MediaWiki master
|
Basic framework for a primary authentication provider that uses passwords. More...
Inherits MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.
Inherited by MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.
Public Member Functions | ||||||||||
__construct (array $params=[]) | ||||||||||
getAuthenticationRequests ( $action, array $options) | ||||||||||
Public Member Functions inherited from MediaWiki\Auth\AbstractPrimaryAuthenticationProvider | ||||||||||
autoCreatedAccount ( $user, $source) | ||||||||||
Post-auto-creation callback.
| ||||||||||
beginPrimaryAccountLink ( $user, array $reqs) | ||||||||||
Start linking an account to an existing user.
| ||||||||||
continuePrimaryAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Continue an account creation flow.
| ||||||||||
continuePrimaryAccountLink ( $user, array $reqs) | ||||||||||
Continue linking an account to an existing user.
| ||||||||||
continuePrimaryAuthentication (array $reqs) | ||||||||||
finishAccountCreation ( $user, $creator, AuthenticationResponse $response) | ||||||||||
Post-creation callback.Called after the user is added to the database, before secondary authentication providers are run. Only called if this provider was the one that issued a PASS.
| ||||||||||
postAccountCreation ( $user, $creator, AuthenticationResponse $response) | ||||||||||
Post-creation callback.This will be called at the end of any account creation attempt, regardless of whether this provider was the one that handled it. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).
| ||||||||||
postAccountLink ( $user, AuthenticationResponse $response) | ||||||||||
Post-link callback.This will be called at the end of any account linking attempt, regardless of whether this provider was the one that handled it.
| ||||||||||
postAuthentication ( $user, AuthenticationResponse $response) | ||||||||||
Post-login callback.This will be called at the end of any login attempt, regardless of whether this provider was the one that handled it. It will not be called for unfinished login attempts that fail by the session timing out.
| ||||||||||
providerAllowsPropertyChange ( $property) | ||||||||||
Determine whether a property can change.
| ||||||||||
providerNormalizeUsername ( $username) | ||||||||||
Normalize the username for authentication.Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.
| ||||||||||
providerRevokeAccessForUser ( $username) | ||||||||||
Revoke the user's credentials.This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).
| ||||||||||
testForAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()
| ||||||||||
testUserCanAuthenticate ( $username) | ||||||||||
Test whether the named user can authenticate with this provider.Should return true if the provider has any data for this user which can be used to authenticate it, even if the user is temporarily prevented from authentication somehow.
| ||||||||||
testUserForCreation ( $user, $autocreate, array $options=[]) | ||||||||||
Determine whether an account may be created.
| ||||||||||
Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider | ||||||||||
getUniqueId () | ||||||||||
Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.
| ||||||||||
init (LoggerInterface $logger, AuthManager $manager, HookContainer $hookContainer, Config $config, UserNameUtils $userNameUtils) | ||||||||||
Initialise with dependencies of an AuthenticationProvider. | ||||||||||
Public Member Functions inherited from MediaWiki\Auth\PrimaryAuthenticationProvider | ||||||||||
accountCreationType () | ||||||||||
Fetch the account-creation type. | ||||||||||
beginPrimaryAccountCreation ( $user, $creator, array $reqs) | ||||||||||
Start an account creation flow. | ||||||||||
beginPrimaryAuthentication (array $reqs) | ||||||||||
Start an authentication flow. | ||||||||||
providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true) | ||||||||||
Validate a change of authentication data (e.g. | ||||||||||
providerChangeAuthenticationData (AuthenticationRequest $req) | ||||||||||
Change or remove authentication data (e.g. | ||||||||||
testUserExists ( $username, $flags=IDBAccessObject::READ_NORMAL) | ||||||||||
Test whether the named user exists. | ||||||||||
Protected Member Functions | |
checkPasswordValidity ( $username, $password) | |
Check that the password is valid. | |
failResponse (PasswordAuthenticationRequest $req) | |
Return the appropriate response for failure. | |
getFatalPasswordErrorResponse (string $username, Status $status) | |
Adds user-friendly description to a fatal password validity check error. | |
getNewPasswordExpiry ( $username) | |
Get expiration date for a new password, if any. | |
getPassword ( $hash) | |
Get a Password object from the hash. | |
getPasswordFactory () | |
getPasswordResetData ( $username, $data) | |
Get password reset data, if any. | |
setPasswordResetFlag ( $username, Status $status, $data=null) | |
Check if the password should be reset. | |
Protected Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider | |
getHookContainer () | |
getHookRunner () | |
postInitSetup () | |
A provider can override this to do any necessary setup after init() is called. | |
Protected Attributes | |
bool | $authoritative |
Whether this provider should ABSTAIN (false) or FAIL (true) on password failure. | |
Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider | |
Config | $config |
LoggerInterface | $logger |
AuthManager | $manager |
UserNameUtils | $userNameUtils |
Additional Inherited Members | |
Public Attributes inherited from MediaWiki\Auth\PrimaryAuthenticationProvider | |
const | TYPE_CREATE = 'create' |
Provider can create accounts. | |
const | TYPE_LINK = 'link' |
Provider can link to existing accounts elsewhere. | |
const | TYPE_NONE = 'none' |
Provider cannot create or link to accounts. | |
Basic framework for a primary authentication provider that uses passwords.
Definition at line 40 of file AbstractPasswordPrimaryAuthenticationProvider.php.
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider::__construct | ( | array | $params = [] | ) |
array | $params | Settings
|
Definition at line 55 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References $params.
|
protected |
Check that the password is valid.
This should be called before validating the password. If the result is not ok, login should fail immediately.
string | $username | |
string | $password |
Definition at line 113 of file AbstractPasswordPrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\providerAllowsAuthenticationDataChange(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\providerAllowsAuthenticationDataChange(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\testForAccountCreation(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\testForAccountCreation().
|
protected |
Return the appropriate response for failure.
PasswordAuthenticationRequest | $req |
Definition at line 93 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AuthenticationResponse\newAbstain(), MediaWiki\Auth\AuthenticationResponse\newFail(), and wfMessage().
Referenced by MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication().
MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider::getAuthenticationRequests | ( | $action, | |
array | $options ) |
string | $action | |
array | $options |
Implements MediaWiki\Auth\AuthenticationProvider.
Reimplemented in MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider.
Definition at line 204 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AuthManager\ACTION_CHANGE, MediaWiki\Auth\AuthManager\ACTION_CREATE, MediaWiki\Auth\AuthManager\ACTION_LOGIN, and MediaWiki\Auth\AuthManager\ACTION_REMOVE.
|
protected |
Adds user-friendly description to a fatal password validity check error.
These errors prevent login even when the password is correct, so just displaying the description of the error would be somewhat confusing.
string | $username | |
Status | $status | The status returned by checkPasswordValidity(); must be a fatal. |
Definition at line 125 of file AbstractPasswordPrimaryAuthenticationProvider.php.
Referenced by MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication().
|
protected |
Get expiration date for a new password, if any.
string | $username |
Definition at line 186 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\MainConfigNames\PasswordExpirationDays, and wfTimestamp().
Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData().
|
protected |
Get a Password object from the hash.
string | $hash |
Definition at line 77 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPasswordFactory(), and MediaWiki\Password\PasswordFactory\newFromCiphertext().
Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\testUserCanAuthenticate().
|
protected |
Definition at line 62 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\MainConfigNames\PasswordConfig, and MediaWiki\MainConfigNames\PasswordDefault.
Referenced by MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getPassword(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData().
|
protected |
Get password reset data, if any.
string | $username | |
\\stdClass | null | $data |
Reimplemented in MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.
Definition at line 175 of file AbstractPasswordPrimaryAuthenticationProvider.php.
|
protected |
Check if the password should be reset.
This should be called after a successful login. It sets 'reset-pass' authentication data if necessary, see ResetPassSecondaryAuthenticationProvider.
string | $username | |
Status | $status | From $this->checkPasswordValidity() |
\\stdClass | null | $data | Passed through to $this->getPasswordResetData() |
Definition at line 147 of file AbstractPasswordPrimaryAuthenticationProvider.php.
References MediaWiki\Status\Status\getMessage(), StatusValue\getValue(), MediaWiki\MainConfigNames\InvalidPasswordReset, and StatusValue\isGood().
Referenced by MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication(), and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider\beginPrimaryAuthentication().
|
protected |
Whether this provider should ABSTAIN (false) or FAIL (true) on password failure.
Definition at line 44 of file AbstractPasswordPrimaryAuthenticationProvider.php.