MediaWiki REL1_31
|
A primary authentication provider is responsible for associating the submitted authentication data with a MediaWiki account. More...
Public Member Functions | |
accountCreationType () | |
Fetch the account-creation type. | |
autoCreatedAccount ( $user, $source) | |
Post-auto-creation callback. | |
beginPrimaryAccountCreation ( $user, $creator, array $reqs) | |
Start an account creation flow. | |
beginPrimaryAccountLink ( $user, array $reqs) | |
Start linking an account to an existing user. | |
beginPrimaryAuthentication (array $reqs) | |
Start an authentication flow. | |
continuePrimaryAccountCreation ( $user, $creator, array $reqs) | |
Continue an account creation flow. | |
continuePrimaryAccountLink ( $user, array $reqs) | |
Continue linking an account to an existing user. | |
continuePrimaryAuthentication (array $reqs) | |
Continue an authentication flow. | |
finishAccountCreation ( $user, $creator, AuthenticationResponse $response) | |
Post-creation callback. | |
getAuthenticationRequests ( $action, array $options) | |
@inheritDoc | |
postAccountCreation ( $user, $creator, AuthenticationResponse $response) | |
Post-creation callback. | |
postAccountLink ( $user, AuthenticationResponse $response) | |
Post-link callback. | |
postAuthentication ( $user, AuthenticationResponse $response) | |
Post-login callback. | |
providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true) | |
Validate a change of authentication data (e.g. | |
providerAllowsPropertyChange ( $property) | |
Determine whether a property can change. | |
providerChangeAuthenticationData (AuthenticationRequest $req) | |
Change or remove authentication data (e.g. | |
providerNormalizeUsername ( $username) | |
Normalize the username for authentication. | |
providerRevokeAccessForUser ( $username) | |
Revoke the user's credentials. | |
testForAccountCreation ( $user, $creator, array $reqs) | |
Determine whether an account creation may begin. | |
testUserCanAuthenticate ( $username) | |
Test whether the named user can authenticate with this provider. | |
testUserExists ( $username, $flags=User::READ_NORMAL) | |
Test whether the named user exists. | |
testUserForCreation ( $user, $autocreate, array $options=[]) | |
Determine whether an account may be created. | |
Public Member Functions inherited from MediaWiki\Auth\AuthenticationProvider | |
getUniqueId () | |
Return a unique identifier for this instance. | |
setConfig (Config $config) | |
Set configuration. | |
setManager (AuthManager $manager) | |
Set AuthManager. | |
Public Attributes | |
const | TYPE_CREATE = 'create' |
Provider can create accounts. | |
const | TYPE_LINK = 'link' |
Provider can link to existing accounts elsewhere. | |
const | TYPE_NONE = 'none' |
Provider cannot create or link to accounts. | |
A primary authentication provider is responsible for associating the submitted authentication data with a MediaWiki account.
When multiple primary authentication providers are configured for a site, they act as alternatives; the first one that recognizes the data will handle it, and further primary providers are not called (although they all get a chance to prevent actions).
For login, the PrimaryAuthenticationProvider takes form data and determines which authenticated user (if any) corresponds to that form data. It might do this on the basis of a username and password in that data, or by interacting with an external authentication service (e.g. using OpenID), or by some other mechanism.
(A PrimaryAuthenticationProvider would not be appropriate for something like HTTP authentication, OAuth, or SSL client certificates where each HTTP request contains all the information needed to identify the user. In that case you'll want to be looking at a \MediaWiki\Session\SessionProvider instead.)
For account creation, the PrimaryAuthenticationProvider takes form data and stores some authentication details which will allow it to verify a login by that user in the future. This might for example involve saving it in the database in a table that can be joined to the user table, or sending it to some external service for account creation, or authenticating the user with some remote service and then recording that the remote identity is linked to the local account. The creation of the local user (i.e. calling User::addToDatabase()) is handled by AuthManager once the primary authentication provider returns a PASS from begin/continueAccountCreation; do not try to do it yourself.
For account linking, the PrimaryAuthenticationProvider verifies the user's identity at some external service (typically by redirecting the user and asking the external service to verify) and then records which local account is linked to which remote accounts. It should keep track of this and be able to enumerate linked accounts via getAuthenticationRequests(ACTION_REMOVE).
This interface also provides methods for changing authentication data such as passwords, and callbacks that are invoked after login / account creation / account linking succeeded or failed.
Definition at line 75 of file PrimaryAuthenticationProvider.php.
MediaWiki\Auth\PrimaryAuthenticationProvider::accountCreationType | ( | ) |
Fetch the account-creation type.
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\beginPrimaryAccountLink().
MediaWiki\Auth\PrimaryAuthenticationProvider::autoCreatedAccount | ( | $user, | |
$source ) |
Post-auto-creation callback.
User | $user | User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such. |
string | $source | The source of the auto-creation passed to AuthManager::autoCreateUser(). |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider, and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAccountCreation | ( | $user, | |
$creator, | |||
array | $reqs ) |
Start an account creation flow.
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAccountLink | ( | $user, | |
array | $reqs ) |
Start linking an account to an existing user.
