Extension:OAuth

混同しないでください: Extension:OATHAuthまたは Extension:WSOAuth.

MediaWiki 拡張機能マニュアル

OAuth リリースの状態: 安定
実装	利用者識別 , 利用者権限 , API
説明	利用者が自分の代わりに MediaWiki 操作 API を使用する別のアプリケーション ("consumer") を安全に認可できるようにする。
最新バージョン	1.1.0 (continuous updates)
互換性の方針	MediaWikiとともにリリースされるスナップショット。 master には後方互換性がありません。
MediaWiki	>= 1.38.0
データベースの変更	はい
Composer	mediawiki/oauth
テーブル	oauth_accepted_consumer oauth_registered_consumer
ライセンス	GNU 一般公衆利用許諾書 2.0 以降
ダウンロード	拡張機能をダウンロード Git [?]: Git master をダウンロード リポジトリを参照 (GitHub) コミット履歴 リポジトリの貢献者 (GitHub) コード レビュー
ヘルプ	Help:OAuth
パラメーター $wgOAuth2PublicKey $wgOAuth2RequireCodeChallengeForPublicClients $wgMWOAuthCentralWiki $wgMWOAuthSecureTokenTransfer $wgMWOAuthSharedUserSource $wgOAuth2GrantExpirationInterval $wgMWOauthDisabledApiModules $wgOAuth2EnabledGrantTypes $wgMWOAuthNonceCacheType $wgOAuthGroupsToNotify $wgMWOAuthRequestExpirationAge $wgOAuth2RefreshTokenTTL $wgMWOAuthSessionCacheType $wgMWOAuthReadOnly $wgOAuth2PrivateKey $wgMWOAuthSharedUserIDs $wgOAuthSecretKey
使用するフック AbuseFilter-builder AbuseFilter-computeVariable AbuseFilter-generateUserVars ApiRsdServiceApis BeforeCreateEchoEvent CentralAuthAbortCentralAuthToken ChangeTagCanCreate ChangeTagsListActive GetPreferences ListDefinedTags LoadExtensionSchemaUpdates LoginFormValidErrorMessages MergeAccountFromTo MessagesPreLoad SetupAfterCache SpecialPageAfterExecute SpecialPageBeforeFormDisplay SpecialPage_initList TestCanonicalRedirect
提供するフック OAuthReplaceMessage
Quarterly downloads	140 (Ranked 69th)
Public wikis using	1,179 (Ranked 211st)
translatewiki.net で翻訳を利用できる場合は、OAuth 拡張機能の翻訳にご協力ください
Vagrant role	oauth
問題点	未解決のタスク · バグを報告

The OAuth extension implements an OAuth server in MediaWiki that supports both the OAuth 1.0a and OAuth 2.0 protocol versions. It allows third party developers to securely develop applications ("consumers"), to which users can give a limited set of permissions ("grants"), so that the application can use the MediaWiki action API on the user's behalf.

If you're attempting to develop an application that uses OAuth on a wiki, see OAuth for Developers. この拡張機能がインストールされているウィキでOAuth対応のツールを使おうとしている場合は、OAuth を参照してください。

要件

• OAuthは一時的なトークンとセッションのためにオブジェクトキャッシュに依存しています。 This should work as long as cache configuration settings are sane. (Older versions required Memcached explicitly.)
• 現在、MySQLとSQLiteのデータベースバックエンドのみをサポートしています。
• If the MediaWiki installation is private (i.e. users need to log in to have read access), Special:OAuth will need to be added to the white list.

インストール

• ダウンロードして、ファイルをextensions/フォルダー内のOAuthという名前のディレクトリ内に配置します。
• Gitでのインストールの場合のみ、PHPの依存関係をインストールするためComposerを実行します。 (合併症の可能性についてはタスク T173141を参照。)
• 以下のコードを LocalSettings.php の末尾に追加します:

  wfLoadExtension( 'OAuth' );
  

• 更新スクリプトを実行します。このスクリプトは、この拡張機能が必要とするデータベーステーブルを自動的に作成します。
• 必要に応じて一般的なパラメーターを設定します。
• 利用者権限の設定は、$wgGroupPermissions の該当するグループ配下に置くと実行されます。
•  完了 – ウィキの「Special:Version」に移動して、拡張機能が正しくインストールされたことを確認します。

MediaWiki 1.24以前を稼働させている利用者へ:

上記の手順では、wfLoadExtension()を使用してこの拡張機能をインストールする新しい方法を記載しています。 この拡張機能をこれらの過去のバージョン (MediaWiki 1.24以前) にインストールする必要がある場合は、wfLoadExtension( 'OAuth' );の代わりに以下を使用する必要があります:

require_once "$IP/extensions/OAuth/OAuth.php";

Vagrant installation:

• Vagrant を使用している場合は、vagrant roles enable oauth --provisionでインストールしてください。

利用者権限

権限	説明
mwoauthproposeconsumer	新しいコンシューマーを提案
mwoauthupdateownconsumer	自身が制御できるOAuthコンシューマーを更新
mwoauthmanageconsumer	OAuthコンシューマーを管理
mwoauthsuppress	OAuthコンシューマーを秘匿
mwoauthviewsuppressed	秘匿されたOAuthコンシューマーを閲覧
mwoauthviewprivate	非公開OAuthデータを閲覧
mwoauthmanagemygrants	OAuth付与を管理

To assign a permission to some group, for example to sysops, you add following line to LocalSettings.php:

$wgGroupPermissions['sysop']['mwoauthproposeconsumer'] = true;

設定

変数名	既定値	説明
$wgMWOAuthCentralWiki	false	Wiki ID of OAuth management wiki. On wiki farms, it makes sense to set this to a wiki that acts as a portal site, is dedicated to management, or just handles login/authentication. It can, however, be set to any wiki in the farm. For single-wiki sites or farms where each wiki manages consumers separately, it should be left as false.
$wgMWOAuthSharedUserIDs	false	(廃止予定) Use $wgMWOAuthSharedUserSource instead Whether shared global user IDs are stored in the oauth tables. On wiki farms with a central authentication system (with integer user IDs) that share a single OAuth management wiki, this must be set to true. If wikis have a central authentication system but have their own OAuth management, then this can be either true or false. Otherwise it should always be set to false. Setting this to true requires CentralIdLookup or an MWOAuth aware authentication extension. This value should not be changed after the fact to avoid ambigious IDs. Proper user ID migration should be done before any such changes.
$wgMWOAuthSharedUserSource	null	Central ID provider when sharing OAuth credentials over a wiki farm Source of shared user IDs, if enabled. If CentralIdLookup is available, this is the $providerId for CentralIdLookup::factory(). Generally null would be what you want, to use the default provider. If that class is not available or the named provider is not found, this is passed to the OAuthGetUserNamesFromCentralIds, OAuthGetLocalUserFromCentralId, OAuthGetCentralIdFromLocalUser, OAuthGetCentralIdFromUserName hooks. This has no effect if $wgMWOAuthSharedUserIDs is set to false.
$wgMWOAuthRequestExpirationAge	2592000 (30 days)	Seconds after which an idle request for a new Consumer is marked as "expired"
$wgMWOAuthSecureTokenTransfer	true	Require SSL/TLS for returning Consumer and user secrets. This is required by RFC 5849, however if a wiki wants to use OAuth, but doesn't support SSL, this option makes this configuration possible. This should be set to true for most production settings.
$wgOAuthSecretKey	$wgSecretKey	A secret configuration string (random 32-bit string generated using "base64_encode(random_bytes(32))") used to hmac the database-stored secret to produce the shared secrets for Consumers. This provides some protection against an attacker reading the values out of the consumer table (the attacker would also need $wgOAuthSecretKey to generate valid secrets), and some protection against potential weaknesses in the secret generation. If this string is compromised, the site should generate a new $wgOAuthSecretKey, which will invalidate Consumer authorizations that use HMAC/shared secret signatures instead of public/private keys. Consumers can regenerate their new shared secret by using the "Reset the secret key to a new value" option under Special:MWOAuthConsumerRegistration/update. If null, the value is set to $wgSecretKey.
$wgOAuthGroupsToNotify	[]	The list of user groups which should be notified about new consumer proposals. Setting this will only have an effect when Echo is installed.
$wgMWOauthDisabledApiModules	[]	List of API module classes to disable when OAuth is used for the request
$wgMWOAuthReadOnly	false	Prevent write activity to the database. When this is set, consumers cannot be added or updated, and new authorizations are prohibited. Authorization headers for existing authorizations will continue to work. Useful for migrating database tables
$wgMWOAuthSessionCacheType	$wgSessionCacheType	The storage mechanism for session data. If null, it defaults to $wgSessionCacheType.
$wgOAuth2EnabledGrantTypes	[ "authorization_code", "refresh_token", "client_credentials" ]	List of OAuth2 grants that client applications can be allowed to use. Actual grants client application will be allowed to use can be any subset of grants listed here. Grants, other than the ones listed here, are considered legacy grants, and are not supported by this extension
$wgOAuth2PrivateKey	""	Private key or a path to the private key used to sign OAuth2 JWT being transmitted. See the OAuth 2.0 Server documentation for how to generate the keys.
$wgOAuth2PublicKey	""	Public key or a path to the public key used to verify OAuth2 resource requests.
$wgOAuth2RequireCodeChallengeForPublicClients	true	Controls whether clients are required to send code challenges with OAuth2 requests. This only applies to non-confidential clients.
$wgOAuth2GrantExpirationInterval	"PT1H"	Controls validity period for access tokens. Does not apply to owner-only clients, whose access tokens are always non-expiring. Accepts ISO 8601 durations or can be set to "infinity" or false for non-expiring tokens.
$wgOAuth2RefreshTokenTTL	"PT1M"	Controls validity period for refresh tokens. Accepts ISO 8601 durations or can be set to "infinity" or false for non-expiring tokens.

