Extension:OAuth

This page is a translated version of the page Extension:OAuth and the translation is 100% complete.
Şununla karıştırılmamalıdır: Extension:OATHAuth veya Extension:WSOAuth.
MediaWiki manüel uzantıları
OOjs UI icon advanced-invert.svg
OAuth
Sürüm durumu: kararlı
Uygulama Kullanıcı kimliği , Kullanıcı hakları , API
Açıklama Kullanıcıların, MediaWiki eylem API'sini kendi adlarına kullanmaları için başka bir uygulamayı ("tüketici") güvenli bir şekilde yetkilendirmesine izin verin.
En son sürüm 1.1.0 (continuous updates)
Uyumluluk politikası MediaWiki ile birlikte anlık görüntüler yayımlanır. Master geriye dönük olarak uyumlu değil.
MediaWiki >= 1.37.0
Veritabanı değişiklikleri Evet
Tablolar oauth_accepted_consumer
oauth_registered_consumer
Lisans GNU Genel Kamu Lisansı 2.0 veya üstü
İndir
  • $wgOAuth2PublicKey
  • $wgOAuthGroupsToNotify
  • $wgMWOAuthRequestExpirationAge
  • $wgOAuth2RefreshTokenTTL
  • $wgMWOAuthCentralWiki
  • $wgOAuth2PrivateKey
  • $wgMWOAuthSecureTokenTransfer
  • $wgOAuth2RequireCodeChallengeForPublicClients
  • $wgMWOAuthSharedUserSource
  • $wgOAuth2GrantExpirationInterval
  • $wgMWOAuthSharedUserIDs
  • $wgMWOAuthSessionCacheType
  • $wgMWOauthDisabledApiModules
  • $wgOAuth2EnabledGrantTypes
  • $wgMWOAuthReadOnly
  • $wgOAuthSecretKey
  • mwoauthproposeconsumer
  • mwoauthupdateownconsumer
  • mwoauthmanageconsumer
  • mwoauthsuppress
  • mwoauthviewsuppressed
  • mwoauthviewprivate
  • mwoauthmanagemygrants
Translatewiki.net adresinde mevcutsa, OAuth uzantısını çevirin

Kullanım ve sürüm matrisini kontrol edin.

Vagrant rolü oauth
Sorunlar Açık görevler · Hata bildir


OAuth uzantısı, MediaWiki'de hem OAuth 1.0a hem de OAuth 2.0 protokol sürümlerini destekleyen bir OAuth sunucusu uygular. It allows third party developers to securely develop applications ("consumers"), to which users can give a limited set of permissions ("grants"), so that the application can use the MediaWiki action API on the user's behalf.


Bir vikide OAuth kullanan bir uygulama geliştirmeye çalışıyorsanız, Geliştiriciler için OAuth'a bakın. If you are trying to use an OAuth-enabled tool on a wiki which has this extension installed, see Help:OAuth.

Gereksinimler

  • OAuth, geçici anahtarlar ve oturumlar için nesne önbelleğini kullanır. Bu, önbellek yapılandırma ayarları makul olduğu sürece çalışmalıdır. (Older versions required Memcached explicitly.)
  • Şu anda yalnızca MySQL ve SQLite veritabanı arka uçları desteklenmektedir
  • MediaWiki kurulumu özelse (yani, kullanıcıların okuma erişimine sahip olmaları için oturum açmaları gerekiyorsa), beyaz listeye Special:OAuth eklenmesi gerekecektir.

Kurulum

  • Vagrant kullanıyorsanız, vagrant roles enable oauth --provision ile yükleyin
Manüel kurulum

MediaWiki 1.24 veya önceki bir sürümü çalıştıran kullanıcılara:

Yukarıdaki talimatlar, bu eklentiyi wfLoadExtension() kullanarak kurmanın yeni yolunu açıklar. Bu uzantıyı önceki sürümlerine (MediaWiki 1.24 ve önceki sürümler) yüklemeniz gerekirse, wfLoadExtension( 'OAuth' ); yerine kullanmanız gerekir:

require_once "$IP/extensions/OAuth/OAuth.php";

Kullanıcı hakları

Yetki Açıklama
mwoauthproposeconsumer Yeni OAuth tüketicileri önerin
mwoauthupdateownconsumer Kontrol ettiğiniz OAuth tüketicilerini güncelleyin
mwoauthmanageconsumer OAuth tüketicilerini yönet
mwoauthsuppress OAuth tüketicilerini gözetleyin
mwoauthviewsuppressed Gözetlenmiş OAuth tüketicilerini görüntüle
mwoauthviewprivate Özel OAuth verilerini görüntüle
mwoauthmanagemygrants OAuth bağışlarını yönet

To assign a permission to some group, for example to sysops, you add following line to LocalSettings.php:

$wgGroupPermissions['sysop']['mwoauthproposeconsumer'] = true;

