Primary authentication provider wrapper for AuthPlugin. More...

Inheritance diagram for MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider:

[legend]

Collaboration diagram for MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider:

[legend]

Public Member Functions

__construct (AuthPlugin $auth, $requestType=null)

accountCreationType ()

Fetch the account-creation type. More...

autoCreatedAccount ($user, $source)

Post-auto-creation callback. More...

beginPrimaryAccountCreation ($user, $creator, array $reqs)

Start an account creation flow. More...

beginPrimaryAuthentication (array $reqs)

Start an authentication flow. More...

getAuthenticationRequests ($action, array $options)

{{Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether the implementing class is also a PreAuthenticationProvider, PrimaryAuthenticationProvider, or SecondaryAuthenticationProvider.

ACTION_LOGIN: Valid for passing to beginAuthentication. Called on all providers.
ACTION_CREATE: Valid for passing to beginAccountCreation. Called on all providers.
ACTION_LINK: Valid for passing to beginAccountLink. Called on linking primary providers only.
ACTION_CHANGE: Valid for passing to AuthManager::changeAuthenticationData to change credentials. Called on primary and secondary providers.
ACTION_REMOVE: Valid for passing to AuthManager::changeAuthenticationData to remove credentials. Must work without additional user input (i.e. without calling loadFromSubmission). Called on primary and secondary providers.

See also: AuthManager::getAuthenticationRequests()

Parameters

string	$action
array	$options	Options are: username: User name related to the action, or null/unset if anon. ACTION_LOGIN: The currently logged-in user, if any. ACTION_CREATE: The account creator, if non-anonymous. ACTION_LINK: The local user being linked to. ACTION_CHANGE: The user having data changed. ACTION_REMOVE: The user having data removed. If you leave the username property of the returned requests empty, this will automatically be copied there (except for ACTION_CREATE where it wouldn't really make sense).

Returns: AuthenticationRequest[]

}Of the requests returned by this method, exactly one should have AuthenticationRequest::$required set to REQUIRED.} More...

getUniqueId ()

Return a unique identifier for this instance. More...

onLocalUserCreated ($user, $autocreated)

Hook function to call AuthPlugin::initUser() More...

onUserGroupsChanged ($user, $added, $removed)

Hook function to call AuthPlugin::updateExternalDBGroups() More...

onUserLoggedIn ($user)

Hook function to call AuthPlugin::updateUser() More...

onUserSaveSettings ($user)

Hook function to call AuthPlugin::updateExternalDB() More...

providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)

Validate a change of authentication data (e.g. More...

providerAllowsPropertyChange ($property)

Determine whether a property can change. More...

providerChangeAuthenticationData (AuthenticationRequest $req)

Change or remove authentication data (e.g. More...

providerRevokeAccessForUser ($username)

Revoke the user's credentials. More...

testForAccountCreation ($user, $creator, array $reqs)

Determine whether an account creation may begin. More...

testUserCanAuthenticate ($username)

Test whether the named user can authenticate with this provider. More...

testUserExists ($username, $flags=User::READ_NORMAL)

Test whether the named user exists. More...

Public Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider

__construct (array $params=[])

getAuthenticationRequests ($action, array $options)

{{Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether the implementing class is also a PreAuthenticationProvider, PrimaryAuthenticationProvider, or SecondaryAuthenticationProvider.

ACTION_LOGIN: Valid for passing to beginAuthentication. Called on all providers.
ACTION_CREATE: Valid for passing to beginAccountCreation. Called on all providers.
ACTION_LINK: Valid for passing to beginAccountLink. Called on linking primary providers only.
ACTION_CHANGE: Valid for passing to AuthManager::changeAuthenticationData to change credentials. Called on primary and secondary providers.
ACTION_REMOVE: Valid for passing to AuthManager::changeAuthenticationData to remove credentials. Must work without additional user input (i.e. without calling loadFromSubmission). Called on primary and secondary providers.

See also: AuthManager::getAuthenticationRequests()

Parameters

string	$action
array	$options	Options are: username: User name related to the action, or null/unset if anon. ACTION_LOGIN: The currently logged-in user, if any. ACTION_CREATE: The account creator, if non-anonymous. ACTION_LINK: The local user being linked to. ACTION_CHANGE: The user having data changed. ACTION_REMOVE: The user having data removed. If you leave the username property of the returned requests empty, this will automatically be copied there (except for ACTION_CREATE where it wouldn't really make sense).

Returns: AuthenticationRequest[]

}Of the requests returned by this method, exactly one should have AuthenticationRequest::$required set to REQUIRED.} More...

