MediaWiki master
|
This serves as the entry point to the authentication system. More...
Inherits LoggerAwareInterface.
Public Member Functions | |
__construct (WebRequest $request, Config $config, ObjectFactory $objectFactory, HookContainer $hookContainer, ReadOnlyMode $readOnlyMode, UserNameUtils $userNameUtils, BlockManager $blockManager, WatchlistManager $watchlistManager, ILoadBalancer $loadBalancer, Language $contentLanguage, LanguageConverterFactory $languageConverterFactory, BotPasswordStore $botPasswordStore, UserFactory $userFactory, UserIdentityLookup $userIdentityLookup, UserOptionsManager $userOptionsManager) | |
forcePrimaryAuthenticationProviders (array $providers, $why) | |
Force certain PrimaryAuthenticationProviders. | |
getRequest () | |
setLogger (LoggerInterface $logger) | |
Authentication | |
canAuthenticateNow () | |
Indicate whether user authentication is possible. | |
beginAuthentication (array $reqs, $returnToUrl) | |
Start an authentication flow. | |
continueAuthentication (array $reqs) | |
Continue an authentication flow. | |
securitySensitiveOperationStatus ( $operation) | |
Whether security-sensitive operations should proceed. | |
userCanAuthenticate ( $username) | |
Determine whether a username can authenticate. | |
normalizeUsername ( $username) | |
Provide normalized versions of the username for security checks. | |
Authentication data changing | |
revokeAccessForUser ( $username) | |
Revoke any authentication credentials for a user. | |
allowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true) | |
Validate a change of authentication data (e.g. | |
changeAuthenticationData (AuthenticationRequest $req, $isAddition=false) | |
Change authentication data (e.g. | |
Account linking | |
canLinkAccounts () | |
Determine whether accounts can be linked. | |
beginAccountLink (User $user, array $reqs, $returnToUrl) | |
Start an account linking flow. | |
continueAccountLink (array $reqs) | |
Continue an account linking flow. | |
Public Attributes | |
const | ACCOUNT_CREATION_STATE = 'AuthManager::accountCreationState' |
const | ACCOUNT_LINK_STATE = 'AuthManager::accountLinkState' |
const | ACTION_CHANGE = 'change' |
Change a user's credentials. | |
const | ACTION_CREATE = 'create' |
Create a new user. | |
const | ACTION_CREATE_CONTINUE = 'create-continue' |
Continue a user creation process that was interrupted by the need for user input or communication with an external provider. | |
const | ACTION_LINK = 'link' |
Link an existing user to a third-party account. | |
const | ACTION_LINK_CONTINUE = 'link-continue' |
Continue a user linking process that was interrupted by the need for user input or communication with an external provider. | |
const | ACTION_LOGIN = 'login' |
Log in with an existing (not necessarily local) user. | |
const | ACTION_LOGIN_CONTINUE = 'login-continue' |
Continue a login process that was interrupted by the need for user input or communication with an external provider. | |
const | ACTION_REMOVE = 'remove' |
Remove a user's credentials. | |
const | ACTION_UNLINK = 'unlink' |
Like ACTION_REMOVE but for linking providers only. | |
const | AUTHN_STATE = 'AuthManager::authnState' |
const | AUTOCREATE_BLOCKLIST = 'AuthManager::AutoCreateBlacklist' |
const | AUTOCREATE_SOURCE_MAINT = '::Maintenance::' |
Auto-creation is due to a Maintenance script. | |
const | AUTOCREATE_SOURCE_SESSION = \MediaWiki\Session\SessionManager::class |
Auto-creation is due to SessionManager. | |
const | AUTOCREATE_SOURCE_TEMP = TempUserCreator::class |
Auto-creation is due to temporary account creation on page save. | |
const | SEC_FAIL = 'fail' |
Security-sensitive should not be performed. | |
const | SEC_OK = 'ok' |
Security-sensitive operations are ok. | |
const | SEC_REAUTH = 'reauth' |
Security-sensitive operations should re-authenticate. | |
Account creation | |
canCreateAccounts () | |
Determine whether accounts can be created. | |
canCreateAccount ( $username, $options=[]) | |
Determine whether a particular account can be created. | |
probablyCanCreateAccount (Authority $creator) | |
Check whether $creator can create accounts. | |
authorizeCreateAccount (Authority $creator) | |
Authorize the account creation by $creator. | |
beginAccountCreation (Authority $creator, array $reqs, $returnToUrl) | |
Start an account creation flow. | |
continueAccountCreation (array $reqs) | |
Continue an account creation flow. | |
