includes/AuthPlugin.php

   1 <?php
   2 /**
   3  * Authentication plugin interface
   4  *
   5  * Copyright © 2004 Brion Vibber <brion@pobox.com>
   6  * https://www.mediawiki.org/
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; if not, write to the Free Software Foundation, Inc.,
  20  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  21  * http://www.gnu.org/copyleft/gpl.html
  22  *
  23  * @file
  24  */
  25
  26 /**
  27  * Authentication plugin interface. Instantiate a subclass of AuthPlugin
  28  * and set $wgAuth to it to authenticate against some external tool.
  29  *
  30  * The default behavior is not to do anything, and use the local user
  31  * database for all authentication. A subclass can require that all
  32  * accounts authenticate externally, or use it only as a fallback; also
  33  * you can transparently create internal wiki accounts the first time
  34  * someone logs in who can be authenticated externally.
  35  */
  36 class AuthPlugin {
  37         /**
  38          * @var string
  39          */
  40         protected $domain;
  41
  42         /**
  43          * Check whether there exists a user account with the given name.
  44          * The name will be normalized to MediaWiki's requirements, so
  45          * you might need to munge it (for instance, for lowercase initial
  46          * letters).
  47          *
  48          * @param string $username Username.
  49          * @return bool
  50          */
  51         public function userExists( $username ) {
  52                 # Override this!
  53                 return false;
  54         }
  55
  56         /**
  57          * Check if a username+password pair is a valid login.
  58          * The name will be normalized to MediaWiki's requirements, so
  59          * you might need to munge it (for instance, for lowercase initial
  60          * letters).
  61          *
  62          * @param string $username Username.
  63          * @param string $password User password.
  64          * @return bool
  65          */
  66         public function authenticate( $username, $password ) {
  67                 # Override this!
  68                 return false;
  69         }
  70
  71         /**
  72          * Modify options in the login template.
  73          *
  74          * @param UserLoginTemplate $template
  75          * @param string $type 'signup' or 'login'. Added in 1.16.
  76          */
  77         public function modifyUITemplate( &$template, &$type ) {
  78                 # Override this!
  79                 $template->set( 'usedomain', false );
  80         }
  81
  82         /**
  83          * Set the domain this plugin is supposed to use when authenticating.
  84          *
  85          * @param string $domain Authentication domain.
  86          */
  87         public function setDomain( $domain ) {
  88                 $this->domain = $domain;
  89         }
  90
  91         /**
  92          * Get the user's domain
  93          *
  94          * @return string
  95          */
  96         public function getDomain() {
  97                 if ( isset( $this->domain ) ) {
  98                         return $this->domain;
  99                 } else {
 100                         return 'invaliddomain';
 101                 }
 102         }
 103
 104         /**
 105          * Check to see if the specific domain is a valid domain.
 106          *
 107          * @param string $domain Authentication domain.
 108          * @return bool
 109          */
 110         public function validDomain( $domain ) {
 111                 # Override this!
 112                 return true;
 113         }
 114
 115         /**
 116          * When a user logs in, optionally fill in preferences and such.
 117          * For instance, you might pull the email address or real name from the
 118          * external user database.
 119          *
 120          * The User object is passed by reference so it can be modified; don't
 121          * forget the & on your function declaration.
 122          *
 123          * @deprecated since 1.26, use the UserLoggedIn hook instead. And assigning
 124          *  a different User object to $user is no longer supported.
 125          * @param User $user
 126          * @return bool
 127          */
 128         public function updateUser( &$user ) {
 129                 # Override this and do something
 130                 return true;
 131         }
 132
 133         /**
 134          * Return true if the wiki should create a new local account automatically
 135          * when asked to login a user who doesn't exist locally but does in the
 136          * external auth database.
 137          *
 138          * If you don't automatically create accounts, you must still create
 139          * accounts in some way. It's not possible to authenticate without
 140          * a local account.
 141          *
 142          * This is just a question, and shouldn't perform any actions.
 143          *
 144          * @return bool
 145          */
 146         public function autoCreate() {
 147                 return false;
 148         }
 149
 150         /**
 151          * Allow a property change? Properties are the same as preferences
 152          * and use the same keys. 'Realname' 'Emailaddress' and 'Nickname'
 153          * all reference this.
 154          *
 155          * @param string $prop
 156          *
 157          * @return bool
 158          */
 159         public function allowPropChange( $prop = '' ) {
 160                 if ( $prop == 'realname' && is_callable( [ $this, 'allowRealNameChange' ] ) ) {
 161                         return $this->allowRealNameChange();
 162                 } elseif ( $prop == 'emailaddress' && is_callable( [ $this, 'allowEmailChange' ] ) ) {
 163                         return $this->allowEmailChange();
 164                 } elseif ( $prop == 'nickname' && is_callable( [ $this, 'allowNickChange' ] ) ) {
 165                         return $this->allowNickChange();
 166                 } else {
 167                         return true;
 168                 }
 169         }
 170
 171         /**
 172          * Can users change their passwords?
 173          *
 174          * @return bool
 175          */
 176         public function allowPasswordChange() {
 177                 return true;
 178         }
 179
 180         /**
 181          * Should MediaWiki store passwords in its local database?
 182          *
 183          * @return bool
 184          */
 185         public function allowSetLocalPassword() {
 186                 return true;
 187         }
 188
 189         /**
 190          * Set the given password in the authentication database.
 191          * As a special case, the password may be set to null to request
 192          * locking the password to an unusable value, with the expectation
 193          * that it will be set later through a mail reset or other method.
 194          *
 195          * Return true if successful.
 196          *
 197          * @param User $user
 198          * @param string $password Password.
 199          * @return bool
 200          */
 201         public function setPassword( $user, $password ) {
 202                 return true;
 203         }
 204
 205         /**
 206          * Update user information in the external authentication database.
 207          * Return true if successful.
 208          *
 209          * @deprecated since 1.26, use the UserSaveSettings hook instead.
 210          * @param User $user
 211          * @return bool
 212          */
 213         public function updateExternalDB( $user ) {
 214                 return true;
 215         }
 216
 217         /**
 218          * Update user groups in the external authentication database.
 219          * Return true if successful.
 220          *
 221          * @deprecated since 1.26, use the UserGroupsChanged hook instead.
 222          * @param User $user
 223          * @param array $addgroups Groups to add.
 224          * @param array $delgroups Groups to remove.
 225          * @return bool
 226          */
 227         public function updateExternalDBGroups( $user, $addgroups, $delgroups = [] ) {
 228                 return true;
 229         }
 230
 231         /**
 232          * Check to see if external accounts can be created.
 233          * Return true if external accounts can be created.
 234          * @return bool
 235          */
 236         public function canCreateAccounts() {
 237                 return false;
 238         }
 239
 240         /**
 241          * Add a user to the external authentication database.
 242          * Return true if successful.
 243          *
 244          * @param User $user Only the name should be assumed valid at this point
 245          * @param string $password
 246          * @param string $email
 247          * @param string $realname
 248          * @return bool
 249          */
 250         public function addUser( $user, $password, $email = '', $realname = '' ) {
 251                 return true;
 252         }
 253
 254         /**
 255          * Return true to prevent logins that don't authenticate here from being
 256          * checked against the local database's password fields.
 257          *
 258          * This is just a question, and shouldn't perform any actions.
 259          *
 260          * @return bool
 261          */
 262         public function strict() {
 263                 return false;
 264         }
 265
 266         /**
 267          * Check if a user should authenticate locally if the global authentication fails.
 268          * If either this or strict() returns true, local authentication is not used.
 269          *
 270          * @param string $username Username.
 271          * @return bool
 272          */
 273         public function strictUserAuth( $username ) {
 274                 return false;
 275         }
 276
 277         /**
 278          * When creating a user account, optionally fill in preferences and such.
 279          * For instance, you might pull the email address or real name from the
 280          * external user database.
 281          *
 282          * The User object is passed by reference so it can be modified; don't
 283          * forget the & on your function declaration.
 284          *
 285          * @deprecated since 1.26, use the UserLoggedIn hook instead. And assigning
 286          *  a different User object to $user is no longer supported.
 287          * @param User $user
 288          * @param bool $autocreate True if user is being autocreated on login
 289          */
 290         public function initUser( &$user, $autocreate = false ) {
 291                 # Override this to do something.
 292         }
 293
 294         /**
 295          * If you want to munge the case of an account name before the final
 296          * check, now is your chance.
 297          * @param string $username
 298          * @return string
 299          */
 300         public function getCanonicalName( $username ) {
 301                 return $username;
 302         }
 303
 304         /**
 305          * Get an instance of a User object
 306          *
 307          * @param User $user
 308          *
 309          * @return AuthPluginUser
 310          */
 311         public function getUserInstance( User &$user ) {
 312                 return new AuthPluginUser( $user );
 313         }
 314
 315         /**
 316          * Get a list of domains (in HTMLForm options format) used.
 317          *
 318          * @return array
 319          */
 320         public function domainList() {
 321                 return [];
 322         }
 323 }
 324
 325 class AuthPluginUser {
 326         function __construct( $user ) {
 327                 # Override this!
 328         }
 329
 330         public function getId() {
 331                 # Override this!
 332                 return -1;
 333         }
 334
 335         /**
 336          * Indicate whether the user is locked
 337          * @deprecated since 1.26, use the UserIsLocked hook instead.
 338          * @return bool
 339          */
 340         public function isLocked() {
 341                 # Override this!
 342                 return false;
 343         }
 344
 345         /**
 346          * Indicate whether the user is hidden
 347          * @deprecated since 1.26, use the UserIsHidden hook instead.
 348          * @return bool
 349          */
 350         public function isHidden() {
 351                 # Override this!
 352                 return false;
 353         }
 354
 355         /**
 356          * @deprecated since 1.28, use SessionManager::invalidateSessionForUser() instead.
 357          */
 358         public function resetAuthToken() {
 359                 # Override this!
 360                 return true;
 361         }
 362 }