On Fri, Aug 1, 2008 at 11:01 AM, Thomas Mortagne <[email protected]> wrote:

On Fri, Aug 1, 2008 at 9:14 AM, lukweb <[email protected]> wrote:

...

Hello all,

I'm working with the last version of XE and i get the LDAP authentication on my Active Directory Domain.

My problem is when i move a user to a different OU in the Active Directory, the user can't login in Xwiki anymore...(Error : Wrong password).

Is there a way to configure the xwiki.cfg in order the authentication could "browse" the all Active Directory to find the user and allow him to login ?

Yes LDAP authentication already do this automatically but you have to change xwiki.authentication.ldap.bind_DN and xwiki.authentication.ldap.bind_pass values to set an existing user that can read the whole LDAP (like ) instead of a pattern

(like a administrator user)

...

Thanks in advance. -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

-- Thomas Mortagne

Ok i tried to put this config in my xwiki.cfg but it doesn't work anymore when i move the user in another OU in the Active Directory : xwiki.authentication.ldap.base_DN=DC=agence,DC=masociete,DC=com xwiki.authentication.ldap.bind_DN=MASOCIETE\\wikildapuser xwiki.authentication.ldap.bind_pass=password xwiki.authentication.ldap.UID_attr=sAMAccountName xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,mail=mail,ldap_dn=dn Any idea ? -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

I just added the use case in http://platform.xwiki.org/xwiki/bin/view/AdminGuide/LDAPAuthenticationUseCas..., could you complete it if needed when you will be able to find the configuration that works for you ? On Fri, Aug 1, 2008 at 2:37 PM, Thomas Mortagne <[email protected]> wrote:

2008/8/1 lukweb <[email protected]>:

...

OK Great,

Can you just give me an example of these config parameters ?

For example if you have in your LDAP a admin user with DN "cn=Administrator,dc=mydomain,dc=org" and password "pass" simply set: xwiki.authentication.ldap.bind_DN=cn=Administrator,dc=mydomain,dc=org xwiki.authentication.ldap.bind_pass=pass

LDAP authentication will use it to connect to LDAP server then it will search provided login trying to match with field sAMAccountName (if you configured xwiki.authentication.ldap.UID_attr=sAMAccountName ) value. Then it try to execute a bind with the found user and provided password to validate it.

...

Thanks in advance.

Je continue à écrire en anglais mais je devine vu ton nom que tu parles bien la France ;-)) Ce sera pour rendre service à un maximum de gens qui rencontreront le même problème... -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

-- Thomas Mortagne

On Fri, Aug 1, 2008 at 3:05 PM, lukweb <[email protected]> wrote:

Here is the results :

When i activate this config parameter xwiki.authentication.ldap.password_field=userPassword, i can connect with an

Why do you configure xwiki.authentication.ldap.password_field=userPassword ? it should not be needed if you have validate_password=0 Can you copy past your entire auth configuration ?

account that i moved in another OU. But when i move again this account, i can't connect from another different OU : Wrong password...

-- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

On Fri, Aug 1, 2008 at 5:10 PM, lukweb <[email protected]> wrote:

Here is my xwiki.cfg :

xwiki.base=../../

xwiki.store.class=com.xpn.xwiki.store.XWikiHibernateStore xwiki.store.hibernate.path=/WEB-INF/hibernate.cfg.xml xwiki.store.hibernate.updateschema=1 xwiki.store.hibernate.custommapping=1 xwiki.store.cache=1 xwiki.store.cache.capacity=100 xwiki.store.migration=1

xwiki.monitor=1

# List of active plugins. xwiki.plugins=\ com.xpn.xwiki.monitor.api.MonitorPlugin,\ com.xpn.xwiki.plugin.calendar.CalendarPlugin,\ com.xpn.xwiki.plugin.skinx.JsSkinExtensionPlugin,\ com.xpn.xwiki.plugin.skinx.CssSkinExtensionPlugin,\ com.xpn.xwiki.plugin.feed.FeedPlugin,\ com.xpn.xwiki.plugin.ldap.LDAPPlugin,\ com.xpn.xwiki.plugin.google.GooglePlugin,\ com.xpn.xwiki.plugin.flickr.FlickrPlugin,\ com.xpn.xwiki.plugin.mail.MailPlugin,\ com.xpn.xwiki.plugin.packaging.PackagePlugin,\ com.xpn.xwiki.plugin.query.QueryPlugin,\ com.xpn.xwiki.plugin.svg.SVGPlugin,\ com.xpn.xwiki.plugin.charts.ChartingPlugin,\ com.xpn.xwiki.plugin.fileupload.FileUploadPlugin,\ com.xpn.xwiki.plugin.image.ImagePlugin,\ com.xpn.xwiki.plugin.captcha.CaptchaPlugin,\ com.xpn.xwiki.plugin.userdirectory.UserDirectoryPlugin,\

