MediaWiki REL1_37
Public Member Functions | List of all members
MediaWiki\Auth\AbstractPrimaryAuthenticationProvider Class Reference

A base class that implements some of the boilerplate for a PrimaryAuthenticationProvider. More...

Inheritance diagram for MediaWiki\Auth\AbstractPrimaryAuthenticationProvider:
Inheritance graph
[legend]
Collaboration diagram for MediaWiki\Auth\AbstractPrimaryAuthenticationProvider:
Collaboration graph
[legend]

Public Member Functions

 autoCreatedAccount ( $user, $source)
 Post-auto-creation callback.
Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
string$sourceThe source of the auto-creation passed to AuthManager::autoCreateUser().

 
 beginPrimaryAccountLink ( $user, array $reqs)
 Start linking an account to an existing user.
Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
  • UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

 
 continuePrimaryAccountCreation ( $user, $creator, array $reqs)
 Continue an account creation flow.
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user may be created. Secondary providers will now run.
  • FAIL: The user may not be created. Fail the creation process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.

 
 continuePrimaryAccountLink ( $user, array $reqs)
 Continue linking an account to an existing user.
Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.

 
 continuePrimaryAuthentication (array $reqs)
 
 finishAccountCreation ( $user, $creator, AuthenticationResponse $response)
 Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responsePASS response returned earlier
Returns
string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.

 
 postAccountCreation ( $user, $creator, AuthenticationResponse $response)
 Post-creation callback.This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).
Parameters
User$userUser that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

 
 postAccountLink ( $user, AuthenticationResponse $response)
 Post-link callback.This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.
Parameters
User$userUser that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

 
 postAuthentication ( $user, AuthenticationResponse $response)
 Post-login callback.This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.
Parameters
User | null$userUser that was attempted to be logged in, if known. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

 
 providerAllowsPropertyChange ( $property)
 Determine whether a property can change.
See also
AuthManager::allowsPropertyChange()
Parameters
string$property
Returns
bool

 
 providerNormalizeUsername ( $username)
 Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.
Parameters
string$username
Returns
string|null

 
 providerRevokeAccessForUser ( $username)
 Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).
Parameters
string$username

 
 testForAccountCreation ( $user, $creator, array $reqs)
 Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()
Note
No need to test if the account exists, AuthManager checks that
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
StatusValue

 
 testUserCanAuthenticate ( $username)
 Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
Parameters
string$usernameMediaWiki username
Returns
bool

 
 testUserForCreation ( $user, $autocreate, array $options=[])
 Determine whether an account may be created.
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
bool | string$autocreateFalse if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser().
array$options
  • flags: (int) Bitfield of User:READ_* constants, default User::READ_NORMAL
  • creating: (bool) If false (or missing), this call is only testing if a user could be created. If set, this (non-autocreation) is for actually creating an account and will be followed by a call to testForAccountCreation(). In this case, the provider might return StatusValue::newGood() here and let the later call to testForAccountCreation() do a more thorough test.
Returns
StatusValue

 
- Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
 getUniqueId ()
 Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.
Returns
string

 
 init (LoggerInterface $logger, AuthManager $manager, HookContainer $hookContainer, Config $config, UserNameUtils $userNameUtils)
 Initialise with dependencies of an AuthenticationProvider.
 
 setConfig (Config $config)
 
 setHookContainer (HookContainer $hookContainer)
 
 setLogger (LoggerInterface $logger)
 
 setManager (AuthManager $manager)
 
- Public Member Functions inherited from MediaWiki\Auth\PrimaryAuthenticationProvider
 accountCreationType ()
 Fetch the account-creation type.
 
 beginPrimaryAccountCreation ( $user, $creator, array $reqs)
 Start an account creation flow.
 
 beginPrimaryAuthentication (array $reqs)
 Start an authentication flow.
 
 getAuthenticationRequests ( $action, array $options)
 Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether the implementing class is also a PreAuthenticationProvider, PrimaryAuthenticationProvider, or SecondaryAuthenticationProvider.

