Interesting

[mohe2015]

https://www.mediawiki.org/wiki/Manual:$wgAuthManagerAutoConfig

https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AbstractPrimaryAuthenticationProvider.html

https://github.com/wikimedia/mediawiki-extensions-GoogleLogin/blob/master/includes/Auth/GooglePrimaryAuthenticationProvider.php

https://doc.wikimedia.org/mediawiki-core/master/php/classAuthManagerSpecialPage.html

https://github.com/wikimedia/mediawiki/blob/master/includes/specials/SpecialUserLogin.php

https://github.com/wikimedia/mediawiki/blob/master/includes/specialpage/LoginSignupSpecialPage.php

For status REDIRECT, redirect the user to the specified URL. Eventually the user should be redirected back, at which point the needed AuthenticationRequests should be populated with data and passed to $authManager->continueAuthentication(). https://www.mediawiki.org/wiki/Manual:SessionManager_and_AuthManager

[mohe2015]

Login, user creation or account linking code will call getAuthenticationRequests(), populate the requests with data (by using them to build a HTMLForm and have the user fill it, or by exposing a form specification via the API, so that the client can build it), and pass them to the appropriate begin method. That will return either a success/failure response, or more requests to fill (either by building a form or by redirecting the user to some external provider which will send the data back), in which case they need to be submitted to the appropriate continue method and that step has to be repeated until the response is a success or failure response. AuthManager will use the session to maintain internal state during the process. https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AuthManager.html

[mohe2015]

https://www.mediawiki.org/wiki/Manual:Database_layout

[mohe2015]

https://www.mediawiki.org/wiki/Manual:Database_access

[mohe2015]

https://doc.wikimedia.org/mediawiki-core/master/php/classWikimedia_1_1Rdbms_1_1Database.html#a3b03dd27f434aabfc8d2d639d1e5fa9a

[mohe2015]

https://github.com/wikimedia/mediawiki-extensions-PluggableAuth/blob/master/includes/PluggableAuthPrimaryAuthenticationProvider.php

[mohe2015]

https://phabricator.wikimedia.org/T138678

[mohe2015]

"MediaWiki uses the username as a primary identifier which makes this awkward."

[mohe2015]

https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AuthenticationResponse.html#ae02c0f18f10a1e25da68f559a0a6c87f

[mohe2015]

https://doc.wikimedia.org/mediawiki-core/master/php/ButtonAuthenticationRequest_8php_source.html

[mohe2015]

https://doc.wikimedia.org/mediawiki-core/master/php/classMediaWiki_1_1Auth_1_1AuthManager.html#ae749ecedb6c60dc2fed514a3002dd244

[mohe2015]

https://phabricator.wikimedia.org/T136710

[mohe2015]

http://localhost/index.php?title=Special:RemoveCredentials

[mohe2015]

https://phabricator.wikimedia.org/T138678#3911381 shows autocreation currently only seems badly by returning a username and hope there is no timing attack

[mohe2015]

https://github.com/wikimedia/mediawiki/blob/master/includes/auth/AuthManager.php

[mohe2015]

Maybe implement merge handling like https://github.com/wikimedia/mediawiki-extensions-GoogleLogin/blob/master/includes/GoogleLoginHooks.php