Hi,

We tried to solve this a couple of ways, and using the LDAP plugin proved to be quite fiddly (maybe I just don't get on with X500...). We used to use IIS, but switched to Apache, then moved the servers to linux - found the subjective "responsiveness" was better on LAMPP than windows.

We ended up plumping for:

http://meta.wikimedia.org/wiki/User:Otheus/Auto_Login_via_REMOTE_USER

... and tweaking it. Its a much simpler extension, that merely creates users on demand, assuming the server has authenticated them correctly, and doesn't rely on much other than server config (I think there may be some issues with cases to resolve). With permissions set right on the sub folder, everything should work fine. We ended up moving to mysql authentication via auth_mysql, and keeping separate user lists, but little needed to change.

Hope that helps,

Alex

On 9/18/07, Connolly, Wayne Wayne.Connolly@team.telstra.com wrote:

All,

I have MW 1.10.1 / IIS / WinXP Server 2003 / PHP 5 / SMTP installed and working flawlessly on our intranet.

There is only one thing left to do to make this complete -> Automatic Authentication against the domain 'ACCOUNT-01' via Windows native NTLM authentication.

Before I embark on this journey I was hoping that anyone could offer any tips, extension ideas or pitfalls to avoid.

I have found these which seem to work with apache but we use IIS for reasons beyond my control.

http://www.mediawiki.org/wiki/Authentication which lists some contenders but nothing I would consider yet and http://www.jamiekerwick.co.uk/?p=13 which is for apache. But what of IIS?

Cheers,

Wayne Connolly Bigpond.com/Telstra.com Production

---

---

MediaWiki-l mailing list MediaWiki-l@lists.wikimedia.org http://lists.wikimedia.org/mailman/listinfo/mediawiki-l

On 9/18/07, Connolly, Wayne Wayne.Connolly@team.telstra.com wrote:

There is only one thing left to do to make this complete -> Automatic Authentication against the domain 'ACCOUNT-01' via Windows native NTLM authentication.

Before I embark on this journey I was hoping that anyone could offer any tips, extension ideas or pitfalls to avoid.

Hi Wayne,

Theres a PHP extension called Plexcel that does Windows authentication and much much more. It doesn't use NTLM though. It uses Kerberos and something called SPNEGO. This is actually what IIS is doing when you turn on IWA. On the wire, Plexcel is just like IWA.

If you want NTLM I think theres a module for Apache that can call Samba's Winbind daemon. But note that NTLM is not optimal for this scenario. It requires communication with a domain controller whereas Kerberos does not (although NTLM is still required for scenarios where the client is not a member of the domain or a member of a domain that has a trust with the target domain).

Anyway, I guess I'm starting to rant. In addition to the Plexcel extension there's a little MediaWiki plugin that calls plexcel. Check it out:

http://www.ioplex.com/mediawiki_plugin.html

It handles SSO, explicit login using the conventional form, automatically creates accounts in the local DB with the user's info from AD and has ACLs to control who can access content and such.

Bear in mind that you're going to need a MediaWiki plugin so that the user's information can be pushed into MW so that the higher level logic does sensible things. You can't just use mod_ntlm or flip on IWA in IIS.

Mike