Public Member Functions inherited from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider

autoCreatedAccount ($user, $source)

Post-auto-creation callback. More...

beginPrimaryAccountLink ($user, array $reqs)

Start linking an account to an existing user. More...

continuePrimaryAccountCreation ($user, $creator, array $reqs)

Continue an account creation flow. More...

continuePrimaryAccountLink ($user, array $reqs)

Continue linking an account to an existing user. More...

continuePrimaryAuthentication (array $reqs)

Continue an authentication flow. More...

finishAccountCreation ($user, $creator, AuthenticationResponse $response)

Post-creation callback. More...

postAccountCreation ($user, $creator, AuthenticationResponse $response)

Post-creation callback. More...

postAccountLink ($user, AuthenticationResponse $response)

Post-link callback. More...

postAuthentication ($user, AuthenticationResponse $response)

Post-login callback. More...

providerAllowsPropertyChange ($property)

Determine whether a property can change. More...

providerNormalizeUsername ($username)

Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.

Parameters

string $username

Returns: string|null

More...

providerRevokeAccessForUser ($username)

Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).

Parameters

string $username

More...

testForAccountCreation ($user, $creator, array $reqs)

Determine whether an account creation may begin. More...

testUserCanAuthenticate ($username)

Test whether the named user can authenticate with this provider. More...

testUserForCreation ($user, $autocreate, array $options=[])

Determine whether an account may be created. More...

Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider

getUniqueId ()

Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.

Returns: string

More...

setConfig (Config $config)

Set configuration. More...

setLogger (LoggerInterface $logger)

setManager (AuthManager $manager)

Set AuthManager. More...

Protected Member Functions
	makeAuthReq ()
	Create an appropriate AuthenticationRequest. More...

	setDomain ($req)
	Call $this->auth->setDomain() More...

Protected Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
	checkPasswordValidity ($username, $password)
	Check that the password is valid. More...

	failResponse (PasswordAuthenticationRequest $req)
	Return the appropriate response for failure. More...

	getNewPasswordExpiry ($username)
	Get expiration date for a new password, if any. More...

	getPassword ($hash)
	Get a Password object from the hash. More...

	getPasswordFactory ()
	Get the PasswordFactory. More...

	getPasswordResetData ($username, $data)
	Get password reset data, if any. More...

	setPasswordResetFlag ($username, Status $status, $data=null)
	Check if the password should be reset. More...

Private Member Functions
	testUserCanAuthenticateInternal ($user)

Private Attributes
	$auth

	$hasDomain

	$requestType = null

Additional Inherited Members
Public Attributes inherited from MediaWiki\Auth\PrimaryAuthenticationProvider
const	TYPE_CREATE = 'create'
	Provider can create accounts. More...

const	TYPE_LINK = 'link'
	Provider can link to existing accounts elsewhere. More...

const	TYPE_NONE = 'none'
	Provider cannot create or link to accounts. More...

Protected Attributes inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
bool	$authoritative
	Whether this provider should ABSTAIN (false) or FAIL (true) on password failure. More...

Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider
Config	$config

LoggerInterface	$logger

AuthManager	$manager

Detailed Description

Primary authentication provider wrapper for AuthPlugin.

Warning: If anything depends on the wrapped AuthPlugin being $wgAuth, it won't work with this!

Since: 1.27

Deprecated:: since 1.27

Definition at line 36 of file AuthPluginPrimaryAuthenticationProvider.php.

Constructor & Destructor Documentation

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::__construct	(	AuthPlugin	$auth,
			$requestType = `null`
	)

Parameters

AuthPlugin	$auth	AuthPlugin to wrap
string \| null	$requestType	Class name of the PasswordAuthenticationRequest to use. If $auth->domainList() returns more than one domain, this must be a PasswordDomainAuthenticationRequest.

Definition at line 49 of file AuthPluginPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\$auth, MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\$requestType, class, AuthPlugin\domainList(), Hooks\register(), and AuthPlugin\strict().

Member Function Documentation

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::accountCreationType ( )

Fetch the account-creation type.

Returns: string One of the TYPE_* constants

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 381 of file AuthPluginPrimaryAuthenticationProvider.php.

Referenced by MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\beginPrimaryAccountCreation().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::autoCreatedAccount	(	$user,
		$source
	)

Post-auto-creation callback.

Parameters

User	$user	User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
string	$source	The source of the auto-creation passed to AuthManager::autoCreateUser().

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 419 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::beginPrimaryAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Start an account creation flow.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

PASS: The user may be created. Secondary providers will now run.
FAIL: The user may not be created. Fail the creation process.
ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 390 of file AuthPluginPrimaryAuthenticationProvider.php.

References $req, $user, $username, MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\accountCreationType(), User\getCanonicalName(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\setDomain().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::beginPrimaryAuthentication ( array $reqs )

Start an authentication flow.

Parameters

AuthenticationRequest[] $reqs

Returns

AuthenticationResponse Expected responses:

PASS: The user is authenticated. Secondary providers will now run.
FAIL: The user is not authenticated. Fail the authentication process.
ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 192 of file AuthPluginPrimaryAuthenticationProvider.php.

References $req, $username, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\failResponse(), User\getCanonicalName(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), User\newFromName(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\setDomain(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\testUserCanAuthenticateInternal().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::getAuthenticationRequests	(		$action,
		array	$options
	)

{{Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether the implementing class is also a PreAuthenticationProvider, PrimaryAuthenticationProvider, or SecondaryAuthenticationProvider.

