Extension:PluggableAuth/ru

Расширение PluggableAuth обеспечивает основу для создания расширений аутентификации и авторизации.

Аутентификация — это процесс подтверждения того, что пользователь является тем, за кого себя выдает. Это можно сделать, например, предоставив имя пользователя и пароль или какой-либо токен или биометрические данные.

С PluggableAuth можно использовать следующие расширения аутентификации:


 * - использует SAML
 * - использует OpenID Connect
 * - использует LDAP
 * - использует OAuth
 * - использует Shibboleth
 * - uses Discourse
 * - использует Naylor Association Management Software
 * - uses phpBB
 * - использует Steam authentication

Авторизация — это процесс определения того, должен ли конкретный аутентифицированный пользователь иметь доступ к конкретному ресурсу. Это можно сделать, например, проверив список авторизованных адресов электронной почты или проверив значения атрибутов пользователя, предоставленные сервером идентификации.

В случае PluggableAuth расширения авторизации определяют, может ли аутентифицированный пользователь продолжить вход в вики. Однако расширения аутентификации (а не расширения авторизации) заботятся о том, для каких групп пользователей пользователь должен быть авторизован, на основе атрибутов, переданных от поставщика удостоверений (IdP).

С PluggableAuth можно использовать следующие расширения авторизации:


 * - uses a list of email addresses and domains
 * - uses LDAP

PluggableAuth must be used with one or more authentication plugins and zero or more authorization plugins. If more than one authentication plugin is used, a button for each authentication plugin will be added to the  page. If a single authentication plugin is used and local login is disabled, the  page will be bypassed. If no authorization plugins are used, all authenticated users will be authorized to use the wiki.

PluggableAuth defines two important hooks:


 * - enables authorization plugins to provide code to make an authorization decision
 * - used to augment MediaWiki's group information with that from an external provider

Creating an authentication plugin
Version 6.0 and later:
 * Authentication plugins subclass the abstract  class provided by PluggableAuth.
 * In version 6.0 and later, an authentication plugin must specify at  section in  . For example:

Version 5.7 and earlier:
 * Authentication plugins subclass the abstract  class provided by PluggableAuth.
 * An authentication plugin must set  to the name of this subclass.

The authentication plugin subclass must implement the following methods:


 * Called to authenticate the user.
 * The parameters are used to return the user id, username, real name, and email address of the authenticated user and, if the user cannot be authenticated, an optional error message. is an integer and the remaining parameters are all strings. If the user cannot be authenticated and no value is set for , a default error message is displayed.
 * must be set to  if the user is new, in which case   will add the user to the database.
 * Must return true if the user has been authenticated and false otherwise.
 * If the return to URL, the name of the page, or the query parameters from the page that login was initiated from are necessary in the authenticate function, they may be accessed as follows:


 * Called after a new user has been authenticated and added to the database to add any additional information to the database required by the authentication mechanism.


 * Called when the user logs out to notify the identity provider, if necessary, that cleanup such as removing the user's session should be done.

Special:UserLogin and extra login fields (Version 5.7 and earlier only)
The  page will only be displayed to the user during authentication if there are fields on that form that the user must fill in.

That is, if an authentication plugin does not add extra fields to the  form using   and if local login (which enables the username and password fields on the   form) is not enabled by a site administrator using , the   page will not be displayed.

Even if  is not displayed, it may be necessary for an authentication plugin to gather user input using a web page provided by an enterprise authentication system. This would be accomplished by a redirect, often from within the authentication library used by the authentication plugin.

If no such library exists and you need to implement the authentication mechanism from scratch, the redirect should not go to. Instead, it should go to a custom, unlisted special page based on. Finally, if there is no user input required by the user as part of authentication from either  or the remote authentication system, clicking on the Log in link will simply re-render the current page in a logged in state.

If an authentication plugin adds extra fields to the  form using , the fields can be accessed in the   function in an authentication plugin as follows:

This will return an array of field values indexed by the name of the field from the field descriptor array.

Creating an authorization plugin
Authorization hooks use the hook to register an implementation of the following function:


 * is the UserIdentity object for the user requesting authorization
 * must be set to true if the user is authorized and false otherwise.

Release notes

 * Version 6.0
 * Support multiple authentication plugins using
 * Requires MediaWiki 1.35+
 * Drop support for the following configuration variables:
 * (use the  field in the corresponding   entry instead)
 * (use the index of the corresponding  entry instead)
 * (no replacement)
 * (now specified by an attribute in the authentication plugin's extension.json and referred to by the   field in the corresponding   entry)


 * Version 5.7
 * Added error message when there is a rare fatal session error


 * Version 5.6
 * Fixed autologin so it returns to the correct page after authentication.


 * Version 5.5
 * Fixed issue with  hook.


 * Version 5.4
 * Added  and.
 * Coding style fixes.


 * Version 5.3
 * Added.


 * Version 5.2
 * Converted auto login to PHP from JavaScript.


 * Version 5.1
 * Added  hook. Thank you to Poikilotherm for contributing this functionality.


 * Version 5.0
 * Added  and removed use of editmyprivateinfo
 * Added debug statement when returntourl is not set


 * Version 4.2
 * Fixed exception when returntoquery is undefined.


 * Version 4.1
 * Added session variables to hold the name of the page and the query parameters of the page from which login was initiated for use in


 * Version 4.0
 * Added optional error message to
 * Bumped version number to synchronize with SimpleSAMLphp and OpenIDConnect extensions


 * Version 2.2
 * Confirm email addresses coming from external authentication sources


 * Version 2.1
 * Update file naming conventions


 * Version 2.0
 * Almost completely rewritten to support the new MediaWiki 1.27 authentication and session management framework
 * Switched to new extension registration
 * Configuration variable names changed to add $wg prefix
 * removed
 * renamed to
 * added to support local password-based login to the wiki in addition to PluggableAuth


 * Version 1.2
 * Moved the addition of a new user to the wiki database to after successful authorization of the user
 * Added  check


 * Version 1.1
 * Added call to logout when session times out to ensure that the deauthenticate function in implementing classes gets called


 * Version 1.0
 * Initial version