Deny self registration, allow only ldap authentication

[bstewart]

If you have Active Directory and run XWiki on a Windows server, you can use the Waffle Java libraries to allow single sign-on (SSO) using Windows integrated authentication to XWiki. See the following:

How to: Integrate Waffle in XWiki using Tomcat on Windows

How to: Integrate Waffle in XWiki using Tomcat on Windows Make sure to install the LDAP Authenticator extension (https://extensions.xwiki.org/xwiki/bin/view/Extension/LDAP/Authenticator/). Run the Tomcat service using a domain service account. You will need to set the service principal name (SPN) for the service account as noted in the Waffle documentation (https://github.com/Waffle/waffle/blob/master/Docs/faq/NegotiateFailsWith401.md). Make sure that the domain service account has permiss…

In this configuration you set the xwiki.authentication.ldap.group_mapping setting in xwiki.cfg to something like this:

xwiki.authentication.ldap.group_mapping=\
  XWiki.XWikiAdminGroup=CN=XWiki Admins,OU=Groups,OU=DC=fabrikam,DC=local|\
  XWiki.MarketingUsers=CN=Marketing,OU=Groups,DC=fabrikam,DC=local|\
  ...

We use a configuration like this in our organization and it works very nicely.