I don't understand why do you want REMOTE_USER at all? Is it because you use Apache authentication modules - some kind of domain autologin? (and what kind?) And if it isn't automatic, if it's just HTTP LDAP authentication using login and password - why you don't use http://www.mediawiki.org/wiki/Extension:LDAP_Authentication?

Oh, thanks for clarifying. Two things that come to my mind are: 1) Try to do it on the application level. For example, try a following hack - check $_SERVER['REMOTE_ADDR'] in LocalSettings.php and conditionally set $wgGroupPermissions['*']['read'] to false (also 'edit', 'createaccount', 'createpage', 'createtalk', 'writeapi') => the wiki will become read-only for non-local addresses... Or another kind of hack - maybe it's even better because of missing userCanRead() calls in different parts of MW: redirect all anonymous external users to Special:Userlogin (again with PHP, using IP check in LocalSettings.php), so the only page they will have access to will be the login page. 2) Try "Satisfy any" in Apache and still use REMOTE_USER, i.e.: Allow from 192.168.0.0/24 Require valid-user Satisfy any This will probably lead to external users having to log in using HTTP authentication and internal users having to use normal application-level authentication. But I think this is uglier, at least because of HTTP auth.

hi again, On 7 September 2013 16:08, <vitalif(a)yourcmc.ru> wrote: This might be the simplest, though I was hoping to avoid any code-level hack since it may be more difficult to keep up to date with MW releases. Though MW auth would be better than the htauth popup that no one likes. I didn't realize this could be done in LocalSettings, I thought it was cached, I will experiment with this Wednesday. It appears that if Satisfy any is present, REMOTE_USER isn't passed on. Thanks for your help so far! David

hi again, Just wanted to say thanks. Although through all my testing REMOTE_USER did not show up in "local" networks, I was able to use the LocalSettings approach as you suggested to achieve the configuration I was looking for. David On 10 September 2013 07:34, <vitalif(a)yourcmc.ru> wrote: