But it should be possible. OTTOMH I would assume that you would be looking for a MediaWiki LDAP module to install and then set up MediaWiki to only allow viewing by logged in users (don't recall how this is done, but IIRC then it is possible).

OTOH if you have it installed locally and don't have any ports forwarded to the outside world then it should only be viewable by LAN users by default anyway.

Assuming you installed TKL v11.x then it is based on Ubuntu 10.04/Lucid

Like you say, there are two places you can configure LDAP. The key difference is whether you want unauthenticated users to be able to read the content, or if you want all accesses to be authenticated. If you only want edits to be authenticated, then configure the LDAP plugin in MediaWiki. I did this first, there was a lot of documentation on it.

 I need all access to be authenticated. Here is how I did it:

1. Enable authnz_ldap and ldap:  

a2enmod authnz_ldap

a2enmod ldap

2. Then I configured the authnz_ldap plugin by creating a file  /etc/apache2/conf.d/LDAP.conf

<Location />
   AuthName "MediaWiki"

   AuthType Basic
   AuthBasicProvider ldap
   AuthLDAPUrl ldap://ldap.example.com/dc=example,dc=com?uid,mail,cn

   Require ldap-user larry curly moe
</Location>

Things to note in this file:

• AuthName is the title of the HTTP-Basic Auth Popup.
• ldap.example.com is the hostname of your server. We use a load balancer, but you can specify multiples here by separating them with spaces.
• dc=example,dc=com is the baseDN of your search
• uid,mail,cn are the attributes to search on (first one, uid) and to return. This way email and Common Name are pulled from LDAP.
• The Require line tells the plugin to only authorize larry, curly and moe as users, denying all other users.

Now when you login, there will be headers sent for REMOTE_USER, AUTHENTICATE_CN, and AUTHENTICATE_MAIL, we just have to get MediaWiki to use and trust those values.

3. Install the auth_remoteuser plugin for MediaWiki.

4. Configure the plugin by editing /etc/mediawiki/extensions.php and adding the following lines:

require_once("$IP/extensions/Auth_remoteuser/Auth_remoteuser.php");
$wgAuth = new Auth_remoteuser();

$wgAuthRemoteuserAuthz = true; /* Your own authorization test */
$wgAuthRemoteuserName = $_SERVER["AUTHENTICATE_CN"]; /* User's name */
$wgAuthRemoteuserMail = $_SERVER["AUTHENTICATE_MAIL"]; /* User's Mail */
$wgAuthRemoteuserNotify = false; /* Do not send mail notifications */
// Don't let anonymous people do things...
$wgGroupPermissions['*']['createaccount']   = false;
$wgGroupPermissions['*']['read']            = false;
$wgGroupPermissions['*']['edit']            = false;

That should be all you need to do. That configuration should work as is.

Hope that helps,

Dave