includes/AuthPlugin.php

   1 <?php
   2 /**
   3  */
   4 # Copyright (C) 2004 Brion Vibber <brion@pobox.com>
   5 # http://www.mediawiki.org/
   6 #
   7 # This program is free software; you can redistribute it and/or modify
   8 # it under the terms of the GNU General Public License as published by
   9 # the Free Software Foundation; either version 2 of the License, or
  10 # (at your option) any later version.
  11 #
  12 # This program is distributed in the hope that it will be useful,
  13 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  15 # GNU General Public License for more details.
  16 #
  17 # You should have received a copy of the GNU General Public License along
  18 # with this program; if not, write to the Free Software Foundation, Inc.,
  19 # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  20 # http://www.gnu.org/copyleft/gpl.html
  21
  22 /**
  23  * Authentication plugin interface. Instantiate a subclass of AuthPlugin
  24  * and set $wgAuth to it to authenticate against some external tool.
  25  *
  26  * The default behavior is not to do anything, and use the local user
  27  * database for all authentication. A subclass can require that all
  28  * accounts authenticate externally, or use it only as a fallback; also
  29  * you can transparently create internal wiki accounts the first time
  30  * someone logs in who can be authenticated externally.
  31  */
  32 class AuthPlugin {
  33         /**
  34          * Check whether there exists a user account with the given name.
  35          * The name will be normalized to MediaWiki's requirements, so
  36          * you might need to munge it (for instance, for lowercase initial
  37          * letters).
  38          *
  39          * @param $username String: username.
  40          * @return bool
  41          */
  42         public function userExists( $username ) {
  43                 # Override this!
  44                 return false;
  45         }
  46
  47         /**
  48          * Check if a username+password pair is a valid login.
  49          * The name will be normalized to MediaWiki's requirements, so
  50          * you might need to munge it (for instance, for lowercase initial
  51          * letters).
  52          *
  53          * @param $username String: username.
  54          * @param $password String: user password.
  55          * @return bool
  56          */
  57         public function authenticate( $username, $password ) {
  58                 # Override this!
  59                 return false;
  60         }
  61
  62         /**
  63          * Modify options in the login template.
  64          *
  65          * @param $template UserLoginTemplate object.
  66          */
  67         public function modifyUITemplate( &$template ) {
  68                 # Override this!
  69                 $template->set( 'usedomain', false );
  70         }
  71
  72         /**
  73          * Set the domain this plugin is supposed to use when authenticating.
  74          *
  75          * @param $domain String: authentication domain.
  76          */
  77         public function setDomain( $domain ) {
  78                 $this->domain = $domain;
  79         }
  80
  81         /**
  82          * Check to see if the specific domain is a valid domain.
  83          *
  84          * @param $domain String: authentication domain.
  85          * @return bool
  86          */
  87         public function validDomain( $domain ) {
  88                 # Override this!
  89                 return true;
  90         }
  91
  92         /**
  93          * When a user logs in, optionally fill in preferences and such.
  94          * For instance, you might pull the email address or real name from the
  95          * external user database.
  96          *
  97          * The User object is passed by reference so it can be modified; don't
  98          * forget the & on your function declaration.
  99          *
 100          * @param User $user
 101          */
 102         public function updateUser( &$user ) {
 103                 # Override this and do something
 104                 return true;
 105         }
 106
 107
 108         /**
 109          * Return true if the wiki should create a new local account automatically
 110          * when asked to login a user who doesn't exist locally but does in the
 111          * external auth database.
 112          *
 113          * If you don't automatically create accounts, you must still create
 114          * accounts in some way. It's not possible to authenticate without
 115          * a local account.
 116          *
 117          * This is just a question, and shouldn't perform any actions.
 118          *
 119          * @return bool
 120          */
 121         public function autoCreate() {
 122                 return false;
 123         }
 124
 125         /**
 126          * Allow a property change? Properties are the same as preferences
 127          * and use the same keys. 'Realname' 'Emailaddress' and 'Nickname'
 128          * all reference this.
 129          *
 130          * @return bool
 131          */
 132         public function allowPropChange( $prop = '' ) {
 133                 return true;
 134         }
 135
 136         /**
 137          * Can users change their Real Name?
