AuthManager is the authentication system in MediaWiki and serves entry point for authentication. More...

Inherits LoggerAwareInterface.

Collaboration diagram for MediaWiki\Auth\AuthManager:

Public Member Functions
	__construct (private readonly WebRequest $request, private readonly Config $config, private readonly ChangeTagsStore $changeTagsStore, private readonly ObjectFactory $objectFactory, private readonly ObjectCacheFactory $objectCacheFactory, private readonly HookContainer $hookContainer, private readonly ReadOnlyMode $readOnlyMode, private readonly UserNameUtils $userNameUtils, private readonly BlockManager $blockManager, private readonly WatchlistManager $watchlistManager, private readonly ILoadBalancer $loadBalancer, private readonly Language $contentLanguage, private readonly LanguageConverterFactory $languageConverterFactory, private readonly BotPasswordStore $botPasswordStore, private readonly UserFactory $userFactory, private readonly UserIdentityLookup $userIdentityLookup, private readonly UserIdentityUtils $identityUtils, private readonly UserOptionsManager $userOptionsManager, private readonly NotificationService $notificationService, private readonly SessionManagerInterface $sessionManager,)

	getRequest ()

	setAuthEventsLogger (LoggerInterface $authEventsLogger)

	setLogger (LoggerInterface $logger)

Authentication
	canAuthenticateNow ()
	Indicate whether user authentication is possible.

	beginAuthentication (array $reqs, $returnToUrl)
	Start an authentication flow.

	continueAuthentication (array $reqs)
	Continue an authentication flow.

	securitySensitiveOperationStatus ( $operation)
	Whether security-sensitive operations should proceed.

	userCanAuthenticate ( $username)
	Determine whether a username can authenticate.

	normalizeUsername ( $username)
	Provide normalized versions of the username for security checks.

	setRequestContextUserFromSessionUser ()
	Call this method to set the request context user for the current request from the context session user.

Authentication data changing
	revokeAccessForUser ( $username)
	Revoke any authentication credentials for a user.

	allowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
	Validate a change of authentication data (e.g.

	changeAuthenticationData (AuthenticationRequest $req, $isAddition=false)
	Change authentication data (e.g.

Account linking
	canLinkAccounts ()
	Determine whether accounts can be linked.

	beginAccountLink (User $user, array $reqs, $returnToUrl)
	Start an account linking flow.

	continueAccountLink (array $reqs)
	Continue an account linking flow.

Public Attributes
const	ACCOUNT_CREATION_STATE = 'AuthManager::accountCreationState'

const	ACCOUNT_LINK_STATE = 'AuthManager::accountLinkState'

const	ACTION_CHANGE = 'change'
	Change a user's credentials.

const	ACTION_CREATE = 'create'
	Create a new user.

const	ACTION_CREATE_CONTINUE = 'create-continue'
	Continue a user creation process that was interrupted by the need for user input or communication with an external provider.

const	ACTION_LINK = 'link'
	Link an existing user to a third-party account.

const	ACTION_LINK_CONTINUE = 'link-continue'
	Continue a user linking process that was interrupted by the need for user input or communication with an external provider.

const	ACTION_LOGIN = 'login'
	Log in with an existing (not necessarily local) user.

const	ACTION_LOGIN_CONTINUE = 'login-continue'
	Continue a login process that was interrupted by the need for user input or communication with an external provider.

const	ACTION_REMOVE = 'remove'
	Remove a user's credentials.

const	ACTION_UNLINK = 'unlink'
	Like ACTION_REMOVE but for linking providers only.

const	AUTHN_STATE = 'AuthManager::authnState'

const	AUTOCREATE_SOURCE_MAINT = '::Maintenance::'
	Auto-creation is due to a Maintenance script.

const	AUTOCREATE_SOURCE_SESSION = SessionManager::class
	Auto-creation is due to SessionManager.

const	AUTOCREATE_SOURCE_TEMP = TempUserCreator::class
	Auto-creation is due to temporary account creation on page save.

const string	SEC_FAIL = 'fail'
	Security-sensitive should not be performed.

const string	SEC_OK = 'ok'
	Security-sensitive operations are ok.

const string	SEC_REAUTH = 'reauth'
	Security-sensitive operations should re-authenticate.