com.xpn.xwiki.plugin.usertools.XWikiUserManagementToolsImpl,\ com.xpn.xwiki.plugin.zipexplorer.ZipExplorerPlugin,\ com.xpn.xwiki.plugin.autotag.AutoTagPlugin,\ com.xpn.xwiki.plugin.lucene.LucenePlugin,\ com.xpn.xwiki.plugin.diff.DiffPlugin,\ com.xpn.xwiki.plugin.rightsmanager.RightsManagerPlugin,\ com.xpn.xwiki.plugin.jodatime.JodaTimePlugin,\ com.xpn.xwiki.plugin.scheduler.SchedulerPlugin,\ com.xpn.xwiki.plugin.mailsender.MailSenderPlugin,\ com.xpn.xwiki.plugin.watchlist.WatchListPlugin

# This parameter allows XWiki to operate in Hosting mode allowing to create # multiple wikis having their own database and responding to different URLs xwiki.virtual=0

xwiki.virtual.redirect=http://127.0.0.1:9080/xwiki/bin/Main/ThisWikiDoesNotExist

# This parameter will activate the eXo Platform integration xwiki.exo=0

xwiki.authentication=form xwiki.authentication.validationKey=totototototototototototototototo xwiki.authentication.encryptionKey=titititititititititititititititi xwiki.authentication.cookiedomains=xwiki.com,wiki.fr

# This allows logout to happen for any page going through the /logout/ action, regardless of the document or the servlet. # Comment-out if you want to enable logout only for /bin/logout/XWiki/XWikiLogout xwiki.authentication.logoutpage=(/[^/]+/|/)logout/*

# Stats configuration allows to globally activate/deactivate stats module (launch storage thread, register events...) xwiki.stats=1 # When statistics are globally enabled, storage can be enabled/disabled by wiki using the XWikiPreference property "statistics". # Note: Statistics are disabled by default for improved performances/space. xwiki.stats.default=0 # It is also possible to choose a different stats service to record statistics separately from XWiki. xwiki.stats.class=com.xpn.xwiki.stats.impl.XWikiStatsServiceImpl

xwiki.encoding=ISO-8859-1

xwiki.backlinks=1

xwiki.tags=1

# Use edit comments xwiki.editcomment=1

# Hide editcomment field and only use Javascript xwiki.editcomment.hidden=0

# Make edit comment mandatory xwiki.editcomment.mandatory=0

# Make edit comment suggested (asks 1 time if the comment is empty. # 1 shows one popup if comment is empty. # 0 means there is no popup. # This setting is ignored if mandatory is set xwiki.editcomment.suggested=0

# GraphViz plugin configuration. The GraphViz plugin is not configured by default. # To enable it, add "com.xpn.xwiki.plugin.graphviz.GraphVizPlugin" to the list of plugins # in the xwiki.plugins property. # Uncomment and set the locations of the Dot and Neato executables #xwiki.plugin.graphviz.dotpath=c:/Program Files/ATT/GraphViz/bin/dot.exe #xwiki.plugin.graphviz.neatopath=c:/Program Files/ATT/GraphViz/bin/neato.exe

xwiki.plugin.laszlo.baseurl=/openlaszlo/xwiki/ xwiki.plugin.laszlo.path=c:/Program Files/Apache Software Foundation/Tomcat 5.0/webapps/openlaszlo/xwiki/

xwiki.plugin.image.cache.capacity=30

xwiki.plugin.captcha=0

# Enable to allow superadmin. It is disabled by default as this could be a security breach if # it were set and you forgot about it. xwiki.superadminpassword=system

#------------------------------------------------------------------------------------- # LDAP #-------------------------------------------------------------------------------------

#-# new LDAP authentication service xwiki.authentication.authclass=com.xpn.xwiki.user.impl.LDAP.XWikiLDAPAuthServiceImpl

