no sq

LDAP, ActiveDirectory, and DokuWiki

I’ve had a terrible time trying to get PHP’s LDAP functions use an ActiveDirectory domain controller for authentication - even using the examples in posted comments.

I tried writing a bunch of different pages but couldn’t get any of them to work. I think part of my problem is that I’m not totally savvy with LDAP terminology to know what I should enter for a DS, a DN, RDN, or the CN at different points. It doesn’t feel very well documented, and of course Microfot’s AD uses a spattering of different terms as well.

Enter adLDAP - a GPL PHP class that provides LDAP authentication with Active Directory. It just worked.

The Problem

I was trying a bunch of PHP wiki implementations at work. Work is a MS shop and whatever we used had to be easy on “average” end users. Creating yet another username and password pair for them wasn’t going to cut it.

I tried using MediaWiki’s LDAP implementation but couldn’t get it to work. Same with PHP Wiki.

I liked DokuWiki the best though - and it too promised it’s own LDAP authentication. Unfortunately, it still didn’t work.

The Solution

Finally I found adLDAP. I configured three parameters in the adLDAP.php file and ran its tests - worked wonderfully.

I then set about getting DokuWiki to work with it. Here’s what it takes -

• download and install adLDAP
• configure adLDAP so that its own test cases pass on your AD domain
• replace the DokuWiki file /inc/auth/ldap.php with this one that I changed to work with adLDAP Update: that only works on versions prior to 2006-03-09. Use this updated version instead.
• edit your /conf/local.php to use ‘ldap’ as its authtype $conf['authtype'] = ‘ldap’; $conf['passcrypt'] = ’ssha’;
• try logging in as one of your domain users

Custom Tweaks

I also use DokuWiki’s ACL security feature. Unfortunately, all of the group names in my domain were something like ‘#ORD-GROUP NAME’. This causes a couple of problems

• LDAP queries returning group names can’t contain a ‘#’ sign… unless escaped.
• DokuWiki’s ACL doesn’t deal with # signs anyway
• DokuWiki’s ACL can’t deal with spaces

So in my ‘ldap.php’ file I added a bit of post-processing to all of the group names

• backslashes (\’s) are removed entirely
• pound signs (#’s) are removed as well
• spaces are replaced with an underscore (_)

Thus, in my ACL I can still use names pretty close to what they are in AD, which is much easier for the site administrators: MY_GROUP_NAME.

Update for DokuWiki 2006-03-09

Download the updated adLDAP auth class for DokuWiki.

The auth files were converted over to classes. I’ve updated my modified LDAP.php file to be ntlm.class.php instead. Instructions for use (also in the comments of the file):

• Copy the ntlm.class.php file into your /dokuwiki/inc/auth/ directory
• Put adLDAP.php in your PHP include path
• Configure adLDAP.php for your environment
• Set DokuWiki’s local.php auth setting to read $conf['useacl'] = 1; $conf['openregister']= 0; $conf['autopasswd'] = 0; $conf['authtype'] = ‘ntlm’; $conf['passcrypt'] = ’ssha’;

Final Notes

I hope this helps other people out there… I spent a lot of time trying to figure out why PHP’s LDAP function didn’t seem to quite work with AD.

Special thanks to Andreas Gohr, author of DokuWiki, for developing one of the best wiki’s for a corporate environment I have seen and tested. (And I tested quite a few before settling on his.)

The clean look of the default site, usable wiki grammar, features for Windows users (like linking to Windows shares) that are usually ignored in open-source environements, non-database dependence, and powerful ACL are just what we needed.

Also thanks to Scott Barnett, maintainer (author?) of adLDAP. The coding is clean, the class function names make sense, and best of all: it actually works.

To Do

Saw on the DokuWiki LDAP page that another user got this working with integrated authentication. I might try and add options to allow that to work.