MediaWiki\Auth\PrimaryAuthenticationProvider Interface Reference

A primary authentication provider determines which user is trying to log in. More...

Inheritance diagram for MediaWiki\Auth\PrimaryAuthenticationProvider:

Collaboration diagram for MediaWiki\Auth\PrimaryAuthenticationProvider:

Public Member Functions
	accountCreationType ()
	Fetch the account-creation type. More...
	autoCreatedAccount ($user, $source)
	Post-auto-creation callback. More...
	beginPrimaryAccountCreation ($user, $creator, array $reqs)
	Start an account creation flow. More...
	beginPrimaryAccountLink ($user, array $reqs)
	Start linking an account to an existing user. More...
	beginPrimaryAuthentication (array $reqs)
	Start an authentication flow. More...
	continuePrimaryAccountCreation ($user, $creator, array $reqs)
	Continue an account creation flow. More...
	continuePrimaryAccountLink ($user, array $reqs)
	Continue linking an account to an existing user. More...
	continuePrimaryAuthentication (array $reqs)
	Continue an authentication flow. More...
	finishAccountCreation ($user, $creator, AuthenticationResponse $response)
	Post-creation callback. More...
	postAccountCreation ($user, $creator, AuthenticationResponse $response)
	Post-creation callback. More...
	postAccountLink ($user, AuthenticationResponse $response)
	Post-link callback. More...
	postAuthentication ($user, AuthenticationResponse $response)
	Post-login callback. More...
	providerAllowsAuthenticationDataChange (AuthenticationRequest $req, $checkData=true)
	Validate a change of authentication data (e.g. More...
	providerAllowsPropertyChange ($property)
	Determine whether a property can change. More...
	providerChangeAuthenticationData (AuthenticationRequest $req)
	Change or remove authentication data (e.g. More...
	providerNormalizeUsername ($username)
	Normalize the username for authentication. More...
	providerRevokeAccessForUser ($username)
	Revoke the user's credentials. More...
	testForAccountCreation ($user, $creator, array $reqs)
	Determine whether an account creation may begin. More...
	testUserCanAuthenticate ($username)
	Test whether the named user can authenticate with this provider. More...
	testUserExists ($username, $flags=User::READ_NORMAL)
	Test whether the named user exists. More...
	testUserForCreation ($user, $autocreate, array $options=[])
	Determine whether an account may be created. More...
Public Member Functions inherited from MediaWiki\Auth\AuthenticationProvider
	getAuthenticationRequests ($action, array $options)
	Return the applicable list of AuthenticationRequests. More...
	getUniqueId ()
	Return a unique identifier for this instance. More...
	setConfig (Config $config)
	Set configuration. More...
	setManager (AuthManager $manager)
	Set AuthManager. More...

Public Attributes
const	TYPE_CREATE = 'create'
	Provider can create accounts. More...
const	TYPE_LINK = 'link'
	Provider can link to existing accounts elsewhere. More...
const	TYPE_NONE = 'none'
	Provider cannot create or link to accounts. More...

Detailed Description

A primary authentication provider determines which user is trying to log in.

A PrimaryAuthenticationProvider is used as part of presenting a login form to authenticate a user. In particular, the PrimaryAuthenticationProvider takes form data and determines the authenticated user (if any) corresponds to that form data. It might do this on the basis of a username and password in that data, or by interacting with an external authentication service (e.g. using OpenID), or by some other mechanism.

A PrimaryAuthenticationProvider would not be appropriate for something like HTTP authentication, OAuth, or SSL client certificates where each HTTP request contains all the information needed to identify the user. In that case you'll want to be looking at a \\MediaWiki\\Session\\SessionProvider instead.

This interface also provides methods for changing authentication data such as passwords and for creating new users who can later be authenticated with this provider.

Since

1.27

Definition at line 52 of file PrimaryAuthenticationProvider.php.

Member Function Documentation

MediaWiki\Auth\PrimaryAuthenticationProvider::accountCreationType

(

)

Fetch the account-creation type.

Returns

string One of the TYPE_* constants

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\beginPrimaryAccountLink().

MediaWiki\Auth\PrimaryAuthenticationProvider::autoCreatedAccount	(		$user,
			$source
	)

Post-auto-creation callback.

Parameters

User	$user	User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
string	$source	The source of the auto-creation passed to AuthManager::autoCreateUser().

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Start an account creation flow.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user may be created. Secondary providers will now run.
• FAIL: The user may not be created. Fail the creation process.
• ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
• UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAccountLink	(		$user,
		array	$reqs
	)

Start linking an account to an existing user.

Parameters

User	$user	User being linked. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user is linked.
• FAIL: The user is not linked. Fail the linking process.
• ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
• UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::beginPrimaryAuthentication

(

array

$reqs

)

Start an authentication flow.

Parameters

AuthenticationRequest[]

$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user is authenticated. Secondary providers will now run.
• FAIL: The user is not authenticated. Fail the authentication process.
• ABSTAIN: These $reqs are not handled. Some other primary provider may handle it.
• UI: The $reqs are accepted, no other primary provider will run. Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: The $reqs are accepted, no other primary provider will run. Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Continue an account creation flow.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user may be created. Secondary providers will now run.
• FAIL: The user may not be created. Fail the creation process.
• UI: Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAccountLink	(		$user,
		array	$reqs
	)

Continue linking an account to an existing user.

Parameters

User	$user	User being linked. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user is linked.
• FAIL: The user is not linked. Fail the linking process.
• UI: Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::continuePrimaryAuthentication

(

array

$reqs

)

Continue an authentication flow.

Parameters

AuthenticationRequest[]

$reqs

Returns

AuthenticationResponse Expected responses:

• PASS: The user is authenticated. Secondary providers will now run.
• FAIL: The user is not authenticated. Fail the authentication process.
• UI: Additional AuthenticationRequests are needed to complete the process.
• REDIRECT: Redirection to a third party is needed to complete the process.

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::finishAccountCreation	(		$user,
			$creator,
		AuthenticationResponse	$response
	)

Post-creation callback.

Called after the user is added to the database, before secondary authentication providers are run.

Parameters

User	$user	User being created (has been added to the database now). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	PASS response returned earlier

Returns

string|null 'newusers' log subtype to use for logging the account creation. If null, either 'create' or 'create2' will be used depending on $creator.

Implemented in MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::postAccountCreation	(		$user,
			$creator,
		AuthenticationResponse	$response
	)

Post-creation callback.

Called when the account creation process ends.

Parameters

User	$user	User that was attempted to be created. This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	Authentication response that will be returned

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::postAccountLink	(		$user,
		AuthenticationResponse	$response
	)

Post-link callback.

Parameters

User	$user	User that was attempted to be linked. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	Authentication response that will be returned

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::postAuthentication	(		$user,
		AuthenticationResponse	$response
	)

Post-login callback.

Parameters

User | null	$user	User that was attempted to be logged in, if known. This may become a "UserValue" in the future, or User may be refactored into such.
AuthenticationResponse	$response	Authentication response that will be returned

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::providerAllowsAuthenticationDataChange	(	AuthenticationRequest	$req,
			$checkData = true
	)

Validate a change of authentication data (e.g.

passwords)

Return StatusValue::newGood( 'ignored' ) if you don't support this AuthenticationRequest type.

Parameters

AuthenticationRequest	$req
bool	$checkData	If false, $req hasn't been loaded from the submission so checks on user-submitted fields should be skipped. $req->username is considered user-submitted for this purpose, even if it cannot be changed via $req->loadFromSubmission.

Returns

StatusValue

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::providerAllowsPropertyChange

(

$property

)

Determine whether a property can change.

See Also

AuthManager::allowsPropertyChange()

Parameters

string

$property

Returns

bool

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::providerChangeAuthenticationData

(

AuthenticationRequest

$req

)

Change or remove authentication data (e.g.

passwords)

If $req was returned for AuthManager::ACTION_CHANGE, the corresponding credentials should result in a successful login in the future.

If $req was returned for AuthManager::ACTION_REMOVE, the corresponding credentials should no longer result in a successful login.

Parameters

AuthenticationRequest

$req

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\providerRevokeAccessForUser().

MediaWiki\Auth\PrimaryAuthenticationProvider::providerNormalizeUsername

(

$username

)

Normalize the username for authentication.

Any two inputs that would result in the same user being authenticated should return the same string here, while inputs that would result in different users should return different strings.

If possible, the best thing to do here is to return the canonicalized name of the local user account that would be used. If not, return something that would be invalid as a local username (e.g. wrap an email address in "<>", or append "#servicename" to the username passed to a third-party service).

If the provider doesn't use a username at all in its AuthenticationRequests, return null. If the name is syntactically invalid, it's probably best to return null.

Parameters

string

$username

Returns

string|null

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::providerRevokeAccessForUser

(

$username

)

Revoke the user's credentials.

This may cause the user to no longer exist for the provider, or the user may continue to exist in a "disabled" state.

The intention is that the named account will never again be usable for normal login (i.e. there is no way to undo the revocation of access).

