Closed mohe2015 closed 2 years ago
Login, user creation or account linking code will call getAuthenticationRequests(), populate the requests with data (by using them to build a HTMLForm and have the user fill it, or by exposing a form specification via the API, so that the client can build it), and pass them to the appropriate begin method. That will return either a success/failure response, or more requests to fill (either by building a form or by redirecting the user to some external provider which will send the data back), in which case they need to be submitted to the appropriate continue method and that step has to be repeated until the response is a success or failure response. AuthManager will use the session to maintain internal state during the process. https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AuthManager.html
"MediaWiki uses the username as a primary identifier which makes this awkward."
https://phabricator.wikimedia.org/T138678#3911381 shows autocreation currently only seems badly by returning a username and hope there is no timing attack
Maybe implement merge handling like https://github.com/wikimedia/mediawiki-extensions-GoogleLogin/blob/master/includes/GoogleLoginHooks.php
https://www.mediawiki.org/wiki/Manual:$wgAuthManagerAutoConfig
https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AbstractPrimaryAuthenticationProvider.html
https://github.com/wikimedia/mediawiki-extensions-GoogleLogin/blob/master/includes/Auth/GooglePrimaryAuthenticationProvider.php
https://doc.wikimedia.org/mediawiki-core/master/php/classAuthManagerSpecialPage.html
https://github.com/wikimedia/mediawiki/blob/master/includes/specials/SpecialUserLogin.php
https://github.com/wikimedia/mediawiki/blob/master/includes/specialpage/LoginSignupSpecialPage.php