Account creation
	canCreateAccounts ()
	Determine whether accounts can be created.

	canCreateAccount ( $username, $options=[])
	Determine whether a particular account can be created.

	probablyCanCreateAccount (Authority $creator)
	Check whether $creator can create accounts.

	authorizeCreateAccount (Authority $creator)
	Authorize the account creation by $creator.

	beginAccountCreation (Authority $creator, array $reqs, $returnToUrl)
	Start an account creation flow.

	continueAccountCreation (array $reqs)
	Continue an account creation flow.

	autoCreateUser (User $user, $source, $login=true, $log=true, ?Authority $performer=null, array $tags=[])
	Auto-create an account and optionally log into that account.

Information methods
	getAuthenticationRequests ( $action, ?UserIdentity $user=null, array $options=[])
	Return the applicable list of AuthenticationRequests.

	userExists ( $username, $flags=IDBAccessObject::READ_NORMAL)
	Determine whether a username exists.

	allowsPropertyChange ( $property)
	Determine whether a user property should be allowed to be changed.

	getAuthenticationProvider ( $id)
	Get a provider by ID.

Internal methods
	setAuthenticationSessionData ( $key, $data)
	Store authentication in the current session.

	getAuthenticationSessionData ( $key, $default=null)
	Fetch authentication data from the current session.

	removeAuthenticationSessionData ( $key)
	Remove authentication data.

	providerArrayFromSpecs ( $class, array $specs)
	Create an array of AuthenticationProviders from an array of ObjectFactory specs @template T of AuthenticationProvider.

	getPreAuthenticationProviders ()
	Get the list of PreAuthenticationProviders.

	getPrimaryAuthenticationProviders ()
	Get the list of PrimaryAuthenticationProviders.

	getSecondaryAuthenticationProviders ()
	Get the list of SecondaryAuthenticationProviders.

Detailed Description

AuthManager is the authentication system in MediaWiki and serves entry point for authentication.

In the future, it may also serve as the entry point to the authorization system.

If you are looking at this because you are working on an extension that creates its own login or signup page, then 1) you really shouldn't do that, 2) if you feel you absolutely have to, subclass AuthManagerSpecialPage or build it on the client side using the clientlogin or the createaccount API. Trying to call this class directly will very likely end up in security vulnerabilities or broken UX in edge cases.

If you are working on an extension that needs to integrate with the authentication system (e.g. by providing a new login method, or doing extra permission checks), you'll probably need to write an AuthenticationProvider.

If you want to create a "reserved" user programmatically, User::newSystemUser() might be what you are looking for. If you want to change user data, use User::changeAuthenticationData(). Code that is related to some SessionProvider or PrimaryAuthenticationProvider can create a (non-reserved) user by calling AuthManager::autoCreateUser(); it is then the provider's responsibility to ensure that the user can authenticate somehow (see especially PrimaryAuthenticationProvider::autoCreatedAccount()). The same functionality can also be used from Maintenance scripts such as createAndPromote.php. If you are writing code that is not associated with such a provider and needs to create accounts programmatically for real users, you should rethink your architecture. There is no good way to do that as such code has no knowledge of what authentication methods are enabled on the wiki and cannot provide any means for users to access the accounts it would create.

The two main control flows when using this class are as follows:

Login, user creation or account linking code will call getAuthenticationRequests(), populate the requests with data (by using them to build a HTMLForm and have the user fill it, or by exposing a form specification via the API, so that the client can build it), and pass them to the appropriate begin* method. That will return either a success/failure response, or more requests to fill (either by building a form or by redirecting the user to some external provider which will send the data back), in which case they need to be submitted to the appropriate continue* method and that step has to be repeated until the response is a success or failure response. AuthManager will use the session to maintain internal state during the process.
Code doing an authentication data change will call getAuthenticationRequests(), select a single request, populate it, and pass it to allowsAuthenticationDataChange() and then changeAuthenticationData(). If the data change is user-initiated, the whole process needs to be preceded by a call to securitySensitiveOperationStatus() and aborted if that returns a non-OK status.

