Category: User Administration (Registration, Login & Banning)

{syntax type="tiki" editor="plain"}
LDAP group synchronisation is dependent on the "corresponding user attribute", a setting which is only needed if an external directory is used for group synchronisation.

The fix is simple - the combination of if-staments just need to be adjusted slightly - see patch.

When groups are synchronised with a big LDAP organisation many empty groups may end up in Tikiwiki.

This enhancement / patch adds an option to let the administrator of a tikiwiki instance decide whether during synchronisation of groups only the user assignments to existing groups will be done or if non-existent groups will be created in tikiwiki.

The default behaviour - as of now - is that when a LDAP user logs in all the groups he belongs to will be created in tikiwiki and he is being added as a member of these groups.

This enhancement adds the preference "ldap_create_groups_tiki" which is "y" by default - which corresponds to the current behaviour.

If "ldap_create_groups_tiki" is set to "n" and a LDAP user logs in the group synchronisation process will silently ignore groups that exist in LDAP but not in tikiwiki. Existing groups will be synced, though.

I am sent here

tiki-adminusers.php?user=abc&action=removegroup&group=xyz

I am referencing forum post: https://tiki.org/tiki-view_forum_thread.php?comments_parentId=43682&topics_offset=1

I would like the ability for users in child domains to access the TikiWiki site the same way users in the parent site are able to access it. According to the forum post, "Tiki is not currently capable of authenticating against multiple domains (or multiple LDAP servers)" and "The code could be modified to search, say, the global catalog for the user's DN and then authenticate against the corresponding domain, but this would be custom coding"

I would like an option to specify multiple domains, or a custom code I could use to search the global catalog for the user's DN.

Basically I want all of my users in all of my offices to access the Tiki site. Not just the home office users.

As an admin, I change the group of a user, and the default group.
The user needs to logout/login or the default group is not changed

{syntax type="tiki" editor="plain"}
I looked if something like this has been reported previously, but didn't find something that completely fits, so I post this and apologize if I missed something.

Since I have already put some detail into a [http://tiki.org/tiki-view_forum_thread.php?forumId=6&comments_parentId=44097#threadId44102|support request] and at the moment I believe it only concerns two Wikis belonging to the same admin, here is a description:

Steps to reproduce:
1) Take any Tiki installation and move a new directory
2) Create a new DB with a copy of the original DB
3) Upgrade and start it up
4) Log into the old installation as admin
5) Find out you're admin on the new one, too.

It may well be that for some admins this is a wanted behaviour like as a single-sign-on (SSO).

But it is my firm belief that any such behaviour is to be considerd a breach of security unless both admins have expressley activated this as a wanted behaviour. Possibly the problem also exists if two different admins operate two different Tikis on the same hosted volume, that somehow were created from one single predecessor, so maybe this is not as harmless as it might seem to be.

I do not know, but suspect, this could be a cookie issue.

Resolution could be that tiki-installer regenerates all security structures upon installation and/or upgrades, or at least asks the admin whether such should be reset. Also, there should be a button in the administration panel to reset this at any later time. In my opinion TikiWiki should at all times, if not told to behave otherwise, protect its instance against all other possible instances of itself...

At some point confusion may get so high to a user's browser that logging into Wiki B alone will not function, and you have to log into Wiki A to be able to access Wiki B. At the moment I experience this with my new 6.7 LTS and my old 1.9.8.3. sitting in different directories on the same volume, accessing to different MySQL DBs with differing user names and passwords...

{syntax type="tiki" editor="plain"}
To reproduce

# Install a fresh Tiki
# Create some usernames as usual
# Set "Use email as username" feature to yes
# Create more users (this time, username will be the email)
# Create a newsletter
# Subscribe the Registered group to the newsletter
# Send a newsletter

The system will crash and be unable to send the newsletter because some users don't have valid emails. If you error reporting is activated, you will get a message like this:

{CODE()}
System error.

The following error message was returned:

Duplicate entry '3-mcradmin-g' for key 'PRIMARY'
The query was:

INSERT INTO `tiki_newsletter_subscriptions` (`nlId`,`email`,`code`,`valid`,`subscribed`,`isUser`,`included`) VALUES (?,?,?,?,?,?,?)
Values:

3
mcradmin
6b78cc21c16e768dd8fbb6b538c6bf78
y
1339700591
g
n
The built query was likely:

INSERT INTO `tiki_newsletter_subscriptions` (`nlId`,`email`,`code`,`valid`,`subscribed`,`isUser`,`included`) VALUES ('3','mcradmin','6b78cc21c16e768dd8fbb6b538c6bf78','y','1339700591','g','n')
Things to check:

Is your database up and running?
Is your database corrupt? Please see how to repair your database
Are your database credentials accurate? (username, database name, etc in db/local.php)
Did you complete the Tiki Installer?
Please see the documentation for more information.
{CODE}

{syntax type="tiki" editor="plain"}
Often, we don't remember if we have already registered...

{syntax type="tiki" editor="plain"}
Please see:
http://irc.tiki.org/irclogger_log/tikiwiki?date=2012-10-03,Wed&sel=483#l479

This following displays when the user was set up, not since "last visit date"

Since your last visit...
2012-11-21
9 new posts

I searched existing bugs and couldn't find any info pertaining to above.
Am I missing something obvious?

Thanks

Using services like http://www.stopforumspam.com can help to identify and handle spam-related mail addresses trying to create an account.

stopforumspam provides an API to test a mail address against a "known spammer"-list. This could be used to warn an admin before confirming an account.

I use email as username and user tracker for more information at registration.
If a user types in an invalid email address and wants to register. He gets an error, no user is registered BUT the user tracker gets an entry.

mostly I have to hit the save button twice. Perhaps that helps to find the bug?

This tracker is made to help filtering and sorting the features vs categories vs options we need to tag a bug/regression/wish with.

It concerns the Passwords match and do not match.
Chealer explained to me that there is a language.js file to be created in the lang/<yourlang> folder (as in ca).
Since my ajax is on, the password check is not run from
tiki-js.js, checkPasswordsMatch
but from
register_ajax.js (please also add a header to this file), check_pass.
The tr function is not defined there, so it would not work.

See also
http://irc.tikiwiki.org/irclogger_log/tikiwiki?date=2010-10-19,Tue

P.S. I rated this 9, because there will be people who want ajax and another language, but do not like to dig js files for such a basic functionality.

If you're editing a page and you fail the CAPTCHA or your session expires, your whole edit is lost. Most users expect their browser to have saved the form data, many would know enough to log back in then hit the back button to get back to the form (or at least, hit "back" and copy the data for later pasting after login). This does not work - after a "back" the form is empty!

I'm ranking this bug as priority 7 because it is very serious - data loss and angry users. I think the solution is trivial, too: see below.

This should be migrated to the community site, and handled with ((doc:Organic groups)) and ((doc:User Trackers))

The tooltip info for site users such as page or post authors incorrectly reports the "last login" information as "never logged in". We can see this now at the Tiki project sites, and I'm seeing it at a Tiki 14 site also.

Apart from not being factually accurate, it probably doesn't make a good impression for the software to indicate that content is being authored by people who've never logged in.

While upgrading from Tiki 12.2 to 21.4, we found that our external LDAP authentication stopped working. After turning on some debugging and looking at the code, I found this major difference between the two versions in lib/auth/ldap.php.

In 12.2 starting at line 90:
$this->options['host'] = array();
foreach ($t as $h) {
if (preg_match('#^ldaps?://#', $h)) { // entry is already URI
$this->options['host'][] = $h;
} else {
$this->options['host'][] = $prefix . $h . ':' . $port;
}
}

In 21.4 starting at line 96:
$this->options['host'] = [];
foreach ($t as $h) {
if (preg_match('#^ldaps?://#', $h)) { // entry is already URI
$this->options['host'] = $h;
} else {
$this->options['host'] = $h;
}
}

Note that in 21.4 regardless of result of the if, the executed code is the same and the LDAP connection will fail if the "host" is not in URI format. I believe the else clause should look similar to that from 12.2. A workaround is to enter a full URI in the configuration for the LDAP server host.

