MediaWiki REL1_35
MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider Class Reference

A primary authentication provider that uses the password field in the 'user' table. More...

Inheritance diagram for MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider:
Collaboration diagram for MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider:

Public Member Functions

 __construct ( $params=[])
 
 accountCreationType ()
 Fetch the account-creation type.
 
 beginPrimaryAccountCreation ( $user, $creator, array $reqs)
 Start an account creation flow.
 
 beginPrimaryAuthentication (array $reqs)
 Start an authentication flow.
 
 finishAccountCreation ( $user, $creator, AuthenticationResponse $res)
 Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responsePASS response returned earlier
Returns
string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.
Stable to override Stable to override
 
 providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
 Validate a change of authentication data (e.g.
 
 providerChangeAuthenticationData (AuthenticationRequest $req)
 Change or remove authentication data (e.g.
 
 testForAccountCreation ( $user, $creator, array $reqs)
 Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()
Note
No need to test if the account exists, AuthManager checks that
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
StatusValue
Stable to override Stable to override
 
 testUserCanAuthenticate ( $username)
 Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
Parameters
string$usernameMediaWiki username
Returns
bool
Stable to override Stable to override
 
 testUserExists ( $username, $flags=User::READ_NORMAL)
 Test whether the named user exists.
 
- Public Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
 __construct (array $params=[])
 Stable to call.
 
 getAuthenticationRequests ( $action, array $options)
 Stable to override.
 
- Public Member Functions inherited from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider
 autoCreatedAccount ( $user, $source)
 Post-auto-creation callback.
Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
string$sourceThe source of the auto-creation passed to AuthManager::autoCreateUser().
Stable to override
 
 beginPrimaryAccountLink ( $user, array $reqs)
 Start linking an account to an existing user.
Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
  • UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.
Stable to override
 
 continuePrimaryAccountCreation ( $user, $creator, array $reqs)
 Continue an account creation flow.
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user may be created. Secondary providers will now run.
  • FAIL: The user may not be created. Fail the creation process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.
Stable to override
 
 continuePrimaryAccountLink ( $user, array $reqs)
 Continue linking an account to an existing user.
Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.
Stable to override
 
 continuePrimaryAuthentication (array $reqs)
 Stable to override.
 
 postAccountCreation ( $user, $creator, AuthenticationResponse $response)
 Post-creation callback.This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).
Parameters
User$userUser that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)
Stable to override
 
 postAccountLink ( $user, AuthenticationResponse $response)
 Post-link callback.This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.
Parameters
User$userUser that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)
Stable to override
 
 postAuthentication ( $user, AuthenticationResponse $response)
 Post-login callback.This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.
Parameters
User | null$userUser that was attempted to be logged in, if known. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)
Stable to override
 
 providerAllowsPropertyChange ( $property)
 Determine whether a property can change.
See also
AuthManager::allowsPropertyChange()
Parameters
string$property
Returns
bool
Stable to override
 
 providerNormalizeUsername ( $username)
 Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.
Parameters
string$username
Returns
string|null
Stable to override
 
 providerRevokeAccessForUser ( $username)
 Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).
Parameters
string$username
Stable to override
 
 testUserForCreation ( $user, $autocreate, array $options=[])
 Determine whether an account may be created.
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
bool | string$autocreateFalse if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser().
array$options
  • flags: (int) Bitfield of User:READ_* constants, default User::READ_NORMAL
  • creating: (bool) If false (or missing), this call is only testing if a user could be created. If set, this (non-autocreation) is for actually creating an account and will be followed by a call to testForAccountCreation(). In this case, the provider might return StatusValue::newGood() here and let the later call to testForAccountCreation() do a more thorough test.
Returns
StatusValue
Stable to override
 
- Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
 getUniqueId ()
 Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.
Returns
string

 
 setConfig (Config $config)
 Stable to override.
 
 setHookContainer (HookContainer $hookContainer)
 Set the HookContainer.
 
 setLogger (LoggerInterface $logger)
 
 setManager (AuthManager $manager)
 Set AuthManager.
 

Protected Member Functions

 getPasswordResetData ( $username, $row)
 Check if the password has expired and needs a reset.
 
- Protected Member Functions inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
 checkPasswordValidity ( $username, $password)
 Check that the password is valid.
 
 failResponse (PasswordAuthenticationRequest $req)
 Return the appropriate response for failure.
 
 getNewPasswordExpiry ( $username)
 Get expiration date for a new password, if any.
 
 getPassword ( $hash)
 Get a Password object from the hash.
 
 getPasswordFactory ()
 Get the PasswordFactory.
 
 setPasswordResetFlag ( $username, Status $status, $data=null)
 Check if the password should be reset.
 
- Protected Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
 getHookContainer ()
 
 getHookRunner ()
 

Protected Attributes

bool $loginOnly = false
 If true, this instance is for legacy logins only.
 
