UseCases (XWiki.org)

*bind_DN* and *bind_pass* are both empty. The connection to the LDAP server will be anonymous. With OpenDS, an anonymous connection can read some needed attributes like userPassword, home, ...

66

67

1.1 Generic

68

69

1.1.1 I want to be able to reuse LDAP users membership in XWiki

70

71

e.g. if you want that all the LDAP users of group <tt>cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas</tt> to be automatically added in XWiki group <tt>XWiki.XWikiAdminGroup</tt> when the user log in, set:

72

{code}

73

xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas

74

{code}

75

76

if you want to add more mapping add them separated by <tt>|</tt>:

77

{code}

78

xwiki.authentication.ldap.group_mapping=XWiki.XWikiAdminGroup=cn=HMS Lydia,ou=crews,ou=groups,o=sevenSeas|\

79

XWiki.OtherXWikiGroup=HMS Victory,ou=crews,ou=groups,o=sevenSeas

80

{code}

81

82

#warning("The xwiki groups have to already exist")

83

84

1.1.1 My users are not located in the same organization unit

85

86

So you can't use the <tt>xwiki.authentication.ldap.bind_DN=cn={0},department=USER,department=INFORMATIK,department=1230,o=MP</tt> pattern.

87

88

The trick here is to to connect to LDAP with a user able to list LDAP users (and groups if you want to do membership synchronization).

89

90

To handle that LDAP authentication automatically search for user DN trying to match the provided login with <tt>xwiki.authentication.ldap.UID_attr</tt> attribute value. So simply set an existing administration (or any other LDAP user with the right to search in the whole LDAP server) user DN at <tt>xwiki.authentication.ldap.bind_DN</tt> and its password at <tt>xwiki.authentication.ldap.bind_pass</tt>. LDAP authentication will user it to connect to LDAP server, search for provided user and bind found DN with provided password to validate it.

91

92

For example if you have an an admin user with DN "cn=Administrator,dc=mydomain,dc=org" and password "pass" set:

93

{code}

94

xwiki.authentication.ldap.bind_DN=cn=Administrator,dc=mydomain,dc=org

95

xwiki.authentication.ldap.bind_pass=pass

96

{code}

97

98

1.1.1 My users are not located on the same server

99

100

e.g. if you use several subdomains and the users are defined separately in each subdomain. This will likely be the case when you have a configuration like this:

{code}

sub1.somedomain.com

sub2.somedomain.com

sub3.somedomain.com

...

{code}

XWiki cannot search in multiple domains (as of XWiki 1.5).

110

111

1.1.1.1 Approach 1: Configure group membership login

112

One possible solution is to make one (or more) group(s) in your AD and set the group membership to all users that have to have access to your wiki. Then configure XWiki's to only let members of that group log in. If a user wants to log in, XWiki will look up if the user's credentials are found in the group member attributes in AD. With this setting, XWiki will ignore the base_DN search, if a user was found in that group.\\

113

Take care that the group membership attribute in AD (in its default configuration) will contain the CN ("FirstName LastName") - not the sAMAccountName. So your users will have to login with their full name instead of their username.

114

115

116

1.1.1 I'm in multiwiki environment and I want my LDAP users to registered only on main wiki

117

118

Each wiki can have it's own LDAP configuration (even enable/disable LDAP) in XWiki.XWikiPreference page (edit it with object editor). What you can find in the xwiki.cfg file is just the default LDAP configuration.

119

120

When LDAP authenticator fail to authenticate to a wiki it will try in the main wiki.

121

122

In order to forbid LDAP authentication to create users on subwikis you can use one of the following way:

123

* disable LDAP in xwiki.cfg and enable it in the main wiki by choosing "Yes" in the "Ldap" field of XWiki.XWikiPreference page object

124

or

125

* disable LDAP in every sub-wikis by choosing "No" in the "Ldap" field of XWiki.XWikiPreference page object