  • ACTION_LOGIN: Valid for passing to beginAuthentication. Called on all providers.
  • ACTION_CREATE: Valid for passing to beginAccountCreation. Called on all providers.
  • ACTION_LINK: Valid for passing to beginAccountLink. Called on linking primary providers only.
  • ACTION_CHANGE: Valid for passing to AuthManager::changeAuthenticationData to change credentials. Called on primary and secondary providers.
  • ACTION_REMOVE: Valid for passing to AuthManager::changeAuthenticationData to remove credentials. Must work without additional user input (i.e. without calling loadFromSubmission). Called on primary and secondary providers.
See also
AuthManager::getAuthenticationRequests()
Parameters
string$action
array$optionsOptions are:
  • username: User name related to the action, or null/unset if anon.
    • ACTION_LOGIN: The currently logged-in user, if any.
    • ACTION_CREATE: The account creator, if non-anonymous.
    • ACTION_LINK: The local user being linked to.
    • ACTION_CHANGE: The user having data changed.
    • ACTION_REMOVE: The user having data removed. If you leave the username property of the returned requests empty, this will automatically be copied there (except for ACTION_CREATE where it wouldn't really make sense).
Returns
AuthenticationRequest[]

 
 providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
 Validate a change of authentication data (e.g.
 
 providerChangeAuthenticationData (AuthenticationRequest $req)
 Change or remove authentication data (e.g.
 
 testUserExists ( $username, $flags=User::READ_NORMAL)
 Test whether the named user exists.
 

Additional Inherited Members

- Public Attributes inherited from MediaWiki\Auth\PrimaryAuthenticationProvider
const TYPE_CREATE = 'create'
 Provider can create accounts.
 
const TYPE_LINK = 'link'
 Provider can link to existing accounts elsewhere.
 
const TYPE_NONE = 'none'
 Provider cannot create or link to accounts.
 
- Protected Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
 getHookContainer ()
 
 getHookRunner ()
 
 postInitSetup ()
 A provider can override this to do any necessary setup after init() is called.
 
- Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider
Config $config
 
LoggerInterface $logger
 
AuthManager $manager
 
UserNameUtils $userNameUtils
 

Detailed Description

A base class that implements some of the boilerplate for a PrimaryAuthenticationProvider.

Stability: stable
to extend
Since
1.27

Definition at line 31 of file AbstractPrimaryAuthenticationProvider.php.

Member Function Documentation

◆ autoCreatedAccount()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::autoCreatedAccount (   $user,
  $source 
)

Post-auto-creation callback.

Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
string$sourceThe source of the auto-creation passed to AuthManager::autoCreateUser().

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 144 of file AbstractPrimaryAuthenticationProvider.php.

◆ beginPrimaryAccountLink()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::beginPrimaryAccountLink (   $user,
array  $reqs 
)

Start linking an account to an existing user.

Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
  • UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 151 of file AbstractPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\PrimaryAuthenticationProvider\accountCreationType().

◆ continuePrimaryAccountCreation()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::continuePrimaryAccountCreation (   $user,
  $creator,
array  $reqs 
)

Continue an account creation flow.

Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user may be created. Secondary providers will now run.
  • FAIL: The user may not be created. Fail the creation process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 112 of file AbstractPrimaryAuthenticationProvider.php.

◆ continuePrimaryAccountLink()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::continuePrimaryAccountLink (   $user,
array  $reqs 
)

Continue linking an account to an existing user.

Parameters
User$userUser being linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse Expected responses:
  • PASS: The user is linked.
  • FAIL: The user is not linked. Fail the linking process.
  • UI: Additional AuthenticationRequests are needed to complete the process.
  • REDIRECT: Redirection to a third party is needed to complete the process.

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 166 of file AbstractPrimaryAuthenticationProvider.php.

◆ continuePrimaryAuthentication()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::continuePrimaryAuthentication ( array  $reqs)
Stability: stable
to override
Parameters
array$reqs
Returns
AuthenticationResponse|void

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 42 of file AbstractPrimaryAuthenticationProvider.php.

