Extension:LDAPAuthorization/fi

This extension is part of the LDAP Stack and requires the LDAPProvider extension to be installed first.
Category:LDAP Stack Member/fi
This extension depends on the PluggableAuth extension, which must be installed beforehand.
Category:PluggableAuth plugins/fi

This extensions checks for certain authorization requirements when logging into a wiki by using Extension:PluggableAuth or Extension:Auth remoteuser. If one of the requirements are not satisfied the login process will be cancelled.

Category:Extensions with invalid or missing type/fiCategory:GPL licensed extensions/fi
MediaWikin laajennukset-ohje
LDAPAuthorization
Julkaisustatus: vakaaCategory:Stable extensions/fi
Tekijä(t) Cindy Cicalese, Mark A. Hershberger, Robert Vogel
Viimeisin versio 1.0.0
Yhteensopivuuskäytäntö Snapshots releases along with MediaWiki. Master is not backward compatible.
MediaWiki 1.31+Category:Extensions with manual MediaWiki version/fi
Lisenssi GNU General Public License 2.0 tai myöhempi
Lataa
Download extension
Git [?]:
Category:Extensions in Wikimedia version control/fi
Parametrit
  • $wgAutoAuthUsernameNormalizer
  • $wgAutoAuthRemoteUserStringParserRegistry
  • $wgAutoAuthRemoteUserStringParser
  • $wgAutoAuthBypassWithCookieUsernameRemoteAddrs
Käytetyt kytköspisteet
Voit kääntää LDAPAuthorization-laajennuksen mikäli se on saatavilla translatewiki.netissä
Category:All extensions/fi

Asennus

  • Install the LDAPProvider and PluggableAuth extensions.
  • Lataa ja siirrä purettu kansio nimeltä LDAPAuthorization extensions/-kansioosi.
    Kehittäjien ja koodipaikkauksia tekevien tahojen tulisi asentaa laajennos git-versionhallintaohjelmaa käyttäen:
    cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/LDAPAuthorization
  • Lisää seuraava koodi LocalSettings.php -tiedostosi loppuosaan: 
    wfLoadExtension( 'LDAPAuthorization' );
    Configure as required.
  • Yes Tehty – Mene wikisi sivulle Special:Version vahvistaaksesi, että laajennoksen asennus onnistui.

Laajennuksen kokoonpanoasetukset

When using them in LocalSettings.php, these variables need to be prefixed with $LDAPAuthorization
Nimi Oletus Kuvaus
AutoAuthRemoteUserStringParserRegistry 
{
 "domain-backslash-username": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\DomainBackslashUsername::factory",
 "username-at-domain": "MediaWiki\\Extension\\LDAPAuthorization\\AutoAuth\\RemoteUserStringParser\\UsernameAtDomain::factory"
}
A registry of factory callbacks for different parsers, that extract domain and username from a provided domain-username.

Must return IRemoteUserStringParser object.

Only used in case of auto-authentication provided by Extension:Auth remoteuser.

AutoAuthRemoteUserStringParser "domain-backslash-username" Configures which parser is needed to extract domain and username from a provided domain-username. Sallitut arvot ovat:
  • "domain-backslash-username" (Use this if $_SERVER['REMOTE_USER'] = "SOMEDOMAIN\\Some username")
  • "username-at-domain" (Use this if $_SERVER['REMOTE_USER'] = "some.username@somedomain.local")

Only used in case of auto-authentication provided by Auth remoteuser.

AutoAuthUsernameNormalizer "" A callback that allows to modify the username when Extension:Auth_remoteuser is used for network based authentication. E.g. "strtolower".

If form based authentication is also enabled though Extension:LDAPAuthentication2 this should have the same value as $LDAPAuthentication2UsernameNormalizer. Only used in case of auto-authentication provided by Extension:Auth remoteuser.

Verkkotunnuksen kokoonpanoasetukset

Nimi Oletus Kuvaus
rules.groups.required [] Array of group DNs that are required to complete the login process. Belonging to one group is sufficient (logical OR) to be authorized.
rules.groups.excluded [] Array of group DNs that the user may not be member of to complete the login process. Belonging to one group is sufficient (logical OR) to be forbidden to log in.
rules.attributes {} This implements the "attributes mapping" rule from Extension:LDAP Authentication

Example:

{
    "&" : {
    	"status": "active",
    	"|": {
    		"department": [ "100", "200" ],
    		"level": [ "5", "6" ]
    	}
    }
}
rules.query "" Allows to provide a standard LDAP query to be tested against the user. Comparable to $wgLDAPAuthAttribute from Extension:LDAP Authentication

Example:

&(active=TRUE)(permissionAlias=cn=X,ou=Y,ou=accounts,dc=company,dc=local)

Example 1

If you want to configure this in LocalSettings.php you can extend the configuration for LDAPProvider like in this example:

$LDAPProviderDomainConfigProvider = function() {
	$config = [
		'LDAP' => [
			'connection' => [
				...
			],
			'authorization' => [
				'rules' => [
					'groups' => [
						'required' => [ "groupname" ]
					]
				]
			]
		]
	];
...

Example 2

Here is a complete example LocalSettings.php configuration for Active Directory:

$LDAPProviderDomainConfigProvider = function()
{
	$config =
	[
		"example.com" =>
		[
			"connection" =>
			[
				"server" => "ldap.example.com",
				"user" => "cn=ldap,cn=Users,dc=example,dc=com",
				"pass" => "password",
				"basedn" => "dc=example,dc=com",
				"groupbasedn" => "dc=example,dc=com",
				"userbasedn" => "dc=example,dc=com",
				"searchattribute" => "samaccountname",
				"searchstring" => "USER-NAME@example.com",
				"usernameattribute" => "samaccountname",
				"realnameattribute" => "cn",
				"emailattribute" => "mail",
				"grouprequest" => "MediaWiki\\Extension\\LDAPProvider\\UserGroupsRequest\\GroupMember::factory"
			],
			"authorization" =>
			[
				"rules" =>
				[
					"groups" =>
					[
						"required" => [ "cn=Developers,cn=Users,dc=example,dc=com" ]
					]
				]
			],
			"groupsync" =>
			[
				"mechanism" => "mappedgroups",
				"mapping" =>
				[
					"sysop" => "cn=Developers,cn=Users,dc=example,dc=com",
					"bureaucrat" => "cn=Developers,cn=Users,dc=example,dc=com"
				]
			],
			"userinfo" =>
			[
				"email" => "mail",
				"realname" => "cn",
				"properties.gender" => "gender"
			]
		]
	];

	return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Versioning

LDAP Stack Extensions are targeted/qualified for MediaWiki LTS releases only.
However, this table helps to determine which extension-releases to use across all recent versions.
MediaWiki Release Recommended Extension Version Test Status Latest Test Date
1.35 (LTS) LDAPxxx_master Tested maaliskuu 2020
Category:LDAP extensions/fi Category:Extensions by MITRE/fi Category:User identity extensions/fi
Category:All extensions/fi Category:AuthRemoteuserFilterUserName extensions/fi Category:Extensions by MITRE/fi Category:Extensions in Wikimedia version control/fi Category:Extensions included in BlueSpice/fi Category:Extensions included in Canasta/fi Category:Extensions with invalid or missing type/fi Category:Extensions with manual MediaWiki version/fi Category:GPL licensed extensions/fi Category:LDAP Stack Member/fi Category:LDAP extensions/fi Category:PluggableAuthUserAuthorization extensions/fi Category:PluggableAuth plugins/fi Category:Stable extensions/fi Category:User identity extensions/fi