MediaWiki  master
MediaWiki\Auth\AuthManager Class Reference

This serves as the entry point to the authentication system. More...

Inheritance diagram for MediaWiki\Auth\AuthManager:
Collaboration diagram for MediaWiki\Auth\AuthManager:

Public Member Functions

 __construct (WebRequest $request, Config $config, ObjectFactory $objectFactory, HookContainer $hookContainer, ReadOnlyMode $readOnlyMode, UserNameUtils $userNameUtils, BlockManager $blockManager, WatchlistManager $watchlistManager, ILoadBalancer $loadBalancer, Language $contentLanguage, LanguageConverterFactory $languageConverterFactory, BotPasswordStore $botPasswordStore, UserFactory $userFactory, UserIdentityLookup $userIdentityLookup, UserOptionsManager $userOptionsManager)
 
 forcePrimaryAuthenticationProviders (array $providers, $why)
 Force certain PrimaryAuthenticationProviders. More...
 
 getRequest ()
 
 setLogger (LoggerInterface $logger)
 
Authentication
 canAuthenticateNow ()
 Indicate whether user authentication is possible. More...
 
 beginAuthentication (array $reqs, $returnToUrl)
 Start an authentication flow. More...
 
 continueAuthentication (array $reqs)
 Continue an authentication flow. More...
 
 securitySensitiveOperationStatus ( $operation)
 Whether security-sensitive operations should proceed. More...
 
 userCanAuthenticate ( $username)
 Determine whether a username can authenticate. More...
 
 normalizeUsername ( $username)
 Provide normalized versions of the username for security checks. More...
 
Authentication data changing
 revokeAccessForUser ( $username)
 Revoke any authentication credentials for a user. More...
 
 allowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
 Validate a change of authentication data (e.g. More...
 
 changeAuthenticationData (AuthenticationRequest $req, $isAddition=false)
 Change authentication data (e.g. More...
 
Account creation
 canCreateAccounts ()
 Determine whether accounts can be created. More...
 
 canCreateAccount ( $username, $options=[])
 Determine whether a particular account can be created. More...
 
 checkAccountCreatePermissions (Authority $creator)
 Basic permissions checks on whether a user can create accounts. More...
 
 beginAccountCreation (Authority $creator, array $reqs, $returnToUrl)
 Start an account creation flow. More...
 
 continueAccountCreation (array $reqs)
 Continue an account creation flow. More...
 
 autoCreateUser (User $user, $source, $login=true, $log=true)
 Auto-create an account, and optionally log into that account. More...
 
Account linking
 canLinkAccounts ()
 Determine whether accounts can be linked. More...
 
 beginAccountLink (User $user, array $reqs, $returnToUrl)
 Start an account linking flow. More...
 
 continueAccountLink (array $reqs)
 Continue an account linking flow. More...
 

Public Attributes

const ACTION_CHANGE = 'change'
 Change a user's credentials. More...
 
const ACTION_CREATE = 'create'
 Create a new user. More...
 
const ACTION_CREATE_CONTINUE = 'create-continue'
 Continue a user creation process that was interrupted by the need for user input or communication with an external provider. More...
 
const ACTION_LINK = 'link'
 Link an existing user to a third-party account. More...
 
const ACTION_LINK_CONTINUE = 'link-continue'
 Continue a user linking process that was interrupted by the need for user input or communication with an external provider. More...
 
const ACTION_LOGIN = 'login'
 Log in with an existing (not necessarily local) user. More...
 
const ACTION_LOGIN_CONTINUE = 'login-continue'
 Continue a login process that was interrupted by the need for user input or communication with an external provider. More...
 
const ACTION_REMOVE = 'remove'
 Remove a user's credentials. More...
 
const ACTION_UNLINK = 'unlink'
 Like ACTION_REMOVE but for linking providers only. More...
 
const AUTOCREATE_SOURCE_MAINT = '::Maintenance::'
 Auto-creation is due to a Maintenance script. More...
 
const AUTOCREATE_SOURCE_SESSION = \MediaWiki\Session\SessionManager::class
 Auto-creation is due to SessionManager. More...
 
const SEC_FAIL = 'fail'
 Security-sensitive should not be performed. More...
 
const SEC_OK = 'ok'
 Security-sensitive operations are ok. More...
 
const SEC_REAUTH = 'reauth'
 Security-sensitive operations should re-authenticate. More...
 