#-# Turn LDAP authentication on - otherwise only XWiki authentication #-# 0: disable #-# 1: enable xwiki.authentication.ldap=1

#-# LDAP Server (Active Directory, eDirectory, OpenLDAP, etc.) xwiki.authentication.ldap.server=55.2.64.29 xwiki.authentication.ldap.port=389

#-# LDAP login, empty = anonymous access, otherwise specify full dn #-# {0} is replaced with the username, {1} with the password # xwiki.authentication.ldap.bind_DN=cn={0},department=USER,department=INFORMATIK,department=1230,o=MP # xwiki.authentication.ldap.bind_pass={1} xwiki.authentication.ldap.base_DN=DC=agence,DC=masociete,DC=com xwiki.authentication.ldap.bind_DN=CN=srv-xwiki,CN=Users,DC=agence,DC=masociete,DC=com xwiki.authentication.ldap.bind_pass=password xwiki.authentication.ldap.UID_attr=sAMAccountName xwiki.authentication.ldap.fields_mapping=name=sAMAccountName,last_name=sn,first_name=givenName,fullname=displayName,mail=mail,ldap_dn=dn

#-# Force to check password after LDAP connection #-# 0: disable #-# 1: enable xwiki.authentication.ldap.validate_password=0

#-# only members of the following group will be verified in the LDAP # otherwise only users that are found after searching starting from the base_DN # xwiki.authentication.ldap.user_group=CN=Utilisa. du domaine,CN=Users,DC=agence,DC=masociete,DC=com

#-# base DN for searches xwiki.authentication.ldap.base_DN=DC=agence,DC=masociete,DC=com

#-# Specifies the LDAP attribute containing the identifier to be used as the XWiki name (default=cn) xwiki.authentication.ldap.UID_attr=sAMAccountName

#-# [SINCE 1.5M1, XWikiLDAPAuthServiceImpl] #-# Specifies the LDAP attribute containing the password to be used "when xwiki.authentication.ldap.validate_password" is set to 1 # xwiki.authentication.ldap.password_field=userPassword

#-# [SINCE 1.5M1, XWikiLDAPAuthServiceImpl] #-# The potential LDAP groups classes. Separated by commas. # xwiki.authentication.ldap.group_classes=group,groupOfNames,groupOfUniqueNames,dynamicGroup,dynamicGroupAux,groupWiseDistributionList

#-# [SINCE 1.5M1, XWikiLDAPAuthServiceImpl] #-# The potential names of the LDAP groups fields containings the members. Separated by commas. # xwiki.authentication.ldap.group_memberfields=member,uniqueMember

#-# retrieve the following fields from LDAP and store them in the XWiki user object (xwiki-attribute=ldap-attribute) #-# ldap_dn=dn -- dn is set by class, caches dn in XWiki.user object for faster access xwiki.authentication.ldap.fields_mapping=last_name=sn,first_name=givenName,fullname=fullName,email=mail,ldap_dn=dn

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# on every login update the mapped attributes from LDAP to XWiki otherwise this happens only once when the XWiki account is created. xwiki.authentication.ldap.update_user=1

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# mapps XWiki groups to LDAP groups, separator is "|" xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=CN=Administrateurs Wiki,CN=Users,DC=agence,DC=masociete,DC=com|\

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# time in s after which the list of members in a group is refreshed from LDAP (default=3600*6) # xwiki.authentication.ldap.groupcache_expiration=21800

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# - create : synchronize group membership only when the user is first created #-# - always: synchronize on every login xwiki.authentication.ldap.mode_group_sync=always

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# if ldap authentication fails for any reason, try XWiki DB authentication with the same credentials xwiki.authentication.ldap.trylocal=1

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# SSL connection to LDAP server #-# 0: normal #-# 1: SSL # xwiki.authentication.ldap.ssl=0

#-# [SINCE 1.3M2, XWikiLDAPAuthServiceImpl] #-# The keystore file to use in SSL connection # xwiki.authentication.ldap.ssl.keystore=

#-# [SINCE 1.5M1, XWikiLDAPAuthServiceImpl] #-# The java secure provider used in SSL connection # xwiki.authentication.ldap.ssl.secure_provider=com.sun.net.ssl.internal.ssl.Provider

#------------------------------------------------------------------------------------- # Cache #-------------------------------------------------------------------------------------

