# http://www.mediawiki.org/ # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License along # with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. # http://www.gnu.org/copyleft/gpl.html /** * Authentication plugin interface. Instantiate a subclass of AuthPlugin * and set $wgAuth to it to authenticate against some external tool. * * The default behavior is not to do anything, and use the local user * database for all authentication. A subclass can require that all * accounts authenticate externally, or use it only as a fallback; also * you can transparently create internal wiki accounts the first time * someone logs in who can be authenticated externally. * * This interface is new, and might change a bit before 1.4.0 final is * done... * * @package MediaWiki */ /** * AuthPluginDrupal * Peter Lieverdink * * Class that can authenticate wiki users against a drupal users table. * * Username matches are case insensitive, users that are marked as * inactive in Drupal cannot login to the wiki. * * For extra security, you should create a mysql user that only has SELECT * privileges on the drupal users table and enter its details below. * * mysql> GRANT SELECT ON drupaldb.usertable TO `read_only_user`@`hostname` IDENTIFIED BY `password`; */ require_once('AuthPlugin.php'); class AuthPluginDrupal extends AuthPlugin { /** * We authenticate against the Drupal users table on the specified host/database. */ var $dbhost = "localhost"; // Change if needed. var $dbname = "drupaldb"; // Change if needed. var $dbuser = "read_only_user"; // Change if needed. var $dbpass = "password"; // Change if needed. var $prefix = ""; // Change if needed. var $dblink = null; // Hands off. function AuthPluginDrupal() { $this->dblink = mysql_connect( "{$this->dbhost}", "{$this->dbuser}", "{$this->dbpass}" ); if( !$this->dblink ) die( "Cannot connect to authentication database." ); mysql_select_db( "{$this->dbname}", $this->dblink ); } /** * Check whether there exists a user account with the given name. * The name will be normalized to MediaWiki's requirements, so * you might need to munge it (for instance, for lowercase initial * letters). * * @param string $username * @return bool * @access public */ function userExists( $username ) { $username_esc = mysql_real_escape_string($username); $q = "SELECT uid FROM {$prefix}users WHERE name LIKE '{$username_esc}' AND status=1"; $r = mysql_query( $q, $this->dblink ); if( !$r ) die( mysql_error( $this->dblink ) ); if( mysql_num_rows( $r ) == 1 ) return true; return false; } /** * Check if a username+password pair is a valid login. * The name will be normalized to MediaWiki's requirements, so * you might need to munge it (for instance, for lowercase initial * letters). * * @param string $username * @param string $password * @return bool * @access public */ function authenticate( $username, $password ) { $username_esc = mysql_real_escape_string($username); $password_esc = mysql_real_escape_string($password); $q = "SELECT uid,name,mail,pass FROM {$prefix}users WHERE name LIKE '{$username_esc}' AND pass=MD5('{$password_esc}')"; $r = mysql_query( $q, $this->dblink ); if( mysql_num_rows( $r ) == 1 ) return true; return false; } /** * Modify options in the login template. * * @param UserLoginTemplate $template * @access public */ function modifyUITemplate( &$template ) { # Override this! $template->set( 'usedomain', false ); } /** * Set the domain this plugin is supposed to use when authenticating. * * @param string $domain * @access public */ function setDomain( $domain ) { $this->domain = $domain; } /** * Check to see if the specific domain is a valid domain. * * @param string $domain * @return bool * @access public */ function validDomain( $domain ) { # Override this! return true; } /** * When a user logs in, optionally fill in preferences and such. * For instance, you might pull the email address or real name from the * external user database. * * The User object is passed by reference so it can be modified; don't * forget the & on your function declaration. * * @param User $user * @access public */ function updateUser( &$user ) { // Fetch email & name, insert into user. $username_esc = mysql_real_escape_string($user->mName); $q = "SELECT uid,name,mail FROM {$prefix}users WHERE name LIKE '{$username_esc}'"; $r = mysql_query( $q, $this->dblink ); if( mysql_num_rows( $r ) != 1 ) return false; $o = mysql_fetch_object( $r ); $user->mEmail = $o->mail; if( ! $user->mOptions['nickname'] ) $user->mOptions['nickname'] = $o->name; return true; } /** * Return true if the wiki should create a new local account automatically * when asked to login a user who doesn't exist locally but does in the * external auth database. * * If you don't automatically create accounts, you must still create * accounts in some way. It's not possible to authenticate without * a local account. * * This is just a question, and shouldn't perform any actions. * * @return bool * @access public */ function autoCreate() { return true; } /** * Set the given password in the authentication database. * Return true if successful. * * @param string $password * @return bool * @access public */ function setPassword( $password ) { return true; } /** * Update user information in the external authentication database. * Return true if successful. * * @param User $user * @return bool * @access public */ function updateExternalDB( $user ) { return true; } /** * Check to see if external accounts can be created. * Return true if external accounts can be created. * @return bool * @access public */ function canCreateAccounts() { return false; } /** * Add a user to the external authentication database. * Return true if successful. * * @param User $user * @param string $password * @return bool * @access public */ function addUser( $user, $password ) { return false; } /** * Return true to prevent logins that don't authenticate here from being * checked against the local database's password fields. * * This is just a question, and shouldn't perform any actions. * * @return bool * @access public */ function strict() { return false; } /** * When creating a user account, optionally fill in preferences and such. * For instance, you might pull the email address or real name from the * external user database. * * The User object is passed by reference so it can be modified; don't * forget the & on your function declaration. * * @param User $user * @access public */ function initUser( &$user ) { // Fetch email & name $username_esc = mysql_real_escape_string($user->mName); $q = "SELECT uid,name,mail FROM {$prefix}users WHERE name LIKE '{$username_esc}'"; $r = mysql_query( $q, $this->dblink ); if( mysql_num_rows( $r ) != 1 ) return false; $o = mysql_fetch_object( $r ); $user->mEmail = $o->mail; if( ! $user->mOptions['nickname'] ) $user->mOptions['nickname'] = $o->name; return true; } /** * If you want to munge the case of an account name before the final * check, now is your chance. */ function getCanonicalName( $username ) { return $username; } } ?>