This extension depends on thePluggableAuth extension, which must be installed first.

MediaWiki extensions manual

AuthRemoteUser Release status: stable
Implementation	User identity
Description	Allows for authentication via the web server's REMOTE_AUTH (i.e., with Kerberos) functionality.
Author(s)	Tobias Oetterer (oetterertalk)
Latest version	1.0.0 (2024/06/30)
MediaWiki	1.39
PHP	7.1
Composer	mediawiki/auth-remote-user
License	GNU General Public License 2.0 or later
Download	GitHub: project page git repository URL[help] commit history README
Parameters $wgAuthRemoteUserDomain $wgAuthRemoteUserUsernameNormalizer

TheAuthRemoteUser extension manages authentication via the web server'sREMOTE_AUTH. UnlikeExtension:Auth remoteuser, where the whole wiki requires a web server's authentication, this extension only relies upon authentication on one page (Special:AuthRemoteUser).

You can either download this extensionfrom Git, using:

gitclonehttps://github.com/oetterer/AuthRemoteUser

or use composer (in which case, add the following to yourcomposer.local.json)

{"require":{"mediawiki/auth-remote-user":"^1.0"}}

Add the following to yourLocalSettings.php

wfLoadExtension('AuthRemoteUser');

Your webserver does the actual authentication, so you need to set it up properly. Please refer to your webserver documentation for instructions on how to do this.

<LocationMatch".*/index\.php"><If"%{QUERY_STRING} =~ /title=[^:]+:AuthRemoteUser/">SSLRequireSSLAuthTypeGSSAPIAuthName"Kerberos Login"GssapiCredStorekeytab:/etc/keytabs/krb5.keytab.HTTPGssapiSSLonlyOnGssapiAllowedMechkrb5requirevalid-user</If></LocationMatch>

<LocationMatch".*/index\.php"><If"%{QUERY_STRING} =~ /title=[^:]+:AuthRemoteUser/">SSLRequireSSLAuthTypeKerberosAuthName"Kerberos Login"KrbMethodNegotiateOnKrbMethodK5PasswdOffKrbAuthoritativeonKrbAuthRealms<yourkrbrealms>KrbVerifyKDConKrb5KeyTab/etc/keytabs/krb5.keytab.HTTPrequirevalid-user</If></LocationMatch>

Note: even, if you are usingShort URL schema, you have to match againstindex.php?title=, because the authentication special page is accessed internally with the original linking schema.

$wgAuthRemoteUserDomain

Specify your domain for remote authentication here. The extension does not validate the domain if this variable is left empty.

$wgAuthRemoteUserUsernameNormalizer

Use this function for normalizing username, for example 'strtolower'. By default, the kerberos domain is stripped and the remaining username is cast to lowercase..

You can specify what text will be shown on the authentication button by editing the MediaWiki messageMediaWiki:Auth-remote-user-login-button-label and its localizations.

Please seeExtension:PluggableAuth

• Extension:Auth remoteuser

• PluggableAuth plugins
• Stable extensions
• User identity extensions
• Extensions supporting Composer
• GPL licensed extensions
• Extensions in GitHub version control
• All extensions

• Extensions without an image
• Extensions without a compatibility policy
• Extensions with manual MediaWiki version
• Extensions not in ExtensionJson