Since: 1.27

See also: https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager

Definition at line 112 of file AuthManager.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Auth\AuthManager::__construct	(	private readonly WebRequest	$request,
		private readonly Config	$config,
		private readonly ChangeTagsStore	$changeTagsStore,
		private readonly ObjectFactory	$objectFactory,
		private readonly ObjectCacheFactory	$objectCacheFactory,
		private readonly HookContainer	$hookContainer,
		private readonly ReadOnlyMode	$readOnlyMode,
		private readonly UserNameUtils	$userNameUtils,
		private readonly BlockManager	$blockManager,
		private readonly WatchlistManager	$watchlistManager,
		private readonly ILoadBalancer	$loadBalancer,
		private readonly Language	$contentLanguage,
		private readonly LanguageConverterFactory	$languageConverterFactory,
		private readonly BotPasswordStore	$botPasswordStore,
		private readonly UserFactory	$userFactory,
		private readonly UserIdentityLookup	$userIdentityLookup,
		private readonly UserIdentityUtils	$identityUtils,
		private readonly UserOptionsManager	$userOptionsManager,
		private readonly NotificationService	$notificationService,
		private readonly SessionManagerInterface	$sessionManager )

Definition at line 218 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\setAuthEventsLogger(), and MediaWiki\Auth\AuthManager\setLogger().

Member Function Documentation

◆ allowsAuthenticationDataChange()

MediaWiki\Auth\AuthManager::allowsAuthenticationDataChange	(	AuthenticationRequest	$req,
			$checkData = true )

Validate a change of authentication data (e.g.

passwords)

Parameters

AuthenticationRequest	$req
bool	$checkData	If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.

Returns: Status

Definition at line 1138 of file AuthManager.php.

References MediaWiki\Auth\AuthenticationRequest\validate().

◆ allowsPropertyChange()

MediaWiki\Auth\AuthManager::allowsPropertyChange ( $property )

Determine whether a user property should be allowed to be changed.

Supported properties are:

emailaddress
realname
nickname

Parameters

string $property

Returns: bool

Definition at line 2831 of file AuthManager.php.

◆ authorizeCreateAccount()

MediaWiki\Auth\AuthManager::authorizeCreateAccount ( Authority $creator )

Authorize the account creation by $creator.

Note: this method should be used right before the account is created. To check whether a current performer has the potential to create accounts, use self::probablyCanCreateAccount instead.

Since: 1.39

Parameters

Authority $creator

Returns: StatusValue

Definition at line 1352 of file AuthManager.php.

References MediaWiki\Permissions\Authority\authorizeWrite().

◆ autoCreateUser()

MediaWiki\Auth\AuthManager::autoCreateUser	(	User	$user,
			$source,
			$login = true,
			$log = true,
		?Authority	$performer = null,
		array	$tags = [] )

Auto-create an account and optionally log into that account.

PrimaryAuthenticationProviders can invoke this method by returning a PASS from beginPrimaryAuthentication() or continuePrimaryAuthentication() with the username of a non-existing user. SessionProviders can invoke it by returning a SessionInfo with the username of a non-existing user from provideSessionInfo(). Calling this method explicitly (e.g., from a maintenance script) is also fine.

Parameters

User	$user	User to auto-create
string	$source	What caused the auto-creation? This must be one of: the ID of a PrimaryAuthenticationProvider, one of the self::AUTOCREATE_SOURCE_* constants
bool	$login	Whether to also log the user in
bool	$log	Whether to generate a user creation log entry (since 1.36)
Authority \| null	$performer	The performer of the action to use for user rights checking NOTE: In 1.46, for callers passing the performer as NULL, the user to be auto-created will be used as the performer (T408724).
string[]	$tags	Tags to apply to the user creation log entry if `$log` is true and the creation succeeds

Returns: Status Good if the user was created, OK if the user already existed, or otherwise Fatal

Definition at line 2037 of file AuthManager.php.