autoCreateUser (User $user, $source, $login=true, $log=true, ?Authority $performer=null) | |
Auto-create an account, and optionally log into that account. | |
Information methods | |
getAuthenticationRequests ( $action, UserIdentity $user=null) | |
Return the applicable list of AuthenticationRequests. | |
userExists ( $username, $flags=IDBAccessObject::READ_NORMAL) | |
Determine whether a username exists. | |
allowsPropertyChange ( $property) | |
Determine whether a user property should be allowed to be changed. | |
getAuthenticationProvider ( $id) | |
Get a provider by ID. | |
Internal methods | |
setAuthenticationSessionData ( $key, $data) | |
Store authentication in the current session. | |
getAuthenticationSessionData ( $key, $default=null) | |
Fetch authentication data from the current session. | |
removeAuthenticationSessionData ( $key) | |
Remove authentication data. | |
providerArrayFromSpecs ( $class, array $specs) | |
Create an array of AuthenticationProviders from an array of ObjectFactory specs. | |
getPreAuthenticationProviders () | |
Get the list of PreAuthenticationProviders. | |
getPrimaryAuthenticationProviders () | |
Get the list of PrimaryAuthenticationProviders. | |
getSecondaryAuthenticationProviders () | |
Get the list of SecondaryAuthenticationProviders. | |
This serves as the entry point to the authentication system.
In the future, it may also serve as the entry point to the authorization system.
If you are looking at this because you are working on an extension that creates its own login or signup page, then 1) you really shouldn't do that, 2) if you feel you absolutely have to, subclass AuthManagerSpecialPage or build it on the client side using the clientlogin or the createaccount API. Trying to call this class directly will very likely end up in security vulnerabilities or broken UX in edge cases.
If you are working on an extension that needs to integrate with the authentication system (e.g. by providing a new login method, or doing extra permission checks), you'll probably need to write an AuthenticationProvider.
If you want to create a "reserved" user programmatically, User::newSystemUser() might be what you are looking for. If you want to change user data, use User::changeAuthenticationData(). Code that is related to some SessionProvider or PrimaryAuthenticationProvider can create a (non-reserved) user by calling AuthManager::autoCreateUser(); it is then the provider's responsibility to ensure that the user can authenticate somehow (see especially PrimaryAuthenticationProvider::autoCreatedAccount()). The same functionality can also be used from Maintenance scripts such as createAndPromote.php. If you are writing code that is not associated with such a provider and needs to create accounts programmatically for real users, you should rethink your architecture. There is no good way to do that as such code has no knowledge of what authentication methods are enabled on the wiki and cannot provide any means for users to access the accounts it would create.
The two main control flows when using this class are as follows:
Definition at line 110 of file AuthManager.php.
MediaWiki\Auth\AuthManager::__construct | ( | WebRequest | $request, |
Config | $config, | ||
ObjectFactory | $objectFactory, | ||
HookContainer | $hookContainer, | ||
ReadOnlyMode | $readOnlyMode, | ||
UserNameUtils | $userNameUtils, | ||
BlockManager | $blockManager, | ||
WatchlistManager | $watchlistManager, | ||
ILoadBalancer | $loadBalancer, | ||
Language | $contentLanguage, | ||
LanguageConverterFactory | $languageConverterFactory, | ||
BotPasswordStore | $botPasswordStore, | ||
UserFactory | $userFactory, | ||
UserIdentityLookup | $userIdentityLookup, | ||
UserOptionsManager | $userOptionsManager | ||
) |
WebRequest | $request | |
Config | $config | |
ObjectFactory | $objectFactory | |
HookContainer | $hookContainer | |
ReadOnlyMode | $readOnlyMode | |
UserNameUtils | $userNameUtils | |
BlockManager | $blockManager | |
WatchlistManager | $watchlistManager | |
ILoadBalancer | $loadBalancer | |
Language | $contentLanguage | |
LanguageConverterFactory | $languageConverterFactory | |
BotPasswordStore | $botPasswordStore | |
UserFactory | $userFactory | |
UserIdentityLookup | $userIdentityLookup | |
UserOptionsManager | $userOptionsManager |
Definition at line 260 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\setLogger().
