableAuth extension to be installed first.

This extensions checks for certain authorization requirements when logging into a wiki by using Разришение:PluggableAuth or Extension:Auth remoteuser . If one of the requirements are not satisfied the login process will be cancelled.

Справка по расширениям MediaWiki

File:OOjs UI icon advanced-invert.svg LDAPAuthorization Статус релиза: стабильно
File:MWStake LDAPStack Icon.svg
Автор(ы)	Cindy Cicalese, Mark A. Hershberger, Robert Vogel
Последняя версия	1.0.0
Политика совместимости	Snapshots releases along with MediaWiki. Master is not backward compatible.
MediaWiki	1.31+
Лицензия	GNU General Public License 2.0 или позднее
Скачать	<translate> Download extension</translate> <translate> Git</translate> [?]: <translate> Download Git master</translate> <translate> browse repository</translate> (Phabricator · GitHub) <translate> commit history</translate> <translate> repository contributors (GitHub)</translate> <translate> code review</translate>
Ежеквартальные загрузки
Использование общедоступными вики
Переведите расширение LDAPAuthorization, если оно доступно на translatewiki.net

Установка

• Install the LDAPProvider and PluggableAuth extensions.
• <translate> [[<tvar name=2>Special:ExtensionDistributor/LDAPAuthorization</tvar>|Download]] and move the extracted <tvar name=name>LDAPAuthorization</tvar> folder to your <tvar name=ext>extensions/</tvar> directory.</translate>
  <translate> Developers and code contributors should install the extension [[<tvar name=git>Special:MyLanguage/Download from Git</tvar>|from Git]] instead, using:</translate>cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/LDAPAuthorization
• <translate> Add the following code at the bottom of your <tvar name=1>LocalSettings.php </tvar> file:</translate>

  wfLoadExtension( 'LDAPAuthorization' );
  

  Configure as required.
• File:OOjs UI icon check-constructive.svg <translate> Done</translate> – <translate> Navigate to <tvar name=special>Special:Version</tvar> on your wiki to verify that the extension is successfully installed.</translate>

Параметры конфигурации расширения

When using them in LocalSettings.php, these variables need to be prefixed with $LDAPAuthorization

Название	По умолчанию	Описание
AutoAuthRemoteUserStringParserRegistry	{ "domain-backslash-username": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\DomainBackslashUsername::factory", "username-at-domain": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\UsernameAtDomain::factory" }	A registry of factory callbacks for different parsers, that extract domain and username from a provided domain-username. Должен возвращать объект IRemoteUserStringParser. Only used in case of auto-authentication provided by Extension:Auth remoteuser .
AutoAuthRemoteUserStringParser	"domain-backslash-username"	Configures which parser is needed to extract domain and username from a provided domain-username. Допустимые значения: "domain-backslash-username" (Use this if $_SERVER['REMOTE_USER'] = "SOMEDOMAIN\\Some username") "username-at-domain" (Use this if $_SERVER['REMOTE_USER'] = "some.username@somedomain.local") Only used in case of auto-authentication provided by Auth remoteuser.
AutoAuthUsernameNormalizer	""	A callback that allows to modify the username when Extension:Auth_remoteuser is used for network based authentication. E.g. "strtolower". If form based authentication is also enabled though Extension:LDAPAuthentication2 this should have the same value as $LDAPAuthentication2UsernameNormalizer. Only used in case of auto-authentication provided by Extension:Auth remoteuser .

Параметры конфигурации домена

Название	По умолчанию	Описание
rules.groups.required	[]	Array of group DNs that are required to complete the login process. Belonging to one group is sufficient (logical OR) to be authorized.
rules.groups.excluded	[]	Array of group DNs that the user may not be member of to complete the login process. Belonging to one group is sufficient (logical OR) to be forbidden to log in.
rules.attributes	{}	This implements the "attributes mapping" rule from Extension:LDAP Authentication Example: { "&" : { "status": "active", "|": { "department": [ "100", "200" ], "level": [ "5", "6" ] } } }
rules.query	""	Allows to provide a standard LDAP query to be tested against the user. Comparable to $wgLDAPAuthAttribute from Extension:LDAP Authentication Example: &(active=TRUE)(permissionAlias=cn=X,ou=Y,ou=accounts,dc=company,dc=local)

Example 1

If you want to configure this in LocalSettings.php you can extend the configuration for LDAPProvider like in this example:

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				...
			],
			'authorization' => [
				'rules' => [
					'groups' => [
						'required' => [ "groupname" ]
					]
				]
			]
		]
	];
...

Example 2

Here is a complete example LocalSettings.php configuration for Active Directory:

$LDAPProviderDomainConfigProvider = function()
{
	$config =
	[
		"example.com" =>
		[
			"connection" =>
			[
				"server" => "ldap.example.com",
				"user" => "cn=ldap,cn=Users,dc=example,dc=com",
				"pass" => "password",
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "samaccountname",
				"searchstring" => "USER-NAME@example.com",
				"usernameattribute" => "samaccountname",
				"realnameattribute" => "cn",
				"emailattribute" => "mail",
				"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
			],
			"authorization" =>
			[
				"rules" =>
				[
					"groups" =>
					[
						"required" => [ "cn=Developers,cn=Users,dc=example,dc=com" ]
					]
				]
			],
			"groupsync" =>
			[
				"mechanism" => "mappedgroups",
				"mapping" =>
				[
					"sysop" => "cn=Developers,cn=Users,dc=example,dc=com",
					"bureaucrat" => "cn=Developers,cn=Users,dc=example,dc=com"
				]
			],
			"userinfo" =>
			[
				"email" => "mail",
				"realname" => "cn",
				"properties.gender" => "gender"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versioning

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
However, this table helps to determine which extension-releases to use across all recent versions.

MediaWiki Release	Recommended Extension Version	Test Status	Latest Test Date
1.35 (LTS)	LDAPxxx_master	Tested	March 2020