References $source, MediaWiki\User\User\addToDatabase(), StatusValue\error(), MediaWiki\User\User\getId(), MediaWiki\User\User\getName(), MediaWiki\User\User\getUserPage(), StatusValue\isGood(), StatusValue\isOK(), MediaWiki\User\User\loadFromId(), MediaWiki\User\User\saveSettings(), MediaWiki\User\User\setId(), and StatusValue\warning().

◆ beginAccountCreation()

MediaWiki\Auth\AuthManager::beginAccountCreation	(	Authority	$creator,
		array	$reqs,
			$returnToUrl )

Start an account creation flow.

In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt. If $createFromLoginAuthenticationRequest->hasPrimaryStateForAction( AuthManager::ACTION_CREATE ) returns true, any AuthenticationRequest::PRIMARY_REQUIRED requests should be omitted. If the CreateFromLoginAuthenticationRequest has a username set, that username must be used for all other requests.

Parameters

Authority	$creator	User doing the account creation
AuthenticationRequest[]	$reqs
string	$returnToUrl	Url that REDIRECT responses should eventually return to.

Returns: AuthenticationResponse

Definition at line 1384 of file AuthManager.php.

References MediaWiki\Permissions\Authority\getUser(), MediaWiki\Permissions\Authority\isTemp(), and wfMessage().

◆ beginAccountLink()

MediaWiki\Auth\AuthManager::beginAccountLink	(	User	$user,
		array	$reqs,
			$returnToUrl )

Start an account linking flow.

Parameters

User	$user	User being linked
AuthenticationRequest[]	$reqs
string	$returnToUrl	Url that REDIRECT responses should eventually return to.

Returns: AuthenticationResponse

Definition at line 2348 of file AuthManager.php.

References MediaWiki\User\User\getId(), MediaWiki\User\User\getName(), StatusValue\isGood(), StatusValue\isOK(), MediaWiki\User\User\isRegistered(), MediaWiki\Permissions\PermissionStatus\merge(), and wfMessage().

◆ beginAuthentication()

MediaWiki\Auth\AuthManager::beginAuthentication	(	array	$reqs,
			$returnToUrl )

Start an authentication flow.

In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt to preserve state.

Instead of the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might pass a CreatedAccountAuthenticationRequest from an account creation that just succeeded to log in to the just-created account.

Parameters

AuthenticationRequest[]	$reqs
string	$returnToUrl	Url that REDIRECT responses should eventually return to.

Returns: AuthenticationResponse See self::continueAuthentication()

Definition at line 294 of file AuthManager.php.

◆ canAuthenticateNow()

MediaWiki\Auth\AuthManager::canAuthenticateNow ( )

Indicate whether user authentication is possible.

It may not be if the session is provided by something like OAuth for which each individual request includes authentication data.

Returns: bool

Definition at line 272 of file AuthManager.php.

◆ canCreateAccount()

MediaWiki\Auth\AuthManager::canCreateAccount	(		$username,
			$options = [] )

Determine whether a particular account can be created.

Parameters

string	$username	MediaWiki username
array	$options	flags: (int) Bitfield of IDBAccessObject::READ_* constants, default IDBAccessObject::READ_NORMAL creating: (bool) For internal use only. Never specify this.

Returns: Status

Definition at line 1243 of file AuthManager.php.

◆ canCreateAccounts()

MediaWiki\Auth\AuthManager::canCreateAccounts ( )

Determine whether accounts can be created.

Returns: bool

Definition at line 1224 of file AuthManager.php.

◆ canLinkAccounts()

MediaWiki\Auth\AuthManager::canLinkAccounts ( )

Determine whether accounts can be linked.

Returns: bool

Definition at line 2330 of file AuthManager.php.

◆ changeAuthenticationData()

MediaWiki\Auth\AuthManager::changeAuthenticationData	(	AuthenticationRequest	$req,
			$isAddition = false )

Change authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, using $req should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, using $req should no longer result in a successful login.

This method should only be called if allowsAuthenticationDataChange( $req, true ) returned success.

Parameters

AuthenticationRequest	$req
bool	$isAddition	Set true if this represents an addition of credentials rather than a change. The main difference is that additions should not invalidate BotPasswords. If you're not sure, leave it false.

Definition at line 1190 of file AuthManager.php.

References MediaWiki\Auth\AuthenticationRequest\validate().

◆ continueAccountCreation()

MediaWiki\Auth\AuthManager::continueAccountCreation ( array $reqs )

Continue an account creation flow.

Parameters

AuthenticationRequest[] $reqs

Returns: AuthenticationResponse

Definition at line 1509 of file AuthManager.php.

References wfMessage().

◆ continueAccountLink()

MediaWiki\Auth\AuthManager::continueAccountLink ( array $reqs )

Continue an account linking flow.

Parameters

AuthenticationRequest[] $reqs

Returns: AuthenticationResponse

Definition at line 2479 of file AuthManager.php.

References StatusValue\isOK(), MediaWiki\Permissions\PermissionStatus\merge(), and wfMessage().

◆ continueAuthentication()

MediaWiki\Auth\AuthManager::continueAuthentication ( array $reqs )

Continue an authentication flow.

Return values are interpreted as follows:

status FAIL: Authentication failed. If $response->createRequest is set, that may be passed to self::beginAuthentication() or to self::beginAccountCreation() to preserve state.
status REDIRECT: The client should be redirected to the contained URL, new AuthenticationRequests should be made (if any), then AuthManager::continueAuthentication() should be called.
status UI: The client should be presented with a user interface for the fields in the specified AuthenticationRequests, then new AuthenticationRequests should be made, then AuthManager::continueAuthentication() should be called.
status RESTART: The user logged in successfully with a third-party service, but the third-party credentials aren't attached to any local account. This could be treated as a UI or a FAIL.
status PASS: Authentication was successful.

Parameters

AuthenticationRequest[] $reqs

Returns: AuthenticationResponse

Definition at line 436 of file AuthManager.php.

References wfMessage().

◆ getAuthenticationProvider()

MediaWiki\Auth\AuthManager::getAuthenticationProvider ( $id )

Get a provider by ID.

Note: This is public so extensions can check whether their own provider is installed and so they can read its configuration if necessary. Other uses are not recommended.

Parameters

string $id

Returns: AuthenticationProvider|null

Definition at line 2850 of file AuthManager.php.

◆ getAuthenticationRequests()

MediaWiki\Auth\AuthManager::getAuthenticationRequests	(		$action,
		?UserIdentity	$user = null,
		array	$options = [] )

Return the applicable list of AuthenticationRequests.

Possible values for $action:

ACTION_LOGIN: Valid for passing to beginAuthentication
ACTION_LOGIN_CONTINUE: Valid for passing to continueAuthentication in the current state
ACTION_CREATE: Valid for passing to beginAccountCreation
ACTION_CREATE_CONTINUE: Valid for passing to continueAccountCreation in the current state
ACTION_LINK: Valid for passing to beginAccountLink
ACTION_LINK_CONTINUE: Valid for passing to continueAccountLink in the current state
ACTION_CHANGE: Valid for passing to changeAuthenticationData to change credentials
ACTION_REMOVE: Valid for passing to changeAuthenticationData to remove credentials.
ACTION_UNLINK: Same as ACTION_REMOVE, but limited to linked accounts.

Parameters

string	$action	One of the AuthManager::ACTION_* constants
UserIdentity \| null	$user	User being acted on, instead of the current user.
array	$options	'securityLevel': (string, optional, since 1.47) the security level the user is being reauthenticated for. Can only be used with ACTION_LOGIN and a logged-in session. See securitySensitiveOperationStatus() for details.

Returns: AuthenticationRequest[]

Definition at line 2636 of file AuthManager.php.

◆ getAuthenticationSessionData()

MediaWiki\Auth\AuthManager::getAuthenticationSessionData	(		$key,
			$default = null )

Fetch authentication data from the current session.

Note: For use by AuthenticationProviders only

Parameters

string	$key
mixed \| null	$default

Returns: mixed

Definition at line 2902 of file AuthManager.php.

◆ getPreAuthenticationProviders()

MediaWiki\Auth\AuthManager::getPreAuthenticationProviders ( )

protected

Get the list of PreAuthenticationProviders.

Returns: PreAuthenticationProvider[]

Definition at line 2972 of file AuthManager.php.

◆ getPrimaryAuthenticationProviders()

MediaWiki\Auth\AuthManager::getPrimaryAuthenticationProviders ( )

protected

Get the list of PrimaryAuthenticationProviders.

Returns: PrimaryAuthenticationProvider[]

Definition at line 2983 of file AuthManager.php.

◆ getRequest()

MediaWiki\Auth\AuthManager::getRequest ( )

Returns: WebRequest

Definition at line 256 of file AuthManager.php.

References $request.

◆ getSecondaryAuthenticationProviders()

MediaWiki\Auth\AuthManager::getSecondaryAuthenticationProviders ( )

protected

Get the list of SecondaryAuthenticationProviders.

Returns: SecondaryAuthenticationProvider[]

Definition at line 2994 of file AuthManager.php.

◆ normalizeUsername()

MediaWiki\Auth\AuthManager::normalizeUsername ( $username )

Provide normalized versions of the username for security checks.

Since different providers can normalize the input in different ways, this returns an array of all the different ways the name might be normalized for authentication.

The returned strings should not be revealed to the user, as that might leak private information (e.g. an email address might be normalized to a username).

Parameters

string $username

Returns: string[]

Definition at line 1068 of file AuthManager.php.

◆ probablyCanCreateAccount()

MediaWiki\Auth\AuthManager::probablyCanCreateAccount ( Authority $creator )

Check whether $creator can create accounts.

Note: this method does not guarantee full permissions check, so it should only be used to to decide whether to show a form. To authorize the account creation action use self::authorizeCreateAccount instead.

Since: 1.39

Parameters

Authority $creator

Returns: StatusValue

Definition at line 1328 of file AuthManager.php.

References MediaWiki\Permissions\Authority\probablyCan().

◆ providerArrayFromSpecs()

MediaWiki\Auth\AuthManager::providerArrayFromSpecs	(		$class,
		array	$specs )

protected

Create an array of AuthenticationProviders from an array of ObjectFactory specs @template T of AuthenticationProvider.

Parameters

	class-string<T>	$class
array[]	$specs

Returns: T[]

Definition at line 2936 of file AuthManager.php.

◆ removeAuthenticationSessionData()

MediaWiki\Auth\AuthManager::removeAuthenticationSessionData ( $key )

Remove authentication data.

Note: For use by AuthenticationProviders

Parameters

string | null $key If null, all data is removed

Definition at line 2916 of file AuthManager.php.

◆ revokeAccessForUser()

MediaWiki\Auth\AuthManager::revokeAccessForUser ( $username )

Revoke any authentication credentials for a user.

After this, the user should no longer be able to log in.

Parameters

string $username

Definition at line 1120 of file AuthManager.php.

◆ securitySensitiveOperationStatus()

MediaWiki\Auth\AuthManager::securitySensitiveOperationStatus ( $operation )

Whether security-sensitive operations should proceed.

A "security-sensitive operation" is something like a password or email change, that would normally have a "reenter your password to confirm" box if we only supported password-based authentication.

Parameters

string $operation Operation being checked. This should be a message-key-like string such as 'change-password' or 'change-email'. When the caller redirects to Special:UserLogin for reauthentication, this same string drives the reauth banner via userlogin-reauth-banner-{operation} (lowercased), with userlogin-reauth-banner-generic as the fallback.

Returns: string One of the SEC_* constants.

See also: $wgReauthenticateTime; SessionProvider::allowSecuritySensitiveOperationIfCannotReauthenticate(); https://www.mediawiki.org/wiki/Manual:Hooks/SecuritySensitiveOperationStatus; ElevatedSecurityAuthenticationRequest

Definition at line 938 of file AuthManager.php.

◆ setAuthenticationSessionData()

MediaWiki\Auth\AuthManager::setAuthenticationSessionData	(		$key,
			$data )

Store authentication in the current session.

Note: For use by AuthenticationProviders only

Parameters

string	$key
mixed	$data	Must be serializable

Definition at line 2885 of file AuthManager.php.

