Question

Colleagues,

Just installed TWiki as a candidate for an intranet collaborative application. We are already running M$ Active Directory 2000. Would like to use LDAP authentication and group membership in twiki. LdapContrib v.0.91 is installed.

Problem: TWikiUsers and TWikiGroups topics only display the built-in entries, nothing from LDAP.

The authentication works as needed: it lets in registered AD users with correct passwords, and rejects anyone else. The logged-in user name displayed on twiki pages is just the Windoze login name (sAMAccountName attribute). The {Ldap}{WikiNameAttribute} and {Ldap}{NormalizeWikiName} settings do not seem to have any effect.

Is there any way to achieve what we want? Where can I look further?

Many, many thanks in advance, Alexandre

P.S. Output of the configure script is attached.

Relevant part of our LocalSite.cfg (with confidential info stripped out) follows:

$TWiki::cfg{AuthRealm} = 'Enter your TWiki.LoginName. (Typically First name and last name, no space, no dots, capitalized, e.g. !JohnSmith, unless you chose otherwise). Visit TWiki.TWikiRegistration if you do not have one.';
$TWiki::cfg{PasswordManager} = 'TWiki::Users::LdapUser';
$TWiki::cfg{MinPasswordLength} = 6;
$TWiki::cfg{Htpasswd}{FileName} = '/var/www/twiki/data/.htpasswd';
$TWiki::cfg{Htpasswd}{Encoding} = 'crypt';
$TWiki::cfg{Register}{HidePasswd} = 0;
$TWiki::cfg{UserMappingManager} = 'TWiki::Users::LdapUserMapping';
$TWiki::cfg{Register}{AllowLoginName} = 1;

$TWiki::cfg{Ldap}{Host} = 'ldap.site.company.com';
$TWiki::cfg{Ldap}{Port} = 389;
$TWiki::cfg{Ldap}{Version} = '3';
$TWiki::cfg{Ldap}{Base} = 'DC=site,DC=company,DC=com';
$TWiki::cfg{Ldap}{BasePasswd} = 'OU=USERS,OU=SITE,DC=site,DC=company,DC=com';
$TWiki::cfg{Ldap}{BaseGroup} = 'OU=GROUPS,OU=SITE,DC=site,DC=company,DC=com';
$TWiki::cfg{Ldap}{LoginAttribute} = 'sAMAccountName';
$TWiki::cfg{Ldap}{LoginFilter} = 'objectClass=user';
$TWiki::cfg{Ldap}{GroupAttribute} = 'cn';
$TWiki::cfg{Ldap}{GroupFilter} = 'objectClass=group';
$TWiki::cfg{Ldap}{MemberAttribute} = 'memberOf';
$TWiki::cfg{Ldap}{MemberIndirection} = 1;
$TWiki::cfg{Ldap}{WikiNameAttribute} = 'sn, givenName';
$TWiki::cfg{Ldap}{NormalizeWikiName} = 1; 
#$TWiki::cfg{Ldap}{TWikiGroupsBackoff} = 1;
$TWiki::cfg{Ldap}{BindDN} = 'CN=Trofimov\, Alexandre,OU=USERS,OU=SITE,DC=site,DC=company,DC=com';
$TWiki::cfg{Ldap}{BindPassword} = 'secret';
$TWiki::cfg{Ldap}{SSL} = 0; 
$TWiki::cfg{Ldap}{MaxCacheHits} = -1; 
$TWiki::cfg{Ldap}{MapGroups} = 1;
$TWiki::cfg{Ldap}{Exclude} = 'TWikiGuest, TWikiContributor, TWikiRegistrationAgent, TWikiAdminGroup, NobodyGroup';

Environment

-- AlexandreTrofimov - 22 Mar 2007

Answer

If you answer a question - or someone answered one of your questions - please remember to edit the page and set the status to answered. The status selector is below the edit box.

Hi Alexandre,

Perhaps the config details from LdapContribLoginsAreSpotty would be useful to you.

When I'm able to login I see the WikiName instead of the login name in the upper left corner and using the NewUserPlugin my WikiName was added to the Users page.

Unfortunately in my case I think I either have a setting wrong somewhere or there is an issue with LdapContrib as logins don't always work.

-- DeorenMoor - 10 Apr 2007

added link in LdapContribDev

-- SvenDowideit - 30 Apr 2007

Please upgrade to the latest LdapContrib v1.0.1 and try again, please.

-- MichaelDaum - 01 May 2007

See my post LdapAuthenticationCaseSensitivityBug

'sAMAccountName', your LoginAttribute, typically uses capital-letter characters for values because that's how Microsoft likes it.

It'd be interesting to know if this is the cause of your problem or not - your symptoms are very similar to my bug. If this is your problem, you could try a workaround until it is fixed.

-- KevinFirko - 17 May 2007

Michael:

Many thanks! It works like a charm after upgrading to v.1.11 of LdapContrib.

Deoren:

Had similar issues, resolved by disabling mod_perl.

Kevin:

On our site, letters' case in login name do not seem to affect the login process: it all works the same, whether I use trofimov, Trofimov, or TROFIMOV - mapped correctly to LastnameFirstname wiki name.

-- AlexandreTrofimov - 08 Jun 2007