Private Attributes

AuthenticationProvider[] $allAuthenticationProviders = []
 
BlockManager $blockManager
 
BotPasswordStore $botPasswordStore
 
Config $config
 
Language $contentLanguage
 
CreatedAccountAuthenticationRequest[] $createdAccountAuthenticationRequests = []
 
HookContainer $hookContainer
 
HookRunner $hookRunner
 
LanguageConverterFactory $languageConverterFactory
 
ILoadBalancer $loadBalancer
 
LoggerInterface $logger
 
ObjectFactory $objectFactory
 
PreAuthenticationProvider[] $preAuthenticationProviders = null
 
PrimaryAuthenticationProvider[] $primaryAuthenticationProviders = null
 
ReadOnlyMode $readOnlyMode
 
WebRequest $request
 
SecondaryAuthenticationProvider[] $secondaryAuthenticationProviders = null
 
UserFactory $userFactory
 
UserIdentityLookup $userIdentityLookup
 
UserNameUtils $userNameUtils
 
UserOptionsManager $userOptionsManager
 
WatchlistManager $watchlistManager
 

Information methods

 getAuthenticationRequests ( $action, UserIdentity $user=null)
 Return the applicable list of AuthenticationRequests. More...
 
 userExists ( $username, $flags=User::READ_NORMAL)
 Determine whether a username exists. More...
 
 allowsPropertyChange ( $property)
 Determine whether a user property should be allowed to be changed. More...
 
 getAuthenticationProvider ( $id)
 Get a provider by ID. More...
 
 getAuthenticationRequestsInternal ( $providerAction, array $options, array $providers, UserIdentity $user=null)
 Internal request lookup for self::getAuthenticationRequests. More...
 
 fillRequests (array &$reqs, $action, $username, $forceAction=false)
 Set values in an array of requests. More...
 

Internal methods

 setAuthenticationSessionData ( $key, $data)
 Store authentication in the current session. More...
 
 getAuthenticationSessionData ( $key, $default=null)
 Fetch authentication data from the current session. More...
 
 removeAuthenticationSessionData ( $key)
 Remove authentication data. More...
 
 getConfiguration ()
 
 setSessionDataForUser ( $user, $remember=null)
 Log the user in. More...
 
 setDefaultUserOptions (User $user, $useContextLang)
 
 callMethodOnProviders ( $which, $method, array $args)
 
 getHookContainer ()
 
 getHookRunner ()
 
 providerArrayFromSpecs ( $class, array $specs)
 Create an array of AuthenticationProviders from an array of ObjectFactory specs. More...
 
 getPreAuthenticationProviders ()
 Get the list of PreAuthenticationProviders. More...
 
 getPrimaryAuthenticationProviders ()
 Get the list of PrimaryAuthenticationProviders. More...
 
 getSecondaryAuthenticationProviders ()
 Get the list of SecondaryAuthenticationProviders. More...
 

Detailed Description

This serves as the entry point to the authentication system.

In the future, it may also serve as the entry point to the authorization system.

If you are looking at this because you are working on an extension that creates its own login or signup page, then 1) you really shouldn't do that, 2) if you feel you absolutely have to, subclass AuthManagerSpecialPage or build it on the client side using the clientlogin or the createaccount API. Trying to call this class directly will very likely end up in security vulnerabilities or broken UX in edge cases.

If you are working on an extension that needs to integrate with the authentication system (e.g. by providing a new login method, or doing extra permission checks), you'll probably need to write an AuthenticationProvider.

If you want to create a "reserved" user programmatically, User::newSystemUser() might be what you are looking for. If you want to change user data, use User::changeAuthenticationData(). Code that is related to some SessionProvider or PrimaryAuthenticationProvider can create a (non-reserved) user by calling AuthManager::autoCreateUser(); it is then the provider's responsibility to ensure that the user can authenticate somehow (see especially PrimaryAuthenticationProvider::autoCreatedAccount()). The same functionality can also be used from Maintenance scripts such as createAndPromote.php. If you are writing code that is not associated with such a provider and needs to create accounts programmatically for real users, you should rethink your architecture. There is no good way to do that as such code has no knowledge of what authentication methods are enabled on the wiki and cannot provide any means for users to access the accounts it would create.

The two main control flows when using this class are as follows:

  • Login, user creation or account linking code will call getAuthenticationRequests(), populate the requests with data (by using them to build a HTMLForm and have the user fill it, or by exposing a form specification via the API, so that the client can build it), and pass them to the appropriate begin* method. That will return either a success/failure response, or more requests to fill (either by building a form or by redirecting the user to some external provider which will send the data back), in which case they need to be submitted to the appropriate continue* method and that step has to be repeated until the response is a success or failure response. AuthManager will use the session to maintain internal state during the process.
  • Code doing an authentication data change will call getAuthenticationRequests(), select a single request, populate it, and pass it to allowsAuthenticationDataChange() and then changeAuthenticationData(). If the data change is user-initiated, the whole process needs to be preceded by a call to securitySensitiveOperationStatus() and aborted if that returns a non-OK status.
Since
1.27
See also
https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager

Definition at line 102 of file AuthManager.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Auth\AuthManager::__construct ( WebRequest  $request,
Config  $config,
ObjectFactory  $objectFactory,
HookContainer  $hookContainer,
ReadOnlyMode  $readOnlyMode,
UserNameUtils  $userNameUtils,
BlockManager  $blockManager,
WatchlistManager  $watchlistManager,
ILoadBalancer  $loadBalancer,
Language  $contentLanguage,
LanguageConverterFactory  $languageConverterFactory,
BotPasswordStore  $botPasswordStore,
UserFactory  $userFactory,
UserIdentityLookup  $userIdentityLookup,
UserOptionsManager  $userOptionsManager 
)

Member Function Documentation

◆ allowsAuthenticationDataChange()

MediaWiki\Auth\AuthManager::allowsAuthenticationDataChange ( AuthenticationRequest  $req,
  $checkData = true 
)

Validate a change of authentication data (e.g.

passwords)

Parameters
AuthenticationRequest$req
bool$checkDataIf false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.
Returns
Status

Definition at line 949 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), StatusValue\newGood(), and Status\wrap().

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequestsInternal(), and AuthManagerSpecialPage\performAuthenticationStep().

◆ allowsPropertyChange()

MediaWiki\Auth\AuthManager::allowsPropertyChange (   $property)

Determine whether a user property should be allowed to be changed.

Supported properties are:

  • emailaddress
  • realname
  • nickname
Parameters
string$property
Returns
bool

Definition at line 2282 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), and MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders().

◆ autoCreateUser()

MediaWiki\Auth\AuthManager::autoCreateUser ( User  $user,
  $source,
  $login = true,
  $log = true 
)

Auto-create an account, and optionally log into that account.

PrimaryAuthenticationProviders can invoke this method by returning a PASS from beginPrimaryAuthentication/continuePrimaryAuthentication with the username of a non-existing user. SessionProviders can invoke it by returning a SessionInfo with the username of a non-existing user from provideSessionInfo(). Calling this method explicitly (e.g. from a maintenance script) is also fine.

Parameters
User$userUser to auto-create
string$sourceWhat caused the auto-creation? This must be one of:
bool$loginWhether to also log the user in
bool$logWhether to generate a user creation log entry (since 1.36)
Returns
Status Good if user was created, Ok if user already existed, otherwise Fatal

Definition at line 1631 of file AuthManager.php.

References $cache, $source, DeferredUpdates\addCallableUpdate(), User\addToDatabase(), DeferredUpdates\addUpdate(), MediaWiki\Auth\AuthManager\callMethodOnProviders(), SiteStatsUpdate\factory(), MediaWiki\Auth\AuthManager\getAuthenticationProvider(), MediaWiki\Auth\AuthManager\getHookRunner(), User\getId(), ObjectCache\getLocalClusterInstance(), User\getName(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), User\getUserPage(), Profiler\instance(), User\loadFromId(), StatusValue\newFatal(), StatusValue\newGood(), User\saveSettings(), MediaWiki\Auth\AuthManager\setDefaultUserOptions(), User\setId(), MediaWiki\Auth\AuthManager\setSessionDataForUser(), wfMessage(), and Status\wrap().

Referenced by MediaWiki\Auth\AuthManager\continueAuthentication().

◆ beginAccountCreation()

MediaWiki\Auth\AuthManager::beginAccountCreation ( Authority  $creator,
array  $reqs,
  $returnToUrl 
)

Start an account creation flow.

In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt. If $createFromLoginAuthenticationRequest->hasPrimaryStateForAction( AuthManager::ACTION_CREATE ) returns true, any AuthenticationRequest::PRIMARY_REQUIRED requests should be omitted. If the CreateFromLoginAuthenticationRequest has a username set, that username must be used for all other requests.

Parameters
Authority$creatorUser doing the account creation
AuthenticationRequest[]$reqs
string$returnToUrlUrl that REDIRECT responses should eventually return to.
Returns
AuthenticationResponse

Definition at line 1124 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\canCreateAccount(), MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\checkAccountCreatePermissions(), MediaWiki\Auth\AuthManager\continueAccountCreation(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Permissions\Authority\getUser(), MediaWiki\Auth\AuthenticationRequest\getUsernameFromRequests(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthManager\removeAuthenticationSessionData(), wfMessage(), and Status\wrap().

Referenced by AuthManagerSpecialPage\performAuthenticationStep().

◆ beginAccountLink()

◆ beginAuthentication()

MediaWiki\Auth\AuthManager::beginAuthentication ( array  $reqs,
  $returnToUrl 
)

Start an authentication flow.

In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt to preserve state.

Instead of the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might pass a CreatedAccountAuthenticationRequest from an account creation that just succeeded to log in to the just-created account.

Parameters
AuthenticationRequest[]$reqs
string$returnToUrlUrl that REDIRECT responses should eventually return to.
Returns
AuthenticationResponse See self::continueAuthentication()

Definition at line 355 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\callMethodOnProviders(), MediaWiki\Auth\AuthManager\continueAuthentication(), MediaWiki\Auth\AuthManager\getHookRunner(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AuthManager\removeAuthenticationSessionData(), MediaWiki\Auth\AuthManager\setSessionDataForUser(), and Status\wrap().

Referenced by LoginSignupSpecialPage\execute(), and AuthManagerSpecialPage\performAuthenticationStep().

◆ callMethodOnProviders()

◆ canAuthenticateNow()

MediaWiki\Auth\AuthManager::canAuthenticateNow ( )

Indicate whether user authentication is possible.

It may not be if the session is provided by something like OAuth for which each individual request includes authentication data.

Returns
bool

Definition at line 333 of file AuthManager.php.

Referenced by LoginSignupSpecialPage\execute(), AuthManagerSpecialPage\isActionAllowed(), and MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().

◆ canCreateAccount()

MediaWiki\Auth\AuthManager::canCreateAccount (   $username,
  $options = [] 
)

Determine whether a particular account can be created.

Parameters
string$usernameMediaWiki username
array$options
  • flags: (int) Bitfield of User:READ_* constants, default User::READ_NORMAL
  • creating: (bool) For internal use only. Never specify this.
Returns
Status

Definition at line 1034 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), StatusValue\newFatal(), StatusValue\newGood(), MediaWiki\Auth\AuthManager\userExists(), and Status\wrap().

Referenced by MediaWiki\Auth\AuthManager\beginAccountCreation().

◆ canCreateAccounts()

◆ canLinkAccounts()

◆ changeAuthenticationData()

MediaWiki\Auth\AuthManager::changeAuthenticationData ( AuthenticationRequest  $req,
  $isAddition = false 
)

Change authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, using $req should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, using $req should no longer result in a successful login.

This method should only be called if allowsAuthenticationDataChange( $req, true ) returned success.

Parameters
AuthenticationRequest$req
bool$isAdditionSet true if this represents an addition of credentials rather than a change. The main difference is that additions should not invalidate BotPasswords. If you're not sure, leave it false.

Definition at line 990 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\callMethodOnProviders().

Referenced by AuthManagerSpecialPage\performAuthenticationStep().

◆ checkAccountCreatePermissions()

MediaWiki\Auth\AuthManager::checkAccountCreatePermissions ( Authority  $creator)

Basic permissions checks on whether a user can create accounts.

Parameters
Authority$creatorUser doing the account creation
Returns
Status

Definition at line 1082 of file AuthManager.php.

References MediaWiki\Permissions\Authority\authorizeWrite(), MediaWiki\Auth\AuthManager\getRequest(), SpecialPage\getTitleFor(), StatusValue\newFatal(), StatusValue\newGood(), wfMessage(), and Status\wrap().

Referenced by MediaWiki\Auth\AuthManager\beginAccountCreation(), and MediaWiki\Auth\AuthManager\continueAccountCreation().

◆ continueAccountCreation()

MediaWiki\Auth\AuthManager::continueAccountCreation ( array  $reqs)

◆ continueAccountLink()

◆ continueAuthentication()

MediaWiki\Auth\AuthManager::continueAuthentication ( array  $reqs)

Continue an authentication flow.

Return values are interpreted as follows:

  • status FAIL: Authentication failed. If $response->createRequest is set, that may be passed to self::beginAuthentication() or to self::beginAccountCreation() to preserve state.
  • status REDIRECT: The client should be redirected to the contained URL, new AuthenticationRequests should be made (if any), then AuthManager::continueAuthentication() should be called.
  • status UI: The client should be presented with a user interface for the fields in the specified AuthenticationRequests, then new AuthenticationRequests should be made, then AuthManager::continueAuthentication() should be called.
  • status RESTART: The user logged in successfully with a third-party service, but the third-party credentials aren't attached to any local account. This could be treated as a UI or a FAIL.
  • status PASS: Authentication was successful.
Parameters
AuthenticationRequest[]$reqs
Returns
AuthenticationResponse

Definition at line 480 of file AuthManager.php.

References $res, MediaWiki\Auth\AuthenticationResponse\ABSTAIN, MediaWiki\Auth\RememberMeAuthenticationRequest\ALWAYS_REMEMBER, MediaWiki\Auth\AuthManager\autoCreateUser(), MediaWiki\Auth\AuthManager\callMethodOnProviders(), MediaWiki\Auth\AuthenticationResponse\FAIL, MediaWiki\Auth\AuthManager\fillRequests(), MediaWiki\Auth\AuthManager\getAuthenticationProvider(), MediaWiki\Auth\AuthManager\getAuthenticationRequestsInternal(), MediaWiki\Auth\AuthManager\getHookRunner(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), MediaWiki\Auth\RememberMeAuthenticationRequest\NEVER_REMEMBER, MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AuthenticationResponse\newRestart(), MediaWiki\Auth\AuthenticationResponse\PASS, MediaWiki\Auth\AuthenticationResponse\REDIRECT, MediaWiki\Auth\AuthManager\removeAuthenticationSessionData(), MediaWiki\Auth\AuthManager\setSessionDataForUser(), MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_LINK, MediaWiki\Auth\AuthenticationResponse\UI, wfMessage(), and Status\wrap().

Referenced by MediaWiki\Auth\AuthManager\beginAuthentication(), and AuthManagerSpecialPage\performAuthenticationStep().

◆ fillRequests()

MediaWiki\Auth\AuthManager::fillRequests ( array &  $reqs,
  $action,
  $username,
  $forceAction = false 
)
private

◆ forcePrimaryAuthenticationProviders()

MediaWiki\Auth\AuthManager::forcePrimaryAuthenticationProviders ( array  $providers,
  $why 
)

Force certain PrimaryAuthenticationProviders.

Deprecated:
For backwards compatibility only
Parameters
PrimaryAuthenticationProvider[]$providers
string$why

Definition at line 280 of file AuthManager.php.

◆ getAuthenticationProvider()

MediaWiki\Auth\AuthManager::getAuthenticationProvider (   $id)

Get a provider by ID.

Note
This is public so extensions can check whether their own provider is installed and so they can read its configuration if necessary. Other uses are not recommended.
Parameters
string$id
Returns
AuthenticationProvider|null

Definition at line 2301 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), and MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders().

Referenced by MediaWiki\Auth\AuthManager\autoCreateUser(), MediaWiki\Auth\AuthManager\continueAccountCreation(), MediaWiki\Auth\AuthManager\continueAccountLink(), and MediaWiki\Auth\AuthManager\continueAuthentication().