User | $user | User being linked. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAuthentication | ( | array | $reqs | ) |
Start an authentication flow.
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAccountCreation | ( | $user, | |
$creator, | |||
array | $reqs ) |
Continue an account creation flow.
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAccountLink | ( | $user, | |
array | $reqs ) |
Continue linking an account to an existing user.
User | $user | User being linked. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAuthentication | ( | array | $reqs | ) |
Continue an authentication flow.
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::finishAccountCreation | ( | $user, | |
$creator, | |||
AuthenticationResponse | $response ) |
Post-creation callback.
Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
User | $user | User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationResponse | $response | PASS response returned earlier |
Implemented in MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::getAuthenticationRequests | ( | $action, | |
array | $options ) |
@inheritDoc
Of the requests returned by this method, exactly one should have AuthenticationRequest::$required
set to REQUIRED.
Implements MediaWiki\Auth\AuthenticationProvider.
Implemented in MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider, MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\providerRevokeAccessForUser().
MediaWiki\Auth\PrimaryAuthenticationProvider::postAccountCreation | ( | $user, | |
$creator, | |||
AuthenticationResponse | $response ) |
Post-creation callback.
This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).
User | $user | User that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationResponse | $response | Authentication response that will be returned (PASS or FAIL) |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::postAccountLink | ( | $user, | |
AuthenticationResponse | $response ) |
Post-link callback.
This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.
User | $user | User that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationResponse | $response | Authentication response that will be returned (PASS or FAIL) |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::postAuthentication | ( | $user, | |
AuthenticationResponse | $response ) |
Post-login callback.
This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.
User | null | $user | User that was attempted to be logged in, if known. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationResponse | $response | Authentication response that will be returned (PASS or FAIL) |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange | ( | AuthenticationRequest | $req, |
$checkData = true ) |
Validate a change of authentication data (e.g.
passwords)
Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.
AuthenticationRequest | $req | |
bool | $checkData | If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission. |
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::providerAllowsPropertyChange | ( | $property | ) |
Determine whether a property can change.
string | $property |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider, and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::providerChangeAuthenticationData | ( | AuthenticationRequest | $req | ) |
Change or remove authentication data (e.g.
passwords)
If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.
If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.
It can be assumed that providerAllowsAuthenticationDataChange with $checkData === true was called before this, and passed. This method should never fail (other than throwing an exception).
AuthenticationRequest | $req |
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\providerRevokeAccessForUser().
MediaWiki\Auth\PrimaryAuthenticationProvider::providerNormalizeUsername | ( | $username | ) |
Normalize the username for authentication.
Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.
If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).
If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.
string | $username |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::providerRevokeAccessForUser | ( | $username | ) |
Revoke the user's credentials.
This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.
The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).
string | $username |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider, and MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::testForAccountCreation | ( | $user, | |
$creator, | |||
array | $reqs ) |
Determine whether an account creation may begin.
Called from AuthManager::beginAccountCreation()
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
User | $creator | User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such. |
AuthenticationRequest[] | $reqs |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider, MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::testUserCanAuthenticate | ( | $username | ) |
Test whether the named user can authenticate with this provider.
Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
string | $username | MediaWiki username |
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider, MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
MediaWiki\Auth\PrimaryAuthenticationProvider::testUserExists | ( | $username, | |
$flags = User::READ_NORMAL ) |
Test whether the named user exists.
Single-sign-on providers can use this to reserve a username for autocreation.
Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.
Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\testUserCanAuthenticate().
MediaWiki\Auth\PrimaryAuthenticationProvider::testUserForCreation | ( | $user, | |
$autocreate, | |||
array | $options = [] ) |
Determine whether an account may be created.
User | $user | User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such. |
bool | string | $autocreate | False if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser(). |
array | $options |
|
Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_CREATE = 'create' |
Provider can create accounts.
Definition at line 77 of file PrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProviderTest\provideAccountCreationType(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAccountCreationLogging(), MediaWiki\Auth\AuthManagerTest\testAccountLink(), MediaWiki\Auth\AuthManagerTest\testAutoAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAutoCreateFailOnLogin(), MediaWiki\Auth\AuthManagerTest\testAutoCreateOnLogin(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\AuthManagerTest\testBeginAccountCreation(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccount(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), MediaWiki\Auth\AuthManagerTest\testContinueAccountCreation(), MediaWiki\Auth\AuthManagerTest\testCreateFromLogin(), MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequestsRequired().
const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_LINK = 'link' |
Provider can link to existing accounts elsewhere.
Definition at line 79 of file PrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\AuthManager\beginAccountLink(), MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\canLinkAccounts(), MediaWiki\Auth\AuthManager\continueAuthentication(), MediaWiki\Auth\AuthManager\getAuthenticationRequests(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAccountLink(), MediaWiki\Auth\AuthManagerTest\testAuthentication(), MediaWiki\Auth\AuthManagerTest\testBeginAccountLink(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), MediaWiki\Auth\AuthManagerTest\testContinueAccountLink(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests().
const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_NONE = 'none' |
Provider cannot create or link to accounts.
Definition at line 81 of file PrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\AuthManager\continueAccountCreation(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProviderTest\provideAccountCreationType(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests().