Extension:AuthBugzilla

The goal of this extension is to offer user the same login and password in Bugzilla and Mediawiki, when installed on the same DB backend. The match between a Mediawiki user and a Bugzilla one is done via their email in the preferences, so make sure to force Mediawiki/Bugzilla to confirm users email at setup.

In short, with below extensions, if a given user has the same email in his Mediawiki profile and as login in Bugzilla:
 * the user can use its Mediawiki login and its Bugzilla password to log either to Mediawiki or Bugzilla
 * a password reset in either of the application will reset password in both applications
 * if the process fails for whatever reason (user has an account in Bugzilla but not Mediawiki, etc...), the authentication reverts to the usual process

Changes to the DBs

 * grant wikiuser the read/update rights to the bugzilla "profiles" table
 * grant bugzilla user the read right to your mediawiki "user" table (don't forget the table prefix if applicable).

Changes to Bugzilla
In Bugzilla\Auth\Verify\DB.pm, add the few lines between ####.

sub check_credentials { my ($self, $login_data) = @_; my $dbh = Bugzilla->dbh;

my $username = $login_data->{username};

####### Check if a Mediawiki login exists ########### # $login will only be used by the following SELECT statement, so it's safe. trick_taint($username); my $usernameMediawiki = $dbh->selectrow_array("SELECT user_email FROM wikidb.user WHERE LOWER(user_name) = LOWER(?)",undef, $username); if ($usernameMediawiki) { $username = $usernameMediawiki; }   ####### End of Mediawiki check ########### my $user_id = login_to_id($username);

return { failure => AUTH_NO_SUCH_USER } unless $user_id;

AuthBugzilla.php
In LocalSettings.php, add these lines: require_once( 'extensions/AuthBugzilla.php' ); $wgAuth = new AuthBugzilla;

Add the file AuthBugzilla.php to your extensions directory (copy the following code and save it as AuthBugzilla.php): 
 * 2) http://www.mediawiki.org/
 * 3) This program is free software; you can redistribute it and/or modify
 * 4) it under the terms of the GNU General Public License as published by
 * 5) the Free Software Foundation; either version 2 of the License, or
 * 6) (at your option) any later version.
 * 7) This program is distributed in the hope that it will be useful,
 * 8) but WITHOUT ANY WARRANTY; without even the implied warranty of
 * 9) MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * 10) GNU General Public License for more details.
 * 11) You should have received a copy of the GNU General Public License along
 * 12) with this program; if not, write to the Free Software Foundation, Inc.,
 * 13) 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * 14) http://www.gnu.org/copyleft/gpl.html
 * 1) with this program; if not, write to the Free Software Foundation, Inc.,
 * 2) 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * 3) http://www.gnu.org/copyleft/gpl.html

/** * Authentication plugin interface. Instantiate a subclass of AuthPlugin * and set $wgAuth to it to authenticate against some external tool. * * The default behavior is not to do anything, and use the local user * database for all authentication. A subclass can require that all * accounts authenticate externally, or use it only as a fallback; also * you can transparently create internal wiki accounts the first time * someone logs in who can be authenticated externally. * * This interface is new, and might change a bit before 1.4.0 final is * done... * * @package MediaWiki */ require_once( 'AuthPlugin.php' ); class AuthBugzilla extends AuthPlugin {

function AuthBugzilla { $this->bugzillatbl = "`bugs`.`profiles`"; }	function encryptPassword( $pass, $salt ) { return crypt( $pass,$salt ); }	/**	 * Check whether there exists a user account with the given name. * The name will be normalized to MediaWiki's requirements, so	 * you might need to munge it (for instance, for lowercase initial	 * letters). *	 * @param $username String: username. * @return bool * @public */	function userExists( $username ) { $dbr =& wfGetDB( DB_SLAVE ); $user = $dbr->tableName( 'user' ); $email = $dbr->selectField(			"$user",			"user_email",			"user_name=$username");

return $dbr->selectField(			$this->bugzillatbl,			"userid",			"LCase(login_name)=LCase($email)",			"AuthBugzilla::userExists" ) !== false; }

