Thanks for the suggestion. Unfortunately, it looks like I will need a lot more hand holding to figure out whether or not I can use the trusted ldap authenticator as you suggest. 1. I found the following comment in xwiki.cfg #-# Used by some authenticators (like com.xpn.xwiki.user.impl.xwiki.AppServerTrustedAuthServiceImpl) But I didn't find that the string anywhere else in the files in WEB-INF. So I'm not sure if I'm using that particular authenticator. Is it the default? How does one select a specific authenticator? 2. In the readme for the extension https://github.com/xwiki-contrib/xwiki-authenticator-trusted-ldap/blob/mast… the configuration examples all seem to refer to authentication using LDAP (and the name of the extension implies that it is intended for LDAP). But in my configuration, xwiki isn't talking to LDAP - it is instead talking to a CAS server which in turn talks to Active Directory (using the LDAP protocol). As a consequence, LDAP authentication is disabled in xwiki.cfg. Instead my xwiki.cfg file has the following line: xwiki.authentication.authclass=org.xwiki.contrib.authentication.cas.XWikiCASAuthenticator Is it true that this extension can be used for CAS authentication as well as LDAP? 3. The extension appears to rely on regexp for transformation/translation of the user ID. I inadvertently omitted one detail from my description of the problem. The mapping from LDAP/CAS user ID to xwiki ID is not as simple as replacing a period with an underscore. Here, people sometimes have multiple surnames or use a second given name in to a surname. As an example, my name might be 'Mark Thomas Jones Sack'. And in xwiki I might have created a user with the ID 'mark_sack'. But in Active Directory, the ID might be 'mark.thomas' or 'mark.jones'. For a mapping such as this from 'mark.jones' to 'mark_sack', I think I would need a separate field (like LDAPProfileClass provides) instead of just a regexp expression. Regards Mark -- View this message in context: http://xwiki.475771.n2.nabble.com/Jasig-CAS-authentication-and-users-with-p… Sent from the XWiki- Users mailing list archive at Nabble.com.

My bad. I am indeed using the extension http://extensions.xwiki.org/xwiki/bin/view/Extension/Authenticator+Jasig+CAS <http://extensions.xwiki.org/xwiki/bin/view/Extension/Authenticator+Jasig+CAS> I just assumed this extension would be the only choice for CAS authentication. So I didn't explicitly mention it. The CAS server has its own login page (at least in the Ruby implementation that I am using). That server takes the ID and password entered on the login page and passes it through to whatever service(s) (LDAP, database, etc.) it is configured to authenticate against. The real value of CAS is that it remembers the user's login status and doesn't ask the user to re-authenticate if he wants to log in to to a different app but already has a status of logged in. Since CAS is intended to handle login requests from multiple applications, it isn't really the right place to do a mapping of user IDs such as that required specifically by xwiki. I'll continue to poke around for alternatives but it appears that, since my programming skills aren't very deep, I'll need to fall back to recreating the users. In the long term, I can see two alternative enhancements to prevent users from getting into this predicament: - remove the restriction that xwiki user IDs cannot contain periods (which I understand from previous posts is difficult and not on the list of priorities) - enhance the xwiki Jasig CAS extension to provide a mapping capability similar to that of LDAPProfileClass (this would depend on the maintainer of the extension, I suppose). All of this is just my two cents worth. I can understand why fixing this issue would not be a high priority since, in any system with a large number of users, the users would not be created manually as I have done. I also have the option of setting the system to create users when they first log in, thus avoiding the problem when adding new users in future. (For now, I need the database nicely populated to demonstrate its utility to the user community and can't rely on them all logging in first.) Thanks for your help in investigating the issue. Regards Mark -- View this message in context: http://xwiki.475771.n2.nabble.com/Jasig-CAS-authentication-and-users-with-p… Sent from the XWiki- Users mailing list archive at Nabble.com.

Created http://jira.xwiki.org/browse/AUTHCAS-1 <http://jira.xwiki.org/browse/AUTHCAS-1> -- View this message in context: http://xwiki.475771.n2.nabble.com/Jasig-CAS-authentication-and-users-with-p… Sent from the XWiki- Users mailing list archive at Nabble.com.