LDAP Security Changes

In an update expected to be released in March 2020, Microsoft will be increasing the default LDAP security settings.  This means if you're using Active Directory to authenticate against Deki, you need to move to LDAP over SSL, aka LDAPS.  I've updated this page with new information on how to configure it:

• How to authenticate Deki with Active Directory

Here's some additional information you may want in order to prepare for this change:

• Microsoft's announcement
• Reddit discussion
• How to enable LDAPS on domain controllers
• How to detect other things that will need to be reconfigured

Bug Fix for Inserting Images

I noticed when using Firefox 65 that trying to insert an image would cause the Browse tab to show the loading spinner indefinitely.  I found the bug and fixed it.

• Open skins\common\yui\mindtouch\link_navigator.js
• Search for "Content-Type" so you find this section:
  
  

  var contentType = o.getResponseHeader['Content-Type'] ?
                    o.getResponseHeader['Content-Type'] :
                    o.getResponseHeader['Content-type']; 

• Change it to this:
  
  

  var contentType = o.getResponseHeader['Content-Type'] ||
                    o.getResponseHeader['Content-type'] ||
                    o.getResponseHeader['content-type'];  
  

It's searching for the "Content-Type" or "Content-type" header, but Firefox 65 uses "content-type".  Now it checks all three.

Editing the Home Page

After I had done everything else on this blog I found that if I changed the home page and clicked Save, I would get this error:

Something seems to have broken! Please try saving again - we've already filled in the editor with the contents of your last edit.

Trying to save again would give you this error:

The page you are attempting to create already exists - change the title of your new page to something else.

If I clicked Details on the error message at the top of the screen I would get information that included these lines:

[message] => Column 'page_display_name' cannot be null
[source] => MySql.Data

This would only happen on the home page, not on any of the other ones.  At first I thought it was something related to my import, but after comparing the database entries for my home page and one from a clean install, I didn't see anything amiss.  In fact, editing the home page on a clean install gave me the same message!  Clearly it's a bug in Deki, and Deki is pretty much abandonware at this point so it's not going to get fixed any time soon.  It also seems like it probably comes from the C# API which wouldn't be as trivial for people to fix as the PHP since you'd need to recompile it.  So instead I tried simply removing the constraints from the database table.  This isn't ideal since it seems like there could be side effects of doing that, but I haven't run into any so far.

The Fix

• Start MySQL Workbench and connect to the database.
• Under Schemas, expand wikidb and Tables.
• Right click on pages and choose Alter Table.
• Under Column Name, select page_display_name.
• Uncheck Not Null.
• Click Apply and go through the dialogs that pop up.
• Back under Schemas > wikidb > Tables, right click on old and choose Alter Table.
• Under Column Name, select old_display_name.
• Uncheck Not Null.
• Click Apply and go through the dialogs that pop up.

That's it.  Try to save again and it should work.  If you get the message about the page already existing, try saving a second time and it should work from that point forward.

Changing MySQL's Storage Location

These are instructions for changing the location where MySQL stores its database files.  They're for version 5.7.17, but that's the latest version as of this writing and they will probably work with future versions as well.

• Stop the MySQL service.
• Use Windows Administrative Tools > Services
• Move the data files to a new location.
• They are stored in C:\ProgramData\MySQL\MySQL Server 5.7\Data by default.
•  You may have to turn on viewing hidden items in Explorer to see C:\ProgramData.
• Make sure NETWORK SERVICE has full NTFS permissions on the new folder.
• Right click the new folder and select Properties.
• Go to the Security tab and click Edit.
• Click Add, type in "network service", and click OK.
• Check the box under Full Control and Allow.
• Change the location in my.ini.
• Edit C:\ProgramData\MySQL\MySQL Server 5.7\my.ini.
• Search for the line that starts with datadir=
• Change the path to the new location and save.
• Restart the MySQL Service.

Authenticating with Active Directory

This is how to configure MindTouch Core (Deki Wiki) 10.1.4 to authenticate with Active Directory.

• From the wiki, go to Tools > Control Panel.
• Go to System Settings > Authentication on the left.
• Click the Add Authentication Service tab.
• For Choose an authentication provider, choose LDAP.
• For Description, choose how you want it to show up on the login page.
• For Service Identifier (SID), use sid://mindtouch.com/ent/2009/03/ldap-authentication
• This is the default value for new LDAP configurations.  The one that was imported from Deki 8.08.2 was sid://mindtouch.com/2007/05/ldap-authentication, though that seemed to work just fine as well.
• Select Default authentication provider if you want it to be selected by default on the login page.  Chances are you do.
• For hostname, put your fully qualified domain controller name, such as myserver.mydomain.com.
• For bindingdn, put $1@mydomain.com, substituting mydomain.com for your own.
• For searchbase, put each segment of your domain in DC=x,DC=y format, such as DC=mydomain,DC=com.
• For userquery, put samAccountName=$1.
• Under Preferences, add key displayname-pattern and give it value {givenname} {SN}.