◆ getAuthenticationRequests()

MediaWiki\Auth\AuthManager::getAuthenticationRequests (   $action,
UserIdentity  $user = null 
)

Return the applicable list of AuthenticationRequests.

Possible values for $action:

  • ACTION_LOGIN: Valid for passing to beginAuthentication
  • ACTION_LOGIN_CONTINUE: Valid for passing to continueAuthentication in the current state
  • ACTION_CREATE: Valid for passing to beginAccountCreation
  • ACTION_CREATE_CONTINUE: Valid for passing to continueAccountCreation in the current state
  • ACTION_LINK: Valid for passing to beginAccountLink
  • ACTION_LINK_CONTINUE: Valid for passing to continueAccountLink in the current state
  • ACTION_CHANGE: Valid for passing to changeAuthenticationData to change credentials
  • ACTION_REMOVE: Valid for passing to changeAuthenticationData to remove credentials.
  • ACTION_UNLINK: Same as ACTION_REMOVE, but limited to linked accounts.
Parameters
string$actionOne of the AuthManager::ACTION_* constants
UserIdentity | null$userUser being acted on, instead of the current user.
Returns
AuthenticationRequest[]

Definition at line 2110 of file AuthManager.php.

References MediaWiki\$action, MediaWiki\Auth\AuthManager\ACTION_CHANGE, MediaWiki\Auth\AuthManager\ACTION_CREATE, MediaWiki\Auth\AuthManager\ACTION_CREATE_CONTINUE, MediaWiki\Auth\AuthManager\ACTION_LINK, MediaWiki\Auth\AuthManager\ACTION_LINK_CONTINUE, MediaWiki\Auth\AuthManager\ACTION_LOGIN, MediaWiki\Auth\AuthManager\ACTION_LOGIN_CONTINUE, MediaWiki\Auth\AuthManager\ACTION_REMOVE, MediaWiki\Auth\AuthManager\ACTION_UNLINK, MediaWiki\Auth\AuthManager\getAuthenticationRequestsInternal(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), and MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_LINK.

Referenced by AuthManagerSpecialPage\isActionAllowed().

◆ getAuthenticationRequestsInternal()

MediaWiki\Auth\AuthManager::getAuthenticationRequestsInternal (   $providerAction,
array  $options,
array  $providers,
UserIdentity  $user = null 
)
private

◆ getAuthenticationSessionData()

MediaWiki\Auth\AuthManager::getAuthenticationSessionData (   $key,
  $default = null 
)

Fetch authentication data from the current session.

Note
For use by AuthenticationProviders only
Parameters
string$key
mixed | null$default
Returns
mixed

Definition at line 2353 of file AuthManager.php.

Referenced by LoginSignupSpecialPage\getFieldDefinitions(), AuthManagerSpecialPage\handleReauthBeforeExecute(), and AuthManagerSpecialPage\handleReturnBeforeExecute().

◆ getConfiguration()

◆ getHookContainer()

MediaWiki\Auth\AuthManager::getHookContainer ( )
private

◆ getHookRunner()

◆ getPreAuthenticationProviders()

◆ getPrimaryAuthenticationProviders()

◆ getRequest()

MediaWiki\Auth\AuthManager::getRequest ( )

◆ getSecondaryAuthenticationProviders()

◆ normalizeUsername()

MediaWiki\Auth\AuthManager::normalizeUsername (   $username)

Provide normalized versions of the username for security checks.

Since different providers can normalize the input in different ways, this returns an array of all the different ways the name might be normalized for authentication.

The returned strings should not be revealed to the user, as that might leak private information (e.g. an email address might be normalized to a username).

Parameters
string$username
Returns
string[]

Definition at line 909 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders().

◆ providerArrayFromSpecs()

MediaWiki\Auth\AuthManager::providerArrayFromSpecs (   $class,
array  $specs 
)
protected

Create an array of AuthenticationProviders from an array of ObjectFactory specs.

Parameters
string$class
array[]$specs
Returns
AuthenticationProvider[]

Definition at line 2386 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getHookContainer().

Referenced by MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), and MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders().

◆ removeAuthenticationSessionData()

MediaWiki\Auth\AuthManager::removeAuthenticationSessionData (   $key)

◆ revokeAccessForUser()

MediaWiki\Auth\AuthManager::revokeAccessForUser (   $username)

Revoke any authentication credentials for a user.

