Installing media with on debian etch against Windows Server 2003 R2 Active Directory
- Installed the ‘mediawiki’ and ‘php5-ldap’ packages.
- Hit ‘http://hostname/mediawiki’ and ran through the configuration
- mv /var/lib/mediawiki1.7/config/LocalSettings.php /var/lib/mediawiki1.7/config/
- Added the latest LdapAuthentication.php extension to /var/lib/mediawiki1.7/config/extensions
- Edited the LocalSettings.php to add:
# Additions for LDAP Auth
$wgAuth = new LdapAuthenticationPlugin();
$wgLDAPDomainNames = array(
$wgLDAPServerNames = array(
‘AD’ => ‘dc01.example.com’
$wgLDAPSearchStrings = array(
‘AD’ => ‘uid=USER-NAME,dc=corp,dc=example,dc=com’
$wgLDAPEncryptionType = array(
‘AD’ => ‘clear’
$wgLDAPProxyAgent = array(
‘AD’ => ‘CN=LDAP User,CN=Users,DC=corp,DC=example,DC=com’
$wgLDAPProxyAgentPassword = array(
‘AD’ => ‘password’
$wgMinimalPasswordLength = 1;
# Prevent new user registrations except by sysops
$wgGroupPermissions['*']['createaccount'] = false;
Trying to log in just gave me a blank white page and no LDAP traffic on the DC. I had seen talk of configuring ssl via openldap so I wasn’t sure I had all the right packages since I lacked /etc/openldap.
- I installed the ‘libldap-2.3-0′ package which notably said ‘Replacing files in old package libldap2 …’ but with no change.
- I restarted apache2 and then on login I got an invalid password error and saw LDAP traffic.
- I noticed in the traffic that it was logging in as ‘uid=Username,dc=corp,dc=example,dc=com’
- In the changelog for 1.7f there is “Added function in for changing usernames to lowercase to fix: Extension Talk:LDAP_Authentication Username_modified_.28capital_letter.29.2C_authentication_fails (only works in versions 1.6+)” (Link was broken, added spaces). So I added ‘$wgLDAPGroupLowerCaseUsername = true;’ to LocalSettings.php. This made no difference.
- I tried ‘$wgLDAPLowerCaseUsername = true;’ which made no difference.
- I realized that it was trying to bind to ‘uid=user,dc=corp,dc=example,dc=com’ and went back to take out the SearchString entry and replaced it with:
$wgLDAPSearchAttributes = array(
‘AD’ => ’sAMAccountName’
- I tried both SAMAccountName and uid, both showing “No Such Objects” errors in the LDAP query (via the wireshark traffic dump).
- Parsing through the source for LdapAuthentication.php I found the $wgLDAPDebug variable. It’s compared against a debugVal integer, so I set ‘$wgLDAPDebug = 10;’ and got a bunch of text output printed on the login page when I tried to log in.
- Looking at the source between ‘Connected successfully’ and ‘Entering getSearchString’ I should have been seeing ‘Lowercasing the username: $username’, but I wasn’t.
- I stared at the LdapAuthentication.php code for a while and figured out I need this instead:
$wgLDAPLowerCaseUsername = array(
‘AD’ => true
- Finally thinking about the whole references mess, I looked for BaseDN settings in the code and added this:
$wgLDAPBaseDNs = array(
‘AD’ => ‘dc=corp,dc=example,dc=com’
- And that worked. So I flipped ‘clear’ to ’ssl’, and all login attempts started giving me a download for an empty index.php file.
- I went to my CA server, grabbed the CA’s cert in DER format
- Ran ‘openssl x509 -inform der -in myca.cer -out myca.pem -outform pem’, put this in /etc/ssl/certs
- Then I added the following to /etc/ldap/ldap.conf, despite many warnings that openssl/php didn’t read this (I <3 Debian though):
- Then bits started basically timing out this sort of trash in the apache2 error.log:
apache2: cyrus.c:468: ldap_int_sasl_open: Assertion `lc->lconn_sasl_ctx == ((void *)0)’ failed.
[Wed Aug 13 12:00:05 2008] [notice] child pid 6139 exit signal Aborted (6)
- I remembered that /etc/ssl/certs had lots of certificates in it, so I commented out the last line, and then everything worked!
- After you login you’ll get settings populated for your user in the ‘user’ table. You’ll want to grab your UID (likely 1) and run the SQL command:
INSERT INTO `user_groups` ( `ug_user` , `ug_group` ) VALUES ( ‘1′, ’sysop’);
You may need to add a prefix to user_groups if you set your DB up that way.
- I used this to basically get rid of the extra URL stuff.
- You’ll have no help pages, use this technique to change all of your help links to go to the mediawiki help links.