OAuth 2.0 REST endpoints

The following REST endpoints are provided for OAuth 2.0 interaction

パス	説明	許容されるパラメーター	Allowed method
/oauth2/authorize	Used for retrieving authorization code when using authorization_code grant.	名前 必須かどうか 説明 response_type はい client_id はい redirect_uri いいえ if present, must match the URI that was set when client was registered exactly scope いいえ state いいえ code_challenge いいえ required if $wgOAuth2RequireCodeChallengeForPublicClients is true code_challenge_method いいえ required if $wgOAuth2RequireCodeChallengeForPublicClients is true	GET
/oauth2/access_token	Used for requesting access tokens	名前 必須かどうか 説明 grant_type はい type of grant used client_id いいえ client_secret いいえ required if client is confidential redirect_uri いいえ if present, must match the URI that was set when client was registered exactly scope いいえ code いいえ required if authorization_code grant is used refresh_token いいえ required if refresh_token grant is used code_verifier いいえ	POST
/oauth2/resource/{{type}}	Used for retrieving protected resources using the access token issued previously. Currently, two resource types can be retrieved using this endpoint, by replacing {{type}} placeholder with the type key: profile - retrieve the user profile of the user that is represented by the access token used to make the request - usually used for logging users in on 3rd party websites using MediaWiki scopes - retrieve all scopes client (application) is allowed to use with the current access token	No parameters are allowed, apart from the {{type}} parameter that is included in the path	GET/POST
/oauth2/client	Lists OAuth 1.0a or 2.0 clients for the logged-in user. Authentication can be achieved over CentralAuth or by including an access token in the authorization header. レスポンスの例 { "clients": [ { "client_key": "xxxxxxxxxxxxxx", "name": "TestFromCurl1807", "version": "2.0", "email": "admin@example.com", "callback_url": "http://example.com", "scopes": [ "authonly" ], "registration": "20200818230806", "stage": 0, "oauth_version": 2, "description": "foo", "allowed_grants": [ "authorization_code" ], "registration_formatted": "23:08, 18 August 2020" } ], "total": 1 }	oauth_version (省略可能) - either 1 (to return only OAuth 1.0a clients) or 2 (to return only OAuth 2.0 clients). 既定値: 2 Pagination parameters limit (省略可能) - maximum number of clients to return. 既定値: 25 offset (省略可能) - number of clients to skip before returning the first result. 既定値: 0	GET
/oauth2/client/{client_key}/reset_secret	Resets a client secret. For owner-only clients, this endpoint also resets the access token. レスポンスの例 { "name": "Example", "client_key": "xxxxxxxxxx", "secret": "xxxxxxxxxx", "access_token": "xxxxxxxxxx" }	名前 必須かどうか 説明 既定 client_key はい client identifier reason いいえ string containing the reason for resetting the secret. ''	POST
/oauth2/client	Creates an OAuth 2.0 client. レスポンスの例 { "name": "Example", "client_key": "xxxxxxxxxx", "secret": "xxxxxxxxxx", "access_token": "xxxxxxxxxx" }	名前 必須かどうか 説明 既定 name はい client name description はい client description email はい contact email is_confidential はい set to true if the client is confidential; set to false for public clients like mobile and desktop apps grant_types はい OAuth 2.0 grant types used by the client, one or more of the following: authorization_code, refresh_token, client_credentials scopes はい OAuth 2.0 scopes, either mwoauth-authonly, mwoauth-authonlyprivate or the set of applicable grants version いいえ client version. 1.0 wiki いいえ applicable project. * for all wikis owner_only ? set to true for a client used only by the creating user callback_url いいえ Return URL for authorizing users. '' callback_is_prefix いいえ set to true to allow the client to specify a callback in requests and use the callback URL as a required prefix. false	POST

If OAuth credentials are shared over a wiki farm, make sure that real names are used/hidden consistently across all wikis (using $wgHiddenPrefs ). 実名が隠されているウィキでは、どの情報が共有されるかを伝えるOAuth許可要求メッセージは実名に言及しないので、その場合、OAuth消費者がまだその情報を取得できる他のウィキが存在しないはずです。

実験用RESTエンドポイント

実験的なRESTエンドポイントを有効にするには、$wgRestAPIAdditionalRouteFiles 設定変数をLocalSettings.phpに追加してください。

$wgRestAPIAdditionalRouteFiles[] = "$wgExtensionDirectory/OAuth/experimentalRoutes.json";

関連項目

• Extension:OATHAuth - A similarly named extension which implements a second authentication factor using OATH-based one-time passwords.
• Extension:WSOAuth – A MediaWiki extension that lets your wiki delegate authentication to any OAuth provider using PluggableAuth, including a wiki that is running Extension:OAuth.
• oauthclient-php – A client library for OAuth consumers.