After this, the user should no longer be able to log in.

Parameters
string$username

Definition at line 933 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\callMethodOnProviders().

◆ securitySensitiveOperationStatus()

MediaWiki\Auth\AuthManager::securitySensitiveOperationStatus (   $operation)

Whether security-sensitive operations should proceed.

A "security-sensitive operation" is something like a password or email change, that would normally have a "reenter your password to confirm" box if we only supported password-based authentication.

Parameters
string$operationOperation being checked. This should be a message-key-like string such as 'change-password' or 'change-email'.
Returns
string One of the SEC_* constants.

Definition at line 809 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\canAuthenticateNow(), MediaWiki\Auth\AuthManager\getHookRunner(), MediaWiki\Auth\AuthManager\SEC_FAIL, MediaWiki\Auth\AuthManager\SEC_OK, and MediaWiki\Auth\AuthManager\SEC_REAUTH.

Referenced by AuthManagerSpecialPage\handleReauthBeforeExecute().

◆ setAuthenticationSessionData()

MediaWiki\Auth\AuthManager::setAuthenticationSessionData (   $key,
  $data 
)

Store authentication in the current session.

Note
For use by AuthenticationProviders only
Parameters
string$key
mixed$dataMust be serializable

Definition at line 2336 of file AuthManager.php.

Referenced by LoginSignupSpecialPage\getFieldDefinitions(), AuthManagerSpecialPage\handleReauthBeforeExecute(), and AuthManagerSpecialPage\handleReturnBeforeExecute().

◆ setDefaultUserOptions()

MediaWiki\Auth\AuthManager::setDefaultUserOptions ( User  $user,
  $useContextLang 
)
private
Parameters
User$user
bool$useContextLangUse 'uselang' to set the user's language

Definition at line 2496 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\$contentLanguage, $lang, RequestContext\getMain(), and User\setToken().

Referenced by MediaWiki\Auth\AuthManager\autoCreateUser(), and MediaWiki\Auth\AuthManager\continueAccountCreation().

◆ setLogger()

MediaWiki\Auth\AuthManager::setLogger ( LoggerInterface  $logger)
Parameters
LoggerInterface$logger

Definition at line 263 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\$logger.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ setSessionDataForUser()

MediaWiki\Auth\AuthManager::setSessionDataForUser (   $user,
  $remember = null 
)
private

◆ userCanAuthenticate()

MediaWiki\Auth\AuthManager::userCanAuthenticate (   $username)

Determine whether a username can authenticate.

This is mainly for internal purposes and only takes authentication data into account, not things like blocks that can change without the authentication system being aware.

Parameters
string$usernameMediaWiki username
Returns
bool

Definition at line 886 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders().

◆ userExists()

MediaWiki\Auth\AuthManager::userExists (   $username,
  $flags = User::READ_NORMAL 
)

Determine whether a username exists.

Parameters
string$username
int$flagsBitfield of User:READ_* constants
Returns
bool

Definition at line 2261 of file AuthManager.php.

References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders().

Referenced by MediaWiki\Auth\AuthManager\canCreateAccount().

Member Data Documentation

◆ $allAuthenticationProviders

AuthenticationProvider [] MediaWiki\Auth\AuthManager::$allAuthenticationProviders = []
private

Definition at line 157 of file AuthManager.php.

◆ $blockManager

BlockManager MediaWiki\Auth\AuthManager::$blockManager
private

Definition at line 181 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $botPasswordStore

BotPasswordStore MediaWiki\Auth\AuthManager::$botPasswordStore
private

Definition at line 196 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $config

Config MediaWiki\Auth\AuthManager::$config
private

Definition at line 145 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $contentLanguage

Language MediaWiki\Auth\AuthManager::$contentLanguage
private

◆ $createdAccountAuthenticationRequests

CreatedAccountAuthenticationRequest [] MediaWiki\Auth\AuthManager::$createdAccountAuthenticationRequests = []
private

Definition at line 169 of file AuthManager.php.

◆ $hookContainer

HookContainer MediaWiki\Auth\AuthManager::$hookContainer
private

◆ $hookRunner

HookRunner MediaWiki\Auth\AuthManager::$hookRunner
private

Definition at line 175 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getHookRunner().

