[Mediawiki-l] MediaWiki, LDAP Authentication and AD groups

Wed Sep 27 13:27:05 UTC 2006

>    OK - but how does this work vis-a-vis AD authentication and groups?

Good question - I only know how to do that via my own auth scripts. I use 
MediaWiki's LDAP integration for sign in and registration, but I use my own 
LDAP scripts to retrieve other information.

Here's a script that will retrieve information about a user. In my scripts, 
I don't need to authorize to retrieve public information - all I need is the 
application ID given me by the directory services. This script includes 
authentication at the end.

# Matt Hart - PHP-based authentication against the directory
# Tested on Fedora Core 4 with Apache 2.0.54, PHP 4.3.11, OpenLDAP
# OpenSSL, php-ldap

echo "<br>Attempting Secure LDAP Connection<br>";

$mh_ldaphost = "ldaps://yourdirectoryhost.com:636";
$mh_ldapconn = ldap_connect($mh_ldaphost) or die ("Failed");
echo "<br>Succeeded ... Testing app binding<br>";

# Bind using app credentials
$mh_appid = "XXXXXXX"; // ****** Use your application id
$mh_dn = "uid=" . $mh_appid . ",ou=theApps,o=dirIntuit.com";
$mh_bind = ldap_bind($mh_ldapconn, $mh_dn) or die("Failed");
echo "<br>Succeeded ... Get user corp ID</br>";

# Get the user's corporate ID
$mh_search = "ou=employees,ou=people,o=dirIntuit.com";
$mh_userid = "XXXXXXXX"; // ****** User ID to find
$mh_filter = "(uid=" . $mh_userid . ")";
$mh_search = ldap_search($mh_ldapconn, $mh_search, $mh_filter) or die 
("Failed");
echo "<br>Succeeded: ";
$mh_entries = ldap_get_entries($mh_ldapconn, $mh_search);
$mh_corpid = $mh_entries[0]["intuitid"][0];
echo "CorpID=" . $mh_corpid;

# Authenticate the user
echo "<br><br>Authenticating...<br>";

$mh_authdn = "intuitcorpid=" . $mh_corpid . 
",ou=employees,ou=people,o=intuit.com";
$mh_authpass = "XXXXXXXX"; // ****** User password
$mh_authbind = ldap_bind($mh_ldapconn, $mh_authdn, $mh_authpass) or 
die("Failed");
die("Success");

- MHart