- Protected Attributes inherited from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider
bool $authoritative
 Whether this provider should ABSTAIN (false) or FAIL (true) on password failure.
 
- Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider
Config $config
 
LoggerInterface $logger
 
AuthManager $manager
 

Additional Inherited Members

- Public Attributes inherited from MediaWiki\Auth\PrimaryAuthenticationProvider
const TYPE_CREATE = 'create'
 Provider can create accounts.
 
const TYPE_LINK = 'link'
 Provider can link to existing accounts elsewhere.
 
const TYPE_NONE = 'none'
 Provider cannot create or link to accounts.
 

Detailed Description

A primary authentication provider that uses the password field in the 'user' table.

Since
1.27

Definition at line 31 of file LocalPasswordPrimaryAuthenticationProvider.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::__construct (   $params = [])
Parameters
array$paramsSettings
  • loginOnly: If true, the local passwords are for legacy logins only: the local password will be invalidated when authentication is changed and new users will not have a valid local password set.

Definition at line 44 of file LocalPasswordPrimaryAuthenticationProvider.php.

Member Function Documentation

◆ accountCreationType()

◆ beginPrimaryAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::beginPrimaryAccountCreation (   $user,
  $creator,
array  $reqs 
)

Start an account creation flow.

Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user may be created. Secondary providers will now run.
  • FAIL: The user may not be created. Fail the creation process.
  • ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
  • UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 296 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), and MediaWiki\Auth\AuthenticationResponse\newPass().

◆ beginPrimaryAuthentication()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::beginPrimaryAuthentication ( array  $reqs)

Start an authentication flow.

Parameters
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is authenticated. Secondary providers will now run.
  • FAIL: The user is not authenticated. Fail the authentication process.
  • ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
  • UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 79 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $dbr, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), DB_MASTER, DB_REPLICA, MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\failResponse(), User\getCanonicalName(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newAbstain(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\setPasswordResetFlag(), and wfGetDB().

◆ finishAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::finishAccountCreation (   $user,
  $creator,
AuthenticationResponse  $response 
)

Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.

Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responsePASS response returned earlier
Returns
string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.
Stable to override Stable to override

Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Definition at line 316 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\accountCreationType(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData().

◆ getPasswordResetData()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::getPasswordResetData (   $username,
  $row 
)
protected

Check if the password has expired and needs a reset.

Parameters
string$username
\\stdClass$rowA row from the user table
Returns
\stdClass|null

Reimplemented from MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider.

Definition at line 56 of file LocalPasswordPrimaryAuthenticationProvider.php.

References wfTimestamp(), and wfTimestampOrNull().

◆ providerAllowsAuthenticationDataChange()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange ( AuthenticationRequest  $req,
  $checkData = true 
)

Validate a change of authentication data (e.g.

passwords)

Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.

Parameters
AuthenticationRequest$req
bool$checkDataIf false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.
Returns
StatusValue

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 205 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), DB_MASTER, User\getCanonicalName(), and wfGetDB().

◆ providerChangeAuthenticationData()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::providerChangeAuthenticationData ( AuthenticationRequest  $req)

Change or remove authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.

It can be assumed that providerAllowsAuthenticationDataChange with $checkData === true was called before this, and passed. This method should never fail (other than throwing an exception).

Parameters
AuthenticationRequest$req

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 244 of file LocalPasswordPrimaryAuthenticationProvider.php.

References DB_MASTER, User\getCanonicalName(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getNewPasswordExpiry(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), and wfGetDB().

Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\finishAccountCreation().

◆ testForAccountCreation()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::testForAccountCreation (   $user,
  $creator,
array  $reqs 
)

Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()

Note
No need to test if the account exists, AuthManager checks that
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
StatusValue
Stable to override Stable to override

Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Definition at line 280 of file LocalPasswordPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\checkPasswordValidity(), and MediaWiki\Auth\AuthenticationRequest\getRequestByClass().

◆ testUserCanAuthenticate()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::testUserCanAuthenticate (   $username)

Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.

Parameters
string$usernameMediaWiki username
Returns
bool
Stable to override Stable to override

Reimplemented from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Definition at line 163 of file LocalPasswordPrimaryAuthenticationProvider.php.

References $dbr, DB_REPLICA, User\getCanonicalName(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), and wfGetDB().

◆ testUserExists()

MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::testUserExists (   $username,
  $flags = User::READ_NORMAL 
)

Test whether the named user exists.

Single-sign-on providers can use this to reserve a username for autocreation.

Parameters
string$usernameMediaWiki username
int$flagsBitfield of User:READ_* constants
Returns
bool

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 189 of file LocalPasswordPrimaryAuthenticationProvider.php.

References User\getCanonicalName(), and wfGetDB().

Member Data Documentation

◆ $loginOnly

bool MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider::$loginOnly = false
protected

If true, this instance is for legacy logins only.

Definition at line 36 of file LocalPasswordPrimaryAuthenticationProvider.php.


The documentation for this class was generated from the following file: