BryanDavis has uploaded a new change for review.
https://gerrit.wikimedia.org/r/147020
Change subject: Allow login with pre-rename username and password
......................................................................
Allow login with pre-rename username and password
Add a feature flag and logic to handle automatic authentication as
"USER~WIKI" for users who have been forcefully renamed during SUL
migration. A user authenticated via this path will end up logged in
under their renamed account and have a flag in their session that
identifies them as having passed through the automated username
mangling path. This durable identifier can be used later to alter the
user's on-wiki experience by providing them with warnings and guidance
regarding the changes to their account.
Happy path test:
* Install MediaWiki-Vagrant
* Enable 'centralauth' role
* Create a new user account (eg 'SulTest')
* Create a second user named '<USER>~wiki' (eg 'SulTest~wiki') with
a different password to simulate a user who was force migrated
* Set '$wgCentralAuthCheckSULMigration = true;' in LocalSettings
* Login using the username from the first account and the password form
the second account
* Expect to see the second username as the authenticated user
* Expect to see debug log output on the 'SUL' channel describing the
automated username change and authentication result
Bug: 67995
Change-Id: I86168c64da2253c96edfb1856e91410bf6bcf7a5
---
M CentralAuth.php
M CentralAuthHooks.php
M CentralAuthPlugin.php
M specials/SpecialCentralLogin.php
4 files changed, 64 insertions(+), 7 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/mediawiki/extensions/CentralAuth
refs/changes/20/147020/1
diff --git a/CentralAuth.php b/CentralAuth.php
index 7cf0c15..7339622 100644
--- a/CentralAuth.php
+++ b/CentralAuth.php
@@ -220,6 +220,13 @@
$wgCentralAuthPreventUnattached = false;
/**
+ * Enable special logic to attempt to ease the user facing impact of forced
+ * user migrations.
+ * @var bool
+ */
+$wgCentralAuthCheckSULMigration = false;
+
+/**
* Initialization of the autoloaders, and special extension pages.
*/
$caBase = __DIR__;
diff --git a/CentralAuthHooks.php b/CentralAuthHooks.php
index b9d2ea0..a8bb13d 100644
--- a/CentralAuthHooks.php
+++ b/CentralAuthHooks.php
@@ -382,6 +382,15 @@
*/
static function onUserLoginComplete( &$user, &$inject_html ) {
global $wgCentralAuthLoginWiki, $wgCentralAuthCookies;
+ global $wgCentralAuthCheckSULMigration;
+
+ if ( $wgCentralAuthCheckSULMigration && isset(
$user->sulRenamed ) ) {
+ // Add a flag in the user's session to track that they
authenticated
+ // with a pre-migration username.
+ $context = RequestContext::getMain();
+ $request = $context->getRequest();
+ $request->setSessionData( 'CentralAuthForcedRename',
true );
+ }
if ( !$wgCentralAuthCookies ) {
// Use local sessions only.
diff --git a/CentralAuthPlugin.php b/CentralAuthPlugin.php
index 3495f4c..d313478 100644
--- a/CentralAuthPlugin.php
+++ b/CentralAuthPlugin.php
@@ -8,6 +8,13 @@
*/
class CentralAuthPlugin extends AuthPlugin {
+
+ /**
+ * Username forced on the user by single user login migration.
+ * @var string $sulMigrationName
+ */
+ public $sulMigrationName = null;
+
/**
* Check whether there exists a user account with the given name.
* The name will be normalized to MediaWiki's requirements, so
@@ -35,7 +42,7 @@
* @public
*/
function authenticate( $username, $password ) {
- global $wgCentralAuthAutoMigrate;
+ global $wgCentralAuthAutoMigrate,
$wgCentralAuthCheckSULMigration;
$central = new CentralAuthUser( $username );
if ( !$central->exists() ) {
@@ -47,6 +54,19 @@
}
$passwordMatch = $central->authenticate( $password ) == "ok";
+
+ if ( !$passwordMatch && $wgCentralAuthCheckSULMigration ) {
+ // Check to see if this is a user who was affected by a
global username
+ // collision during a forced migration to central auth
accounts.
+ $wiki = wfWikiID();
+ $this->sulMigrationName = "{$username}~{$wiki}";
+ wfDebugLog( 'SUL',
+ "Checking for migration of '{$username}' to
'{$this->sulMigrationName}'"
+ );
+ $renamed = new CentralAuthUser( $this->sulMigrationName
);
+ $passwordMatch = $renamed->exists() &&
+ $renamed->authenticate( $password ) == "ok";
+ }
if ( $passwordMatch && $wgCentralAuthAutoMigrate ) {
// If the user passed in the global password, we can
identify
@@ -109,13 +129,26 @@
* @return bool
*/
public function updateUser( &$user ) {
+ global $wgCentralAuthCheckSULMigration;
+
$central = CentralAuthUser::getInstance( $user );
- if ( $central->exists() && $central->isAttached() &&
- $central->getEmail() != $user->getEmail() )
- {
- $user->setEmail( $central->getEmail() );
- $user->mEmailAuthenticated =
$central->getEmailAuthenticationTimestamp();
- $user->saveSettings();
+ if ( $central->exists() && $central->isAttached() ) {
+ if ( $wgCentralAuthCheckSULMigration &&
+ isset( $this->sulMigrationName )
+ ) {
+ wfDebugLog( 'SUL', "Coercing user to
'{$this->sulMigrationName}'" );
+ // Create a new user object using the
post-migration name
+ $user = User::newFromName(
$this->sulMigrationName );
+ // Annotate the user so we can tell them about
the change to their
+ // username.
+ $user->sulRenamed = true;
+ }
+
+ if ( $central->getEmail() != $user->getEmail() ) {
+ $user->setEmail( $central->getEmail() );
+ $user->mEmailAuthenticated =
$central->getEmailAuthenticationTimestamp();
+ $user->saveSettings();
+ }
}
return true;
}
diff --git a/specials/SpecialCentralLogin.php b/specials/SpecialCentralLogin.php
index 20ff18b..a09685c 100644
--- a/specials/SpecialCentralLogin.php
+++ b/specials/SpecialCentralLogin.php
@@ -135,6 +135,7 @@
*/
protected function doLoginComplete( $token ) {
global $wgUser, $wgMemc, $wgSecureLogin;
+ global $wgCentralAuthCheckSULMigration;
$request = $this->getRequest();
@@ -240,6 +241,13 @@
( $attempt['finalProto'] == 'https' ) // influnces
http/https of returnTo page
);
$this->getOutput()->setPageTitle( $this->msg(
'centralloginsuccesful' ) );
+ if ( $wgCentralAuthCheckSULMigration &&
+ $request->getSessionData( 'CentralAuthForcedRename' )
=== true
+ ) {
+ wfDebugLog( 'SUL',
+ "Login completed for renamed user
'{$wgUser->getName()}'"
+ );
+ }
}
protected function showLoginStatus() {
--
To view, visit https://gerrit.wikimedia.org/r/147020
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I86168c64da2253c96edfb1856e91410bf6bcf7a5
Gerrit-PatchSet: 1
Gerrit-Project: mediawiki/extensions/CentralAuth
Gerrit-Branch: master
Gerrit-Owner: BryanDavis <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