Update: In March 2020 Microsoft is expected to increase the default security settings around LDAP.  This means you should also configure LDAP over SSL (LDAPS).

• Configure LDAPS support on the server you are using to authenticate.  Here's one set of instructions for Active Directory, but you can also just google LDAPS plus whichever server you're using.
• In Tools > Control Panel > System Settings > Authentication, edit the authentication service you created before.
• Under Configuration, click Add New Key.
• Enter key ssl with value true.
• If you're using a self-signed certificate:
• Click Add New Key again.
• Enter key ssl-ignore-cert-errors with value true.
• Click Save Changes.
• Log out and back in to test the changes.  If it doesn't work, try going back and adding the ssl-ignore-cert-errors setting above and trying again.

Also, a reference for all the available settings for this configuration page is available on the Wayback Machine here:

• LDAP Settings in Deki Wiki

Migrating Site Data

This is how you export data from one instance of MindTouch Core (Deki Wiki) and import it into another.  These instructions are based on moving from version 8.08.2 to 10.1.4.  These are not instructions for an in-place upgrade.

Export Data from the Old Wiki

You may have to search for the folders below because they may be in different locations depending on how Deki was installed and which version you were using.

• Make a copy of the attachments folder.
• It may be in web\attachments.
• Make a copy of LocalSettings.php and AdminSettings.php.
• You may not have AdminSettings.php if you started with Deki 1.9.0 or later, so just skip it if it doesn't exist.
• Make a copy of mindtouch.host.bat.
• It may be in bin or web\bin.
• Make a copy of mindtouch.deki.startup.xml.
• It may be in c:\dekiwiki, config, or web\config.
• Make a copy of any other customizations you have, such as a custom favicon.ico file.

• Export your MySQL database.
• Open a command prompt.
• Go the the MySQL\bin folder.
• For example: cd\Program Files\MySQL\MySQL Server 5.1\bin
• Run this command: mysqldump -u root -p wikidb > [exportfile].sql
• Substitute [exportfile] with where you want to put the file.
• You can substitute "root" with a different MySQL user name if you have one.

Install a New Wiki

Follow the instructions here to install a new instance of Deki Wiki, including going through the setup process.  Use the same MySQL password as the previous instance.

Import Data into the New Wiki

• Stop mindtouch.host.exe on the new instance if it's running.
• If you have mindtouch.host.bat running in a visible console window, just press Ctrl+C and enter Y when it asks you to terminate the batch job.
• If it's running from a scheduled task like the instructions said, open Task Manager, go to Details, select mindtouch.host.exe, and then click End Task. 

• Delete anything in the existing attachments folder and copy the contents of the old one in.

• Start MySQL Workbench and connect to the instance.
• Under Schemas on the left, right click on wikidb and choose Drop Schema.
• Go to Server > Data Import in the menu.
• Select Import from Self-Contained file and choose the file you made with mysqldump earlier.
• Next to Default Target Schema, click New and type wikidb.
• Click Start Import.
• Close the tab when it's done.
• Next to Schemas on the left, click the refresh button.  You should see wikidb appear.
• Under Schemas on the left, expand wikidb > Tables > config.
• Right click and choose Select Rows - Limit 1000.
• Find any paths in the config_value column and correct them if necessary.
• For example, change the value for storage/fs/path and make sure it matches your attachments folder.
• Click the Apply button to the lower right to save the changes.

• This isn't strictly necessary, but open mindtouch.deki.startup.xml from the new installation.
• Find <indexer><path.store> and change it to the path where you want to store the search index data.
• By default Deki defaults to "\bin\cache\luceneindex\\$1", which basically becomes c:\bin\cache\luceneindex.
• Change it to something more sensible but still end it with "\$1".
• You can delete the c:\bin folder it already created.

• Open the command prompt.
• Go to the maintenance folder in Deki.
• For example: cd\inetpub\wwwroot\maintenance
• Run php update-db.php
• This may take a few minutes depending on the size of your site. 

•  Restart mindtouch.host.bat.

Installing Deki from Source on Windows Server

This is how you install MindTouch Core (Deki Wiki) 10.1.14 from source on Windows Server.  These instructions work with Windows Server 2016 and Windows Server 2008 R2.

