With AuthManager, we have a bunch of new special pages for managing user credentials. These should likely be linked from Special:Preferences.
The existing link to Special:ChangePassword should probably be replaced with one to Special:ChangeCredentials. Not sure how exactly the other three should be linked.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • Deskana | T75616 Tracking: API/backend issues blocking Wikipedia app development | |||
| Resolved | Anomie | T32788 Allow triggering of user password reset email via the API | |||
| Open | None | T90925 General authentication improvements for MediaWiki | |||
| Resolved | Anomie | T48179 Allow a challenge stage during authentication | |||
| Open | None | T5709 Refactoring to make external authentication and identity systems easier | |||
| Resolved | Tgr | T43201 UserLoadFromSession considered evil | |||
| Resolved | Anomie | T67493 Session is started by EditAction (problem for extensions using UserLoadFromSession hook) | |||
| Open | Feature | None | T55156 Provide option to force a login session to end within a certain time | ||
| Open | None | T89459 Modernize MediaWiki authentication system (AuthManager) | |||
| Open | None | T110278 Improve interaction between AuthManager and the UI layer | |||
| Open | None | T136710 Add links to Special:LinkAccounts, Special:UnlinkAccounts, Special:ChangeCredentials, and Special:RemoveCredentials to Special:Preferences somewhere |
"change password" currently links to Special:ChangeCredentials/\MediaWiki\Auth\SpecialChangePassword (through a SpecialRedirectToSpecial page, mostly for the nicer URL), which is more user-friendly IMO. I think it's nicer if auth extenions add their similar links (to some ChangeCredentials or RemoveCredentials subpage); the main pages themselves are accessible from Special:SpecialPages and contain some cruft that might be useful but usually isn't (such as removing a temporary password).
In any case, there should be links between the various special pages, and from the subpage to the main page, to aid discoverability.
I wonder if it made sense to cache getAuthenticationRequests results somehow? Displaying links would require a bunch of calls to that (so that no link is shown when the given special page would not be able to do anything meaningful), which could become slow.
Hmm, should really any primary authentication provider add it's own link into the user profile tab? That could be a long list if there are multiple providers, right (e.g. Password, 2FA, Ldap, Google, Twitter, Facebook, MediaWiki.org,...). Wouldn't be a new tab (e.g. named "Authentication settings" or similar) better to be more structured? Or maybe just add links tot he base special pages (Link accounts, unlink accounts, remove credentials, change credentials)?
I thought about this a bit more, and the more I think about it, I'm not sure, if a special page for each action (link, unlink, change and remove) is relly a good idea (btw.: I'm not sure, if there was a special reason). I would expect a single special page, where I've a list of currently used authentication providers (like Special:RemoveCredentials), where I've a link at the end of the line to remove the provider or change the authentication data, if it's provided (with a change link). At the bottom it would be possible to add the things found on Special:LinkAccounts (e.g. after a visual line that separates both areas. A similar concept is used in stackoverflow.org.
Special:UnlinkAccounts could be removed, as far as I can see as it's pretty useless (the actions can be taken through Special:RemoveCredentials), see T136000: Unify Special:UnlinkAccounts and Special:RemoveCredentials.