◆ finishAccountCreation()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::finishAccountCreation (   $user,
  $creator,
AuthenticationResponse  $response 
)

Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.

Parameters
User$userUser being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responsePASS response returned earlier
Returns
string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Reimplemented in MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.

Definition at line 121 of file AbstractPrimaryAuthenticationProvider.php.

◆ postAccountCreation()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::postAccountCreation (   $user,
  $creator,
AuthenticationResponse  $response 
)

Post-creation callback.This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).

Parameters
User$userUser that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 129 of file AbstractPrimaryAuthenticationProvider.php.

◆ postAccountLink()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::postAccountLink (   $user,
AuthenticationResponse  $response 
)

Post-link callback.This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.

Parameters
User$userUser that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 175 of file AbstractPrimaryAuthenticationProvider.php.

◆ postAuthentication()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::postAuthentication (   $user,
AuthenticationResponse  $response 
)

Post-login callback.This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.

Parameters
User | null$userUser that was attempted to be logged in, if known. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse$responseAuthentication response that will be returned (PASS or FAIL)

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 51 of file AbstractPrimaryAuthenticationProvider.php.

◆ providerAllowsPropertyChange()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::providerAllowsPropertyChange (   $property)

Determine whether a property can change.

See also
AuthManager::allowsPropertyChange()
Parameters
string$property
Returns
bool

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 96 of file AbstractPrimaryAuthenticationProvider.php.

◆ providerNormalizeUsername()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::providerNormalizeUsername (   $username)

Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.

Parameters
string$username
Returns
string|null

Stability: stable
to override
Note
Reimplement this if you do anything other than UserNameUtils->getCanonical( $req->username ) to determine the user being authenticated.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 70 of file AbstractPrimaryAuthenticationProvider.php.

◆ providerRevokeAccessForUser()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::providerRevokeAccessForUser (   $username)

Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).

Parameters
string$username

Stability: stable
to override
Note
Reimplement this if self::getAuthenticationRequests( AuthManager::ACTION_REMOVE ) doesn't return requests that will revoke all access for the user.

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 81 of file AbstractPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\AuthManager\ACTION_REMOVE, MediaWiki\Auth\PrimaryAuthenticationProvider\getAuthenticationRequests(), and MediaWiki\Auth\PrimaryAuthenticationProvider\providerChangeAuthenticationData().

◆ testForAccountCreation()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::testForAccountCreation (   $user,
  $creator,
array  $reqs 
)

Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()

Note
No need to test if the account exists, AuthManager checks that
Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User$creatorUser doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]$reqs
Returns
StatusValue

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Reimplemented in MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.

Definition at line 104 of file AbstractPrimaryAuthenticationProvider.php.

◆ testUserCanAuthenticate()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::testUserCanAuthenticate (   $username)

Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.

Parameters
string$usernameMediaWiki username
Returns
bool

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Reimplemented in MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider.

Definition at line 58 of file AbstractPrimaryAuthenticationProvider.php.

References MediaWiki\Auth\PrimaryAuthenticationProvider\testUserExists().

◆ testUserForCreation()

MediaWiki\Auth\AbstractPrimaryAuthenticationProvider::testUserForCreation (   $user,
  $autocreate,
array  $options = [] 
)

Determine whether an account may be created.

Parameters
User$userUser being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
bool | string$autocreateFalse if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser().
array$options
  • flags: (int) Bitfield of User:READ_* constants, default User::READ_NORMAL
  • creating: (bool) If false (or missing), this call is only testing if a user could be created. If set, this (non-autocreation) is for actually creating an account and will be followed by a call to testForAccountCreation(). In this case, the provider might return StatusValue::newGood() here and let the later call to testForAccountCreation() do a more thorough test.
Returns
StatusValue

Stability: stable
to override

Implements MediaWiki\Auth\PrimaryAuthenticationProvider.

Definition at line 136 of file AbstractPrimaryAuthenticationProvider.php.

The documentation for this class was generated from the following file: