Extension:OpenID

The manual explains the contemporary OpenID extension version (0.925-beta and later) for MediaWiki trunk and PHP 5.3.x. If you need a manual for older and deprecated versions, please consult one of the [ archived] versions.

The extension makes a MediaWiki installation OpenID-aware and lets users log in using their OpenID identity - a special URL - instead of or as an alternative to standard username/password log in. In that way, the MediaWiki acts as OpenID consumer. If expressly enabled, the extension allows the MediaWiki installation also to act as OpenID provider, so that users with an account on that wiki are able to use their userpage URL as OpenID to log in to other OpenID-aware web sites. It can only be installed by a site administrator.

Relying party = consumer: The site that wants to verify the end-user's identifier; other terms include "service provider" or the now obsolete "consumer" - which is still used here (this will be changed soon).

Typical uses of OpenID and the OpenID extension for MediaWiki are:
 * Single-signon between multiple affiliated wikis and other sites. For example, users of almost 20 wikis that work together for Wikitravel can login to different Wikitravel wikis with their home wiki account.
 * Single-signon across the Internet. Many sites now support OpenID, including "big names" like Google, Yahoo, and Verisign. Allowing users to login with OpenID means one less step for them to contribute to your wiki.
 * Distributed reputation. Logging into a new wiki with the same username as you have on another wiki does not prove that they are the same person. Logging in with your OpenID from the old wiki does. Using OpenID can help build a distributed reputation across the wiki world.

The software supports OpenID 2.0 and requires the openidenabled.com 2.x libraries. Users of previous versions should look in the footnotes →.

This extension has been in use for years on several large wikis without known security problems. However, no software is completely bug-free or secure, and there's no guarantee that this software will work as advertised.

Pre-requisites
One of the major improvements of the new OpenID extension version is a tiny "Makefile" which creates a sub directory in your extensions path, and downloads and patches the required php-openid library in one step. Everything has been successfully tested in production with MediaWiki trunk version 1.19alpha.

requisite 1: php-openid library
The extension depends on the OpenIDEnabled.com PHP library for OpenID, which in turn depends on the OpenIDEnabled.com PHP library for YADIS. This package is called "php-openid library" here. The step of downloading, installing and patching php-openid can be automated by running "make" in your extensions folder, and you can skip to the next section ("requisite 2 ...")
 * http://www.openidenabled.com/php-openid/
 * The Extension:OpenID has been tested to work with php-openid 2.2.0.

requisite 2: PHP extensions or modules
You need to install a few additional PHP extensions if they are not part of your standard PHP installation e.g. when running a server with OpenSUSE:
 * gmp
 * curl
 * mcrypt

You can either add these and possibly further missing extensions one by one to your PHP installation (use YaST, or check your system's manual) and install the required php5-modules, or you can recompile PHP until the ./configure command finishes without errors. See the OpenIDEnabled documentation for details. The php-openid README is helpful.

Installation
The installation is explained for OpenID extension versions 0.925-beta (and later) suited for MediaWiki trunk and contemporary PHP.

1. make sure that you have the pre-requisite 2. Pre-requisite 1 will be downloaded by the makefile during step 3.

2. download from svn into a new subdirectory $IP/extensions/OpenID

cd $IP/extensions $IP/extensions# svn checkout http://svn.wikimedia.org/svnroot/mediawiki/trunk/extensions/OpenID OpenID

3. goto the OpenID directory and run make to download the library and to apply patches for PHP 5.3. or later cd $IP/extensions/OpenID $IP/extensions/OpenID# make 4. In your MediaWiki $IP/LocalSettings.php, at the bottom of the file add

5. Run update.php script in in your MediaWiki maintenance folder $IP/maintenance to create necessary tables in MediaWiki database. $IP/maintenance# php update.php

It should work out of the box, but you'll almost definitely want to set the trust root and access controls (see Configuration below).

information for legacy version users
Please consult [ older] page versions for more detailed information and special cases, or check our |discussion page.
 * Upgrade from OpenID version 0.3 →
 * Installation using sqlite →
 * Installation issues for Debian →
 * Upgrade from older versions →

Logging in using OpenID (MediaWiki as OpenID consumer)
To log in to the wiki using an OpenID, go to the Special:OpenIDLogin page on the wiki. Add the OpenID identity URL to the login box, and click "Verify".

This should take you to the OpenID server for your identity, where you can either log in (if you're not already) or approve allowing the wiki to use your OpenID for logging in. If the OpenID server supports the Simple Registration Extension ('sreg'), it may also ask you whether to share personal information like your preferred nickname, real name, email address, etc. Choose as you wish.

Once you're logged in to your OpenID server, and you've finished approving the login, you should return to the wiki from whence you came automatically.

Every user who logs in with an OpenID identity for the first time will be assigned a "fake" username in the local wiki. (This just makes things work better.)

If you've allowed your nickname to be passed to the wiki, and it's not already taken, and it's a legal MediaWiki user name, then it should use that for your login automatically.

If not, the extension will try to make up some good candidate usernames for you and present you with a choice. If you don't like any of them, you can make up your own.

After you're logged in, you can edit, read, write, and do all the other things that MediaWiki users do. Since you've got a "real" account, you'll also have a home page and a message page and such. It should also be possible to assign extra permissions ('sysop', 'bureaucrat') to the account. You can log out as normal.

To log back in, use the OpenIDLogin page again. Don't try to login using the regular login page, since it won't work.

You can log in with an Interwiki abbreviation of an URL right now, but that's experimental and may disappear in later versions. Don't fall in love with this convenient, useful feature. You may get hurt.

Using a MediaWiki account as an OpenID (MediaWiki as OpenID Server)
MediaWikis with the extension act as OpenID consumers (clients). They also can work as OpenID server, but only if the Wiki adminstrator has enabled this feature.

To log in to other OpenID-aware sites (consumer) with your MediaWiki account (OpenID server):
 * if, and only if you have a user account, and
 * if, and only if you have manually set a password to your account via Reset Password (link in your User profile preferences), and
 * if the user page exists (has some content)

then your OpenID identity URL is the full URL of your non-empty MediaWiki user page http://www.server.org/wiki/index.php/User:MySelf

When you use this OpenID with another site, logging in should take you to the wiki site. You may need to enter your password if you're not already logged in (by cookie, or by session).

You'll then be asked if you want to let the other site log you in, and if you want the MediaWiki wiki to share your personal information (nickname, email, full name, language) with the other site. Choose what feels comfortable to you. For some sites, you may not be asked; see configuration below.

Once you've finished deciding, the other site will finish the login.

Configuration
The administrator can configure these variables in the LocalSettings.php file. Please read carefully. If you want other than the default values, you need to place your parameters after the require_once line for the OpenID extension.

OpenID servers (where you can register an OpenID)
The following non-comprehensive list of OpenID services shows those with which the extension has been tested in the past. All have free signup for identities.

"It does not work": bugs, common pitfalls

 * Please check our First aid checklist before asking for help. Report a bug: see info box.


 * one MediaWiki acting as OpenID server Bob does not work with another or same MediaWiki acting as OpenID consumer Alice on the same server. Advice for the moment: use two different servers while playing with the extension
 * when you want to log in to your OpenID-consuming MediaWiki Alice as user X:
 * make sure that your are not logged in to the OpenID identity server Bob as another user Z ; otherwise you will see an error, which is intended.
 * I recommend you log out every persona you may have on server Bob while testing the extension
 * clear your browser cache of all Bob-related cookies, and session cookie.
 * The OpenID authentication process flow will redirect you from Alice to Bob. Bob will then prompt you to log in and hopefully everything works.