Extension:GoogleLogin/PreAuthManager

The GoogleLogin extension allows wiki users to login with their Google Account. The extension uses Google API to request user data. If the user logged in first time, the extension allows to create a user with the Google email address and Google username (or given name, or an own name).

Requirements
To use this extension you need:
 * MediaWiki 1.23+ (for version v0.2.0 and above you need at least MediaWiki 1.24)
 * MySQL (no PostgreSQL or SQLite support for now!)
 * PHP 5.3+
 * Google Developer Access
 * Google+ API access
 * API Credentials for Webapplication (Client ID and Client Secret)
 * Version v0.2.1 until version 0.3.1 requires the Extension GoogleAPIClient, otherwise run , only.

Configuration
The extension provides two configuration variables to set the Client ID and Client Secret (you get this pair in Google Developer Console, remove " " and "  ").

Settings in Google Developer Console
To use this extension you need a Google developer account and access to the developer console. This is a simple (a very simple!) step-by-step guide (use Step 1 of the official step-by-step example with these settings):


 * 1) Open Google developer console


 * 1) Read and accept the terms of service


 * 1) Create your first project


 * 1) Go to APIS & AUTH


 * 1) Go to APIs and enable Google+ API (read and accept the terms)


 * 1) Go to Credentials


 * 1) In Section OAuth click Create new Client ID


 * 1) Select as Web application as APPLICATION TYPE, as Authorized JavaScript origins type in your domain name (no wildcards and directories allowed!)


 * 1) Type in your Authorized redirect URI like this example:


 * If your domain is example.com and you have installed MediaWiki in Root of your domain, the redirect URI is as follows: http://example.com/index.php/Special:GoogleLogin


 * 1) Click create and copy the Client ID and Client Secret to the configuration variables in LocalSettings.php

"Special:GoogleLogin" or (in German for example) "Spezial:Mit_Google_anmelden"
The allowed redirect URI in Google developer console must be in content language. So, if your wiki has content language German, then type in "Spezial:Mit_Google_anmelden" and not "Special:GoogleLogin". If you used the wrong language, all Authentication requests will fail with redirect uri mismatch.

Debug
Normally, you can see the error message on all generic error pages. Sometimes there are Internal Errors, called Exceptions. In this case, please add with value true in  to see the complete Exception message. For a support request, please provide always the lines of the Exception.

Use on a private wiki
If you have set your Wiki to private with

you have to whitelist the "Special:GoogleLogin" page, so that anonymous users can access the callback URL after being redirected from the authentication provider. You can do this by adding the following line to your LocalSettings.php:

Allow account creation only via GoogleLogin
It's possible to deactivate the account creation function of MediaWiki. Normally GoogleLogin don't give the option to create a new account, too. It's possible to change this, that Users can still create an account with GoogleLogin, but can't with the vanilla account creation form. For this you need to set up the following configuration varaibles in your :

If you want to remove the Login form of MediaWiki, too, you can set this configuration variable, too:

If you want to remove GoogleLogin in the future for any reason, your users can still login into your MediaWiki installation without to register a new account. GoogleLogin creates normal MediaWiki-accounts with a random password. Your users just have to reset their password with the special page Special:PasswordReset.

<-> GoogleLogin conflict (only with and MediaWiki <= 1.26!)
MobileFrontend, the extension to provide a mobile optimized version of your wiki, actually conflicts with GoogleLogin if you set  to   (to disallow login with the vanilla login form). In the case, that MobileFrontend is loaded after GoogleLogin (the require_once line of MobileFrontend in your  is after the one of GoogleLogin), the special page UserLogin (which handles the login with username and password) will be overwritten by GoogleLogin the first time and by MobileFrontend the second time (to provide a mobile optimized login page). In this case, MobileFrontends Replacement will win and mobile users can still login with username and passwords.

Actually this problem is solved in the MediaWiki release branch/version 1.26 (tracked in ) of MobileFrontend. For older versions of MediaWiki/MobileFrontend you need to change the order in which the Extensions are loaded. Put the require_once and configuration lines of GoogleLogin somewhere after the ones of MobileFrontend in your. This workaround should be obsolete in one of the next versions of MobileFrontend.

What can this extension do
With the database update, the extension will create a new table called prefix_user_google_user which contains the needed connection between the wiki users and Google accounts. It stores only the Google UserId and the Wiki UserId.

If a user calls the special page GoogleLogin, they will instantly redirected to Google Authentication request to give your application access to some user information stored by Google. The user must accept this request (or they can not use the login with Google). After accepting, the user has the possibility, if they are not logged in as a wiki user, to create a new account. The username they can choose self or choose one of the suggestions, based on the Google user name and given name (if one s free and createable). If the chosen username is creatable (free, valid and not blocked), a new user with the username and the Google-Mail as e-mail-address will be created and linked to the Google Account.

If the user is logged in (means: they have already a wiki account) they can link this account with the Google account, this the user must do only once. If the connection is created, the user will be able to login simply by clicking Login with Google button on Special:Login.

If the wiki account and Google account is connected, the user can, if they navigate to "Special:GoogleLogin", unlink his account and Google account.

Google API PHP Client
This Extension uses the Google API PHP Client (included in versions before 0.2.1), distributed under the Apache 2.0 License. The Client can be downloaded from GitHub.