Collections with read-permissions restricted And security risks
Müller
I'm facing a problem that I don't know how to solve.
I manage a wiki in a company with ldap authentication, It'll be easy if I just put the variable at config file
$wgGroupPermissions['*']['createaccount'] = false;
$wgGroupPermissions['*']['read'] = false;
$wgGroupPermissions['*']['edit'] = false;
$wgGroupPermissions['*']['createpage'] = false;
$wgGroupPermissions['*']['createtalk'] = false;
$wgCollectionMWServeCredentials="USERNAME:PASSWORD:DOMAIN"
but it's obviously this is a security risk.
Is there a way to use the already loged in user to be the user of the variable $wgCollectionMWServeCredential
Probably something like this:
$wgCollectionMWServeCredentials="$wgUserName:PASSWORD_ENCRYPTED:DOMAIN"
Wlysses Pereira
Johannes Beigel
> but it's obviously this is a security risk.
Yes, it is if you are using the public render server.
> Is there a way to use the already loged in user to be the user of the variable $wgCollectionMWServeCredential
> Probably something like this:
> $wgCollectionMWServeCredentials="$wgUserName:PASSWORD_ENCRYPTED:DOMAIN"
What do you mean by "already logged in"? As long as mw-serve doesn't share your local browser cookie, there's no already logged in user.
You might want to use your own render server and grant access by some other means (e.g. in your web server config via IPs or network interfaces).
-- Johannes Beigel
Müller
this are my conditions:
- We already have our own render server, and we are using the extension Collections of mediawiki to render.
- Just authenticated user can read de articles.
- the Company's security policy prohibits passwords of employees at the configurations files.
When I try to render some page a error occur.
The problem is solve if I do this is Collection.php
$wgCollectionMWServeCredentials="my_user:my_password:domain"
But I don't want my password in the variable or at least put it there encrypted.
Johannes Beigel
> this are my conditions:
> • We already have our own render server, and we are using the extension Collections of mediawiki to render.
> • Just authenticated user can read de articles.
> • the Company's security policy prohibits passwords of employees at the configurations files.
You could create a new account only used by the render server. You'd still have to put the password in cleartext in your MediaWiki config, but that should be readable by some admins anyway. And it's not an employee's password.
Alternatively, you provide (somehow, that's up to you) internal access to your MediaWiki that's not password-restricted.
-- Johannes Beigel
Wlysses Pereira
I have a suggestion, would not "get"the current user's password, the command to move to?