Our Active Directory is configured not to allow arbitrary LDAP searches for unprivileged users. However, these users can successfully bind to AD's LDAP interface. This would be enough for authentication and we would not need a special account for checking authentication.

I therefore removed parts of the function fetchData in /lib/pear/Auth/Container/LDAP.php:

{img src=images/code.png}%%% {CODE()}
function fetchData($username, $password)
{
$this->log('Auth_Container_LDAP::fetchData() called.', AUTH_LOG_DEBUG);
$err = $this->_prepare();
if ($err !== true) {
return PEAR::raiseError($err->getMessage(), $err->getCode());
}

$err = $this->_getBaseDN();
if ($err !== true) {
return PEAR::raiseError($err->getMessage(), $err->getCode());
}

// UTF8 Encode username for LDAPv3
if (@ldap_get_option($this->conn_id, LDAP_OPT_PROTOCOL_VERSION, $ver) && $ver == 3) {
$this->log('UTF8 encoding username for LDAPv3', AUTH_LOG_DEBUG);
$username = utf8_encode($username);
}

/* // make search filter
$filter = sprintf('(&(%s=%s)%s)',
$this->options['userattr'],
$this->_quoteFilterString($username),
$this->options['userfilter']);

// make search base dn
$search_basedn = $this->options['userdn'];
if ($search_basedn != '' && substr($search_basedn, -1) != ',') {
$search_basedn .= ',';
}
$search_basedn .= $this->options['basedn'];

// attributes
$searchAttributes = $this->options['attributes'];

// make functions params array
$func_params = array($this->conn_id, $search_basedn, $filter, $searchAttributes);

// search function to use
$func_name = $this->_scope2function($this->options['userscope']);

$this->log("Searching with $func_name and filter $filter in $search_basedn", AUTH_LOG_DEBUG);

// search
if (($result_id = @call_user_func_array($func_name, $func_params)) === false) {
$this->log('User not found', AUTH_LOG_DEBUG);
} elseif (@ldap_count_entries($this->conn_id, $result_id) >= 1) { // did we get some possible results?

$this->log('User(s) found', AUTH_LOG_DEBUG);

$first = true;
$entry_id = null;

do {

// then get the user dn
if ($first) {
$entry_id = @ldap_first_entry($this->conn_id, $result_id);
$first = false;
} else {
$entry_id = @ldap_next_entry($this->conn_id, $entry_id);
if ($entry_id === false)
break;
}
$user_dn = @ldap_get_dn($this->conn_id, $entry_id);

// as the dn is not fetched as an attribute, we save it anyway
if (is_array($searchAttributes) && in_array('dn', $searchAttributes)) {
$this->log('Saving DN to AuthData', AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData('dn', $user_dn);
}

// fetch attributes
if ($attributes = @ldap_get_attributes($this->conn_id, $entry_id)) {

if (is_array($attributes) && isset($attributes['count']) &&
$attributes['count'] > 0) {

// ldap_get_attributes() returns a specific multi dimensional array
// format containing all the attributes and where each array starts
// with a 'count' element providing the number of attributes in the
// entry, or the number of values for attribute. For compatibility
// reasons, it remains the default format returned by LDAP container
// setAuthData().
// The code below optionally returns attributes in another format,
// more compliant with other Auth containers, where each attribute
// element are directly set in the 'authData' list. This option is
// enabled by setting 'attrformat' to
// 'AUTH' in the 'options' array.
// eg. $this->options['attrformat'] = 'AUTH'

if ( strtoupper($this->options['attrformat']) == 'AUTH' ) {
$this->log('Saving attributes to Auth data in AUTH format', AUTH_LOG_DEBUG);
unset ($attributes['count']);
foreach ($attributes as $attributeName => $attributeValue ) {
if (is_int($attributeName)) continue;
if (is_array($attributeValue) && isset($attributeValue['count'])) {
unset ($attributeValue['count']);
}
if (count($attributeValue)<=1) $attributeValue = $attributeValue[0];
$this->log('Storing additional field: '.$attributeName, AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData($attributeName, $attributeValue);
}
}
else
{
$this->log('Saving attributes to Auth data in LDAP format', AUTH_LOG_DEBUG);
$this->_auth_obj->setAuthData('attributes', $attributes);
}
}
}
@ldap_free_result($result_id);