MediaWiki\Auth\AuthManager::allowsAuthenticationDataChange | ( | AuthenticationRequest | $req, |
$checkData = true |
|||
) |
Validate a change of authentication data (e.g.
passwords)
AuthenticationRequest | $req | |
bool | $checkData | If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission. |
Definition at line 1004 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), and MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders().
MediaWiki\Auth\AuthManager::allowsPropertyChange | ( | $property | ) |
Determine whether a user property should be allowed to be changed.
Supported properties are:
string | $property |
Definition at line 2443 of file AuthManager.php.
MediaWiki\Auth\AuthManager::authorizeCreateAccount | ( | Authority | $creator | ) |
Authorize the account creation by $creator.
self::probablyCanCreateAccount
instead.Authority | $creator |
Definition at line 1199 of file AuthManager.php.
References MediaWiki\Permissions\Authority\authorizeWrite().
MediaWiki\Auth\AuthManager::autoCreateUser | ( | User | $user, |
$source, | |||
$login = true , |
|||
$log = true , |
|||
?Authority | $performer = null |
||
) |
Auto-create an account, and optionally log into that account.
PrimaryAuthenticationProviders can invoke this method by returning a PASS from beginPrimaryAuthentication/continuePrimaryAuthentication with the username of a non-existing user. SessionProviders can invoke it by returning a SessionInfo with the username of a non-existing user from provideSessionInfo(). Calling this method explicitly (e.g. from a maintenance script) is also fine.
User | $user | User to auto-create |
string | $source | What caused the auto-creation? This must be one of:
|
bool | $login | Whether to also log the user in |
bool | $log | Whether to generate a user creation log entry (since 1.36) |
Authority | null | $performer | The performer of the action to use for user rights checking. Normally null to indicate an anonymous performer. Added in 1.42 for Special:CreateLocalAccount (T234371). |
Definition at line 1745 of file AuthManager.php.
References $source, MediaWiki\User\User\addToDatabase(), MediaWiki\User\User\getId(), MediaWiki\User\User\getName(), MediaWiki\User\User\getUserPage(), MediaWiki\User\User\loadFromId(), MediaWiki\User\User\saveSettings(), MediaWiki\User\User\setId(), and wfMessage().
Referenced by MediaWiki\Auth\AuthManager\continueAuthentication().
MediaWiki\Auth\AuthManager::beginAccountCreation | ( | Authority | $creator, |
array | $reqs, | ||
$returnToUrl | |||
) |
Start an account creation flow.
In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt. If $createFromLoginAuthenticationRequest->hasPrimaryStateForAction( AuthManager::ACTION_CREATE )
returns true, any AuthenticationRequest::PRIMARY_REQUIRED requests should be omitted. If the CreateFromLoginAuthenticationRequest has a username set, that username must be used for all other requests.
Authority | $creator | User doing the account creation |
AuthenticationRequest[] | $reqs | |
string | $returnToUrl | Url that REDIRECT responses should eventually return to. |
Definition at line 1231 of file AuthManager.php.
References MediaWiki\Permissions\Authority\getUser(), and wfMessage().
MediaWiki\Auth\AuthManager::beginAccountLink | ( | User | $user, |
array | $reqs, | ||
$returnToUrl | |||
) |
Start an account linking flow.
User | $user | User being linked |
AuthenticationRequest[] | $reqs | |
string | $returnToUrl | Url that REDIRECT responses should eventually return to. |
Definition at line 2048 of file AuthManager.php.
References MediaWiki\User\User\getId(), MediaWiki\User\User\getName(), StatusValue\isGood(), MediaWiki\User\User\isRegistered(), and wfMessage().
MediaWiki\Auth\AuthManager::beginAuthentication | ( | array | $reqs, |
$returnToUrl | |||
) |
Start an authentication flow.
In addition to the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might include a CreateFromLoginAuthenticationRequest from a previous login attempt to preserve state.
Instead of the AuthenticationRequests returned by $this->getAuthenticationRequests(), a client might pass a CreatedAccountAuthenticationRequest from an account creation that just succeeded to log in to the just-created account.
AuthenticationRequest[] | $reqs | |
string | $returnToUrl | Url that REDIRECT responses should eventually return to. |
Definition at line 391 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\continueAuthentication(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), and MediaWiki\Auth\AuthManager\removeAuthenticationSessionData().
MediaWiki\Auth\AuthManager::canAuthenticateNow | ( | ) |
Indicate whether user authentication is possible.
