Extension talk:PluggableAuth/2020

When reporting an error, please be sure to include version information for MediaWiki and all relevant extensions as well as configuration information. Also, please turn on debug logging as described at Manual:How to debug#Logging and include the relevant portions of the debug log.

Weird characters at start and end of login button text

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I'm running Mediawiki 1.34 and i customized the PluggableAuth login button text using $wgPluggableAuth_ButtonLabelMessage = 'Login with ABC credentials';

But, it is adding a weird character to the beginning and end of the text. Is that normal, can i get rid of them? See screen snip:

screen snip from login screen

thanks,

russ Relayman7 (talk) 22:07, 8 January 2020 (UTC)

That is because what the configuration variable is referring to is an internationalizable message, not a string. This configuration variable is usually set in another extension, not by the site administrator. Instead, you could edit the page MediaWiki:Pluggableauth-loginbutton-labelin your wiki.

See the description of the config variable at Extension:PluggableAuth#Configuration and information about overriding Messages at Help:System message#Overriding messages on-wiki. Cindy.cicalese (talk) 16:58, 20 February 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Could not bind to LDAP: (-1) Can't contact LDAP server only when using SSL

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I have managed to get everything working up to the point when i change the enctype from tls to ssl at this point i get the error

[7eb0e2783d82bac21aa4da06] /index.php/Special:PluggableAuthLogin MWException from line 157 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Could not bind to LDAP: (-1) Can't contact LDAP server

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(80): MediaWiki\Extension\LDAPProvider\Client->establishBinding()

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()

#2 /var/www/html/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(76): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#3 /var/www/html/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#4 /var/www/html/mediawiki/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#5 /var/www/html/mediawiki/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)

#6 /var/www/html/mediawiki/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#7 /var/www/html/mediawiki/includes/MediaWiki.php(900): MediaWiki->performRequest()

#8 /var/www/html/mediawiki/includes/MediaWiki.php(527): MediaWiki->main()

#9 /var/www/html/mediawiki/index.php(44): MediaWiki->run()

#10 {main}

Dturtill (talk) 11:00, 12 February 2020 (UTC)

now im getting the following error on tls

[cadcd2571028d80a8bda5cf1] /index.php/Special:PluggableAuthLogin MWException from line 128 of /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php: Could not start TLS!

Backtrace:

#0 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(79): MediaWiki\Extension\LDAPProvider\Client->maybeStartTLS()

#1 /var/www/html/mediawiki/extensions/LDAPProvider/src/Client.php(313): MediaWiki\Extension\LDAPProvider\Client->init()

#2 /var/www/html/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(76): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#3 /var/www/html/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(30): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#4 /var/www/html/mediawiki/includes/specialpage/SpecialPage.php(575): PluggableAuthLogin->execute(NULL)

#5 /var/www/html/mediawiki/includes/specialpage/SpecialPageFactory.php(611): SpecialPage->run(NULL)

#6 /var/www/html/mediawiki/includes/MediaWiki.php(296): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#7 /var/www/html/mediawiki/includes/MediaWiki.php(900): MediaWiki->performRequest()

#8 /var/www/html/mediawiki/includes/MediaWiki.php(527): MediaWiki->main()

#9 /var/www/html/mediawiki/index.php(44): MediaWiki->run()

#10 {main} Dturtill (talk) 11:53, 12 February 2020 (UTC)

Since this error occurs with Extension:LDAPProvider, you should request help on that talk page. Cindy.cicalese (talk) 16:52, 20 February 2020 (UTC)

I have the same problem when trying to swicht to SSL. Were you able to solve this problem? D3s3ertf0x (talk) 09:50, 3 April 2020 (UTC)

Since this error occurs with Extension:LDAPProvider, you should request help on that talk page. Cindy.cicalese (talk) 14:08, 3 April 2020 (UTC)

I have done that, I just wanted to know if Dturtill has solved it as he did not post on the talk page of the plugin D3s3ertf0x (talk) 07:52, 7 April 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Return to main page after login.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

MediaWiki 1.31.6

PHP 7.3.15 (cgi-fcgi)
MySQL 5.6.41-log
PluggableAuth 5.4 (300ac44) 01:28, 14 April 2018

How do I configure this to return to the page the login was initiated from? Seem that I always return to the main page. Legaulph (talk) 16:25, 9 March 2020 (UTC)

I thought I downloaded the latest. I see it is 5.7. I pulled it from git and seems to work now Legaulph (talk) 16:59, 9 March 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Replace standard login button

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I use this with LDAPAuthentication2. But on the login page there are now to login buttons, the standard one and the one by PluggableAuth. Login works perfetcly, but only with the second button. But I don't want the first button. How do I hide it? The Login via PluggableAuth is supposed to be the only way to log in. 2A00:8A60:C010:1:0:0:1:125B (talk) 11:20, 30 March 2020 (UTC)

Please include what your MediaWiki and extension versions are as well as any configuration settings. Are you seeing only two login buttons or also other fields such as a username and password field? What other extensions do you have enabled? Cindy.cicalese (talk) 03:43, 31 March 2020 (UTC)

MediaWiki 1.34 and the latest Versions of the plugins (just downloaded them). About what Plugins are active and their config:

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigs = "/var/www/mediawiki-1.34.0/ldapprovider.json";

wfLoadExtension( 'PluggableAuth' ); 

$wgPluggableAuth_EnableLocalLogin = true;

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

And obviously I don't only have the two buttons but also fields for username and password, otherwise "Login works perfetcly" wouldn't make a lot of sense 2A00:8A60:C010:1:0:0:1:1062 (talk) 13:50, 31 March 2020 (UTC)

@Osnard Can local login and LDAP login both be enabled simultaneously? I seem to remember discuss this at one point.