Install .NET 3.5

• For Windows Server 2016:
• Start Server Manager.
• Go to Manage > Add Roles and Features.
• In the Server Roles section, just click Next.
• In the Features section, open .NET Framework 3.5 Features and select .NET Framework 3.5 (includes .NET 2.0 and 3.0).
• Finish the install.

• For Windows Server 2008 R2:
• Start Server Manager.
• Click Features and then Add Features.
• Open .NET Framework 3.5.1 Features and select .NET Framework 3.5.1.
• Finish the install.

Install IIS

• For Windows Server 2016:
• Start Server Manager.
• Go to Manage > Add Roles and Features.
• In the Server Roles section, select Web Server (IIS).
• It will ask you if you also want to install the management tools.  Do so.
• In the Features section, just click Next.
• In the Web Server Role (IIS) > Role Services section, open the Web Server > Application Development group and add these to the defaults:
• CGI
• ISAPI Extensions
• ISAPI Filters
• Finish the wizard to install the components.

• For Windows Server 2008 R2:
• Start Server Manager.
• Go to Roles and click Add Roles.
• In the Server Roles section, select Web Server (IIS).
• In the Web Server (IIS) > Role Services section, in the Web Server > Application Development group, add these to the defaults:
• CGI
• ISAPI Extensions
• ISAPI Filters
• Finish the wizard to install the components.

Install MySQL

These instructions are based on MySQL 5.7.17, but that's the latest version as of this writing so they will probably work with future versions as well.

• Download it at MySQL.com
• Go to MySQL Community Edition > MySQL Community Server.  As of this writing it's available here.
• Download the MySQL Installer for Windows, the MSI version.
• It's okay that it says 32-bit.  It can install either 32-bit or 64-bit versions of the server.

• Install MySQL
• In Choose a Setup Type, select Custom.
• In Select Products and Features, choose these options:
• MySQL Servers > MySQL Server 5.7.17 - X64
• Applications > MySQL Workbench 6.3.8 - X64
• The workbench isn't required, but you should include it if you're going to be importing data from another Deki installation or if you want to be able to inspect the database.
• In Check Requirements, click Execute to install the Visual C++ Runtime.
• Continue until you get to the product configuration section.

• Configure MySQL
•  In the Type and Networking section:
• Set Config Type to Server Machine.
• Leave TCP/IP and Port Number: 3306 checked, but uncheck Open Firewall port for network access.
• This is for accessing the database directly over the network, which we won't need.  Only Deki will access it from the current machine.
• In the Accounts and Roles section, add a root password.
• In the Windows Service section, leave Configure MySQL Server as a Windows Service and Start the MySQL Server at System Startup checked.
• Everything else should be fine to leave at their defaults.  Apply the server configuration.

Install PHP

• Download the PHP 5.2.17 NTS (non-thread safe) MSI installer from the archives.
• Deki needs mimetypec (mime_magic) which was removed in 5.3.0.  This is the latest 5.2 release.

• Install PHP
• In the Web Server Setup section, choose IIS FastCGI.
• In the Choose Items to Install section, add these items:
• In Extensions:
• Curl
• GD2
• Multi-Byte String
• Mimetypec
• MySQL
• MySQLi
• In Extras:
• PEAR Install
• Finish the install.

• Configure PHP
• Edit php.ini.  The installer should have created a Start menu shortcut to it in the PHP 5 group.
• In all the examples below, make sure you change the lines that don't start with a semicolon.  Lines starting with a semicolon don't affect anything and are just examples.
• Search for short_open_tag and set it to On
• Search for error_reporting and set it to E_ALL & ~E_NOTICE
• Search for max_execution_time and make sure it's at least 300.
• I've found some operations, like viewing the very long edit history of our telephone directory, can take some time to execute.  This is the amount of time in seconds the server will let the operation run before it cancels it.  Setting it to 300 means five minutes.
• Search for upload_max_filesize and set it to 50M or something similar.  The default 2M is too small.

Install Deki Source Files

• Download MindTouch Core Source > Pipestone 10.1.4 at SourceForge.
• It's in .tar.gz format, so you may need to use 7-Zip to extract it.
• Delete everything in c:\inetpub\wwwroot.
• Copy the contents of the "web" folder in the archive to c:\inetpub\wwwroot.
• Also copy src\services\deki\resources\license-community.xml somewhere.  You'll need it later, but it doesn't have to be in wwwroot.
• Give "everyone" full permission on c:\inetpub\wwwroot\config.
• Right click on the folder in Explorer and go to Properties > Security tab > Edit button > Add button > type "everyone" > check Full Control under Allow.

