Hi, i’ve got a problem with the login procedure.
We’re using LDAP for the authentication and it works fine so far.
But it doesn’t work with sub wikis.
I’m aware of the thread SubWiki: Global users getting registered als local users with LDAP - Help / Discuss - XWiki Forum and Use cases of configuration to authenticate users with LDAP (XWiki.org) but this doesn’t provide an solution.
If a user is using the login feature on a sub wiki he’s not logged in to his global account. The process will create/use an local account in the sub wiki. Even if it doesn’t exist. I’ve disabled the login button from our sub wikis.
The most problematic part is not the login form itself. After the session expires, XWiki automatically re-authenticates the user from the remember-me cookies. When this re-authentication happens while browsing a subwiki, the user is logged in as a local subwiki user instead of the existing global LDAP user.
This problem persists since we use xwiki(v16.x) and we are currently at 18.2.1.
The configuration for the sub wiki:
I even tried to install und configure the LDAP plugin in the sub wikis but that resulted also in local sub wiki accounts. currently the ldap plugin is only installed and configured on the main wiki.
Is there any chance that the login from a sub wiki will use the global account and not an local sub wiki account?
Steps to reproduce:
1. Configure LDAP on the main wiki.
2. Create a subwiki configured as:
-
Only global users are available in the wiki
-
Only an admin can send invitations
3. Login as a LDAP user on the main wiki.
4. Add this global user to the subwiki.
5. Logout.
6. Open the subwiki directly.
7. Login from the subwiki login form.
Expected:
The existing global LDAP user should be authenticated and used.
Actual:
A local user is created/used in the subwiki. Like /xwiki/wiki/public/view/XWiki/kbielecke and not the expected path /xwiki/bin/view/XWiki/kbielecke