Yapılandırma

Değişken adı Varsayılan değer Açıklama
$wgMWOAuthCentralWiki false Wiki ID of OAuth management wiki. On wiki farms, it makes sense to set this to a wiki that acts as a portal site, is dedicated to management, or just handles login/authentication. It can, however, be set to any wiki in the farm. For single-wiki sites or farms where each wiki manages consumers separately, it should be left as false.
$wgMWOAuthSharedUserIDs false (kaldırıldı), use $wgMWOAuthSharedUserSource instead

Whether shared global user IDs are stored in the oauth tables. On wiki farms with a central authentication system (with integer user IDs) that share a single OAuth management wiki, this must be set to true. If wikis have a central authentication system but have their own OAuth management, then this can be either true or false. Otherwise it should always be set to false. Setting this to true requires CentralIdLookup or an MWOAuth aware authentication extension. This value should not be changed after the fact to avoid ambigious IDs. Proper user ID migration should be done before any such changes.

$wgMWOAuthSharedUserSource null Central ID provider when sharing OAuth credentials over a wiki farm

Source of shared user IDs, if enabled. If CentralIdLookup is available, this is the $providerId for CentralIdLookup::factory(). Generally null would be what you want, to use the default provider. If that class is not available or the named provider is not found, this is passed to the 'OAuthGetUserNamesFromCentralIds', 'OAuthGetLocalUserFromCentralId', 'OAuthGetCentralIdFromLocalUser', and 'OAuthGetCentralIdFromUserName' hooks. This has no effect if $wgMWOAuthSharedUserIDs is set to false.

$wgMWOAuthRequestExpirationAge 2592000 (30 days) Seconds after which an idle request for a new Consumer is marked as "expired"
$wgMWOAuthSecureTokenTransfer true Require SSL/TLS for returning Consumer and user secrets. This is required by RFC 5849, however if a wiki wants to use OAuth, but doesn't support SSL, this option makes this configuration possible. This should be set to true for most production settings.
$wgOAuthSecretKey $wgSecretKey A secret configuration string (random 32-bit string generated using "base64_encode(random_bytes(32))") used to hmac the database-stored secret to produce the shared secrets for Consumers. This provides some protection against an attacker reading the values out of the consumer table (the attacker would also need $wgOAuthSecretKey to generate valid secrets), and some protection against potential weaknesses in the secret generation. If this string is compromised, the site should generate a new $wgOAuthSecretKey, which will invalidate Consumer authorizations that use HMAC/shared secret signatures instead of public/private keys. Consumers can regenerate their new shared secret by using the "Reset the secret key to a new value" option under Special:MWOAuthConsumerRegistration/update. If null, the value is set to $wgSecretKey.
$wgOAuthGroupsToNotify [] The list of user groups which should be notified about new consumer proposals. Setting this will only have an effect when Echo is installed.
$wgMWOauthDisabledApiModules [] List of API module classes to disable when OAuth is used for the request
$wgMWOAuthReadOnly false Prevent write activity to the database. When this is set, consumers cannot be added or updated, and new authorizations are prohibited. Authorization headers for existing authorizations will continue to work. Useful for migrating database tables
$wgMWOAuthSessionCacheType $wgSessionCacheType The storage mechanism for session data. If null, it defaults to $wgSessionCacheType.
$wgOAuth2EnabledGrantTypes
[
"authorization_code",
"refresh_token",
"client_credentials"
]
List of OAuth2 grants that client applications can be allowed to use. Actual grants client application will be allowed to use can be any subset of grants listed here. Grants, other than the ones listed here, are considered legacy grants, and are not supported by this extension
$wgOAuth2PrivateKey "" Private key or a path to the private key used to sign OAuth2 JWT being transmitted.
$wgOAuth2PublicKey "" Public key or a path to the public key used to verify OAuth2 resource requests.
$wgOAuth2RequireCodeChallengeForPublicClients true Controls whether clients are required to send code challenges with OAuth2 requests. This only applies to non-confidential clients.
$wgOAuth2GrantExpirationInterval "PT1H" Controls validity period for access tokens. Does not apply to owner-only clients, whose access tokens are always non-expiring. Accepts ISO 8601 durations or can be set to "infinity" or false for non-expiring tokens.
$wgOAuth2RefreshTokenTTL "PT1M" Controls validity period for refresh tokens. Accepts ISO 8601 durations or can be set to "infinity" or false for non-expiring tokens.