 138          * @deprecated Use allowPropChange()
 139          * @return bool
 140          */
 141         public function allowRealNameChange() {
 142                 wfDeprecated( __METHOD__ );
 143                 return $this->allowPropChange( 'realname' );
 144         }
 145
 146         /**
 147          * Can users change their email address?
 148          * @deprecated Use allowPropChange()
 149          * @return bool
 150          */
 151         public function allowEmailChange() {
 152                 wfDeprecated( __METHOD__ );
 153                 return $this->allowPropChange( 'emailaddress' );
 154         }
 155
 156         /**
 157          * Can users change their Nickname?
 158          * @deprecated Use allowPropChange()
 159          * @return bool
 160          */
 161         public function allowNickChange() {
 162                 wfDeprecated( __METHOD__ );
 163                 return $this->allowPropChange( 'nickname' );
 164         }
 165
 166         /**
 167          * Can users change their passwords?
 168          *
 169          * @return bool
 170          */
 171         public function allowPasswordChange() {
 172                 return true;
 173         }
 174
 175         /**
 176          * Set the given password in the authentication database.
 177          * As a special case, the password may be set to null to request
 178          * locking the password to an unusable value, with the expectation
 179          * that it will be set later through a mail reset or other method.
 180          *
 181          * Return true if successful.
 182          *
 183          * @param $user User object.
 184          * @param $password String: password.
 185          * @return bool
 186          */
 187         public function setPassword( $user, $password ) {
 188                 return true;
 189         }
 190
 191         /**
 192          * Update user information in the external authentication database.
 193          * Return true if successful.
 194          *
 195          * @param $user User object.
 196          * @return bool
 197          */
 198         public function updateExternalDB( $user ) {
 199                 return true;
 200         }
 201
 202         /**
 203          * Check to see if external accounts can be created.
 204          * Return true if external accounts can be created.
 205          * @return bool
 206          */
 207         public function canCreateAccounts() {
 208                 return false;
 209         }
 210
 211         /**
 212          * Add a user to the external authentication database.
 213          * Return true if successful.
 214          *
 215          * @param User $user - only the name should be assumed valid at this point
 216          * @param string $password
 217          * @param string $email
 218          * @param string $realname
 219          * @return bool
 220          */
 221         public function addUser( $user, $password, $email='', $realname='' ) {
 222                 return true;
 223         }
 224
 225
 226         /**
 227          * Return true to prevent logins that don't authenticate here from being
 228          * checked against the local database's password fields.
 229          *
 230          * This is just a question, and shouldn't perform any actions.
 231          *
 232          * @return bool
 233          */
 234         public function strict() {
 235                 return false;
 236         }
 237
 238         /**
 239          * Check if a user should authenticate locally if the global authentication fails.
 240          * If either this or strict() returns true, local authentication is not used.
 241          *
 242          * @param $username String: username.
 243          * @return bool
 244          */
 245         public function strictUserAuth( $username ) {
 246                 return false;
 247         }
 248
 249         /**
 250          * When creating a user account, optionally fill in preferences and such.
 251          * For instance, you might pull the email address or real name from the
 252          * external user database.
 253          *
 254          * The User object is passed by reference so it can be modified; don't
 255          * forget the & on your function declaration.
 256          *
 257          * @param $user User object.
 258          * @param $autocreate bool True if user is being autocreated on login
 259          */
 260         public function initUser( &$user, $autocreate=false ) {
 261                 # Override this to do something.
 262         }
 263
 264         /**
 265          * If you want to munge the case of an account name before the final
 266          * check, now is your chance.
 267          */
 268         public function getCanonicalName( $username ) {
 269                 return $username;
 270         }
 271
 272         /**
 273          * Get an instance of a User object
 274          *
 275          * @param $user User
 276          * @public
 277          */
 278         public function getUserInstance( User &$user ) {
 279                 return new AuthPluginUser( $user );
 280         }
 281 }
 282
 283 class AuthPluginUser {
 284         function __construct( $user ) {
 285                 # Override this!
 286         }
 287
 288         public function getId() {
 289                 # Override this!
 290                 return -1;
 291         }
 292
 293         public function isLocked() {
 294                 # Override this!
 295                 return false;
 296         }
 297
 298         public function isHidden() {
 299                 # Override this!
 300                 return false;
 301         }
 302
 303         public function resetAuthToken() {
 304                 # Override this!
 305                 return true;
 306         }
 307 }