// need to catch an empty password as openldap seems to return TRUE
// if anonymous binding is allowed
*/ $user_dn = $username;
if ($password != "") {
$this->log("Bind as $user_dn", AUTH_LOG_DEBUG);

// try binding as this user with the supplied password
if (@ldap_bind($this->conn_id, $user_dn, $password)) {
$this->log('Bind successful', AUTH_LOG_DEBUG);
// check group if appropiate
if (strlen($this->options['group'])) {
// decide whether memberattr value is a dn or the username
$this->log('Checking group membership', AUTH_LOG_DEBUG);
$return = $this->checkGroup(($this->options['memberisdn']) ? $user_dn : $username);
$this->_disconnect();
return $return;
} else {
$this->log('Authenticated', AUTH_LOG_DEBUG);
$this->_disconnect();
return true; // user authenticated
} // checkGroup
} // bind
} // non-empty password
// } while ($this->options['try_all'] == true); // interate through entries
// } // get results
// default
$this->log('NOT authenticated!', AUTH_LOG_DEBUG);
$this->_disconnect();
return false;
}
{CODE}

If would be nice to have a checkbox in the LDAP part of the admin page for selecting this behaviour.

I have encountered a few snags after upgrading from Tiki 1.9.11 to 2.0

One of the problems is that I am unable to register / add users, because of the following error message:

An error occured in a database query!
Unknown column 'email_confirm' in 'field list'

This happens on
tiki-register.php (registration) and tiki-adminusers.php (batch upload / add)

Is there a fix for this?

Seems like Tanzania keeps falling out of the country list. This was the case some years ago. Might as well add Swahili as a language option if applicable.

I have an error when I try to add a new user:

{img src=images/code.png}%%% {CODE()} Context:
File tiki-adminusers.php
Url tiki-adminusers.php
Query:
insert into `users_users`(`login`, `password`, `email`, `provpass`, `registrationDate`, `hash`, `pass_confirm`, `email_confirm`, `created`, `valid`, `openid_url`, `lastLogin`, `waiting`) values(?,?,?,?,?,?,?,?,?,?,?,?,?)
Values:
0 trenad
1
2 n.trepanier@rrsss16.gouv.qc.ca
3
4 1224014104
5 $1$98TWiy55$sm3YVgaZTDG8wTR6O9kvz0
6 1224014104
7 1224014104
8 1224014104
9 NULL
10 NULL
11 NULL
12 NULL
Message:
Unknown column 'email_confirm' in 'field list'
Built query was probably:
insert into `users_users`(`login`, `password`, `email`, `provpass`, `registrationDate`, `hash`, `pass_confirm`, `email_confirm`, `created`, `valid`, `openid_url`, `lastLogin`, `waiting`) values('trenad','','n.trepanier@rrsss16.gouv.qc.ca','','1224014104','$1$98TWiy55$sm3YVgaZTDG8wTR6O9kvz0','1224014104','1224014104','1224014104',NULL,NULL,NULL,NULL){CODE}

Do you guys have any idea what is happening.

User set forum style as Plain and save it after next login style is Threaded again.

{syntax type="tiki" editor="plain"}
Enabling 2FA for a user works, but when trying to login, one is presented with a System Error page. With debug enabled, we see:

'''
System error.

The following error message was returned:

Unknown column 'last_mfa_date' in 'SET'

The query was:
update `users_users` set `last_mfa_date` = ? WHERE `login` = ?

Values:

1788618450
username

The built query was likely:
update `users_users` set `last_mfa_date` = '1788618450' WHERE `login` = 'username'
'''

I can confirm that adding in the column manually with:

alter table users_users add column if not exists last_mfa_date bigint DEFAULT NULL;

has allowed me to login/logout with MFA enabled.