It may not be if the session is provided by something like OAuth for which each individual request includes authentication data.
Definition at line 369 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().
MediaWiki\Auth\AuthManager::canCreateAccount | ( | $username, | |
$options = [] |
|||
) |
Determine whether a particular account can be created.
string | $username | MediaWiki username |
array | $options |
|
Definition at line 1089 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\getPreAuthenticationProviders(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), and MediaWiki\Auth\AuthManager\userExists().
MediaWiki\Auth\AuthManager::canCreateAccounts | ( | ) |
Determine whether accounts can be created.
Definition at line 1070 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_CREATE, and MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_LINK.
Referenced by MediaWiki\Auth\AuthManager\canCreateAccount().
MediaWiki\Auth\AuthManager::canLinkAccounts | ( | ) |
Determine whether accounts can be linked.
Definition at line 2030 of file AuthManager.php.
MediaWiki\Auth\AuthManager::changeAuthenticationData | ( | AuthenticationRequest | $req, |
$isAddition = false |
|||
) |
Change authentication data (e.g.
passwords)
If $req was returned for AuthManager::ACTION_CHANGE, using $req should result in a successful login in the future.
If $req was returned for AuthManager::ACTION_REMOVE, using $req should no longer result in a successful login.
This method should only be called if allowsAuthenticationDataChange( $req, true ) returned success.
AuthenticationRequest | $req | |
bool | $isAddition | Set true if this represents an addition of credentials rather than a change. The main difference is that additions should not invalidate BotPasswords. If you're not sure, leave it false. |
Definition at line 1045 of file AuthManager.php.
MediaWiki\Auth\AuthManager::continueAccountCreation | ( | array | $reqs | ) |
Continue an account creation flow.
AuthenticationRequest[] | $reqs |
Definition at line 1333 of file AuthManager.php.
References wfMessage().
MediaWiki\Auth\AuthManager::continueAccountLink | ( | array | $reqs | ) |
Continue an account linking flow.
AuthenticationRequest[] | $reqs |
Definition at line 2157 of file AuthManager.php.
References wfMessage().
MediaWiki\Auth\AuthManager::continueAuthentication | ( | array | $reqs | ) |
Continue an authentication flow.
Return values are interpreted as follows:
AuthenticationRequest[] | $reqs |
Definition at line 521 of file AuthManager.php.
References MediaWiki\Auth\AuthenticationResponse\ABSTAIN, MediaWiki\Auth\RememberMeAuthenticationRequest\ALWAYS_REMEMBER, MediaWiki\Auth\AuthManager\autoCreateUser(), MediaWiki\Auth\AuthenticationResponse\FAIL, MediaWiki\Auth\AuthManager\getAuthenticationProvider(), MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders(), MediaWiki\Auth\AuthenticationRequest\getRequestByClass(), MediaWiki\Auth\AuthManager\getSecondaryAuthenticationProviders(), MediaWiki\Auth\RememberMeAuthenticationRequest\NEVER_REMEMBER, MediaWiki\Auth\AuthenticationResponse\newFail(), MediaWiki\Auth\AuthenticationResponse\newPass(), MediaWiki\Auth\AuthenticationResponse\newRestart(), MediaWiki\Auth\AuthenticationResponse\PASS, MediaWiki\Auth\AuthenticationResponse\REDIRECT, MediaWiki\MainConfigNames\RememberMe, MediaWiki\Auth\AuthManager\removeAuthenticationSessionData(), MediaWiki\Auth\PrimaryAuthenticationProvider\TYPE_LINK, MediaWiki\Auth\AuthenticationResponse\UI, and wfMessage().
Referenced by MediaWiki\Auth\AuthManager\beginAuthentication().
MediaWiki\Auth\AuthManager::forcePrimaryAuthenticationProviders | ( | array | $providers, |
$why | |||
) |
Force certain PrimaryAuthenticationProviders.
PrimaryAuthenticationProvider[] | $providers | |
string | $why |
Definition at line 316 of file AuthManager.php.
MediaWiki\Auth\AuthManager::getAuthenticationProvider | ( | $id | ) |
Get a provider by ID.
string | $id |
Definition at line 2462 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\continueAuthentication().
MediaWiki\Auth\AuthManager::getAuthenticationRequests | ( | $action, | |
UserIdentity | $user = null |
||
) |
Return the applicable list of AuthenticationRequests.