◆ setAuthEventsLogger()

MediaWiki\Auth\AuthManager::setAuthEventsLogger ( LoggerInterface $authEventsLogger )

Definition at line 249 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ setLogger()

MediaWiki\Auth\AuthManager::setLogger ( LoggerInterface $logger )

Definition at line 245 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ setRequestContextUserFromSessionUser()

MediaWiki\Auth\AuthManager::setRequestContextUserFromSessionUser ( )

Call this method to set the request context user for the current request from the context session user.

Useful in cases where we need to make sure that a MediaWiki request outputs correct context data for a user who has just been logged-in.

The method will also update the global language variable based on the session's user's context language.

This won't affect objects which already made a copy of the user or the context, so it shouldn't be relied on too heavily, but can help to make the UI more consistent after changing the user. Typically used after a successful AuthManager action that changed the session user (e.g. AuthManager::autoCreateUser() with the login flag set).

Definition at line 1095 of file AuthManager.php.

◆ userCanAuthenticate()

MediaWiki\Auth\AuthManager::userCanAuthenticate ( $username )

Determine whether a username can authenticate.

This is mainly for internal purposes and only takes authentication data into account, not things like blocks that can change without the authentication system being aware.

Parameters

string $username MediaWiki username

Returns: bool

Definition at line 1045 of file AuthManager.php.

◆ userExists()

MediaWiki\Auth\AuthManager::userExists	(		$username,
			$flags = IDBAccessObject::READ_NORMAL )

Determine whether a username exists.

Parameters

string	$username
int	$flags	Bitfield of IDBAccessObject::READ_* constants

Returns: bool

Definition at line 2810 of file AuthManager.php.

Member Data Documentation

◆ ACCOUNT_CREATION_STATE

const MediaWiki\Auth\AuthManager::ACCOUNT_CREATION_STATE = 'AuthManager::accountCreationState'

Access: internal: Key in the user's session data for storing account creation state.

Definition at line 123 of file AuthManager.php.

Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\beginSecondaryAccountCreation(), and MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueSecondaryAccountCreation().

◆ ACCOUNT_LINK_STATE

const MediaWiki\Auth\AuthManager::ACCOUNT_LINK_STATE = 'AuthManager::accountLinkState'

Access: internal: Key in the user's session data for storing account linking state.

Definition at line 129 of file AuthManager.php.

◆ ACTION_CHANGE

const MediaWiki\Auth\AuthManager::ACTION_CHANGE = 'change'

Change a user's credentials.

Definition at line 150 of file AuthManager.php.

Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueLinkAttempt(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), and MediaWiki\Auth\ResetPasswordSecondaryAuthenticationProvider\tryReset().

◆ ACTION_CREATE

const MediaWiki\Auth\AuthManager::ACTION_CREATE = 'create'

Create a new user.

Definition at line 138 of file AuthManager.php.

Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PreviouslyRenamedAccountPreAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasPrimaryStateForAction(), and MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasStateForAction().

◆ ACTION_CREATE_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_CREATE_CONTINUE = 'create-continue'

Continue a user creation process that was interrupted by the need for user input or communication with an external provider.

Definition at line 142 of file AuthManager.php.

◆ ACTION_LINK

const MediaWiki\Auth\AuthManager::ACTION_LINK = 'link'

Link an existing user to a third-party account.

Definition at line 144 of file AuthManager.php.

◆ ACTION_LINK_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_LINK_CONTINUE = 'link-continue'

Continue a user linking process that was interrupted by the need for user input or communication with an external provider.

Definition at line 148 of file AuthManager.php.

◆ ACTION_LOGIN

const MediaWiki\Auth\AuthManager::ACTION_LOGIN = 'login'

Log in with an existing (not necessarily local) user.

Definition at line 132 of file AuthManager.php.

Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), and MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasStateForAction().

◆ ACTION_LOGIN_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_LOGIN_CONTINUE = 'login-continue'

Continue a login process that was interrupted by the need for user input or communication with an external provider.

Definition at line 136 of file AuthManager.php.

◆ ACTION_REMOVE

const MediaWiki\Auth\AuthManager::ACTION_REMOVE = 'remove'

Remove a user's credentials.

Definition at line 152 of file AuthManager.php.

Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), MediaWiki\Auth\AbstractTemporaryPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData(), MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\providerRevokeAccessForUser(), and MediaWiki\Auth\AbstractSecondaryAuthenticationProvider\providerRevokeAccessForUser().

◆ ACTION_UNLINK

const MediaWiki\Auth\AuthManager::ACTION_UNLINK = 'unlink'

Like ACTION_REMOVE but for linking providers only.

Definition at line 154 of file AuthManager.php.

◆ AUTHN_STATE

const MediaWiki\Auth\AuthManager::AUTHN_STATE = 'AuthManager::authnState'

Access: internal: Key in the user's session data for storing login state.

Definition at line 117 of file AuthManager.php.

Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\beginSecondaryAuthentication(), and MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueSecondaryAuthentication().

◆ AUTOCREATE_SOURCE_MAINT

const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_MAINT = '::Maintenance::'

Auto-creation is due to a Maintenance script.

Definition at line 167 of file AuthManager.php.

◆ AUTOCREATE_SOURCE_SESSION

const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_SESSION = SessionManager::class

Auto-creation is due to SessionManager.

Definition at line 164 of file AuthManager.php.

◆ AUTOCREATE_SOURCE_TEMP

const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_TEMP = TempUserCreator::class

Auto-creation is due to temporary account creation on page save.

Definition at line 170 of file AuthManager.php.

◆ SEC_FAIL

const string MediaWiki\Auth\AuthManager::SEC_FAIL = 'fail'

Security-sensitive should not be performed.

Definition at line 161 of file AuthManager.php.

◆ SEC_OK

const string MediaWiki\Auth\AuthManager::SEC_OK = 'ok'

Security-sensitive operations are ok.

Definition at line 157 of file AuthManager.php.

◆ SEC_REAUTH

const string MediaWiki\Auth\AuthManager::SEC_REAUTH = 'reauth'

Security-sensitive operations should re-authenticate.

Definition at line 159 of file AuthManager.php.

The documentation for this class was generated from the following file:

includes/Auth/AuthManager.php

Public Member Functions

Public Attributes

Account creation

Information methods

Internal methods

Detailed Description

Constructor & Destructor Documentation

◆ __construct()

Member Function Documentation

◆ allowsAuthenticationDataChange()

◆ allowsPropertyChange()

◆ authorizeCreateAccount()

◆ autoCreateUser()

◆ beginAccountCreation()

◆ beginAccountLink()

◆ beginAuthentication()

◆ canAuthenticateNow()

◆ canCreateAccount()

◆ canCreateAccounts()

◆ canLinkAccounts()

◆ changeAuthenticationData()

◆ continueAccountCreation()

◆ continueAccountLink()

◆ continueAuthentication()

◆ getAuthenticationProvider()

◆ getAuthenticationRequests()

◆ getAuthenticationSessionData()

◆ getPreAuthenticationProviders()

◆ getPrimaryAuthenticationProviders()

◆ getRequest()

◆ getSecondaryAuthenticationProviders()

◆ normalizeUsername()

◆ probablyCanCreateAccount()

◆ providerArrayFromSpecs()

◆ removeAuthenticationSessionData()

◆ revokeAccessForUser()

◆ securitySensitiveOperationStatus()

◆ setAuthenticationSessionData()

◆ setAuthEventsLogger()

◆ setLogger()

◆ setRequestContextUserFromSessionUser()

◆ userCanAuthenticate()

◆ userExists()

Member Data Documentation

◆ ACCOUNT_CREATION_STATE

◆ ACCOUNT_LINK_STATE

◆ ACTION_CHANGE

◆ ACTION_CREATE

◆ ACTION_CREATE_CONTINUE

◆ ACTION_LINK

◆ ACTION_LINK_CONTINUE

◆ ACTION_LOGIN

◆ ACTION_LOGIN_CONTINUE

◆ ACTION_REMOVE

◆ ACTION_UNLINK

◆ AUTHN_STATE

◆ AUTOCREATE_SOURCE_MAINT

◆ AUTOCREATE_SOURCE_SESSION

◆ AUTOCREATE_SOURCE_TEMP

◆ SEC_FAIL

◆ SEC_OK

◆ SEC_REAUTH