/**	 * Check if a username+password pair is a valid login. * The name will be normalized to MediaWiki's requirements, so	 * you might need to munge it (for instance, for lowercase initial	 * letters). *	 * @param $username String: username. * @param $password String: user password. * @return bool * @public */	function authenticate( $username, $password ) { $dbr =& wfGetDB( DB_SLAVE ); $user = $dbr->tableName( 'user' ); $qusername = $dbr->addQuotes( $username ); $email = $dbr->selectField(			"$user",			"user_email",			"user_name=$qusername"); $qemail = $dbr->addQuotes( $email );

$res = $dbr->selectRow(			$this->bugzillatbl,			array( "cryptpassword" ),			"LCase(login_name)=LCase($qemail)",			"AuthBugzilla::authenticate" );

if ( $res !== false ) return ($this->encryptPassword( $password, $res->cryptpassword )				== $res->cryptpassword); else return false; }

/**	 * Modify options in the login template. *	 * @param $template UserLoginTemplate object. * @public */	function modifyUITemplate( &$template ) { # Override this! $template->set( 'usedomain', false ); }

/**	 * Set the domain this plugin is supposed to use when authenticating. *	 * @param $domain String: authentication domain. * @public */	function setDomain( $domain ) { $this->domain = $domain; }

/**	 * Check to see if the specific domain is a valid domain. *	 * @param $domain String: authentication domain. * @return bool * @public */	function validDomain( $domain ) { # Override this! return true; }

/**	 * When a user logs in, optionally fill in preferences and such. * For instance, you might pull the email address or real name from the * external user database. *	 * The User object is passed by reference so it can be modified; don't	 * forget the & on your function declaration. *	 * @param User $user * @public */	function updateUser( &$user ) { # Override this and do something return true; }

/**	 * Return true if the wiki should create a new local account automatically * when asked to login a user who doesn't exist locally but does in the * external auth database. *	 * If you don't automatically create accounts, you must still create * accounts in some way. It's not possible to authenticate without * a local account. *	 * This is just a question, and shouldn't perform any actions. *	 * @return bool * @public */	function autoCreate { return false; }

/**	 * Can users change their passwords? *	 * @return bool */	function allowPasswordChange { return true; }

/**	 * Set the given password in the authentication database. * As a special case, the password may be set to null to request * locking the password to an unusable value, with the expectation * that it will be set later through a mail reset or other method. *	 * Return true if successful. *	 * @param $user User object. * @param $password String: password. * @return bool * @public */	function setPassword( $user, $password ) { $saltchars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./';

# Generate the salt. We use an 8 character (48 bit) salt for maximum # security on systems whose crypt uses MD5. Systems with older # versions of crypt will just use the first two characters of the salt. $salt = ''; for ($i=0 ; $i < 8 ; $i++ ) { $salt .= $saltchars[rand(0,63)]; }		$dbr =& wfGetDB( DB_MASTER ); $qusername = $dbr->addQuotes( $user->mName ); $user = $dbr->tableName( 'user' ); $email = $dbr->selectField(			"$user",			"user_email",			"user_name=$qusername"); #$qemail = $dbr->addQuotes( $email );

$newpass = $this->encryptPassword($password,$salt);

$res = $dbr->update(			$this->bugzillatbl,			array( "cryptpassword" => $newpass),			array( "login_name" => $email),			"AuthBugzilla::setPassword" ); return true; }

/**	 * Update user information in the external authentication database. * Return true if successful. *	 * @param $user User object. * @return bool * @public */	function updateExternalDB( $user ) { return true; }

/**	 * Check to see if external accounts can be created. * Return true if external accounts can be created. * @return bool * @public */	function canCreateAccounts { return false; }

/**	 * Add a user to the external authentication database. * Return true if successful. *	 * @param User $user * @param string $password * @return bool * @public */	function addUser( $user, $password ) { return true; }

/**	 * Return true to prevent logins that don't authenticate here from being * checked against the local database's password fields. *	 * This is just a question, and shouldn't perform any actions. *	 * @return bool * @public */	function strict { return false; }

/**	 * When creating a user account, optionally fill in preferences and such. * For instance, you might pull the email address or real name from the * external user database. *	 * The User object is passed by reference so it can be modified; don't	 * forget the & on your function declaration. *	 * @param $user User object. * @public */	function initUser( &$user ) { # Override this to do something. }

/**	 * If you want to munge the case of an account name before the final * check, now is your chance. */	function getCanonicalName( $username ) { return $username; } }

?>