Extension:WSOAuth/ko

혼동하지 마세요: Extension:OAuth.

This extension depends on the PluggableAuth extension, which must be installed first.

미디어위키 확장 기능 설명서

WSOAuth 출시 상태: 안정
구현	사용자 식별 , 사용자 권한
설명	Extends the PluggableAuth extension to provide authentication using an OAuth provider
만든 이	Xxmarijnw (Wikibase Solutions) and others
최신 버전	9.0.1 (2025-02-08)
호환성 정책	스냅샷은 미디어위키와 함께 릴리스됩니다. Master is not backward compatible.
MediaWiki	1.35+
PHP	7.3+
데이터베이스 변경	예
변수 $wgOAuthCustomAuthProviders $wgOAuthAutoPopulateGroups $wgOAuthMigrateUsersByUsername $wgOAuthDisallowRemoteOnlyAccounts $wgOAuthUseRealNameAsUsername
사용된 훅 LoadExtensionSchemaUpdates PluggableAuthPopulateGroups GetPreferences
훅 제공 WSOAuthAfterGetUser WSOAuthBeforeLogout WSOAuthBeforeAutoPopulateGroups WSOAuthGetAuthProviders
Licence	MIT License
다운로드	확장 기능 다운로드 Git [?]: 저장소 보기 (Phabricator · GitHub) Gerrit 코드 리뷰 Git 커밋 기록 Download source tarball
WSOAuth 확장 기능 번역
Vagrant 역할	wsoauth
이슈	미해결 작업 · 버그 보고

The WSOAuth extension (Wikibase Solutions OAuth) provide authentication using an OAuth provider. It provides a layer on top of the PluggableAuth extension to enable authentication via OAuth.

The following OAuth providers are currently available by default:

• MediaWiki (MediaWiki instance running OAuth )
• Facebook

WSOAuth makes it easy to add new OAuth providers. You can read more about how to add a new OAuth provider on WSOAuth for Developers .

Compatibility

Compatibility Matrix

WSOAuth	PluggableAuth	MediaWiki
9.0+	7.0+	미디어위키 버전: ≥ 1.35
6.0-8.x	6.0-6.x	미디어위키 버전: ≥ 1.35
1.0-5.x	5.7	미디어위키 버전: ≥ 1.31

Configuration

Values must be provided for the following mandatory configuration variables:

Flag	Default	Description
$wgPluggableAuth_Config (see Extension:PluggableAuth#Configuration)	[]	A mandatory array of arrays specifying the OAuth providers and their configuration. The data field of the array should be an array with the following keys: type The OAuth provider the extension will use (e.g. mediawiki or facebook) Required uri The OAuth application authentication URI. optional for some providers clientId The consumer key received from the OAuth application. Required clientSecret The consumer secret received from the OAuth application. Required redirectUri The default callback URI to which the OAuth application returns after a successful authentication request. required for some providers extensionData An array containing additional data required by the provider. required for some providers migrateUsersByUsername Whether or not to allow usurpation of existing accounts. This overwrites the globally set $wgOAuthMigrateUsersByUsername. Optional disallowRemoteOnlyAccounts Whether or not to allow accounts to not have a local counterpart. This overwrites the globally set $wgOAuthDisallowRemoteOnlyAccounts. Optional useRealNameAsUsername Whether to use the real name as the username. This overwrites the globally set $wgOAuthUseRealNameAsUsername. Optional autoPopulateGroups An array containing a list of MediaWiki group names that must be automatically assigned to the user after they are authenticated. This overwrites the globally set $wgOAuthAutoPopulateGroups. Since WSOAuth 9.0, this requires you to also configure how groups are synchronised. Optional

In addition, the following optional configuration variables are provided:

Flag	Default	Description
$wgOAuthCustomAuthProviders	false	An array containing a list of custom OAuth providers together with their class name (see WSOAuth for Developers for more information).
$wgOAuthAutoPopulateGroups	[]	An array containing a list of MediaWiki group names that must be automatically assigned to the user after they are authenticated. Since WSOAuth 9.0, this requires you to also configure how groups are synchronised.
$wgOAuthMigrateUsersByUsername	false	Whether or not to allow usurpation of existing accounts. If a user is already registered on your wiki before installing WSOAuth with the same username as a user that is logging in via OAuth, this setting will determine whether that existing account will be given to the user signing in (true), or whether the user singing in through OAuth will be prevented from doing so because the user already exists (false). Once an account has been migrated, the user associated with that account will always be able to sign in through OAuth, even after this setting is changed to false. It is safer to leave this value as false and let the user connect their remote account manually through Special:Preferences.
$wgOAuthDisallowRemoteOnlyAccounts	false	Whether or not to allow accounts to not have a local counterpart.
$wgOAuthUseRealNameAsUsername	false	Whether to use the real name as the username.

An example of the $wgPluggableAuth_Config for a single providers is as follows:

$wgPluggableAuth_Config['nlwiki'] = [
    'plugin' => 'WSOAuth',
    'data' => [
        'type' => 'mediawiki',
        'uri' => 'https://nl.wikipedia.org/wiki/Special:OAuth',
        'clientId' => '...',
        'clientSecret' => '...'
    ],
    'buttonLabelMessage' => 'dutch-wikipedia-login-button-label'
];

The key of the configuration (in the example above nlwiki) is used to identify the OAuth provider internally and MUST NOT change.

An example of the $wgPluggableAuth_Config for multiple providers is as follows:

$wgPluggableAuth_Config['nlwiki'] = [
    'plugin' => 'WSOAuth',
    'data' => [
        'type' => 'mediawiki',
        'uri' => 'https://nl.wikipedia.org/wiki/Special:OAuth',
        'clientId' => '...',
        'clientSecret' => '...'
    ],
    'buttonLabelMessage' => 'dutch-wikipedia-login-button-label'
];

$wgPluggableAuth_Config['facebook'] = [
    'plugin' => 'WSOAuth',
    'data' => [
        'type' => 'facebook',
        'clientId' => '...',
        'clientSecret' => '...',
        'redirectUri' => '...'
    ],
    'buttonLabelMessage' => 'facebook-login-button-label'
];

Group synchronisation

같이 보기: Extension:PluggableAuth#Group Synchronization

To configure group synchronisation, you need to add a groupsyncs array to the $wgPluggableAuth_Config array. This array must contain zero or more sub-arrays that specify how groups are synced. For detailed information, see Extension:PluggableAuth#Group Synchronization.

The most common use-case is to synchronise all groups, which can be achieved using the syncall group synchronisation algorithm. The configuration below will achieve similar functionality to older version of WSOAuth (<= 8.0.0).

$wgPluggableAuth_Config['nlwiki'] = [
    'plugin' => 'WSOAuth',
    'data' => [
        'type' => 'mediawiki',
        'uri' => 'https://nl.wikipedia.org/wiki/Special:OAuth',
        'clientId' => '...',
        'clientSecret' => '...',
        'autoPopulateGroups' => ['mygroups' => ['sysop', 'bureaucrat']]
    ],
    'groupsyncs' => [
        'mygroupsync' => [
            'type' => 'syncall',
            'groupattributename' => 'mygroups'
        ]
    ]
    'buttonLabelMessage' => 'dutch-wikipedia-login-button-label'
];

OAuth providers

If you want to add a new OAuth provider, see WSOAuth for Developers.

Currently, the following OAuth providers are supported:

• MediaWiki OAuth (MediaWiki instance running OAuth )
• Facebook

MediaWiki OAuth

Follow the steps below to enable authentication and authorization via MediaWiki OAuth.

1. Register a new OAuth 1.0a consumer application for the wiki you are delegating access to.
2. Set the following in your LocalSettings.php:

$wgPluggableAuth_Config['mywikiauth'] = [
    'plugin' => 'WSOAuth',
    'data' => [
        'type' => 'mediawiki',
        'uri' => 'https://<central wiki>/w/index.php?title=Special:OAuth',
        'clientId' => '<The client ID (key) you received from MediaWiki when you registered your app>',
        'clientSecret' => '<The secret you received from MediaWiki when you registered your app>'
    ]
];

Example of registering a new OAuth consumer application for a wiki for which you want to authenticate against Wikimedia's Meta Wiki:

1. visit: https://meta.wikimedia.org/wiki/Special:OAuthConsumerRegistration/propose
2. Click the "Request a token for a new OAuth 1.0a consumer."
3. Set the following:
   • Set "Application name" to something unique for your application (i.e the string "mywikiauth" used above in $wgPluggableAuth_Config['mywikiauth']).
     (Note - Be sure to keep an exact copy of this string value for use later.)
   • Set "Application description" to some helpful text.
   • Set "This consumer is for use only by <yourusername>." checkbox as you wish.
   • Set "OAuth "callback" URL" to the canonical URL of Special:PluggableAuthLogin on your wiki, e.g. https://<local wiki URL and script path>/index.php?title=Special:PluggableAuthLogin
   • Note "Contact email address" is set as the email address related to your wikimedia account.
   • Ensure "Applicable project" is set to "*" (this is the default)
   • Set "Types of grants being requested" to "User identity verification only, no ability to read pages or act on a user's behalf."
4. Click the checkbox to agree to the conditions of use.
5. Click the "Propose Consumer" button to submit your proposal.
6. Write down the "Client application key" and "Client application secret" that are given by meta.wikimedia.org upon submission.
7. Use the "Application name" you submitted to meta.wikipedia.org as the WSO 'mywikiauth' in the example configuration on the left.
8. Use the "Client application key" as the WSO "clientId"
9. Use the "Client application secret" as the WSO "clientSecret"

To exclusively use MediaWiki as your sign-on system and to automatically log in when visiting the wiki, also set the following in LocalSettings.php:

$wgPluggableAuth_EnableAutoLogin = true;
$wgPluggableAuth_EnableLocalLogin = false;

For OAuth applications that utilize a "callback" prefix, a redirect URI must be set through the redirectUri key. This redirect URI must have the prefix specified.

Facebook

Follow the steps below to enable authentication and authorization via Facebook.

1. Create a new app on Facebook for Developers.
2. Under Add a Product, select Facebook Login.
3. In the menu on the left, select Settings under Facebook Login.
4. Add the domain of your wiki to the list of Valid OAuth Redirect URIs and hit save.
5. In the menu on the left, click Settings, then Basic and write down the App ID and App Secret.
6. Set the following in your LocalSettings.php:

   $wgPluggableAuth_Config['myfacebookauth'] = [
       'plugin' => 'WSOAuth',
       'data' => [
           'type' => 'facebook',
           'clientId' => '<The App ID>',
           'clientSecret' => '<The App Secret>',
           'redirectUri' => 'https://<wiki domain>/index.php/Special:PluggableAuthLogin'
       ]
   ];
   

The key of the configuration (in the example above myfacebookauth) is used to identify the OAuth provider internally and MUST NOT change.

To exclusively use Facebook as your sign-on system and to automatically log in when visiting the wiki, also set the following in LocalSettings.php:

$wgPluggableAuth_EnableAutoLogin = true;
$wgPluggableAuth_EnableLocalLogin = false;

Upgrading from before 6.0

The database schema had to be changed in order to support multiple authentication providers after version 6.0. If you are running a MediaWiki instance with a version of WSOAuth older than 6.0, you must migrate your existing external users to the new database schema if you want to upgrade.

You can use the maintenance script multiAuthMigrate.php located in the extension's maintenance folder to migrate:

$ php extensions/WSOAuth/maintenance/multiAuthMigrate.php --provider=mywikiauth

The provider option in the example above determines which provider to migrate existing users to.

System messages

Here some useful system messages, related to this extension, that can be personalized:

Message title	Default message	Position	Tip
wsoauth-user-already-exists-message	The username "{{{1}}}" is already taken.	Text displayed is the login screen error message when a user tries to login with OAuth, but there is a user in that wiki who has the same username.	It may happen that a user first registers on the wiki via the regular user registration and then tries to login through OAuth, encountering this error message. If this may happen in your wiki, you can personalize this message to invite users to authorize remote logins from their preferences. Here a screenshot: The page Special:Preferences with WSOAuth installed showing the "Connect a remote account" button

To change a system message, edit the MediaWiki:Message title page on your wiki.

설치

This extension requires the PluggableAuth extension.

• 파일을 다운로드하고 WSOAuth 폴더를 extensions/ 디렉토리에 넣어 주세요.
  개발자와 코딩 기여자는 Git을 이용해 확장기능을 다운받는 것이 좋습니다.

  cd extensions/
  git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/WSOAuth
  

• Git에서 설치할 경우, PHP 의존 기능을 설치하려면 Composer를 실행하여 확장 기능 디렉터리에 composer install --no-dev를 발행하십시오. (잠재적인 문제에 대해서는 T173141 을 참고하십시오.)
• 아래의 코드를 LocalSettings.php 코드의 마지막에 추가합니다.

  $wgGroupPermissions['*']['autocreateaccount'] = true;
  
  wfLoadExtension( 'PluggableAuth' );
  wfLoadExtension( 'WSOAuth' );
  

• 갱신 스크립트를 실행합니다. 이 스크립트는 이 확장기능을 필요로 하는 데이터 베이스 테이블을 자동적으로 작성합니다.
• Configure as required.
• 완료 – 위키의 ‘Special:Version’에 이동해서, 확장기능이 올바르게 설치된 것을 확인합니다.

Vagrant 설치:

• Vagrant 를 사용하고 있는 경우에는, vagrant roles enable wsoauth --provision로 설치해주세요

Notes

Gallery

• 
  Login page with local and remote authentication enabled.
• 
  User preferences showing the "connect a remote account" button.
  Discussion: phab:T283908