If you set $wgPluggableAuth_EnableLocalLogin to false or remove that line, the other button should disappear, but IIRC you will not be able to login locally. Cindy.cicalese (talk) 18:24, 31 March 2020 (UTC)

@Cindy.cicalese thanks, that did the trick. I thought that would remove the login fields entirely. But setting it to false and using $wgPluggableAuth_ButtonLabel I was able to simply replace the standard login button so nobody get's confused. Sure, now local login shouldn't be possible but if that would ever be necessary I can still revert it 2A00:8A60:C010:1:0:0:1:1011 (talk) 19:40, 31 March 2020 (UTC)

Great. I'm glad that worked. Cindy.cicalese (talk) 20:33, 31 March 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

is anyone using phpBB auth?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

i added a link to this page but it seems a little sketchy, i'm wondering if there's a more official solution, since Extension:PHPBB Auth relies on a deprecated plugin? Davecotter (talk) 18:37, 6 April 2020 (UTC)

I am not familiar with that method, but I'd rather not have the PluggableAuth extension page point to a method that is untested and not packaged itself as an extension. Cindy.cicalese (talk) 14:23, 7 April 2020 (UTC)

a valid concern, which if i think about it, was my concern as well. having thought about it, i agree it should not be linked from the main page. anyone searching hard enough will find this thread, with the link. thanks. Davecotter (talk) 18:49, 7 April 2020 (UTC)

Thank you! Cindy.cicalese (talk) 21:57, 7 April 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

API clientlogin with PluggableAuth

I am trying to log in to my private wiki using the clientlogin API from a linux-based IoT terminal which displays pages from the wiki that require authentication. I'm able to get the login token by posting "action=query&meta=tokens&type=login&format=json" to the API as specified in the API docs, but when I attempt to post "action=login&username=XX&password=XX&domain=XX&logintoken=XX&loginreturnurl=XX&format=json" to the API, the post is successful but I get [status: "FAIL", message: "The supplied credentials could not be authenticated.", messagecode: "authmanager-authn-no-primary"] in the response.

After doing some digging, it appears that this either has to do with PluggabeAuth removing the primary auth manager in $wgAuthManagerAutoConfig (as done in /includes/PluggableAuthHooks.php) or that perhaps PluggableAuth is serving as primary manager but turning down the request. When I run "action=query&meta=authmanagerinfo&amirequestsfor=login&format=json" through the API it shows that PluggableAuth has an additional field "pluggableauthlogin", which looks to be the login button, but I'm wondering if I somehow need to pass this as a parameter for the API login to work?

Any help would be greatly appreciated, as I'm running out of troubleshooting ideas here. Drcnyc (talk) 17:20, 9 April 2020 (UTC)

You cannot use the clientlogin API when PluggableAuth is enabled. Instead use the login API with a bot password. See Manual:Bot passwords and API:Login#Method 1. login. Cindy.cicalese (talk) 02:38, 10 April 2020 (UTC)

Thank you - the bot login worked! But the issue I am now facing is that a bot is limited to accessing wiki pages via api.php (action=parse), and it doesn't appear that there is a way for a bot to access the "full" HTML pages via index.php as they would normally appear in a browser when accessing the wiki. The parse method only returns stripped down versions of pages, with no formatting/css, links and images not working, etc. What I need is the ability to access wiki pages via index.php so that I can get the full interactive experience for wiki pages on the IoT terminal. I believe the only way to do this would be a full login via action=clientlogin vs a bot login via action=login. Any ideas on how I can accomplish this? Can I login via action=clientlogin using a local account if PluggableAuth is enabled? Drcnyc (talk) 02:07, 16 April 2020 (UTC)

Unfortunately, action=clientlogin will not work with PluggableAuth. It's been a while since I've looked at it, but I believe it has to do with the way that most PluggableAuth authentication plugins interact with an external identity provider with redirects to the identity provider and then back to the wiki. Cindy.cicalese (talk) 13:13, 16 April 2020 (UTC)

Image authorization

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Authorization is not invoked when an Image/File access occurs by executing img_auth.php (Manual:Image authorization). I wonder wheather the Extension:PluggableAuth respectively Extension:SimpleSAMLphp are interacting or not with this script, while in the source code https://doc.wikimedia.org/mediawiki-core/1.31.0/php/img__auth_8php_source.html there is a check for basic user authorization only. S0ring (talk) 13:10, 12 May 2020 (UTC)

Image authorization does indeed work with PluggableAuth. The authentication checks are done outside img_auth.php. Cindy.cicalese (talk) 13:46, 12 May 2020 (UTC)

Thank you for your quick reply. I am struggle with the img_auth.php script to make it working. I followed the article, I renamed the images directory, I moved it outside the DocumentRoot and I turned the php_admin_flag engine off. The images/files are now available under https://wiki.yourwiki.org/w/img_auth.php/01/01/Example.png ., but they are reachable without login, I expected to get a 403. S0ring (talk) 07:33, 14 May 2020 (UTC)

More information about your configuration would be helpful. For example, do you have your wiki set to require login to read?

$wgGroupPermissions['*']['read'] = false;

Login will only be enforced for image authorization if the content in your wiki is not readable without login.

Cindy.cicalese (talk) 17:32, 14 May 2020 (UTC)

Wow, exactly this settings was guilt, now the access to images/files is denied without login as expected. Thank you a lot! S0ring (talk) 06:39, 15 May 2020 (UTC)

Great! You're welcome! Cindy.cicalese (talk) 12:44, 15 May 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

How to return on previous page when login time out?

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Is there is any configuration to return on previous page when logged in time out?

Kindly help me here Rajeshrajesh.35 (talk) 11:47, 30 June 2020 (UTC)

No, there is no such configuration. Cindy.cicalese (talk) 14:03, 3 July 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Is there a way to avoid session timeout so quick with AzureAD?

Hi, I`m using mediawiki 1.34 with PluggableAuth and OpenIDConnect plugins, and after log in using AzureAD the session is expiring very fast.

Is there a way to set a specific time?

Thanks BrunoPenso (talk) 18:00, 16 July 2020 (UTC)

I think it might have to do with PHP, but pinging @Cindy.cicalese in case she has a better idea. ☠MarkAHershberger☢(talk)☣ 22:11, 23 July 2020 (UTC)

I've heard that setting $wgObjectCacheSessionExpiry to a larger value such as 24 hours is helpful. I'm also considering ways to expose the Remember Me functionality in core MediaWiki, which may be especially useful in SSO environments. Cindy.cicalese (talk) 16:25, 27 July 2020 (UTC)

Speaking of this, is there any updates about the Remember Me functionality, @Cindy.cicalese? Mdmallardi (talk) 21:58, 7 January 2021 (UTC)

I created a patch that included that and (way too much) other functionality, but then I got stalled realizing that other aspects of the patch break backward compatibility with MW 1.31. I should break out the Remember Me part into its own patch. https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PluggableAuth/+/606057 Cindy.cicalese (talk) 22:12, 7 January 2021 (UTC)

Unfortunately, my organization is currently using 1.31.12, and so I would love to see a broken out patch. Thanks! Mdmallardi (talk) 22:20, 7 January 2021 (UTC)

As a quick follow up to this, I've tried patchset 10 on mediawiki 1.35.1 with the REL1_35 version of OpenIDConnect, and the OpenIDConnect extension cannot find the PluggableAuth Class to extend. The same happens when I try the HEAD of the master branch for OpenIDConnect.

Thanks!! Mdmallardi (talk) 18:29, 1 February 2021 (UTC)

Yes, unfortunately that patch is not quite ready for testing yet. I hope to get back to working on it soon. Cindy.cicalese (talk) 19:38, 1 February 2021 (UTC)

There is now a patch that would add the additional Remember Me behavior. However, it turns out that it needed to be a MediaWiki core patch, since the Remember Me implementation was not sufficiently flexible to allow me to modify it from PluggableAuth. This, sadly, means that it would require a MediaWiki upgrade to get the new behavior, if it is merged. See https://gerrit.wikimedia.org/r/c/mediawiki/core/+/665805. Cindy.cicalese (talk) 21:38, 2 March 2021 (UTC)

We had the same Problem with KeyCloak and Wiki Version "1.31.10".

To solve the problem you have to increase the value of the parameter $wgObjectCacheSessionExpiry for example to 8 Hours (28800 seconds). The default value is 3600 seconds. 80.156.94.66 (talk) 09:13, 29 March 2021 (UTC)

There is also new functionality in MediaWiki 1.36 that adds a $wgRememberMe configuration variable. This will allow you to extend login sessions so that your users will not be logged out as frequently. See https://gerrit.wikimedia.org/r/c/mediawiki/core/+/665805. Cindy.cicalese (talk) 15:45, 29 March 2021 (UTC)

hi, I'm using MW1.34.2, Plugthauth & OpenID connect to Azure AD, the same issue, & users complains too fast to be force logout.

Good news are seems 1.36 would solve it. Lamjon (talk) 07:05, 22 April 2021 (UTC)

Standard "Log in" vs. "Log in with PluggableAuth"

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I've installed MediaWiki 1.31.8 with the LDAPProvider, PluggableAuth, and LDAPAuthentication2. I have two kinds of users, namely local users, which need to be generated manually by an admin, and automatically-generated users that are authenticated through LDAP. For testing purposes I use the public LDAP server of forumsys.com. Here is the relevant part of my LocalSettings.php:

$wgGroupPermissions['*']['autocreateaccount'] = true;

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigs = "{$IP}/../ldapprovider.json";

$wgDebugLogGroups['LDAP'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableLocalLogin =true;

$wgPluggableAuth_EnableLocalProperties = true;

$wgDebugLogGroups['PluggableAuth'] = "/var/log/mediawiki/{$wgDBname}-debug-authentication.log";

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2AllowLocalLogin = true;

$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$wgDebugLogGroups['LDAPAuthentication2'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

The login page shows the standard "Log in" button and a "Log in with PluggableAuth" button. Furthermore, there is a drop-down menu that lets me choose between "LDAP" and "local" when logging in with PluggableAuth. I can log in with credentials from forumsys.com (e.g. user riemann) when I choose "LDAP" and press on "Log in with PluggableAuth". I can also log in with local user credentials (e.g. the admin account that I created during installation of the wiki) when I choose "local" then then press the "Log in with PluggableAuth" button. However, I can not change the password of this admin account and I can also not use this admin account to create a new local user account. When I try to do this I get the following error message:

The supplied credentials could not be used for account creation.

The log file contains the following entry:

[authentication] MediaWiki\Auth\AuthManager::continueAccountCreation: Primary creation failed because no provider accepted

However, when I log in as admin using the standard "Log in" button, I can change my password and I can also create new local users. Is this behaviour intended? Is there a possibility to log in as admin using PluggableAuth so that I can change the password and create new users like when using the standard "Log in" button? 31.172.149.79 (talk) 23:57, 4 August 2020 (UTC)

A few updates (sorry for posting from a different IP address):

I updated the database with "sudo -u apache php maintenance/update.php" (I'm using CentOS) and rebootet the Linux box. After the reboot I did not have the problem described above anymore, i.e. when I log in with my local admin account using PluggableAuth I can create new users and I can also change my password and email address. So this works now as expected. However, every time I log in locally using PluggableAuth (i.e. choosing "local" on drop-down menu) I get the following entry in my error log:

2020-08-06 18:42:32 xxx xxx: [XyxPGJpnV5T--FbH105FNQAAAIM] /index.php/Special:PluggableAuthLogin   ErrorException from line 77 of /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

#0 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(77): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#2 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#3 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#4 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#5 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#6 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#7 {main}

I don't get this message in my log file when I log in using the standard "Log in" button, but only when I log in with PluggableAuth. I also don't get any error log when I log in with credentials from forumsys.com (e.g. user riemann) and choose "LDAP" for log in with PluggableAuth. Any idea what could be the reason for this message in the error log? I'm using version 5.4 (300ac44) of PluggableAuth. 2001:A18:0:B23:0:0:0:6 (talk) 18:58, 6 August 2020 (UTC)

A further question: Does it matter in which order the LDAPProvider, PluggableAuth, and LDAPAuthentication2 extensions are loaded and configured? 2001:A18:0:B23:0:0:0:6 (talk) 19:14, 6 August 2020 (UTC)

@Osnard is the best person to answer these questions. Cindy.cicalese (talk) 20:30, 6 August 2020 (UTC)

No, order of loading/configuring is not important. Osnard (talk) 10:13, 7 August 2020 (UTC)

Could you please share the contents of the "ldapprovider.json"? Is this file readable by the webserver?

It looks like the issue might come from here: https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/1.0.1/src/ExtraLoginFields.php#L39, which again could mean https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/blob/1.0.1/src/Setup.php#L12 returns a non-array. Osnard (talk) 10:27, 7 August 2020 (UTC)

Hi Osnard, I'm using the static json file from Extension:LDAPProvider . I didn't modify the file. The owner of the file is apache (I'm using CentOS 8). I strongly suppose the file is readable by the webserver since I can log in using credentials from forumsys.com, e.g. I can log in as user riemann. Thanks for your help! 31.172.149.79 (talk) 10:34, 7 August 2020 (UTC)

The strange thing with the message

ErrorException from line 77 of /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

is, that there is not call to count() anywhere in PluggableAuth. could you please share this particular section of the code? Line 70 to 90 of /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php? Osnard (talk) 12:45, 7 August 2020 (UTC)

This is the full PluggableAuthLogin.php (the version of PluggableAuth is 5.4 (300ac44))

<?php

use \MediaWiki\Auth\AuthManager;

class PluggableAuthLogin extends UnlistedSpecialPage {

   const RETURNTOURL_SESSION_KEY = 'PluggableAuthLoginReturnToUrl';

   const RETURNTOPAGE_SESSION_KEY = 'PluggableAuthLoginReturnToPage';

   const RETURNTOQUERY_SESSION_KEY = 'PluggableAuthLoginReturnToQuery';

   const EXTRALOGINFIELDS_SESSION_KEY = 'PluggableAuthLoginExtraLoginFields';

   const USERNAME_SESSION_KEY = 'PluggableAuthLoginUsername';

   const REALNAME_SESSION_KEY = 'PluggableAuthLoginRealname';

   const EMAIL_SESSION_KEY = 'PluggableAuthLoginEmail';

   const ERROR_SESSION_KEY = 'PluggableAuthLoginError';

   public function __construct() {

       parent::__construct( 'PluggableAuthLogin' );

   }

   /**

    * @param string|null $param parameters (ignored)

    */

   public function execute( $param ) {

       wfDebugLog( 'PluggableAuth', 'In execute()' );

       $authManager = AuthManager::singleton();

       $user = $this->getUser();

       $pluggableauth = PluggableAuth::singleton();

       $error = null;

       if ( $pluggableauth ) {

           if ( $pluggableauth->authenticate( $id, $username, $realname, $email,

                   $error ) ) {

               if ( is_null( $id ) ) {

                   $user->loadDefaults( $username );

                   $user->mName = $username;

                   $user->mRealName = $realname;

                   $user->mEmail = $email;

                   $user->mEmailAuthenticated = wfTimestamp();

                   $user->mTouched = wfTimestamp();

                   wfDebugLog( 'PluggableAuth', 'Authenticated new user: ' . $username );

               } else {

                   $user->mId = $id;

                   $user->loadFromId();

                   wfDebugLog( 'PluggableAuth', 'Authenticated existing user: ' . $user->mName );

               }

               $authorized = true;

               Hooks::run( 'PluggableAuthUserAuthorization', [ $user, &$authorized ] );

               if ( $authorized ) {

                   $authManager->setAuthenticationSessionData(

                       self::USERNAME_SESSION_KEY, $username );

                   $authManager->setAuthenticationSessionData(

                       self::REALNAME_SESSION_KEY, $realname );

                   $authManager->setAuthenticationSessionData(

                       self::EMAIL_SESSION_KEY, $email );

                   wfDebugLog( 'PluggableAuth', 'User is authorized.' );

               } else {

                   wfDebugLog( 'PluggableAuth', 'Authorization failure.' );

                   $error = wfMessage( 'pluggableauth-not-authorized', $username )->text();

               }

           } else {

               wfDebugLog( 'PluggableAuth', 'Authentication failure.' );

               if ( is_null( $error ) ) {

                   $error = wfMessage( 'pluggableauth-authentication-failure' )->text();

               } else {

                   if ( !is_string( $error ) ) {

                       $error = strval( $error );

                   }

                   wfDebugLog( 'PluggableAuth', 'ERROR: ' . $error );

               }

           }

       }

       if ( !is_null( $error ) ) {

           $authManager->setAuthenticationSessionData( self::ERROR_SESSION_KEY,

               $error );

       }

       $returnToUrl = $authManager->getAuthenticationSessionData(

           self::RETURNTOURL_SESSION_KEY );

       if ( is_null( $returnToUrl ) || count( $returnToUrl ) === 0 ) {

           wfDebugLog( 'PluggableAuth', 'ERROR: return to URL is null or empty' );

       } else {

           $this->getOutput()->redirect( $returnToUrl );

       }

   }

} 2001:A18:0:B23:0:0:0:6 (talk) 13:56, 7 August 2020 (UTC)

Well, even though the line number is wrong, I can say that the count() call has been replaced in current versions: https://github.com/wikimedia/mediawiki-extensions-PluggableAuth/commit/254742d21964a36a48ae8b13001b2dd07c6f10ed#diff-294579ff13ff80d676d43fad3ade34d8L78

But I don't think this is really related. I think the issue is more that you use the standard "Login" button with domain "local", instead of just the "Login with PluggableAuth". I'd recommend to rename "Login with PluggableAuth" to "Login" with $wgPluggableAuth_ButtonLabel or $wgPluggableAuth_ButtonLabelMessage, disable local login provided by PluggableAuth ($wgPluggableAuth_EnableLocalLogin) but keep it enabled with LDAPAuthentication2 ($LDAPAuthentication2AllowLocalLogin). Osnard (talk) 15:01, 7 August 2020 (UTC)

Dear Osnard, thanks for your reply. I modified LocalSettings.php, it looks now as follows:

$wgGroupPermissions['*']['autocreateaccount'] = true;

wfLoadExtension( 'LDAPProvider' );

$LDAPProviderDomainConfigs = "{$IP}/../ldapprovider.json";

$wgDebugLogGroups['LDAP'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

$wgDebugLogGroups['MediaWiki\\Extension\\LDAPProvider\\Client'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableLocalLogin = false;

$wgPluggableAuth_ButtonLabel = "Log in";

$wgPluggableAuth_EnableLocalProperties = false;

$wgDebugLogGroups['PluggableAuth'] = "/var/log/mediawiki/{$wgDBname}-debug-authentication.log";

wfLoadExtension( 'LDAPAuthentication2' );

$LDAPAuthentication2AllowLocalLogin = true;

#$LDAPAuthentication2UsernameNormalizer = 'strtolower';

$wgDebugLogGroups['LDAPAuthentication2'] = "/var/log/mediawiki/{$wgDBname}-debug-ldap.log";

Unfortunately, I still get the same error message when I log in as a local user (using PluggableAuth):

2020-08-07 15:22:18 xxx xxx: [Xy1xqZUuCaGRGbZLo4WcogAAANI] /index.php/Special:PluggableAuthLogin   ErrorException from line 77 of /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

#0 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(77): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#2 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#3 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#4 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#5 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#6 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#7 {main}

When I log in as user Riemann (using LDAP), I get even more error messages (four altogether) that seem to come from Client.php, PlatformFunctionWrapper.php, and PluggableAuthLogin.php:

2020-08-07 15:24:28 xxx xxx: [Xy1yLJUuCaGRGbZLo4WcpwAAAMc] /index.php/Special:PluggableAuthLogin   ErrorException from line 122 of /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php: PHP Notice: Array to string conversion

#0 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(122): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(90): MediaWiki\Extension\LDAPProvider\Client->setConnectionOptions()

#2 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()

#3 /var/www/mediawiki-1.31.8/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#4 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#5 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#6 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#7 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#8 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#9 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#10 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#11 {main}

2020-08-07 15:24:28 xxx xxx: [Xy1yLJUuCaGRGbZLo4WcpwAAAMc] /index.php/Special:PluggableAuthLogin   ErrorException from line 123 of /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php: PHP Warning: constant(): Couldn't find constant 0

#0 [internal function]: MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(123): constant(string)

#2 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(90): MediaWiki\Extension\LDAPProvider\Client->setConnectionOptions()

#3 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()

#4 /var/www/mediawiki-1.31.8/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#5 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#6 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#7 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#8 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#9 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#10 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#11 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#12 {main}

2020-08-07 15:24:28 xxx xxx: [Xy1yLJUuCaGRGbZLo4WcpwAAAMc] /index.php/Special:PluggableAuthLogin   ErrorException from line 52 of /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: PHP Notice: Array to string conversion

#0 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/PlatformFunctionWrapper.php(52): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(123): MediaWiki\Extension\LDAPProvider\PlatformFunctionWrapper->setOption(NULL, array)

#2 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(90): MediaWiki\Extension\LDAPProvider\Client->setConnectionOptions()

#3 /var/www/mediawiki-1.31.8/extensions/LDAPProvider/src/Client.php(329): MediaWiki\Extension\LDAPProvider\Client->init()

#4 /var/www/mediawiki-1.31.8/extensions/LDAPAuthentication2/src/PluggableAuth.php(77): MediaWiki\Extension\LDAPProvider\Client->canBindAs(string, string)

#5 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->authenticate(NULL, string, NULL, NULL, NULL)

#6 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#7 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#8 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#9 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#10 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#11 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#12 {main}

2020-08-07 15:24:29 xxx xxx: [Xy1yLJUuCaGRGbZLo4WcpwAAAMc] /index.php/Special:PluggableAuthLogin   ErrorException from line 77 of /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

#0 /var/www/mediawiki-1.31.8/extensions/PluggableAuth/includes/PluggableAuthLogin.php(77): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPage.php(565): PluggableAuthLogin->execute(NULL)

#2 /var/www/mediawiki-1.31.8/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#3 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Title, RequestContext)

#4 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(861): MediaWiki->performRequest()

#5 /var/www/mediawiki-1.31.8/includes/MediaWiki.php(524): MediaWiki->main()

#6 /var/www/mediawiki-1.31.8/index.php(42): MediaWiki->run()

#7 {main} 2001:A18:0:B23:0:0:0:6 (talk) 15:30, 7 August 2020 (UTC)

One more note: I do not get an error message when I completely disable the LDAPProvider, PluggableAuth, LDAPAuthentication2 extensions. Of course, I can then only log in locally. 2001:A18:0:B23:0:0:0:6 (talk) 12:39, 10 August 2020 (UTC)

The PHP Notice: Array to string conversion and PHP Warning: constant(): Couldn't find constant 0 are most likely caused by a bad value in connection.options of you domain config. It may have been caused by a bad example in the offical documentation: https://www.mediawiki.org/w/index.php?diff=4029642&oldid=3978464&title=Extension:LDAPProvider&type=revision&diffmode=source

But regarding ErrorException from line 77 of PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable I really have no idea, as there is no call to the function count() near line 77 in the code file your provided.

I can only recommend trying to update the LDAP Stack extensions completely. Try using the versions from branch REL1_31. Osnard (talk) 15:46, 10 August 2020 (UTC)

Dear Osnard,

Volltreffer! The correction of the brackets in ldapprovider.json eliminated all error messages except the one that originates from line 77 of PluggableAuth. Thanks a lot for solving this problem, I think this is very useful for other users who try to install and configure the LDAP extensions the first time.

I will follow you advice and update the LDAP Stack extensions completely (I'm currently using the latest versions for MW1.31 that are available on the corresponding extension pages, e.g. for PluggableAuth it is PluggableAuth-REL1_31-300ac44.tar.gz). What exactly do you mean with "versions from branch REL1_31"? The versions from Github, which is mediawiki-extensions-PluggableAuth/tree/REL1_31 for PluggableAuth? 31.172.149.79 (talk) 14:02, 11 August 2020 (UTC)

Try

• https://github.com/wikimedia/mediawiki-extensions-PluggableAuth/archive/5.7.zip
• https://github.com/wikimedia/mediawiki-extensions-LDAPProvider/archive/REL1_31.zip
• https://github.com/wikimedia/mediawiki-extensions-LDAPAuthentication2/archive/REL1_31.zip
• https://github.com/wikimedia/mediawiki-extensions-LDAPAuthorization/archive/REL1_31.zip
• https://github.com/wikimedia/mediawiki-extensions-LDAPUserGroups/archive/REL1_31.zip
• https://github.com/wikimedia/mediawiki-extensions-LDAPUserInfo/archive/REL1_31.zip Osnard (talk) 16:14, 11 August 2020 (UTC)

Dear Osnard,

Thanks again for your help, I finally got rid of the last error message (which is the error message originating from line 77 PluggableAuthLogin.php) by installing the versions of LDAPProvider, LDAPAuthentication2, and PluggableAuth you linked above (I'm only using these 3 extensions from the LDAP stack).

I checked the difference between LDAPProvider from the extension page (which is LDAPProvider-REL1_31-8e93a3e.tar.gz) and the version from GitHub; the two versions are largely identical, the only difference is that the latter does not contain the files composer.lock, gitinfo.json, and version, as well as the subdirectory 'vendor'. All other files, which includes all PHP files from the src subdirectory, are identical.

The same holds for the LDAPAuthentication2 versions from the extension homepage and from GitHub. Both versions are identical except that the latter does not contain the files gitinfo.json and version, and it also does not contain the subdirectory 'vendor'.

However, the PluggableAuth version from the extension homepage (which is PluggableAuth-REL1_31-300ac44.tar.gz) differs significantly from the GitHub version. For example, the part of PluggableAuthLogin.php from where the error message comes from looks as follows in the version from the extension website:

       if ( is_null( $returnToUrl ) || count( $returnToUrl ) === 0 ) {

           wfDebugLog( 'PluggableAuth', 'ERROR: return to URL is null or empty' );

       } else {

           $this->getOutput()->redirect( $returnToUrl );

       }

The corresponding code segment of the version from GitHub is here:

       if ( is_null( $returnToUrl ) || strlen( $returnToUrl ) === 0 ) {

           wfDebugLog( 'PluggableAuth', 'ERROR: return to URL is null or empty' );

           $this->getOutput()->wrapWikiMsg( "<div class='error'>\n$1\n</div>",

               'pluggableauth-fatal-error' );

       } else {

           $this->getOutput()->redirect( $returnToUrl );

       }

Given that MediaWiki 1.31 is still supported until June 2021, it would IMHO make sense to fix this issue in PluggableAuth and update it (and also LDAPProvider and LDAPAuthentication2 if needed). I suppose this is now the right time to pass the ball back to @Cindy.cicalese . 2001:A18:0:B23:0:0:0:6 (talk) 16:43, 17 August 2020 (UTC)

I believe PluggableAuth does not follow the LTS branch approach, but uses real SemVer versioning. Therefor I am not sure if if makes sense to add changes from 5.7 to REL1_31. You can use 5.7 with REL1_31 MediaWikis quite well. This is probably more a question of documentation. Osnard (talk) 07:29, 7 October 2020 (UTC)

As Osnard stated, PluggableAuth currently supports the master branch only, which retains compatability back to at least the most recent LTS. That may change in the future. Cindy.cicalese (talk) 21:03, 3 November 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Picking up WebRequest object in authenticate()

I'm trying to pick up a custom GET variable within the authenticate() function in my extension building upon PluggableAuth.

As far as I understand it, to do so MediaWiki requires me to pick up the WebRequest object to be able to call getText('customGETvar').

Within my authenticate() function, I've tried different options for picking up the WebRequest object as mentioned in the mediawiki manual, notably these three:  

$this->getRequest();

$this->getMain()->getRequest();

global $wgRequest;

These don't work. Clearly, I'm lost... Can anyone help? Cheers! 2001:985:5065:1:5044:2FA3:B184:953D (talk) 09:59, 20 September 2020 (UTC)

I'm not sure, but it seems like this should work:

$authManager = AuthManager::singleton();

$request = $authManager->getRequest();

However, I think the additional GET request variables I'm sending to Special:UserLogin are not actually available within my plugin's authenticate() function. I presume this has something to do with the fact that it's actually Special:PluggableAuthLogin where the action happens (again, as far as I understand it).

All help highly appreciated. Thanks in advance. 2001:985:5065:1:54FD:AFB1:82B9:4AD4 (talk) 15:07, 20 September 2020 (UTC)

"Could not find username attribute: uid" error

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

Hello, I'm running into an issue with PluggableAuth and/or SimpleSAMLphp plugins that are beyond my meager ability to rectify. This is a duplicate post from the SimpleSAMLphp plugin talk page because I'm unsure where the problem lies.

Mediawiki version: 1.34.2

PluggableAuth version: REL1_34

SimpleSAMLphp (plugin) version: REL1_34

SimpleSAMLphp (application) version: 1.18.7

The SimpleSAMLphp application appears to be working correctly, I can access the web control panel, have exchanged metadata with our SAML administrator here on campus, and it successfully passes me through to the university's login page when I test authentication. However, Mediawiki is not handling something correctly. Very possibly due to bad configuration on my part.

When I attempt to log in with the PluggableAuth button I am taken to my university's login page but when I enter my credentials there I am shortly returned back to the MediaWiki login page with the error "could not find username attribute: uid" in a red box above fields for username and password. This error message will change depending on what value is in the "$wgSimpleSAMLphp_UsernameAttribute" variable. If that contains "username" the error says "username". If it contains "uid" then the error says "uid", etc.

