3 * Authentication plugin interface
5 * Copyright © 2004 Brion Vibber <brion@pobox.com>
6 * http://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
27 * Authentication plugin interface. Instantiate a subclass of AuthPlugin
28 * and set $wgAuth to it to authenticate against some external tool.
30 * The default behavior is not to do anything, and use the local user
31 * database for all authentication. A subclass can require that all
32 * accounts authenticate externally, or use it only as a fallback; also
33 * you can transparently create internal wiki accounts the first time
34 * someone logs in who can be authenticated externally.
38 * Check whether there exists a user account with the given name.
39 * The name will be normalized to MediaWiki's requirements, so
40 * you might need to munge it (for instance, for lowercase initial
43 * @param $username String: username.
46 public function userExists( $username ) {
52 * Check if a username+password pair is a valid login.
53 * The name will be normalized to MediaWiki's requirements, so
54 * you might need to munge it (for instance, for lowercase initial
57 * @param $username String: username.
58 * @param $password String: user password.
61 public function authenticate( $username, $password ) {
67 * Modify options in the login template.
69 * @param $template UserLoginTemplate object.
70 * @param $type String 'signup' or 'login'. Added in 1.16.
72 public function modifyUITemplate( &$template, &$type ) {
74 $template->set( 'usedomain', false );
78 * Set the domain this plugin is supposed to use when authenticating.
80 * @param $domain String: authentication domain.
82 public function setDomain( $domain ) {
83 $this->domain
= $domain;
87 * Get the user's domain
91 public function getDomain() {
92 if ( $this->domain
) {
95 return 'invaliddomain';
100 * Check to see if the specific domain is a valid domain.
102 * @param $domain String: authentication domain.
105 public function validDomain( $domain ) {
111 * When a user logs in, optionally fill in preferences and such.
112 * For instance, you might pull the email address or real name from the
113 * external user database.
115 * The User object is passed by reference so it can be modified; don't
116 * forget the & on your function declaration.
118 * @param $user User object
121 public function updateUser( &$user ) {
122 # Override this and do something
127 * Return true if the wiki should create a new local account automatically
128 * when asked to login a user who doesn't exist locally but does in the
129 * external auth database.
131 * If you don't automatically create accounts, you must still create
132 * accounts in some way. It's not possible to authenticate without
135 * This is just a question, and shouldn't perform any actions.
139 public function autoCreate() {
144 * Allow a property change? Properties are the same as preferences
145 * and use the same keys. 'Realname' 'Emailaddress' and 'Nickname'
146 * all reference this.
148 * @param $prop string
152 public function allowPropChange( $prop = '' ) {
153 if ( $prop == 'realname' && is_callable( array( $this, 'allowRealNameChange' ) ) ) {
154 return $this->allowRealNameChange();
155 } elseif ( $prop == 'emailaddress' && is_callable( array( $this, 'allowEmailChange' ) ) ) {
156 return $this->allowEmailChange();
157 } elseif ( $prop == 'nickname' && is_callable( array( $this, 'allowNickChange' ) ) ) {
158 return $this->allowNickChange();
165 * Can users change their passwords?
169 public function allowPasswordChange() {
174 * Set the given password in the authentication database.
175 * As a special case, the password may be set to null to request
176 * locking the password to an unusable value, with the expectation
177 * that it will be set later through a mail reset or other method.
179 * Return true if successful.
181 * @param $user User object.
182 * @param $password String: password.
185 public function setPassword( $user, $password ) {
190 * Update user information in the external authentication database.
191 * Return true if successful.
193 * @param $user User object.
196 public function updateExternalDB( $user ) {
201 * Check to see if external accounts can be created.
202 * Return true if external accounts can be created.
205 public function canCreateAccounts() {
210 * Add a user to the external authentication database.
211 * Return true if successful.
213 * @param $user User: only the name should be assumed valid at this point
214 * @param $password String
215 * @param $email String
216 * @param $realname String
219 public function addUser( $user, $password, $email = '', $realname = '' ) {
224 * Return true to prevent logins that don't authenticate here from being
225 * checked against the local database's password fields.
227 * This is just a question, and shouldn't perform any actions.
231 public function strict() {
236 * Check if a user should authenticate locally if the global authentication fails.
237 * If either this or strict() returns true, local authentication is not used.
239 * @param $username String: username.
242 public function strictUserAuth( $username ) {
247 * When creating a user account, optionally fill in preferences and such.
248 * For instance, you might pull the email address or real name from the
249 * external user database.
251 * The User object is passed by reference so it can be modified; don't
252 * forget the & on your function declaration.
254 * @param $user User object.
255 * @param $autocreate Boolean: True if user is being autocreated on login
257 public function initUser( &$user, $autocreate = false ) {
258 # Override this to do something.
262 * If you want to munge the case of an account name before the final
263 * check, now is your chance.
264 * @param $username string
267 public function getCanonicalName( $username ) {
272 * Get an instance of a User object
276 * @return AuthPluginUser
278 public function getUserInstance( User
&$user ) {
279 return new AuthPluginUser( $user );
283 * Get a list of domains (in HTMLForm options format) used.
287 public function domainList() {
292 class AuthPluginUser
{
293 function __construct( $user ) {
297 public function getId() {
302 public function isLocked() {
307 public function isHidden() {
312 public function resetAuthToken() {