User:Jeblad/Qualified access

A qualified access to another system is done according to the usercredits inside the wiki. Such credits can be several features such as user rights, number of contributions, time since registering, time since last block or even user name. The extension identifies some such features.

Defaults can be changed in  to enable configuration of each value, and then further enabled or disabled as necessary. Note that enabling use of user name will make it possible for external parties to identify users.

Fundamental operation is to add a parser function in running text, or to add link to a toolbox through LocalSettings.php, or to add a javascript link somewhere on a referencing page, which creates a backlink to a special page. This takes one parameter describing the resource which identifies the actual configuration set. A call to this special page will be Special:Qualifiedaccess/resource. During processing of this special page the necessary signing and/or encrytion will happend.

If the special page is accessed with an identificator an access for a specific external resource is prepared, and if necessary the available resources are filtered, and only those who make this external resource available will be listed. If no identificator is available the special page will prepare an empty request, which typically is used for an automatic log on to the external resource.

Unless otherwise configured the special page will display all data to be sent to the external web site.

Installation
Note that installation of  is a prerequisite for the extension. wiki-install-folder/extensions/QualifiedAccess
 * 1) Create a new folder (directory) in the following location:
 * 1) Download the following files:
 * 2) * QualifiedAccess.php
 * 3) * QualifiedAccess.i18n.php
 * 4) Copy the files to the new QualifiedAccess folder
 * 5) Add the following code to your LocalSettings.php (at the bottom)
 * 1) Adjust the following code to your needs

You should not enable reporting of username or realname unless necessary, and if so you should inform your users of the consequences. Note also that using sufficient many attibutes in parallell can compromise the users anonymity.

Usage
The extension will enable a parser function which will prepare a redirect to a special page. This will only identify a resource by its name, and should have no security implications.


 * Mediawiki:qualifiedaccess-definitions navngir resurser brukt av spesialsiden, gitt den eksterne identifikatoren som er angitt. Kodifisering av forespørselen til den eksterne siden utsettes inntil det er klart at den kan leveres. Dette vil redusere den nokså tunge operasjonen, og hindre at denne utføres for unødvendige instanser.

The extension will also enable a tag function and according to the definitions it will prepare a POST request, using customised values, for a request towards the given external web site. Any feature not disabled in LocalSettings.php and identified in the local tag function wil be added to the request. If a public key is specified it will be used to sign the request, and it will be downloaded from either of the specified key servers.

Tags are used on special pages from the Mediawiki namespace.

Title for the given dataset
 * title

Identifier for the given dataset (if no known service is given all are used)
 * service


 * Note that title and service are aliases, but only service is used for inclusion matching on the special page

Patterns for matching a specific protected resource at the given service
 * resources

The actual url to use for the lookup of the resource
 * action

How to access the external resource
 * method

A comma-separated list of rights to add to the request (if given, and without any result, the request will terminate)
 * rights

A comma-separated list of groups to add to the request (if given, and without any result, the request will terminate)
 * groups

A comma-separated list of features to add to the request (if given, and without any result, the request will terminate)
 * features

The name used for the external websites' public key
 * name

The email used for the external websites' public key
 * email

The comment used for the external websites' public key
 * comment

An external keyserver to be used for look up of public keys (must be on the configurations list of valid servers)
 * keyserver

The algorithm to use for the signing
 * hash

How to process, only to do a clearsign or a encrypt operation
 * mode

The final rendered special page will contain and visualize all parts to be submitted to the external site, and a button to submitt the prepared dataset. This should make it completly visible and transparent to the user what he/she are about to do.

Note that the identificator for the external digital object is delivered directly to the special page in the call to this...

A timestamp will always be embedded in the packet.

It might be necessary to add a value lastedit.

The editcount feature is obfusicated if it is non-zeero. It is then adjusted with a scaling random number and the final number is rounded.

Signing
Signing is done through one of several subsystems, gpg is used as default. Other subsystems may or may not be used as a drop in replacement. It is a primary goal for the signing process to be able to deliver a packet to the recipent that is self contained, and without any need for the recipent to do further communication with the wiki-based service or the user to establish the users credentials.

Usually mode will describe the use of the external service public key. If it says «encrypt» the public key will be used for encryption of the packet. If it says «clearsign» the public key will be used for making a cleartext signature of the packet.

If a scond word is added this will refer to a second pass with the internal service private key. This can also be done by adding the special word double to make two similar passes. By doing a second pass with the internal service private key it is possible to completely verify the origin and content of the packet without making separate callbacks from the external service to the internal one. The internal service keypair is associated with, and a private key for this user should be available on the secret keyring.

If a third word is added, or the special word triple is used, this will refer to a third pass with a private key for the actual user, but as this is under the control of the user he or she has to use additional software to rewrite the request. Normally this will be done by adding a java applet that will intercept the submit process, do local signing in the browser and change the request accordingly. The wiki will use the users public key, the user has to verify the signature and make a new signature with the private key, then the external service can verify the signature with the users public key. This process can be extended to several layers and form a onion-like solution.

Example
Requests to a resource are in general Special:Qualifiedaccess/megarchive. If a specific object are requested the shortform is Special:Qualifiedaccess/megarchive,1234567890. The form without a resource isn't generally supported Special:Qualifiedaccess/,1234567890, but the special page will use a fallback and allow use of all resources to locate the object. Some special forms of identificators is identified as such and cant be used as resource names.

The datasets for the resources resides at pages in the Mediawiki-space. This makes them implicit protected from anyone other than sysops, unless other users are given edit-access to this namespace.

&lt;qaccess feature="rights" action="http://somewhere.on.net" key="webmaster@somewhere.on.net" keyserver="" /&gt;

&lt;qaccess feature="contribution" action="http://somewhere.on.net" key="webmaster@somewhere.on.net"&gt; -BEGIN PGP PUBLIC KEY BLOCK- Version: GnuPG v1.4.6 (GNU/Linux) mQGiBEMdoegRBACSr3vbqextfQ51sHPr3Qs8SANLBJJyoPwcxYSTcgava5xWHU70 Zm8yCfHW7T90noBtCVHBNG5Yk9VIEOa6Ab/4axsRH5kc9lGSi7o3dHadFB4SmsEO MVB0DB8REWnQ+9Mh6jdyV5Ef/w7YlO5cnf6MI5dLOKI53ojhro9jRFC6owCgyTzI d6dvWrlutGwtgctQ8zj3EK0D/jezwAhV+neCTxBQYbu5rZthqa9pxHO3wasn+JWT 49qlb5GeCHN0jaBDMuMfVv7iXrLy8oYfq6A/cTnp+tSY4kPG63JvM5UtKzdlGngJ 1Tml/zSkLMumz5W02+jNPBCbNZla1pAJS6miyNZi1KjId3BvRuHOX8x1YKdeHCQA OcFkA/9HmhOtgJuWDHHE2Y+sP2GZ1DNjnRtbm4MhrwFeiuKPQTGX8Ni9ET4/++Mm XbfjMVgLbQ6ulusH4W3qePru96ChOMb+NYnN358Kxwy0sw3ZGsPiQucOmA6QvhWV AHKuRgW6LE5FQsCtVSJidJTEuJ12Yfwsn7rjq655iJk657xJ47Q1V2VibWFzdGVy IChqZWIga29uc3VsZW50dGplbmVzdGVyKSA8d2VibWFzdGVyQGplYi5ubz6IWwQT EQIAGwUCQx2h6AYLCQgHAwIDFQIDAxYCAQIeAQIXgAAKCRCiJ2KkNOTcWF8bAJwL 86704BMmJjpKa7xZS6LBdDJ7oQCdFHsJQBzPGmSJEaKfm7q4nDRa9BG5BA0EQx2i qhAQAND/iI7KPimjuPFIkiYFwuayf67daofmZGfzbZayRkPCJf5H+F7Pv7f4Xpsz /xKDqUTQdXag9+LFKc/MAACHiyIaqdI8BPuhgQ+2uMIFVSU0QwmZHBcofPxv95Wn TQt1n1UpWs8sm5kQ0b0rzYEClp5IDZcpCRN8S+irAmXkM735/ZzO5AP5loF+kc9r r3fh5KM8R6hP7FGWQCrNr0cWpMDlUMM6eAiAmoZDf33OoaqL5FRi8YiCfNi9bAHz YtWH+jCA9aKimQS+vRg+TIQwLAbxPFh0tSaZ55CuJh07uV3GrUUJPsS+epLuR7y5 MrrtIb50wabyy6QUTquQqTqSahr3CK2m0PHb8mZxGHSpY2iu/jzfhja/dItvaki1 kn+AWahU8fEa+Xi9XwzyHB4sdF0K7RMlgXq0Bs76Lr6a804ZsDc/cHBauEnqjWho 8ER68GiFohLv50s2RP4IgAyhRnQ8LIOPVJHPq7Db2Q1WfiSk1zVgOXnhtt1VoUyj MRO1BG/bChanIF+mjuozA0LtAOLl1WHlKhmyaho79gBJ3E/vFGd4OWHAgt4zbVLf 8fxfRcaNv3P8y084HLwrF1R/dAgQKOXwT57iL3T9OX4mq4mleJ+TDLep47Ql2dky 6Pqk0T2u2+xGq9lqBlUXr+z9yRyTZsolcvG2zcK9TG3ggIxDAAMFEACXAui5hidN QPS2iFN3lQBVqgFRLsFs3s4EuDyIkhZ87dLNQ0IorrMP+rBtU0m1QQ9j22dGgvSu EabKg5sgo6iKBlfAiWB6Mx9VRBHVyH8vb2MEEFmhVuNgW6VAc1lh6pL3AOP3UTFP 9BeKemriW7Gc27MT/LoknGdIpSX6EePHOQsxcXoHx97ogvjX2ZqH08BzoP2hJJEE 4TOOOEKeaHU3IvrkqalmCOx5npVZF8EVxbrLgLA5vhZzAZtVCdzBy+DJ27wVGQoH AGHaDhAb0VW6B6XlbK2TKgKr3TyMhZ0WlS48QNhyqDfiz7tu1FdjeCQ6jrmLU7fM y1K6rmTKMh1eh90t+GeIr32H8ySe0BUV25e116aJNk78wkHh1EvTqBbxNGGsro9B kMMBlFq0llOHhVpKyvrlHIlIpF6Vd4YMhtP/MpOCZkQAaxjFJNuXA+2+YezkoK2Y 7zStR6Gr1S8mKBPiI5BBUh13HrFFF6OWj8UUWA21OLaP/DHIZRPaXPliOBmehdaW an4osRrdY+Imc/XVzJyhAD5DwPoqO2JoSJymW0DHVjDyzdyeHIguEOn27+E6InmL jyTClfAoIwuTuzmF9onc1jsg1Y9Fk/OenfFH2xsNZ7QoiFftPLHq58fVlFDDMDum 5QwYv4oZQyXo45LX7L60i8GSDYP9xkpqXohGBBgRAgAGBQJDHaKqAAoJEKInYqQ0 5NxYqcQAnRbu2hRVLXLICt+F4So21hDhW0W1AJ9P0hlYFFY6MFaeuzC5VuLTsIrI 3Q== =mJeP -END PGP PUBLIC KEY BLOCK- &lt;/qaccess&gt;