A primary authentication provider that uses the password field in the 'user' table. More...

Inheritance diagram for MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider:

[legend]

Collaboration diagram for MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider:

[legend]

Public Member Functions
	__construct ( $params=[])

	accountCreationType ()
	Fetch the account-creation type.

	beginPrimaryAccountCreation ( $user, $creator, array $reqs)
	Start an account creation flow.

	beginPrimaryAuthentication (array $reqs)
	Start an authentication flow.

	finishAccountCreation ( $user, $creator, AuthenticationResponse $res)
	Post-creation callback.

	providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
	Validate a change of authentication data (e.g.

	providerChangeAuthenticationData (AuthenticationRequest $req)
	Change or remove authentication data (e.g.

	testForAccountCreation ( $user, $creator, array $reqs)
	Determine whether an account creation may begin.

	testUserCanAuthenticate ( $username)
	Test whether the named user can authenticate with this provider.

	testUserExists ( $username, $flags=User::READ_NORMAL)
	Test whether the named user exists.

Public Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
	__construct (array $params=[])

	getAuthenticationRequests ( $action, array $options)
	Return the applicable list of AuthenticationRequests.

Public Member Functions inherited from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider
	autoCreatedAccount ( $user, $source)
	Post-auto-creation callback.

	beginPrimaryAccountLink ( $user, array $reqs)
	Start linking an account to an existing user.

	continuePrimaryAccountCreation ( $user, $creator, array $reqs)
	Continue an account creation flow.

	continuePrimaryAccountLink ( $user, array $reqs)
	Continue linking an account to an existing user.

	continuePrimaryAuthentication (array $reqs)
	Continue an authentication flow.

	postAccountCreation ( $user, $creator, AuthenticationResponse $response)
	Post-creation callback.

	postAccountLink ( $user, AuthenticationResponse $response)
	Post-link callback.

	postAuthentication ( $user, AuthenticationResponse $response)
	Post-login callback.

	providerAllowsPropertyChange ( $property)
	Determine whether a property can change.

	providerNormalizeUsername ( $username)
	@inheritDoc

	providerRevokeAccessForUser ( $username)
	@inheritDoc

	testUserForCreation ( $user, $autocreate, array $options=[])
	Determine whether an account may be created.

Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
	getUniqueId ()
	@inheritDoc

	setConfig (Config $config)
	Set configuration.

	setLogger (LoggerInterface $logger)

	setManager (AuthManager $manager)
	Set AuthManager.

Protected Member Functions
	getPasswordResetData ( $username, $row)
	Get password reset data, if any.

Protected Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
	checkPasswordValidity ( $username, $password)
	Check that the password is valid.

	failResponse (PasswordAuthenticationRequest $req)
	Return the appropriate response for failure.

	getNewPasswordExpiry ( $username)
	Get expiration date for a new password, if any.

	getPassword ( $hash)
	Get a Password object from the hash.

	getPasswordFactory ()
	Get the PasswordFactory.

	setPasswordResetFlag ( $username, Status $status, $data=null)
	Check if the password should be reset.

Protected Attributes
bool	$loginOnly = false
	If true, this instance is for legacy logins only.

Protected Attributes inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
bool	$authoritative
	Whether this provider should ABSTAIN (false) or FAIL (true) on password failure.

Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider
Config	$config

LoggerInterface	$logger

AuthManager	$manager

Additional Inherited Members
Public Attributes inherited from MediaWiki\Auth\PrimaryAuthenticationProvider
const	TYPE_CREATE = 'create'
	Provider can create accounts.

const	TYPE_LINK = 'link'
	Provider can link to existing accounts elsewhere.

const	TYPE_NONE = 'none'
	Provider cannot create or link to accounts.

Detailed Description

A primary authentication provider that uses the password field in the 'user' table.

Since: 1.27

Definition at line 31 of file LocalPasswordPrimaryAuthenticationProvider.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::__construct ( $params = [] )

Parameters

array

$params

Settings

loginOnly: If true, the local passwords are for legacy logins only: the local password will be invalidated when authentication is changed and new users will not have a valid local password set.

Definition at line 44 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $params.

Member Function Documentation

◆ accountCreationType()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::accountCreationType ( )

Fetch the account-creation type.

Returns: string One of the TYPE_* constants

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 273 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_CREATE, and MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_NONE.

Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAccountCreation(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\finishAccountCreation().

◆ beginPrimaryAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::beginPrimaryAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Start an account creation flow.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

PASS: The user may be created. Secondary providers will now run.
FAIL: The user may not be created. Fail the creation process.
ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 293 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $req, $ret, $user, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), and MediaWiki\Auth\AuthenticationResponse\newPass().

◆ beginPrimaryAuthentication()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::beginPrimaryAuthentication ( array $reqs )

Start an authentication flow.

Parameters

AuthenticationRequest[] $reqs

Returns

AuthenticationResponse Expected responses:

PASS: The user is authenticated. Secondary providers will now run.
FAIL: The user is not authenticated. Fail the authentication process.
ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 72 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $dbr, $fname, $req, $username, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), DB_MASTER, DB_REPLICA, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\failResponse(), User\getCanonicalName(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\setPasswordResetFlag(), use, and wfGetDB().

◆ finishAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::finishAccountCreation	(		$user,
			$creator,
		AuthenticationResponse	$response
	)

Post-creation callback.

Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.

Parameters

User	$user	User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	PASS response returned earlier

Returns: string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.

Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Definition at line 315 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData().

◆ getPasswordResetData()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::getPasswordResetData	(	$username,
		$data
	)

protected

Get password reset data, if any.

Parameters

string	$username
mixed	$data

Returns: object|null { 'hard' => bool, 'msg' => Message }

Reimplemented from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider.

Definition at line 49 of file LocalPasswordPrimaryAuthenticationProvider.php.

References wfTimestamp(), and wfTimestampOrNull().

◆ providerAllowsAuthenticationDataChange()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange	(	AuthenticationRequest	$req,
			$checkData = `true`
	)

Validate a change of authentication data (e.g.

passwords)

Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.

Parameters

AuthenticationRequest	$req
bool	$checkData	If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.

Returns: StatusValue

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 202 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $req, $username, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), DB_MASTER, User\getCanonicalName(), and wfGetDB().

◆ providerChangeAuthenticationData()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::providerChangeAuthenticationData ( AuthenticationRequest $req )

Change or remove authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.

It can be assumed that providerAllowsAuthenticationDataChange with $checkData === true was called before this, and passed. This method should never fail (other than throwing an exception).

Parameters

AuthenticationRequest $req

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 241 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $req, $username, DB_MASTER, User\getCanonicalName(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getNewPasswordExpiry(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), and wfGetDB().

Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\finishAccountCreation().

◆ testForAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::testForAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Determine whether an account creation may begin.

Called from AuthManager::beginAccountCreation()

Note: No need to test if the account exists, AuthManager checks that

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]	$reqs

Returns: StatusValue

Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Definition at line 277 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $req, $ret, $user, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), and MediaWiki\Auth\AuthenticationRequest\getRequestByClass().

◆ testUserCanAuthenticate()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::testUserCanAuthenticate ( $username )

Test whether the named user can authenticate with this provider.

Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.

Parameters

string $username MediaWiki username