#-# [SINCE 1.5M2] #-# The cache component implementation to use as "normal" (can be local or distributed depending on the implementation) #-# cache component. xwiki.cache.cachefactory.hint=oscache

#-# [SINCE 1.5M2] #-# The cache component to use as local cache component. xwiki.cache.cachefactory.local.hint=oscache/local

#-------------------------------------------------------------------------------------

xwiki.authentication.unauthorized_code=200

# This parameter will activate the sectional editing xwiki.section.edit=1

# Uncomment if you want to ignore requests for unmapped actions, and simply display the document # xwiki.unknownActionResponse=view

# You can configure the toolbars you wish to see in the WYSIWYG editor by defining the # xwiki.wysiwyg.toolbars property. # When not defined it defaults to: # xwiki.wysiwyg.toolbars=texttoolbar, listtoolbar, indenttoolbar, undotoolbar, titletoolbar, \ # styletoolbar, horizontaltoolbar, attachmenttoolbar, macrostoolbar, \ # tabletoolbar, tablerowtoolbar, tablecoltoolbar, linktoolbar # The full list of toolbars includes the one defined above and the following ones: # subtoolbar, findtoolbar, symboltoolbar

xwiki.defaultskin=toucan xwiki.defaultbaseskin=albatross

# Calendar Prev/Next Month bounds. # The calendar generates links to the previous/next months for a limited range, by default 6 months back and 12 months after. # A value of 0 means that there is no limit in that direction. # xwiki.calendar.bound.prev=6 # xwiki.calendar.bound.next=12

# xwiki.temp.dir=/tmp/xwiki # xwiki.work.dir=/usr/local/xwiki

# xwiki.plugins.lucene.indexdir=/usr/local/xwiki/lucene # xwiki.plugins.lucene.analyzer=org.apache.lucene.analysis.standard.StandardAnalyzer # xwiki.plugins.lucene.indexinterval=20

xwiki.work.dir=work

I found what is the problem: It's not your configuration, by default XWiki store the DN in the user's profile (with the "ldap_dn=dn" in xwiki.authentication.ldap.fields_mapping property) to speed up the DN search. The problem is that it will always use the first DN used for a user even the user moved in LDAP server. So what you can do to fix it: - for existing users in XWiki: edit the user's profile page using object editor and change the value of the property ldap_dn (LDAP DN). Set the new DN or just blank it to let XWiki update it. - if you plan to move LDAP users regularely: remove the "ldap_dn=dn" from xwiki.authentication.ldap.fields_mapping property to avoid LDAP user DN storage.

Thanks for your help.

-- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

On Fri, Aug 1, 2008 at 6:22 PM, Vincent Massol <[email protected]> wrote:

On Aug 1, 2008, at 6:17 PM, Thomas Mortagne wrote:

[snip]

...

I found what is the problem: It's not your configuration, by default XWiki store the DN in the user's profile (with the "ldap_dn=dn" in xwiki.authentication.ldap.fields_mapping property) to speed up the DN search. The problem is that it will always use the first DN used for a user even the user moved in LDAP server.

So what you can do to fix it:

- for existing users in XWiki: edit the user's profile page using object editor and change the value of the property ldap_dn (LDAP DN). Set the new DN or just blank it to let XWiki update it. - if you plan to move LDAP users regularely: remove the "ldap_dn=dn" from xwiki.authentication.ldap.fields_mapping property to avoid LDAP user DN storage.

This looks like an important XWiki limitation isn't it?

I guess moving users in LDAP is a pretty common thing and we should probably not request admins to edit related XWiki users objects. That doesn't sound right.

It's not a limitation, just configuration. As I said, If you don't have "ldap_dn=dn" in xwiki.authentication.ldap.fields_mapping the DN is never stored so you don't have the problem. But maybe the default value of wiki.authentication.ldap.fields_mapping has to be changed.

WDYT?

Thanks -Vincent _______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

GREAT !!! I can't test it now because i'm not at work but i'm sure you're right about the ldap_dn because i was testing the first login of a new user anywhere in the Active Directory and it works until i move it into another OU... I will test it on next Monday and i'll give you a feedback about it. Thanks for your quick answers. P.S. : I love Xwiki but i'm sure it can be a more popular wiki if it was more documented... The standalone package (multiplatformed) is amazing. The good point is this great forum with you the great experts, thanks buddies !!! -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

On Fri, Aug 1, 2008 at 10:42 PM, lukweb <[email protected]> wrote:

GREAT !!!