Install ISAPI_Rewrite

These instructions are based on ISAPI_Rewrite 3 Build 0112.

• Download the full or trial (not lite) version of ISAPI_Rewrite 64-bit. 
• The lite version does not support [S] which is used in the configuration.  The full version costs money but there's a 45-day trial you can use first.
• The web page only lists up to Windows Server 2012 R2 but it works on 2016.

• Install ISAPI_Rewrite
• The defaults are fine for everything. 

• Start Helicon > ISAPI_Rewrite Manager
• Click Edit.
• Paste in these settings and click Apply:

RewriteEngine On

RewriteCond %{REQUEST_URI} ^/$
RewriteRule ^/$ /index.php?title= [L,NE]

RewriteCond %{REQUEST_URI} ^/@gui/[^.]+$
RewriteRule ^/@gui/(.*)$ /proxy.php?path=$1 [L,QSA,NE]

RewriteCond %{REQUEST_URI} ^/@api/
RewriteRule ^/@api/(.*)$ http://localhost:8081/$1 [P,L]

RewriteCond %{REQUEST_URI} !^/(@api|editor|skins|config|@gui)/
RewriteCond %{REQUEST_URI} !^/index\.php
RewriteCond %{REQUEST_URI} !^/favicon\.ico$
RewriteCond %{REQUEST_URI} !^/robots\.txt$
RewriteCond %{REQUEST_URI} !^/deki/
RewriteCond %{QUERY_STRING} ^$ [OR]
RewriteCond %{REQUEST_URI} ^/Special:Search
RewriteRule ^/(.*)$ /index.php?title=$1 [L,QSA,NE]

• Click Apply in the Helicon Manager window and close it.

Install ImageMagick

• Download ImageMagick 6.9.7-9 Q8 x64 Static from their legacy page.
• Deki needs convert.exe and identify.exe which were removed in ImageMagick 7.  This is the latest 6 release.

• Install ImageMagick
• You can uncheck the option to add the application directory to your system path.

Configure Deki

• Open the site in a web browser.
• From the server it will be http://localhost.  From a different computer you would replace localhost with the server name.
• Click Install for MindTouch Core.
• In the Site Setup section, fill in all the information.
• In the Configuration section, use these settings:
• Set Superuser name to root.
• Set Superuser password to the password you chose when you installed MySQL.
• Set ImageMagick convert to convert.exe in the ImageMagick folder.  By default it should be C:\Program Files\ImageMagick-6.9.7-Q8\convert.exe
• Set ImageMagick identify to identify.exe in the ImageMagick folder.  By default it should be C:\Program Files\ImageMagick-6.9.7-Q8\identify.exe
• The rest can be left at their defaults.  It's okay for Mono and Prince to be blank.
• You can ignore the stuff in the Your Organization section.
• In the Confirmation section click Install MindTouch.
• If it succeeds it will tell you to open a command prompt and do this:

cd C:\inetpub\wwwroot\config
mkdir C:\dekiwiki
copy mindtouch.deki.startup.xml C:\dekiwiki
copy LocalSettings.php C:\inetpub\wwwroot\
copy mindtouch.host.bat C:\inetpub\wwwroot\bin
cd C:\inetpub\wwwroot\bin
mindtouch.host.bat

• After running mindtouch.host.bat and waiting for it to be ready, the text under the Continue to MindTouch button should change to "MindTouch is running!".  Click Continue to MindTouch.
• Click Browse and upload the license-community.xml file you got from the Deki archive.  It was in src\services\deki\resources.
• Click Activate License.
• Click Return to MindTouch on the upper left corner of the page to get started.

Make Deki Start Automatically

Deki is running but mindtouch.host.bat won't start automatically with Windows.  This is a problem if you ever reboot the server since you'd have to remember to log in and start it again every time.  We can make Windows do this for us though.

• Click Start and type in Task Scheduler.
• Click Create Basic Task on the right.
• Give it a name, like Start Deki Wiki.
• In the Trigger section, select When the computer starts.
• In the Action section, select Start a program.
• In the Start a Program section, enter C:\inetpub\wwwroot\bin\mindtouch.host.bat
• In the Finish section, check Open the Properties dialog for this task when I click Finish.
• On the General tab, select Run whether user is logged on or not.
• On the Settings tab, uncheck Stop the task if it runs longer than.
• Click OK and enter your password.  It will save it so it can run the task with your account without you logging in.

Now you are finally, finally done!