本地域上的LDAP，在Debian 10上具有Mediawiki

Question

我有一个MediaWiki（1.34）在我们本地网络的Debian 10 linux VM上运行。我们有一个由Win Server 2008 R2管理的本地域（abc.local）。我正在尝试实施LDAP，因此只有abc.local域用户可以使用我们的Wiki。当我使用此测试ldapprovider.json进行测试时，我安装了所有必需的扩展程序和所有似乎正常工作。我不知道此测试域的凭据，所以我得到了：

这似乎告诉我LDAP正在运行，并尝试根据我提供的虚假用户凭据进行身份验证。因此，现在我尝试为我的本地域修改ldapprovider.json。我最初尝试做的就是更改“服务器”，“用户”和“通过”。 5.5.5.5是我们的内部本地域控制器。

{
    "LDAP": {
            "connection": {
                    "server": "5.5.5.5",
                    "user": "cn=Administrator,dc=example,dc=com",
                    "pass": "XXXXXXXXXX",
                    "options": {
                            "LDAP_OPT_DEREF": 1
                    },
                    "basedn": "dc=example,dc=com",
                    "groupbasedn": "dc=example,dc=com",
                    "userbasedn": "dc=example,dc=com",
                    "searchattribute": "uid",
                    "searchstring": "uid=USER-NAME,dc=example,dc=com",
                    "usernameattribute": "uid",
                    "realnameattribute": "cn",
                    "emailattribute": "mail"
            },
            "userinfo": {
                    "attributes-map": {
                            "email": "mail",
                            "realname": "cn",
                            "nickname": "uid",
                            "language": "preferredlanguage"
                    }
            },
            "groupsync": {
                    "mapping": {
                            "mathematicians": "ou=mathematicians,dc=example,dc=com",
                            "scientists": "ou=scientists,dc=example,dc=com"
                    }
            }
    }
}

这次，当我输入用户凭据时，出现以下错误：

[f66f7d40890c442c71165a80] /index.php/Special:PluggableAuthLogin MWException from line 157 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (49) Invalid credentials

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()
#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()
#2 /var/www/html/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(76): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)
#3 /var/www/html/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)
#4 /var/www/html/mediawiki/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)
#5 /var/www/html/mediawiki/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)
#6 /var/www/html/mediawiki/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)
#7 /var/www/html/mediawiki/includes/MediaWiki.php(900): MediaWiki->performRequest()
#8 /var/www/html/mediawiki/includes/MediaWiki.php(527): MediaWiki->main()
#9 /var/www/html/mediawiki/index.php(44): MediaWiki->run()
#10 {main}

我不知道如何为我的本地域ldapprovider.json修改abc.local。不知道这是否有帮助，但是当我将计算机加入域时，我使用“ abc.local”，而当用户登录时使用“ abc \ username”。

ps.s。由于获得了from this question的认真帮助/辅导，我才走到现在。只是讨厌放弃...

EDIT1：我将Linux机器joined移到Windows域，并且realm discover，realm join和id命令得到以下结果。工作正常-可以为用户rjsmith（他既是用户，也是工程师组成员）提供ID。

root@mediawiki-linux:/etc# realm discover abc.local
abc.local
  type: kerberos
  realm-name: abc.local
  domain-name: abc.local
  configured: no
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin



root@mediawiki-linux:/etc# realm join abc.local
Password for Administrator:
root@mediawiki-linux:/etc#


root@mediawiki-linux:/etc# realm discover abc.local
abc.local
  type: kerberos
  realm-name: abc.local
  domain-name: abc.local
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %[email protected]
  login-policy: allow-realm-logins


root@mediawiki-linux:/etc# id [email protected]
uid=521401112([email protected]) gid=521400513(domain [email protected]) groups=521400513(domain [email protected]),521401111([email protected])

EDIT2：这是我的LDAPProviderDomainConfigProvider文件中的LocalSettings.php函数。仍然出现Could not bind to LDAP: (49) Invalid credentials.错误。

$LDAPProviderDomainConfigProvider = function() {
    $config = [
        'LDAP' => [
            'connection' => [
                "server" => "5.5.5.5"
                "user" => "[email protected],dc=abc,dc=local",
                "pass" => 'password',
                "options" => [
                    "LDAP_OPT_DEREF" => 1
                ],
                "basedn" => "dc=abc,dc=local",
                "groupbasedn" => "dc=abc,dc=local",
                "userbasedn" => "dc=abc,dc=local",
                "searchattribute" => "uid",
                "searchstring" => "uid=USER-NAME,dc=abc,dc=local",
                "usernameattribute" => "uid",
                "realnameattribute" => "cn",
                "emailattribute" => "mail"
            ]
        ]
    ];

    return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

Answer 1

基于注释，您的错误似乎是您需要将ldap连接绑定到的用户名不是[email protected],dc=abc,dc=local，而是[email protected]。

因此，请在您的ldap配置中将扩展名更改为类似的内容：

$LDAPProviderDomainConfigProvider = function() {
    $config = [
        'LDAP' => [
            'connection' => [
                "server" => "5.5.5.5"
                "user" => "[email protected]",
                "pass" => 'password',
                "options" => [
                    "LDAP_OPT_DEREF" => 1
                ],
                "basedn" => "dc=abc,dc=local",
                "groupbasedn" => "dc=abc,dc=local",
                "userbasedn" => "dc=abc,dc=local",
                "searchattribute" => "uid",
                "searchstring" => "uid=USER-NAME,dc=abc,dc=local",
                "usernameattribute" => "uid",
                "realnameattribute" => "cn",
                "emailattribute" => "mail"
            ]
        ]
    ];

    return new \MediaWiki\Extension\LDAPProvider\DomainConfigProvider\InlinePHPArray( $config );
};

应该在登录时从LDAP检索用户信息的技巧（看一下更改后的user属性。