Fixing LDAP
https://www.mediawiki.org/wiki/User:Osnard/LDAP

== Current issues ==
* SSO is broken
* Change user is no longer possible
* Usernames are nomralized
* Local accounts cannot change passwords
* Issues with underscore

== Attempts to fill the gap ==
* PluggableAuth (c.cicalese)
* LdapAuthorisation (c.cicalese)
* PluggableSSO (hexmode)
* LDAPGroups (hexmode)
* TBD: Mapping attributes LdapSyncAttr

== Experiences ==
* Mark: we should create special pages for any tasks
* Robert: LdapAuthorisation does not work out of the box -> hexmode is working on that

* Local sign on possible? PluggableAuth allows that
* Tgr: reason is LDAPAuthentication was never properly updated to new auth manager

* Markus: Update LDAPAuthentiction or rewrite from scratch?
** Concerns are not separated
** Hard to extend
* Tgr: We need at least test cases / unit tests
--> ACTION: Write unittests

* Robert: A migration path would be good for existing LDAPAuthentication users
-> ACTION: Create migration path Robert

* Robert: There are a lot of configuration files, there are even more extensions by hexmode: LDAP, which connects the various ldap extensions. Configure this one and it passes on the config to the other extensions

* Foundation will cease to care about LDAP Authentication, as they will move their wikis away from it

* There is a consensus among the group that the old extension should be deprecated and we will build upon the new stack of extensions

-> ACTION: Create a requirements document

-> ACTION: Put a deprecation notice on the extension page, but talk to Ryan Lane before

== Architecture of the new set of extensions ==
* Markus: make the set of attributes requested from LDAP extensible, keep a slim core but provied entry points for extensions
* Robert: use a plugin based system to extend
* first use case could be th profile image (used in BlueSpice)

* Where do the extensions live?
-> should be moved to gerrit

At the moment it's hard to find all the extensions needed, e.g. synchronize groups
-> ACTION: Create a LDAP documentation portal on mediawiki.org, see below

== Documentation ==
* Link from old LDAP to new portal
* Name of LDAP hub on mw.o "LDAP hub"
** Two documents: migration document, alternatives to ldap authentication, help desk (Flow discussion page)

== Interested in contributing to this ==
Toniher -> helping migration docs
MeskoBalazs -> testing migration, localization (to Hungarian)

P.S.: T Shrinivasan: Errors should be put out to the user interface (Login page) and not just into the log
Configuring with any LDAP should have a web interface. We should input the LDAP server, DN details etc.
The there should be a test button to check any user's login.

PS.: MeskoBalazs: if possible there should be a (regex based) mapping between LDAP login names and the usernames
in MediaWiki.