A pre-authentication provider to throttle authentication actions. More...

Inherits MediaWiki\Auth\AbstractPreAuthenticationProvider.

Collaboration diagram for MediaWiki\Auth\ThrottlePreAuthenticationProvider:

[legend]

Public Member Functions

__construct ( $params=[])

postAuthentication ( $user, AuthenticationResponse $response)

testForAccountCreation ( $user, $creator, array $reqs)

Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()

Note: No need to test if the account exists, AuthManager checks that

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]	$reqs

Returns: StatusValue

Stability: stable: to override

testForAuthentication (array $reqs)

Determine whether an authentication may begin.Called from AuthManager::beginAuthentication()

Parameters

AuthenticationRequest[] $reqs

Returns: StatusValue

Stability: stable: to override

Public Member Functions inherited from MediaWiki\Auth\AbstractPreAuthenticationProvider

getAuthenticationRequests ( $action, array $options)

Return the applicable list of AuthenticationRequests.Possible values for $action depend on whether the implementing class is also a PreAuthenticationProvider, PrimaryAuthenticationProvider, or SecondaryAuthenticationProvider.

ACTION_LOGIN: Valid for passing to beginAuthentication. Called on all providers.
ACTION_CREATE: Valid for passing to beginAccountCreation. Called on all providers.
ACTION_LINK: Valid for passing to beginAccountLink. Called on linking primary providers only.
ACTION_CHANGE: Valid for passing to AuthManager::changeAuthenticationData to change credentials. Called on primary and secondary providers.
ACTION_REMOVE: Valid for passing to AuthManager::changeAuthenticationData to remove credentials. Must work without additional user input (i.e. without calling loadFromSubmission). Called on primary and secondary providers.

See also: AuthManager::getAuthenticationRequests()

Parameters

string	$action
array	$options	Options are: username: Username related to the action, or null/unset if anon. ACTION_LOGIN: The currently logged-in user, if any. ACTION_CREATE: The account creator, if non-anonymous. ACTION_LINK: The local user being linked to. ACTION_CHANGE: The user having data changed. ACTION_REMOVE: The user having data removed. If you leave the username property of the returned requests empty, this will automatically be copied there (except for ACTION_CREATE and ACTION_LOGIN).

Returns: AuthenticationRequest[]

postAccountCreation ( $user, $creator, AuthenticationResponse $response)

Post-creation callback.This will be called at the end of an account creation attempt. It will not be called if the account creation process results in a session timeout (possibly after a successful user creation, while a secondary provider is waiting for a response).

Parameters

User	$user	User that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	Authentication response that will be returned (PASS or FAIL)

postAccountLink ( $user, AuthenticationResponse $response)

Post-link callback.This will be called at the end of an account linking attempt.

Parameters

User	$user	User that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	Authentication response that will be returned (PASS or FAIL)

testForAccountLink ( $user)

Determine whether an account may linked to another authentication method.

Parameters

User $user User being linked. This may become a "UserValue" in the future, or User may be refactored into such.

Returns: StatusValue

testUserForCreation ( $user, $autocreate, array $options=[])

Determine whether an account may be created.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
bool \| string	$autocreate	False if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser().
array	$options	flags: (int) Bitfield of IDBAccessObject::READ_* constants, default IDBAccessObject::READ_NORMAL creating: (bool) If false (or missing), this call is only testing if a user could be created. If set, this (non-autocreation) is for actually creating an account and will be followed by a call to testForAccountCreation(). In this case, the provider might return StatusValue::newGood() here and let the later call to testForAccountCreation() do a more thorough test.

Returns: StatusValue

Public Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider

getUniqueId ()

Return a unique identifier for this instance.This must be the same across requests. If multiple instances return the same ID, exceptions will be thrown from AuthManager.

Returns: string

init (LoggerInterface $logger, AuthManager $manager, HookContainer $hookContainer, Config $config, UserNameUtils $userNameUtils)

Initialise with dependencies of an AuthenticationProvider.

Protected Member Functions
	postInitSetup ()
	A provider can override this to do any necessary setup after init() is called.

Protected Member Functions inherited from MediaWiki\Auth\AbstractAuthenticationProvider
	getHookContainer ()

	getHookRunner ()

Protected Attributes
Throttler	$accountCreationThrottle

BagOStuff	$cache

Throttler	$passwordAttemptThrottle

array	$throttleSettings

Protected Attributes inherited from MediaWiki\Auth\AbstractAuthenticationProvider
Config	$config

LoggerInterface	$logger

AuthManager	$manager

UserNameUtils	$userNameUtils

Detailed Description

A pre-authentication provider to throttle authentication actions.

Adding this provider will throttle account creations and primary authentication attempts (more specifically, any authentication that returns FAIL on failure). Secondary authentication cannot be easily throttled on a framework level (since it would typically return UI on failure); secondary providers are expected to do their own throttling.

Since: 1.27

Definition at line 38 of file ThrottlePreAuthenticationProvider.php.

Constructor & Destructor Documentation

◆ __construct()

MediaWiki\Auth\ThrottlePreAuthenticationProvider::__construct ( $params = [] )

Parameters

array

$params

accountCreationThrottle: (array) Condition array for the account creation throttle; an array of arrays in a format like $wgPasswordAttemptThrottle, passed to the Throttler constructor.
passwordAttemptThrottle: (array) Condition array for the password attempt throttle, in the same format as accountCreationThrottle.
cache: (BagOStuff) Where to store the throttle, defaults to the local cluster instance.

Definition at line 59 of file ThrottlePreAuthenticationProvider.php.

References $params.

Member Function Documentation

◆ postAuthentication()

MediaWiki\Auth\ThrottlePreAuthenticationProvider::postAuthentication	(		$user,
		AuthenticationResponse	$response )

Parameters

null \| User	$user
AuthenticationResponse	$response

Reimplemented from MediaWiki\Auth\AbstractPreAuthenticationProvider.

Definition at line 164 of file ThrottlePreAuthenticationProvider.php.

References MediaWiki\Auth\AuthenticationResponse\PASS.

◆ postInitSetup()

MediaWiki\Auth\ThrottlePreAuthenticationProvider::postInitSetup ( )

protected

A provider can override this to do any necessary setup after init() is called.

Since: 1.37

Stability: stable: to override

Reimplemented from MediaWiki\Auth\AbstractAuthenticationProvider.

Definition at line 65 of file ThrottlePreAuthenticationProvider.php.

References MediaWiki\Auth\ThrottlePreAuthenticationProvider\$accountCreationThrottle, MediaWiki\MainConfigNames\AccountCreationThrottle, and MediaWiki\MainConfigNames\PasswordAttemptThrottle.

◆ testForAccountCreation()

MediaWiki\Auth\ThrottlePreAuthenticationProvider::testForAccountCreation	(		$user,
			$creator,
		array	$reqs )

Determine whether an account creation may begin.Called from AuthManager::beginAccountCreation()

Note: No need to test if the account exists, AuthManager checks that

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationRequest[]	$reqs