I had already set up working directories as screen window titles as an extension of one of your previous blog posts ( http://ryandlane.com/blog/2011/03/23/screen-with-ssh-on-a-shell-server/ ; I’ve also gotten vi/vim/view to display the file being edited as the screen window title) but could never quite get that to work reliably. PROMPT_COMMAND (which I didn’t know about before) definitely helped there.

My Setup:
I was running Mediawiki on a Windows 2008 computer using Wamp, trying to connect to a 2008 AD. I could get it to connect, but only using clear passwords. I was able to later do a work around by putting in the line
TLS_REQCERT never
in my ldap.conf file in c:\openldap\sysconf.

But I needed better, the likelihood that we would get a MitM, or a DNS hijack is slim, but I still couldn’t sleep well unless I got the certificates working.

My fix was not to use openssl to pull the certificate off the server using -

“openssl s_client -connect adserver1.testad.example.com:636″

Instead what I had to do was install Active Directory Certificate Services on my DC. Then follow this website to make a self signed cert – very easy to follow.
http://www.christowles.com/2010/11/enable-ldap-over-ssl-ldaps-on-windows.html

Once I had a certificate I exported the certificate as a .cer file to my wamp server inside my c:\openldap\sysconf folder and edited the ldap.conf file to TLS_CACERT c:\openldap\sysconf\dc1.cer

SSL now works! Seriously this all took me several days just gathering all the right info and troubleshooting. That last little bit saved me. active directory doesn’t support ssl out of the box. No wonder it wasn’t working.

This is my LocalSettings
# LDAP AUTENTICATION – Chamada do Aplicativo e Plugin
require_once (“$IP/extensions/LdapAuthentication/LdapAuthentication.php”);
$wgAuth = new LdapAuthenticationPlugin();

#Basic Auth.
$wgLDAPDomainNames = array( “Bellcomsys” );
$wgLDAPServerNames = array( “Bellcomsys” => “server.bellcomsys.net” );
$wgLDAPSearchStrings = array( “Bellcomsys” => “USER-NAME@Bellcomsys” );
$wgLDAPEncryptionType = array( “Bellcomsys” => “clear” );

#GROUPS
$wgLDAPGroupUseFullDN = array( “Bellcomsys”=>true );
$wgLDAPBaseDNs = array( ‘Bellcomsys’ => ‘dc=bellcomsys,dc=net’ );
$wgLDAPSearchAttributes = array( ‘Bellcomsys’ => ‘sAMAccountName’ );
$wgLDAPGroupsUseMemberOf = array( “Bellcomsys” => true );
$wgLDAPGroupObjectclass = array( “Bellcomsys”=>”group” );
$wgLDAPGroupAttribute = array( “Bellcomsys”=>”member” );
$wgLDAPGroupNameAttribute = array( “Bellcomsys”=>”cn” );
$wgLDAPRequiredGroups = array( “Acesso,Edit”=> array( “ou=wiki,ou=bellcomcorp,dc=bellcomsys,dc=net” ) );
#$wgLDAPRequiredGroups = array( “Edit”=> array( “ou=wiki,ou=bellcomcorp,dc=bellcomsys,dc=net” ) );

#GSync
$wgLDAPUseLDAPGroups = array( “Bellcomsys”=>true );
$wgLDAPGroupsPrevail = array( “Bellcomsys”=>true );

#LOG
$wgLDAPDebug = 99; # 3
$wgDebugLogGroups["ldap"] = “./debug.txt” ;

#Permission
# The following permissions were set based on your choice in the installer
$wgGroupPermissions['*']['createaccount'] = false;
$wgWhitelistRead = array( “Main Page”, “Special:Userlogin”, “-”, “MediaWiki:Monobook.css” );
$wgGroupPermissions['Acesso']['read'] = true;
$wgGroupPermissions['Edit']['edit'] = false;
$wgGroupPermissions['*']['read'] = false;

The Autentication is working fine, the Goups are Sync with the Data Base but the permissions dont work, as you can see, the group “Edit” = False but the members of this group still with the permission of edit files.

What am i doing wrong?

Thanks for the Help!