UseCases

Version 14.1 by Thomas Mortagne on 2009/06/19 12:11
Warning: For security reasons, the document is displayed in restricted mode as it is not the current version. There may be differences and errors due to this.

Use cases of configuration to authenticate users with LDAP

Here you can find some detailed uses cases of LDAP authentication configuration.

Invalid macro parameters used for the [toc] macro. Cause: [Failed to validate bean: [must be greater than or equal to 1]]. Click on this message for details.

I want to be able to reuse LDAP users membership in XWiki

e.g. if you want that all the LDAP users of group cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas to be automatically added in XWiki group XWiki.XWikiAdminGroup when the user log in, set:

xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas

if you want to add more mapping add them separated by |:

xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas|\
                                        XWiki.OtherXWikiGroup=HMS Victory,ou=crews,ou=groups,o=sevenSeas

The xwiki groups have to already exist

My users are not located in the same organization unit

So you can't use the xwiki.authentication.ldap.bind_DN=cn={0},department=USER,department=INFORMATIK,department=1230,o=MP pattern.

To handle that LDAP authentication automatically search for user DN trying to match the provided login with xwiki.authentication.ldap.UID_attr attribute value. So simply set an existing administration (or any other LDAP user with the right to search in the whole LDAP server) user DN at xwiki.authentication.ldap.bind_DN and its password at xwiki.authentication.ldap.bind_pass. LDAP authentication will user it to connect to LDAP server, search for provided user and bind found DN with provided password to validate it.

For example if you have an an admin user with DN "cn=Administrator,dc=mydomain,dc=org" and password "pass" set:

xwiki.authentication.ldap.bind_DN=cn=Administrator,dc=mydomain,dc=org
xwiki.authentication.ldap.bind_pass=pass

My users are not located on the same server

e.g. if you use several subdomains and the users are defined seperately in each subdomain. This will likely be the case when you have a configuration like this:

sub1.somedomain.com
sub2.somedomain.com
sub3.somedomain.com
...

XWiki cannot search in multiple domains (as of XWiki 1.5). 

Approach 1: Configure group membership login

One possible solution is to make one (or more) group(s) in your AD and set the group membership to all users that have to have access to your wiki. Then configure XWiki's to only let members of that group log in. If a user wants to log in, XWiki will look up if the user's credentials are found in the group member attributes in AD. With this setting, XWiki will ignore the base_DN search, if a user was found in that group.\ Take care that the group membership attribute in AD (in its default configuration) will contain the CN ("FirstName LastName") - not the sAMAccountName. So your users will have to login with their full name instead of their username.

I want to use XWiki with an Apple Open Directory Server

In order to set this up your xwiki.cfg file should have the attributes below set like this:

xwiki.authentication.ldap.bind_DN=uid={0},cn=users,dc=sub,dc=domain,dc=tld
xwiki.authentication.ldap.bind_pass={1}
xwiki.authentication.ldap.UID_attr=uid
xwiki.authentication.ldap.group_classes=apple-group
xwiki.authentication.ldap.group_memberfields=memberUid,uid

Note that if you set it up like this the users logging will need to right to list groups members in LDAP server.

About

About

Support

Platform

User Guide

Admin Guide

Developer Guide

Projects

XWiki

Extensions

Other

Contribute

Status

Practices

Under the Hood

Get Involved

Get Connected