Possible values for $action:
string | $action | One of the AuthManager::ACTION_* constants |
UserIdentity | null | $user | User being acted on, instead of the current user. |
Definition at line 2271 of file AuthManager.php.
MediaWiki\Auth\AuthManager::getAuthenticationSessionData | ( | $key, | |
$default = null |
|||
) |
Fetch authentication data from the current session.
string | $key | |
mixed | null | $default |
Definition at line 2514 of file AuthManager.php.
|
protected |
Get the list of PreAuthenticationProviders.
Definition at line 2590 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\beginAuthentication(), and MediaWiki\Auth\AuthManager\canCreateAccount().
|
protected |
Get the list of PrimaryAuthenticationProviders.
Definition at line 2604 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\allowsAuthenticationDataChange(), MediaWiki\Auth\AuthManager\canCreateAccount(), MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\continueAuthentication(), MediaWiki\Auth\AuthManager\normalizeUsername(), and MediaWiki\Auth\AuthManager\userCanAuthenticate().
MediaWiki\Auth\AuthManager::getRequest | ( | ) |
Definition at line 306 of file AuthManager.php.
|
protected |
Get the list of SecondaryAuthenticationProviders.
Definition at line 2618 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\allowsAuthenticationDataChange(), MediaWiki\Auth\AuthManager\canCreateAccount(), and MediaWiki\Auth\AuthManager\continueAuthentication().
MediaWiki\Auth\AuthManager::normalizeUsername | ( | $username | ) |
Provide normalized versions of the username for security checks.
Since different providers can normalize the input in different ways, this returns an array of all the different ways the name might be normalized for authentication.
The returned strings should not be revealed to the user, as that might leak private information (e.g. an email address might be normalized to a username).
string | $username |
Definition at line 964 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders().
MediaWiki\Auth\AuthManager::probablyCanCreateAccount | ( | Authority | $creator | ) |
Check whether $creator can create accounts.
self::authorizeCreateAccount
instead.Authority | $creator |
Definition at line 1175 of file AuthManager.php.
References MediaWiki\Permissions\Authority\probablyCan().
|
protected |
Create an array of AuthenticationProviders from an array of ObjectFactory specs.
string | $class | |
array[] | $specs |
Definition at line 2547 of file AuthManager.php.
MediaWiki\Auth\AuthManager::removeAuthenticationSessionData | ( | $key | ) |
Remove authentication data.
string | null | $key | If null, all data is removed |
Definition at line 2528 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\beginAuthentication(), and MediaWiki\Auth\AuthManager\continueAuthentication().
MediaWiki\Auth\AuthManager::revokeAccessForUser | ( | $username | ) |
Revoke any authentication credentials for a user.
After this, the user should no longer be able to log in.
string | $username |
Definition at line 988 of file AuthManager.php.
MediaWiki\Auth\AuthManager::securitySensitiveOperationStatus | ( | $operation | ) |
Whether security-sensitive operations should proceed.
A "security-sensitive operation" is something like a password or email change, that would normally have a "reenter your password to confirm" box if we only supported password-based authentication.
string | $operation | Operation being checked. This should be a message-key-like string such as 'change-password' or 'change-email'. |
Definition at line 863 of file AuthManager.php.
References MediaWiki\MainConfigNames\AllowSecuritySensitiveOperationIfCannotReauthenticate, MediaWiki\Auth\AuthManager\canAuthenticateNow(), MediaWiki\MainConfigNames\ReauthenticateTime, MediaWiki\Auth\AuthManager\SEC_FAIL, MediaWiki\Auth\AuthManager\SEC_OK, and MediaWiki\Auth\AuthManager\SEC_REAUTH.
MediaWiki\Auth\AuthManager::setAuthenticationSessionData | ( | $key, | |
$data | |||
) |
Store authentication in the current session.
string | $key | |
mixed | $data | Must be serializable |
Definition at line 2497 of file AuthManager.php.
MediaWiki\Auth\AuthManager::setLogger | ( | LoggerInterface | $logger | ) |
LoggerInterface | $logger |
Definition at line 299 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\__construct().
MediaWiki\Auth\AuthManager::userCanAuthenticate | ( | $username | ) |
Determine whether a username can authenticate.
This is mainly for internal purposes and only takes authentication data into account, not things like blocks that can change without the authentication system being aware.
string | $username | MediaWiki username |
Definition at line 941 of file AuthManager.php.
