includes/AuthPlugin.php

   1 <?php
   2 /**
   3  */
   4 # Copyright (C) 2004 Brion Vibber <brion@pobox.com>
   5 # http://www.mediawiki.org/
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 2 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License along
  18 # with this program; if not, write to the Free Software Foundation, Inc.,
  19 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20 # http://www.gnu.org/copyleft/gpl.html
  21
  22 /**
  23  * Authentication plugin interface. Instantiate a subclass of AuthPlugin
  24  * and set $wgAuth to it to authenticate against some external tool.
  25  *
  26  * The default behavior is not to do anything, and use the local user
  27  * database for all authentication. A subclass can require that all
  28  * accounts authenticate externally, or use it only as a fallback; also
  29  * you can transparently create internal wiki accounts the first time
  30  * someone logs in who can be authenticated externally.
  31  */
  32 class AuthPlugin {
  33         /**
  34          * Check whether there exists a user account with the given name.
  35          * The name will be normalized to MediaWiki's requirements, so
  36          * you might need to munge it (for instance, for lowercase initial
  37          * letters).
  38          *
  39          * @param $username String: username.
  40          * @return bool
  41          */
  42         public function userExists( $username ) {
  43                 # Override this!
  44                 return false;
  45         }
  46
  47         /**
  48          * Check if a username+password pair is a valid login.
  49          * The name will be normalized to MediaWiki's requirements, so
  50          * you might need to munge it (for instance, for lowercase initial
  51          * letters).
  52          *
  53          * @param $username String: username.
  54          * @param $password String: user password.
  55          * @return bool
  56          */
  57         public function authenticate( $username, $password ) {
  58                 # Override this!
  59                 return false;
  60         }
  61
  62         /**
  63          * Modify options in the login template.
  64          *
  65          * @param $sp SpecialUserlogin or SpecialCreateAccount object.
  66          * @param $type String 'signup' or 'login'. Redundant because
  67          *    you can just use instanceof to tell the two cases apart.
  68          */
  69         public function modifyUITemplate( &$sp, $type=null ) {
  70                 # Override this!
  71                 $sp->mDomains = false;
  72         }
  73
  74         /**
  75          * Set the domain this plugin is supposed to use when authenticating.
  76          *
  77          * @param $domain String: authentication domain.
  78          */
  79         public function setDomain( $domain ) {
  80                 $this->domain = $domain;
  81         }
  82
  83         /**
  84          * Check to see if the specific domain is a valid domain.
  85          *
  86          * @param $domain String: authentication domain.
  87          * @return bool
  88          */
  89         public function validDomain( $domain ) {
  90                 # Override this!
  91                 return true;
  92         }
  93
  94         /**
  95          * When a user logs in, optionally fill in preferences and such.
  96          * For instance, you might pull the email address or real name from the
  97          * external user database.
  98          *
  99          * The User object is passed by reference so it can be modified; don't
 100          * forget the & on your function declaration.
 101          *
 102          * @param User $user
 103          */
 104         public function updateUser( &$user ) {
 105                 # Override this and do something
 106                 return true;
 107         }
 108
 109
 110         /**
 111          * Return true if the wiki should create a new local account automatically
 112          * when asked to login a user who doesn't exist locally but does in the
 113          * external auth database.
 114          *
 115          * If you don't automatically create accounts, you must still create
 116          * accounts in some way. It's not possible to authenticate without
 117          * a local account.
 118          *
 119          * This is just a question, and shouldn't perform any actions.
 120          *
 121          * @return bool
 122          */
 123         public function autoCreate() {
 124                 return false;
 125         }
 126
 127         /**
 128          * Allow a property change? Properties are the same as preferences
 129          * and use the same keys. 'Realname' 'Emailaddress' and 'Nickname'
 130          * all reference this.
 131          *
 132          * @return bool
 133          */
 134         public function allowPropChange( $prop = '' ) {
 135                 if( $prop == 'realname' && is_callable( array( $this, 'allowRealNameChange' ) ) ) {
 136                         return $this->allowRealNameChange();
 137                 } elseif( $prop == 'emailaddress' && is_callable( array( $this, 'allowEmailChange' ) ) ) {
 138                         return $this->allowEmailChange();
 139                 } elseif( $prop == 'nickname' && is_callable( array( $this, 'allowNickChange' ) ) ) {
 140                         return $this->allowNickChange();
 141                 } else {
 142                         return true;
 143                 }
 144         }
 145
 146         /**
 147          * Can users change their passwords?
 148          *
 149          * @return bool
 150          */
 151         public function allowPasswordChange() {
 152                 return true;
 153         }
 154
 155         /**
 156          * Set the given password in the authentication database.
 157          * As a special case, the password may be set to null to request
 158          * locking the password to an unusable value, with the expectation
 159          * that it will be set later through a mail reset or other method.
 160          *
 161          * Return true if successful.
 162          *
 163          * @param $user User object.
 164          * @param $password String: password.
 165          * @return bool
 166          */
 167         public function setPassword( $user, $password ) {
 168                 return true;
 169         }
 170
 171         /**
 172          * Update user information in the external authentication database.
 173          * Return true if successful.
 174          *
 175          * @param $user User object.
 176          * @return bool
 177          */
 178         public function updateExternalDB( $user ) {
 179                 return true;
 180         }
 181
 182         /**
 183          * Check to see if external accounts can be created.
 184          * Return true if external accounts can be created.
 185          * @return bool
 186          */
 187         public function canCreateAccounts() {
 188                 return false;
 189         }
 190
 191         /**
 192          * Add a user to the external authentication database.
 193          * Return true if successful.
 194          *
 195          * @param User $user - only the name should be assumed valid at this point
 196          * @param string $password
 197          * @param string $email
 198          * @param string $realname
 199          * @return bool
 200          */
 201         public function addUser( $user, $password, $email='', $realname='' ) {
 202                 return true;
 203         }
 204
 205
 206         /**
 207          * Return true to prevent logins that don't authenticate here from being
 208          * checked against the local database's password fields.
 209          *
 210          * This is just a question, and shouldn't perform any actions.
 211          *
 212          * @return bool
 213          */
 214         public function strict() {
 215                 return false;
 216         }
 217
 218         /**
 219          * Check if a user should authenticate locally if the global authentication fails.
 220          * If either this or strict() returns true, local authentication is not used.
 221          *
 222          * @param $username String: username.
 223          * @return bool
 224          */
 225         public function strictUserAuth( $username ) {
 226                 return false;
 227         }
 228
 229         /**
 230          * When creating a user account, optionally fill in preferences and such.
 231          * For instance, you might pull the email address or real name from the
 232          * external user database.
 233          *
 234          * The User object is passed by reference so it can be modified; don't
 235          * forget the & on your function declaration.
 236          *
 237          * @param $user User object.
 238          * @param $autocreate bool True if user is being autocreated on login
 239          */
 240         public function initUser( &$user, $autocreate=false ) {
 241                 # Override this to do something.
 242         }
 243
 244         /**
 245          * If you want to munge the case of an account name before the final
 246          * check, now is your chance.
 247          */
 248         public function getCanonicalName( $username ) {
 249                 return $username;
 250         }
 251
 252         /**
 253          * Get an instance of a User object
 254          *
 255          * @param $user User
 256          * @public
 257          */
 258         public function getUserInstance( User &$user ) {
 259                 return new AuthPluginUser( $user );
 260         }
 261 }
 262
 263 class AuthPluginUser {
 264         function __construct( $user ) {
 265                 # Override this!
 266         }
 267
 268         public function getId() {
 269                 # Override this!
 270                 return -1;
 271         }
 272
 273         public function isLocked() {
 274                 # Override this!
 275                 return false;
 276         }
 277
 278         public function isHidden() {
 279                 # Override this!
 280                 return false;
 281         }
 282
 283         public function resetAuthToken() {
 284                 # Override this!
 285                 return true;
 286         }
 287 }