3 * Authentication plugin interface
5 * Copyright © 2004 Brion Vibber <brion@pobox.com>
6 * https://www.mediawiki.org/
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License along
19 * with this program; if not, write to the Free Software Foundation, Inc.,
20 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
21 * http://www.gnu.org/copyleft/gpl.html
27 * Authentication plugin interface. Instantiate a subclass of AuthPlugin
28 * and set $wgAuth to it to authenticate against some external tool.
30 * The default behavior is not to do anything, and use the local user
31 * database for all authentication. A subclass can require that all
32 * accounts authenticate externally, or use it only as a fallback; also
33 * you can transparently create internal wiki accounts the first time
34 * someone logs in who can be authenticated externally.
36 * @deprecated since 1.27
45 * Check whether there exists a user account with the given name.
46 * The name will be normalized to MediaWiki's requirements, so
47 * you might need to munge it (for instance, for lowercase initial
50 * @param string $username Username.
53 public function userExists( $username ) {
59 * Check if a username+password pair is a valid login.
60 * The name will be normalized to MediaWiki's requirements, so
61 * you might need to munge it (for instance, for lowercase initial
64 * @param string $username Username.
65 * @param string $password User password.
68 public function authenticate( $username, $password ) {
74 * Modify options in the login template.
76 * @param BaseTemplate &$template
77 * @param string &$type 'signup' or 'login'. Added in 1.16.
79 public function modifyUITemplate( &$template, &$type ) {
81 $template->set( 'usedomain', false );
85 * Set the domain this plugin is supposed to use when authenticating.
87 * @param string $domain Authentication domain.
89 public function setDomain( $domain ) {
90 $this->domain
= $domain;
94 * Get the user's domain
98 public function getDomain() {
99 return $this->domain ??
'invaliddomain';
103 * Check to see if the specific domain is a valid domain.
105 * @param string $domain Authentication domain.
108 public function validDomain( $domain ) {
114 * When a user logs in, optionally fill in preferences and such.
115 * For instance, you might pull the email address or real name from the
116 * external user database.
118 * The User object is passed by reference so it can be modified; don't
119 * forget the & on your function declaration.
121 * @deprecated since 1.26, use the UserLoggedIn hook instead. And assigning
122 * a different User object to $user is no longer supported.
126 public function updateUser( &$user ) {
127 # Override this and do something
132 * Return true if the wiki should create a new local account automatically
133 * when asked to login a user who doesn't exist locally but does in the
134 * external auth database.
136 * If you don't automatically create accounts, you must still create
137 * accounts in some way. It's not possible to authenticate without
140 * This is just a question, and shouldn't perform any actions.
144 public function autoCreate() {
149 * Allow a property change? Properties are the same as preferences
150 * and use the same keys. 'Realname' 'Emailaddress' and 'Nickname'
151 * all reference this.
153 * @param string $prop
157 public function allowPropChange( $prop = '' ) {
158 if ( $prop == 'realname' && is_callable( [ $this, 'allowRealNameChange' ] ) ) {
159 return $this->allowRealNameChange();
160 } elseif ( $prop == 'emailaddress' && is_callable( [ $this, 'allowEmailChange' ] ) ) {
161 return $this->allowEmailChange();
162 } elseif ( $prop == 'nickname' && is_callable( [ $this, 'allowNickChange' ] ) ) {
163 return $this->allowNickChange();
170 * Can users change their passwords?
174 public function allowPasswordChange() {
179 * Should MediaWiki store passwords in its local database?
183 public function allowSetLocalPassword() {
188 * Set the given password in the authentication database.
189 * As a special case, the password may be set to null to request
190 * locking the password to an unusable value, with the expectation
191 * that it will be set later through a mail reset or other method.
193 * Return true if successful.
196 * @param string $password Password.
199 public function setPassword( $user, $password ) {
204 * Update user information in the external authentication database.
205 * Return true if successful.
207 * @deprecated since 1.26, use the UserSaveSettings hook instead.
211 public function updateExternalDB( $user ) {
216 * Update user groups in the external authentication database.
217 * Return true if successful.
219 * @deprecated since 1.26, use the UserGroupsChanged hook instead.
221 * @param array $addgroups Groups to add.
222 * @param array $delgroups Groups to remove.
225 public function updateExternalDBGroups( $user, $addgroups, $delgroups = [] ) {
230 * Check to see if external accounts can be created.
231 * Return true if external accounts can be created.
234 public function canCreateAccounts() {
239 * Add a user to the external authentication database.
240 * Return true if successful.
242 * @param User $user Only the name should be assumed valid at this point
243 * @param string $password
244 * @param string $email
245 * @param string $realname
248 public function addUser( $user, $password, $email = '', $realname = '' ) {
253 * Return true to prevent logins that don't authenticate here from being
254 * checked against the local database's password fields.
256 * This is just a question, and shouldn't perform any actions.
260 public function strict() {
265 * Check if a user should authenticate locally if the global authentication fails.
266 * If either this or strict() returns true, local authentication is not used.
268 * @param string $username Username.
271 public function strictUserAuth( $username ) {
276 * When creating a user account, optionally fill in preferences and such.
277 * For instance, you might pull the email address or real name from the
278 * external user database.
280 * The User object is passed by reference so it can be modified; don't
281 * forget the & on your function declaration.
283 * @deprecated since 1.26, use the UserLoggedIn hook instead. And assigning
284 * a different User object to $user is no longer supported.
286 * @param bool $autocreate True if user is being autocreated on login
288 public function initUser( &$user, $autocreate = false ) {
289 # Override this to do something.
293 * If you want to munge the case of an account name before the final
294 * check, now is your chance.
295 * @param string $username
298 public function getCanonicalName( $username ) {
303 * Get an instance of a User object
307 * @return AuthPluginUser
309 public function getUserInstance( User
&$user ) {
310 return new AuthPluginUser( $user );
314 * Get a list of domains (in HTMLForm options format) used.
318 public function domainList() {
324 * @deprecated since 1.27
326 class AuthPluginUser
{
327 function __construct( $user ) {
331 public function getId() {
337 * Indicate whether the user is locked
338 * @deprecated since 1.26, use the UserIsLocked hook instead.
341 public function isLocked() {
347 * Indicate whether the user is hidden
348 * @deprecated since 1.26, use the UserIsHidden hook instead.
351 public function isHidden() {
357 * @deprecated since 1.28, use SessionManager::invalidateSessionForUser() instead.
360 public function resetAuthToken() {