References MediaWiki\Auth\AuthManager\getPrimaryAuthenticationProviders().
MediaWiki\Auth\AuthManager::userExists | ( | $username, | |
$flags = IDBAccessObject::READ_NORMAL |
|||
) |
Determine whether a username exists.
string | $username | |
int | $flags | Bitfield of IDBAccessObject::READ_* constants |
Definition at line 2422 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\canCreateAccount().
const MediaWiki\Auth\AuthManager::ACCOUNT_CREATION_STATE = 'AuthManager::accountCreationState' |
Definition at line 121 of file AuthManager.php.
Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\beginSecondaryAccountCreation(), and MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueSecondaryAccountCreation().
const MediaWiki\Auth\AuthManager::ACCOUNT_LINK_STATE = 'AuthManager::accountLinkState' |
Definition at line 127 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::ACTION_CHANGE = 'change' |
Change a user's credentials.
Definition at line 155 of file AuthManager.php.
Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueLinkAttempt(), MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), and MediaWiki\Auth\ResetPasswordSecondaryAuthenticationProvider\tryReset().
const MediaWiki\Auth\AuthManager::ACTION_CREATE = 'create' |
Create a new user.
Definition at line 143 of file AuthManager.php.
Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasPrimaryStateForAction(), and MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasStateForAction().
const MediaWiki\Auth\AuthManager::ACTION_CREATE_CONTINUE = 'create-continue' |
Continue a user creation process that was interrupted by the need for user input or communication with an external provider.
Definition at line 147 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::ACTION_LINK = 'link' |
Link an existing user to a third-party account.
Definition at line 149 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::ACTION_LINK_CONTINUE = 'link-continue' |
Continue a user linking process that was interrupted by the need for user input or communication with an external provider.
Definition at line 153 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::ACTION_LOGIN = 'login' |
Log in with an existing (not necessarily local) user.
Definition at line 137 of file AuthManager.php.
Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), and MediaWiki\Auth\CreateFromLoginAuthenticationRequest\hasStateForAction().
const MediaWiki\Auth\AuthManager::ACTION_LOGIN_CONTINUE = 'login-continue' |
Continue a login process that was interrupted by the need for user input or communication with an external provider.
Definition at line 141 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::ACTION_REMOVE = 'remove' |
Remove a user's credentials.
Definition at line 157 of file AuthManager.php.
Referenced by MediaWiki\Auth\AbstractPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\getAuthenticationRequests(), MediaWiki\Auth\PasswordAuthenticationRequest\getFieldInfo(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider\providerChangeAuthenticationData(), MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\providerRevokeAccessForUser(), and MediaWiki\Auth\AbstractSecondaryAuthenticationProvider\providerRevokeAccessForUser().
const MediaWiki\Auth\AuthManager::ACTION_UNLINK = 'unlink' |
Like ACTION_REMOVE but for linking providers only.
Definition at line 159 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::AUTHN_STATE = 'AuthManager::authnState' |
Definition at line 115 of file AuthManager.php.
Referenced by MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\beginSecondaryAuthentication(), and MediaWiki\Auth\ConfirmLinkSecondaryAuthenticationProvider\continueSecondaryAuthentication().
const MediaWiki\Auth\AuthManager::AUTOCREATE_BLOCKLIST = 'AuthManager::AutoCreateBlacklist' |
Definition at line 134 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_MAINT = '::Maintenance::' |
Auto-creation is due to a Maintenance script.
Definition at line 172 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_SESSION = \MediaWiki\Session\SessionManager::class |
Auto-creation is due to SessionManager.
Definition at line 169 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::AUTOCREATE_SOURCE_TEMP = TempUserCreator::class |
Auto-creation is due to temporary account creation on page save.
Definition at line 175 of file AuthManager.php.
const MediaWiki\Auth\AuthManager::SEC_FAIL = 'fail' |
Security-sensitive should not be performed.
Definition at line 166 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().
const MediaWiki\Auth\AuthManager::SEC_OK = 'ok' |
Security-sensitive operations are ok.
Definition at line 162 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().
const MediaWiki\Auth\AuthManager::SEC_REAUTH = 'reauth' |
Security-sensitive operations should re-authenticate.
Definition at line 164 of file AuthManager.php.
Referenced by MediaWiki\Auth\AuthManager\securitySensitiveOperationStatus().