When I sent this error to the SAML administrator he said "Hmm...for some reason it isn't finding the uid attribute in the SAML assertion.  I know it's being released since I can see it in my logs."

Here are the relevant settings from my LocalSettings.php:

wfLoadExtension( 'PluggableAuth' );

$wgPluggableAuth_EnableAutoLogin = true;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = true;

//$wgPluggableAuth_ButtonLabelMessage = "PluggableAuth Login";

//$wgPluggableAuth_Class = 'SimpleSAMLphp';

wfLoadExtension( 'SimpleSAMLphp' );

$wgSimpleSAMLphp_InstallDir = "/var/simplesamlphp";

$wgSimpleSAMLphp_AuthSourceId = "default-sp";

$wgSimpleSAMLphp_RealNameAttribute = "givenName";

$wgSimpleSAMLphp_EmailAttribute = "mail";

$wgSimpleSAMLphp_UsernameAttribute = "uid";

The wiki debug log contains the following seemingly relevant lines:

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[SimpleSAMLphp] Could not find username attribute: uid

[PluggableAuth] Authentication failure.

[PluggableAuth] ERROR: Could not find username attribute: uid

[session] SessionBackend "crqehku38g33i88npuilpc2r199rqmfs" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Se        ssion->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "crqehku38g33i88npuilpc2r199rqmfs" save: dataDirty=1 metaDirty=0 forcePersist=0 Adarkwmu (talk) 15:35, 20 October 2020 (UTC)

Did you test the simpleSAMLphp library configuration using https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_5 to see what attributes are returned? Cindy.cicalese (talk) 21:10, 3 November 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Doesn't work

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

I do everything according to the instructions:

1. Activate extension wfLoadExtension( 'PluggableAuth' );
2. Enable rights $wgGroupPermissions['*']['createaccount'] = true; $wgGroupPermissions['*']['autocreateaccount'] = true;

But always when I try to login, I get this error and can't enter any login data:

"Предоставленные учётные данные не связаны ни с одним участником этой вики."

In English, it corresponds this string "authmanager-authn-no-local-user".

I tested on clean MediaWiki 1.35. Аргскригициониец (talk) 20:54, 15 November 2020 (UTC)

Which authentication plugin are you using (e.g. OpenID Connect, SimpleSAMLphp, etc.)? What version of the extensions are you using? Cindy.cicalese (talk) 01:03, 16 November 2020 (UTC)

Hmm, I've found the reason, I should set $wgPluggableAuth_EnableLocalLogin as true. Аргскригициониец (talk) 10:29, 16 November 2020 (UTC)

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Combine with account confirmation

Hi! I'm using this extension with the SimpleSAMLphp extension and it works flawlessly. However, an issue I have is that I only want a subset of the people that have the required SAML credentials to be able to log in. I can't do this with clever checking of SAML attributes (unless I manually specify hundreds of users), so I was hoping to be able to manually confirm/deny people's requests to make an account. Extension:ConfirmAccount seems to do exactly that, but at first sight it seems incompatible with PluggableAuth; $wgGroupPermissions['*']['createaccount'] = true; is not allowed for the ConfirmAccount extension. Are the two extensions indeed not compatible? 2A02:A452:64AD:1:2974:BDBC:157A:7CAC (talk) 11:48, 20 November 2020 (UTC)

ConfirmAccount is not compatible with SimpleSAMLphp, but perhaps you could use Extension:Email Authorization with wgEmailAuthorization_EnableRequests enabled? Cindy.cicalese (talk) 15:33, 20 November 2020 (UTC)

I'm not sure that would work with SimpleSAMLphp; I have the feeling it adds a separate method of authentication instead? It would be great if signing in via SAML makes the user end up on an email authorization list, but I don't think that is what would happen, right? 2A02:A452:64AD:1:D56B:453C:1F65:CFB7 (talk) 16:06, 20 November 2020 (UTC)

Or do I not understand the extension properly; would users simply login via SAML, but then only be able to access the email request page? That could work 2A02:A452:64AD:1:D56B:453C:1F65:CFB7 (talk) 16:09, 20 November 2020 (UTC)

Yes, it does work with SimpleSAMLphp. The PluggableAuth extension that SimpleSAMLphp is built upon supports two steps: authentication (which would be done by SimpleSAMLphp) and authorization (which would be done by EmailAuthentication). See Extension:PluggableAuth for a description of the two phases. This was created expressly for the purpose you described: limiting access to the wiki to a subset of the users that can authenticate with the identity provider. EmailAuthorization also supports the step you were requesting: self-service account requests that would be approved by a wiki admin. Cindy.cicalese (talk) 16:18, 20 November 2020 (UTC)

Actually, I see that the latter functionality is not well documented on the extension page. The user requesting an account would go to the Special:EmailAuthorizationRequest page on the wiki to request an account. The wiki admin would go to the Special:EmailAuthorizationApprove page on the wiki to approve/reject the request. Cindy.cicalese (talk) 16:23, 20 November 2020 (UTC)