kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 28 Pull Requests 4 Projects 2 Activity

Add LDAP support to mediawiki

Browse Source 
Users can log in if they have an account in the database, or using their
LDAP account (in the cn=greg,ou=users,dc=kosmos,dc=org group and with
the wiki attribute set to enabled
This commit is contained in:
Greg Karékinian 2019-11-04 19:03:45 +01:00
parent ef79434cb5
commit ab37a6a24e
1 changed files with 85 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

85
site-cookbooks/kosmos-mediawiki/recipes/default.rb
View File

@ -133,6 +133,8 @@ else
package "php-curl"
end
package "php-ldap"
ark "MediawikiHubot" do
url "https://github.com/67P/mediawiki-hubot/archive/master.zip"
path "#{node['mediawiki']['webdir']}/extensions/MediawikiHubot"
@ -150,6 +152,49 @@ template "#{node['mediawiki']['webdir']}/extensions/MediawikiHubot/DefaultConfig
wiki_url: node['mediawiki']['url']
end
#
# LDAP
ark "PluggableAuth" do
url "https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_33-a69f626.tar.gz"
path "#{node['mediawiki']['webdir']}/extensions"
owner node["nginx"]["user"]
group node["nginx"]["group"]
mode 0750
action :dump
end
ark "LDAPProvider" do
url "https://extdist.wmflabs.org/dist/extensions/LDAPProvider-master-6ce932d.tar.gz"
path "#{node['mediawiki']['webdir']}/extensions"
owner node["nginx"]["user"]
group node["nginx"]["group"]
mode 0750
action :dump
end
ark "LDAPAuthorization" do
url "https://extdist.wmflabs.org/dist/extensions/LDAPAuthorization-REL1_31-2bfd752.tar.gz"
path "#{node['mediawiki']['webdir']}/extensions"
owner node["nginx"]["user"]
group node["nginx"]["group"]
mode 0750
action :dump
end
ark "LDAPAuthorization" do
url "https://extdist.wmflabs.org/dist/extensions/LDAPAuthentication2-REL1_31-e170a82.tar.gz"
path "#{node['mediawiki']['webdir']}/extensions"
owner node["nginx"]["user"]
group node["nginx"]["group"]
mode 0750
action :dump
end
ldap_credentials = data_bag_item("credentials", "389")
ldap_domain = node["kosmos-dirsrv"]["nginx"]["domain"]
ldap_encryption_type = node.chef_environment == "development" ? "clear" : "tls"
ldap_base = "ou=users,dc=kosmos,dc=org"
ruby_block "configuration" do
block do
file = Chef::Util::FileEdit.new("#{node['mediawiki']['webdir']}/LocalSettings.php")
@ -196,6 +241,46 @@ $wgArticlePath = "/$1";
file.insert_line_if_no_match(/Mermaid/,
"wfLoadExtension( 'Mermaid' );")
file.insert_line_if_no_match(/# LDAP config/,
<<-EOF
# LDAP config
$LDAPProviderDomainConfigProvider = function()
{
$config = [
"#{server_name}" => [
"connection" => [
"server" => "#{ldap_domain}",
"enctype" => "#{ldap_encryption_type}",
"user" => "cn=Directory Manager",
"pass" => "#{ldap_credentials['password']}",
"basedn" => "#{ldap_base}",
"groupbasedn" => "#{ldap_base}",
"userbasedn" => "#{ldap_base}",
"searchattribute" => "uid",
"searchstring" => "cn=USER-NAME,#{ldap_base}",
"usernameattribute" => "uid",
"realnameattribute" => "cn",
"emailattribute" => "mail"
],
"authorization" => [
"rules" => [
"attributes" => [
"wiki" => "enabled"
]
]
]
]
];
return new \\MediaWiki\\Extension\\LDAPProvider\\DomainConfigProvider\\InlinePHPArray( $config );
};
$wgPluggableAuth_EnableLocalLogin = true; # allow local logins
wfLoadExtension( 'LDAPProvider' );
wfLoadExtension( 'PluggableAuth' );
wfLoadExtension( 'LDAPAuthorization' );
wfLoadExtension( 'LDAPAuthentication2' );
EOF
)
file.write_file
end