OAuth 2.0 REST endpoints

The following REST endpoints are provided for OAuth 2.0 interaction

Yol Açıklama İzin verilen parametreler İzin verilen yöntem
/oauth2/authorize Used for retrieving authorization code when using authorization_code grant.
  • response_type (required)
  • client_id (required)
  • redirect_uri (optional) - if present, must match the URI that was set when client was registered exactly
  • scope (optional)
  • state (optional)
  • code_challenge (optional) - required if $wgOAuth2RequireCodeChallengeForPublicClients is true
  • code_challenge_method (optional) - - required if $wgOAuth2RequireCodeChallengeForPublicClients is true
GET
/oauth2/access_token Used for requesting access tokens
  • grant_type (required) - type of grant used
  • client_id (optional)
  • client_secret (optional) - required if client is confidential
  • redirect_uri (optional) - if present, must match the URI that was set when client was registered exactly
  • scope (optional)
  • code (optional) - required if authorization_code grant is used
  • refresh_token (optional) - required if refresh_token grant is used
  • code_verifier (optional)
POST
/oauth2/resource/{{type}} Used for retrieving protected resources using the access token issued previously.

Currently, two resource types can be retrieved using this endpoint, by replacing {{type}}placeholder with the type key:

  • profile - retrieve the user profile of the user that is represented by the access token used to make the request - usually used for logging users in on 3rd party websites using MediaWiki
  • scopes - retrieve all scopes client (application) is allowed to use with the current access token
No parameters are allowed, apart from the {{type}} parameter that is included in the path GET/POST
/oauth2/client Lists OAuth 1.0a or 2.0 clients for the logged-in user. Authentication can be achieved over CentralAuth or by including an access token in the authorization header.
Response example
{
  "clients": [
    {
      "client_key": "xxxxxxxxxxxxxx",
      "name": "TestFromCurl1807",
      "version": "2.0",
      "email": "admin@example.com",
      "callback_url": "http://example.com",
      "scopes": [
        "authonly"
      ],
      "registration": "20200818230806",
      "stage": 0,
      "oauth_version": 2,
      "description": "foo",
      "allowed_grants": [
        "authorization_code"
      ],
      "registration_formatted": "23:08, 18 August 2020"
    }
  ],
  "total": 1
}
  • oauth_version (optional) - either 1 (to return only OAuth 1.0a clients) or 2 (to return only OAuth 2.0 clients), defaults to 2
  • Pagination parameters
    • limit (optional) - maximum number of clients to return, defaults to 25
    • offset (optional) - number of clients to skip before returning the first result, defaults to 0
GET
/oauth2/client/{client_key}/reset_secret Resets a client secret. For owner-only clients, this endpoint also resets the access token.
Response example
{
  "name": "Example",
  "client_key": "xxxxxxxxxx",
  "secret": "xxxxxxxxxx",
  "access_token": "xxxxxxxxxx"
}
  • client_key (required) - client identifier
  • reason (optional) - string containing the reason for resetting the secret, defaults to ''
POST
/oauth2/client Creates an OAuth 2.0 client.
Response example
{
  "name": "Example",
  "client_key": "xxxxxxxxxx",
  "secret": "xxxxxxxxxx",
  "access_token": "xxxxxxxxxx"
}
  • name (required) - client name
  • description (required) - client description
  • email (required) - contact email
  • is_confidential (required) - set to true if the client is confidential; set to false for public clients like mobile and desktop apps
  • grant_types (required) - OAuth 2.0 grant types used by the client, one or more of authorization_code, refresh_token, and client_credentials
  • scopes (required) - OAuth 2.0 scopes, either mwoauth-authonly, mwoauth-authonlyprivate or the set of applicable grants
  • version (optional) - client version, defaults to 1.0
  • wiki (optional) - applicable project, defaults to * for all wikis
  • owner_only - set to true for a client used only by the creating user
  • callback_url (optional) - Return URL for authorizing users, defaults to ''
  • callback_is_prefix (optional) - set to true to allow the client to specify a callback in requests and use the callback URL as a required prefix, defaults to false
POST
If OAuth credentials are shared over a wiki farm, make sure that real names are used/hidden consistently across all wikis (using $wgHiddenPrefs ). On wikis where real names are hidden, the OAuth permission request message that tells the user which information is shared does not mention the real name, so in that case there should not be any other wiki where the OAuth consumer may still get that information from.

Experimental REST endpoints

To enable the experimental REST endpoints, add the $wgRestAPIAdditionalRouteFiles configuration variable to your LocalSettings.php:

$wgRestAPIAdditionalRouteFiles[] = "$wgExtensionDirectory/OAuth/experimentalRoutes.json";

Ayrıca bakınız

  • Extension:OAuthAuthentication – Vikinizin, Extension:OAuth çalıştıran başka bir vikiye kimlik doğrulama yetkisi vermesini sağlayan bir MediaWiki uzantısı.
  • Extension:OATHAuth - OATH tabanlı tek seferlik parolaları kullanarak ikinci bir kimlik doğrulama faktörü uygulayan benzer şekilde adlandırılmış bir uzantı.
  • Extension:WSOAuth – Vikinizin, Extension:OAuth çalıştıran bir viki de dahil olmak üzere PluggableAuth kullanan herhangi bir OAuth sağlayıcısına kimlik doğrulama yetkisi vermesini sağlayan bir MediaWiki uzantısı.
  • oauthclient-php – OAuth tüketicileri için bir istemci kitaplığı.