• Migrating MediaWiki v1.4.12 to TikiWiki v15.2
  • target:
  • required:
  • choice:
  • major issues:
  • minor issues:
  • todo:
  • LDAP settings:
  • LDAP external groups

• OS: ubuntu lts (16/04)
• http: apache2 + php7
• db: mysql5
• AD: windows-server 2008/12

• permissions per groups on collections of resources (pages, images, attachments).
  • solved by use of categories + groups created as workspaces (per templates)
• ideally AGDLP application (role-based access control).
  • solved by permission inheritance from workspace-groups to AD groups
• AD integration
  • solved per LDAP setup

(because of restrictions originating from strict permissions requirement)

1. creating pages 1st, then assigning to cat.
   • pro: can edit text 1st, put link, follow empty link, create page.
   • contra: requires to assign category manually explicitly.
2. creating pages directly into cats via structures "Add Page" field/ button.
   • pro: automatically puts new page into cat / structure of page where you use the button.
   • contra: must prepend page-name with cat-name or else name misses cat part; can't use "pro" above.

To avoid accidental misplacement of pages to wrong cat permissions, we selected #2.
Either way requires dealing with global + cat permissions to setup in advance.

• https://dev.tiki.org/item6213 : editing cat permissions fails for names with "~" (namespace separator), e.g. "pe-hh~core" saves new permissions only as "pe-hh".
• https://dev.tiki.org/item6215 : editing cat permissions titles the page only with the last part of a workspace ("pe-hh~core" -> "core"), not the whole path, can be confusing when you have 2 workspaces with the same name in 2 different templates (areas).
• https://dev.tiki.org/item6214 : syntax highlighting works OK for all langs in editor, but produced / viewed pages only work with "php", all other langs are mono-colored.
• https://dev.tiki.org/item5657 : must hack /lib/userslib.php to make group-sync work along Ticket #5657 => replace all occurances.
• https://dev.tiki.org/item6216 : workspace templates don't cover all possible permissions as globally possible.
• https://dev.tiki.org/item6217 : need 2 permissions for "create structure" and "edit structure", so to provide structures that can be worked on but not messed up new ones or destroy them altogether.
• https://dev.tiki.org/item6218 : workspace should create and assign file gallery, too, to keep files separated as pages.
• https://dev.tiki.org/item6219 : copy&paste from media wiki this char "→" breaks "index rebuilding".
• https://dev.tiki.org/item5036 : LDAP: clean-up up tiki group+user db when memberships change in AD (differential, not just incremental).
• https://dev.tiki.org/item6220 : preview looks different from final output, like using "{CODE]..." creates boxes, but used fronts differ.
• https://dev.tiki.org/item6221 : renaming elements in cat OK for everything but perspective: cat listing still shows old perspective name while showing new wiki page names
  • "profile_symbols" & "objects" tables not updated.
• https://dev.tiki.org/item6222 : mediawiki importer fails because of "... =& new ...", in php7 the "&" is not allowed.
• https://dev.tiki.org/item6223 : when renaming cat + homepage of workspace, the homepage property "Namespace" must be changed manually, too, otherwise new pages from the renamed page will be misnamed.
• https://dev.tiki.org/item6224 : PDF/ office document files are supposed to be indexed while uploading, but indexing + upload fails.
  • "Incorrect string value: '\xFCr Spi...' for column 'search_data' at row 1"
• https://dev.tiki.org/item6277 : filling cells in sheets wth too much content leaves it empty.

• rollback fails even though global + cat perms "tiki_p_rollback" is set.
• menu features require global permissions, although cat permission granted (structures, workspaces, search, tags, file gals).
  • cat permissions override global not only incrementally, but differentially: cat denies -> global doesn't apply.

• Links to forbidden pages should be indicated as such, not to be required to follow link just to learn afterwards that it's denied.
• renaming "perspective" because of cat name change doesn't allow/show new cat name and new homepage (to be) assigned.
• can't create Convene entries editable by groups.
• "list pages" shows only permitted pages, but indicates more not shown with empty results on pages numbered beyond reach.
• when setting up LDAP, LDAP config elements are invisible because "style=display:none;" when php-ldap is missing.
  • tiki-check.php just lists this case as "info", not as "bad/ ugly/ failure", which it is when selecting it in the auth method.
  • LDAP external groups hides the elements in the "user" section, but shows them in the "group" section. A hint for the missing php-ldap would be more useful than hiding.
• disable menu items when insufficient permissions (global yes, cat no).
• "remember login" fails.
• "featured links" module has no menu links, must enter URL in browser.
• when created page is removed from all cats a user has access to (by that user), user can't recover page.
  • not required to be solved, just info.

• doc: usecase

LDAP Bind settings

LDAP User