No need to frankenstein something together. Version 1.2a of the LDAP plugin (LDAPAuthentication.php and LDAPAutoAuthentication.php) should be able to handle any form of web authentication. Kerberos auth is likely what you are using. You want to look at this documentation (just ignore the Apache stuff): http://www.mediawiki.org/wiki/Extension:LDAP_Authentication/Kerberos_Con figuration_Examples Note that I haven't tested this with IIS (as I don't have a Windows 2003 system to test with). I've tested this with Apache and MIT Kerberos. The following line may need to change, depending on what you get back from IIS: $wgLDAPAutoAuthUsername = preg_replace( '/@.*/', '', $_SERVER["REMOTE_USER"] ); This line is expecting "REMOTE_USER" to be returned as "username@DOMAIN". If IIS returns something else, you'll need to change it. For instance, if IIS simply returns "username" then you'll need to change this to: $wgLDAPAutoAuthUsername = $_SERVER["REMOTE_USER"]; V/r, Ryan Lane

Lane, Ryan wrote: Hi Ryan, Just to follow up, I took a look at the configuration examples, and picked out the Kerberos-related entries and gave it a shot. Sadly, IIS gives me a 500. I did verify that IIS passes $_SERVER["REMOTE_USER"] for the REMOTE_USER as that is what the AutomaticREMOTE_USER extension successfully uses. I suspect the issue is with AutoAuth, as there is no LDAP traffic generated. (I am running a debug LDAP proxy that shows Here are the relevant entries from LocalSettings.php: # # LDAP Authentication # require_once( "extensions/LdapAutoAuthentication.php" ); require_once( "extensions/LdapAuthentication.php" ); $wgLDAPDomainNames = array("MyDomain); $wgLDAPServerNames = array("MyDomain"=>"192.168.20.212"); $wgLDAPAutoAuthDomain = "MyDomain"; $wgLDAPProxyAgent = array("MyDomain"=>"CN=Proxy User,cn=Users,dc=MyDomain,dc=com"); $wgLDAPProxyAgentPassword = array("MyDomain"=>"PASSWORD"); $wgLDAPBaseDNs = array("MyDomain"=>"dc=MyDomain,dc=com"); $wgLDAPSearchAttributes = array("MyDomain"=>"samaccountname"); $wgLDAPAutoAuthUsername = $_SERVER["REMOTE_USER"] ); AutoAuthSetup(); If you see anything wonky with my config, I'd like to hear about it. In the meanwhile, I will start Frankensteining... Thanks very much!! John

Lane, Ryan wrote: Oh crap. ;-) Thanks a lot for responding and confirming my configuration, Ryan. Sadly, I am more of an LDAP Guy than a Developer Guy, so short of some creative Cut&Pastes between the automaticREMOTE_USER extension and LDAPAuthentication, you shouldn't hold your breath for any epiphanies from this user! Thanks once again, John