Parameters

string

$username

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::testForAccountCreation	(		$user,
			$creator,
		array	$reqs
	)

Determine whether an account creation may begin.

Called from AuthManager::beginAccountCreation()

Note

No need to test if the account exists, AuthManager checks that

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
User	$creator	User doing the creation. This may become a "UserValue" in the future, or User may be refactored into such.
	AuthenticationRequest[]	$reqs

Returns

StatusValue

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::testUserCanAuthenticate

(

$username

)

Test whether the named user can authenticate with this provider.

Parameters

string

$username

Returns

bool

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

MediaWiki\Auth\PrimaryAuthenticationProvider::testUserExists	(		$username,
			$flags = User::READ_NORMAL
	)

Test whether the named user exists.

Parameters

string	$username
int	$flags	Bitfield of User:READ_* constants

Returns

bool

Implemented in MediaWiki\Auth\AuthPluginPrimaryAuthenticationProvider, MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProvider, and MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProvider.

Referenced by MediaWiki\Auth\AbstractPrimaryAuthenticationProvider\testUserCanAuthenticate().

MediaWiki\Auth\PrimaryAuthenticationProvider::testUserForCreation	(		$user,
			$autocreate,
		array	$options = []
	)

Determine whether an account may be created.

Parameters

User	$user	User being created (not added to the database yet). This may become a "UserValue" in the future, or User may be refactored into such.
bool | string	$autocreate	False if this is not an auto-creation, or the source of the auto-creation passed to AuthManager::autoCreateUser().
array	$options	flags: (int) Bitfield of User:READ_* constants, default User::READ_NORMAL creating: (bool) If false (or missing), this call is only testing if a user could be created. If set, this (non-autocreation) is for actually creating an account and will be followed by a call to testForAccountCreation(). In this case, the provider might return StatusValue::newGood() here and let the later call to testForAccountCreation() do a more thorough test.

Returns

StatusValue

Implemented in MediaWiki\Auth\AbstractPrimaryAuthenticationProvider.

Member Data Documentation

const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_CREATE = 'create'

Provider can create accounts.

Definition at line 54 of file PrimaryAuthenticationProvider.php.

Referenced by MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProviderTest\provideAccountCreationType(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAccountCreationLogging(), MediaWiki\Auth\AuthManagerTest\testAccountLink(), MediaWiki\Auth\AuthManagerTest\testAutoAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAutoCreateFailOnLogin(), MediaWiki\Auth\AuthManagerTest\testAutoCreateOnLogin(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\TemporaryPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\AuthManagerTest\testBeginAccountCreation(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccount(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), MediaWiki\Auth\AuthManagerTest\testContinueAccountCreation(), MediaWiki\Auth\AuthManagerTest\testCreateFromLogin(), MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequestsRequired().

const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_LINK = 'link'

Provider can link to existing accounts elsewhere.

Definition at line 56 of file PrimaryAuthenticationProvider.php.

Referenced by MediaWiki\Auth\AuthManager\beginAccountLink(), MediaWiki\Auth\AuthManager\canCreateAccounts(), MediaWiki\Auth\AuthManager\canLinkAccounts(), MediaWiki\Auth\AuthManager\continueAuthentication(), MediaWiki\Auth\AuthManager\getAuthenticationRequests(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\AuthManagerTest\testAccountLink(), MediaWiki\Auth\AuthManagerTest\testAuthentication(), MediaWiki\Auth\AuthManagerTest\testBeginAccountLink(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), MediaWiki\Auth\AuthManagerTest\testContinueAccountLink(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests().

const MediaWiki\Auth\PrimaryAuthenticationProvider::TYPE_NONE = 'none'

Provider cannot create or link to accounts.

Definition at line 58 of file PrimaryAuthenticationProvider.php.

Referenced by MediaWiki\Auth\AuthManager\continueAccountCreation(), MediaWiki\Auth\AuthPluginPrimaryAuthenticationProviderTest\provideAccountCreationType(), MediaWiki\Auth\AbstractPrimaryAuthenticationProviderTest\providePrimaryAccountLink(), MediaWiki\Auth\AuthManagerTest\testAccountCreation(), MediaWiki\Auth\LocalPasswordPrimaryAuthenticationProviderTest\testBasics(), MediaWiki\Auth\AuthManagerTest\testCanCreateAccounts(), MediaWiki\Auth\AuthManagerTest\testCanLinkAccounts(), and MediaWiki\Auth\AuthManagerTest\testGetAuthenticationRequests().

---

The documentation for this interface was generated from the following file:

• includes/auth/PrimaryAuthenticationProvider.php