I can't test it now because i'm not at work but i'm sure you're right about the ldap_dn because i was testing the first login of a new user anywhere in the Active Directory and it works until i move it into another OU...

I will test it on next Monday and i'll give you a feedback about it.

Hmm, I looked into the code and it's possible that there is a bug with LDAP DN field of user profile that someone removed by hand (but there should not be any problem with user profile that never has LDAP DN inserted). Let me know if you have problem and I will look more into it.

Thanks for your quick answers.

P.S. : I love Xwiki but i'm sure it can be a more popular wiki if it was more documented... The standalone package (multiplatformed) is amazing. The good point is this great forum with you the great experts, thanks buddies !!! -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

On Mon, Aug 4, 2008 at 10:25 AM, lukweb <[email protected]> wrote:

Hi Thomas,

Ok it's working, when i move the user in a different OU, the login is ok BUT....

...The groups mapping doesn't work anymore....

I tested it with another new user and it's not good, no more group mapping between the LDAP and Xwiki.

There is a cache for the LDAP group. You can change it using property "xwiki.authentication.ldap.groupcache_expiration" (the value is in sec) or simply restart (the cache is reinitialized when XWiki starts).

Any idea ? -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

On Mon, Aug 4, 2008 at 11:05 AM, lukweb <[email protected]> wrote:

I already tried to restart but it's the same thing.

The parameter groupcache was commented so now it's on : xwiki.authentication.ldap.groupcache_expiration=21800

I have restarted but no mapping is done.

If it does not work after restarting XWiki then it's not cache. But I don't see what can be the problem here. Does it work if you set the new user LDAP DN in its profile ? Could you enable "debug" log (see http://platform.xwiki.org/xwiki/bin/view/AdminGuide/Logging) and copy/paste what you have in the log when authenticating ?

-- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne

Hi Thomas, Forget my last message, i made several tests and as far as i know, xwiki ldap auth can't do group mapping and allow logons from differents OU in Active Directory at the same time... So for now, i choosed to keep group mapping on and if i want to move a user to a different OU, i will modify its ldap_dn value in its xwiki profile (it's working). Thanks for your help and maybe if you've got a solution/evolution to that, please tell me. Have a nice day. -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

Hi again, My version is XWiki Enterprise 1.5.11446. I have tested the cleaning of the ldap_dn value in order to allow a login in a different OU of my Active Directory and no bug for me... -- View this message in context: http://n2.nabble.com/Xwiki-LDAP-Authentication-doesn%27t-work-when-you-move-... Sent from the XWiki- Users mailing list archive at Nabble.com.

On Tue, Nov 20, 2012 at 10:00 AM, Csaba <[email protected]> wrote:

Hi,

I would like to configure the XWIKI LDAP and I encountered a specific issue defining more than one base_DN. Is this possible at all?

No, its not officially supported yet. Should be part of http://jira.xwiki.org/browse/XWIKI-2577 but nobody is assigned to work on it anytime soon (contribution welcomed ;)). That said there is the hack explained on http://platform.xwiki.org/xwiki/bin/view/AdminGuide/LDAPAuthenticationUseCas... I never tried it myself and you are not guaranty that this will work forever.

I have 2 types of Users: 1. o=org1, c=c1, dc=company 2. o=org2, c=c2, dc=company

These Users also have a common Group:

xwiki.authentication.ldap.user_group=cn=APP-SYTA- EMPLOYEES,cn=appgroups,cn=groups,dc=company

My question is: how do I configure the LDAP in this case, so that both types of users have access to xwiki? Should I use only the group configuration??

Now is configured as follows and it works for one type of users (the ones belonging in org1, c1 in LDAP):

xwiki.authentication.ldap.base_DN=o=org1,c=c1,dc=company

xwiki.authentication.ldap.bind_DN=uid={0},o=org1,c=c1,dc=company xwiki.authentication.ldap.bind_pass={1}

xwiki.authentication.ldap.user_group=cn=APP-SYTA- EMPLOYEES,cn=appgroups,cn=groups,dc=company

I would appreciate some help. Thanks a lot in advance!

Best regards!

_______________________________________________ users mailing list [email protected] http://lists.xwiki.org/mailman/listinfo/users

-- Thomas Mortagne