ACTION_LOGIN: Valid for passing to beginAuthentication. Called on all providers.
ACTION_CREATE: Valid for passing to beginAccountCreation. Called on all providers.
ACTION_LINK: Valid for passing to beginAccountLink. Called on linking primary providers only.
ACTION_CHANGE: Valid for passing to AuthManager::changeAuthenticationData to change credentials. Called on primary and secondary providers.
ACTION_REMOVE: Valid for passing to AuthManager::changeAuthenticationData to remove credentials. Must work without additional user input (i.e. without calling loadFromSubmission). Called on primary and secondary providers.

See also: AuthManager::getAuthenticationRequests()

Parameters

string	$action
array	$options	Options are: username: User name related to the action, or null/unset if anon. ACTION_LOGIN: The currently logged-in user, if any. ACTION_CREATE: The account creator, if non-anonymous. ACTION_LINK: The local user being linked to. ACTION_CHANGE: The user having data changed. ACTION_REMOVE: The user having data removed. If you leave the username property of the returned requests empty, this will automatically be copied there (except for ACTION_CREATE where it wouldn't really make sense).

Returns: AuthenticationRequest[]

}Of the requests returned by this method, exactly one should have AuthenticationRequest::$required set to REQUIRED.}

Of the requests returned by this method, exactly one should have AuthenticationRequest::$required set to REQUIRED.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 176 of file AuthPluginPrimaryAuthenticationProvider.php.

References MediaWiki\$action, MediaWiki\Auth\AuthManager\ACTION_CHANGE, MediaWiki\Auth\AuthManager\ACTION_CREATE, MediaWiki\Auth\AuthManager\ACTION_LOGIN, MediaWiki\Auth\AuthManager\ACTION_REMOVE, and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\makeAuthReq().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::getUniqueId ( )

Return a unique identifier for this instance.

This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.

Returns: string

Implements MediaWiki\Auth\AuthenticationProvider.

Definition at line 172 of file AuthPluginPrimaryAuthenticationProvider.php.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::makeAuthReq ( )

protected

Create an appropriate AuthenticationRequest.

Returns: PasswordAuthenticationRequest

Definition at line 88 of file AuthPluginPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\$requestType.

Referenced by MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\getAuthenticationRequests().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::onLocalUserCreated	(	$user,
		$autocreated
	)

Hook function to call AuthPlugin::initUser()

Parameters

User	$user
bool	$autocreated

Definition at line 158 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::onUserGroupsChanged	(	$user,
		$added,
		$removed
	)

Hook function to call AuthPlugin::updateExternalDBGroups()

Parameters

User	$user
array	$added
array	$removed

Definition at line 133 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::onUserLoggedIn ( $user )

Hook function to call AuthPlugin::updateUser()

Parameters

User $user

Definition at line 142 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::onUserSaveSettings ( $user )

Hook function to call AuthPlugin::updateExternalDB()

Parameters

User $user

Definition at line 122 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange	(	AuthenticationRequest	$req,
			$checkData = `true`
	)

Validate a change of authentication data (e.g.

passwords)

Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.

Parameters

AuthenticationRequest	$req
bool	$checkData	If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.

Returns: StatusValue

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 308 of file AuthPluginPrimaryAuthenticationProvider.php.

References $username, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), User\getCanonicalName(), StatusValue\newGood(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\setDomain().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::providerAllowsPropertyChange ( $property )

Determine whether a property can change.

See also: AuthManager::allowsPropertyChange()

Parameters

string $property

Returns: bool

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 303 of file AuthPluginPrimaryAuthenticationProvider.php.

References $property.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::providerChangeAuthenticationData ( AuthenticationRequest $req )

Change or remove authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.

It can be assumed that providerAllowsAuthenticationDataChange with $checkData === true was called before this, and passed. This method should never fail (other than throwing an exception).

Parameters

AuthenticationRequest $req

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 356 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user, $username, User\getCanonicalName(), User\newFromName(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\setDomain().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::providerRevokeAccessForUser ( $username )

Revoke the user's credentials.

This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.

The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).

Parameters

string $username

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 252 of file AuthPluginPrimaryAuthenticationProvider.php.

References $user, $username, as, User\getCanonicalName(), User\newFromName(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\testUserCanAuthenticateInternal().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::setDomain ( $req )

protected

Call $this->auth->setDomain()

Parameters

PasswordAuthenticationRequest $req

Definition at line 101 of file AuthPluginPrimaryAuthenticationProvider.php.

References $req.

Referenced by MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\beginPrimaryAccountCreation(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\beginPrimaryAuthentication(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\providerAllowsAuthenticationDataChange(), and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\providerChangeAuthenticationData().

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::testForAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Determine whether an account creation may begin.

Called from AuthManager::beginAccountCreation()

Note: No need to test if the account exists, AuthManager checks that

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns: StatusValue

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 386 of file AuthPluginPrimaryAuthenticationProvider.php.

MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider::testUserCanAuthenticate ( $username )

Test whether the named user can authenticate with this provider.

Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.

Parameters

string $username MediaWiki username