◆ $languageConverterFactory

LanguageConverterFactory MediaWiki\Auth\AuthManager::$languageConverterFactory
private

Definition at line 193 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $loadBalancer

ILoadBalancer MediaWiki\Auth\AuthManager::$loadBalancer
private

Definition at line 187 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $logger

LoggerInterface MediaWiki\Auth\AuthManager::$logger
private

Definition at line 151 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\setLogger().

◆ $objectFactory

ObjectFactory MediaWiki\Auth\AuthManager::$objectFactory
private

Definition at line 148 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $preAuthenticationProviders

PreAuthenticationProvider [] MediaWiki\Auth\AuthManager::$preAuthenticationProviders = null
private

◆ $primaryAuthenticationProviders

PrimaryAuthenticationProvider [] MediaWiki\Auth\AuthManager::$primaryAuthenticationProviders = null
private

◆ $readOnlyMode

ReadOnlyMode MediaWiki\Auth\AuthManager::$readOnlyMode
private

Definition at line 178 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $request

WebRequest MediaWiki\Auth\AuthManager::$request
private

◆ $secondaryAuthenticationProviders

SecondaryAuthenticationProvider [] MediaWiki\Auth\AuthManager::$secondaryAuthenticationProviders = null
private

◆ $userFactory

UserFactory MediaWiki\Auth\AuthManager::$userFactory
private

Definition at line 199 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $userIdentityLookup

UserIdentityLookup MediaWiki\Auth\AuthManager::$userIdentityLookup
private

Definition at line 202 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $userNameUtils

UserNameUtils MediaWiki\Auth\AuthManager::$userNameUtils
private

Definition at line 154 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $userOptionsManager

UserOptionsManager MediaWiki\Auth\AuthManager::$userOptionsManager
private

Definition at line 205 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ $watchlistManager

WatchlistManager MediaWiki\Auth\AuthManager::$watchlistManager
private

Definition at line 184 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\__construct().

◆ ACTION_CHANGE

◆ ACTION_CREATE

◆ ACTION_CREATE_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_CREATE_CONTINUE = 'create-continue'

Continue a user creation process that was interrupted by the need for user input or communication with an external provider.

Definition at line 114 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequests().

◆ ACTION_LINK

const MediaWiki\Auth\AuthManager::ACTION_LINK = 'link'

Link an existing user to a third-party account.

Definition at line 116 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequests().

◆ ACTION_LINK_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_LINK_CONTINUE = 'link-continue'

Continue a user linking process that was interrupted by the need for user input or communication with an external provider.

Definition at line 120 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequests().

◆ ACTION_LOGIN

◆ ACTION_LOGIN_CONTINUE

const MediaWiki\Auth\AuthManager::ACTION_LOGIN_CONTINUE = 'login-continue'

Continue a login process that was interrupted by the need for user input or communication with an external provider.

Definition at line 108 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequests().

◆ ACTION_REMOVE

◆ ACTION_UNLINK

const MediaWiki\Auth\AuthManager::ACTION_UNLINK = 'unlink'

Like ACTION_REMOVE but for linking providers only.

Definition at line 126 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\getAuthenticationRequests().

◆ AUTOCREATE_SOURCE_MAINT

const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_MAINT = '::Maintenance::'

Auto-creation is due to a Maintenance script.

Definition at line 139 of file AuthManager.php.

◆ AUTOCREATE_SOURCE_SESSION

const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_SESSION = \MediaWiki\Session\SessionManager::class

Auto-creation is due to SessionManager.

Definition at line 136 of file AuthManager.php.

◆ SEC_FAIL

const MediaWiki\Auth\AuthManager::SEC_FAIL = 'fail'

Security-sensitive should not be performed.

Definition at line 133 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().

◆ SEC_OK

const MediaWiki\Auth\AuthManager::SEC_OK = 'ok'

Security-sensitive operations are ok.

Definition at line 129 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().

◆ SEC_REAUTH

const MediaWiki\Auth\AuthManager::SEC_REAUTH = 'reauth'

Security-sensitive operations should re-authenticate.

Definition at line 131 of file AuthManager.php.

Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().


The documentation for this class was generated from the following file: