Page MenuHomePhabricator

Allow PluggableAuth to work with multiple providers without extra extensions
Closed, ResolvedPublic

Description

I want to request this feature, primarily for my wikibase installation. I think this will be important for wikidata, since it will allow people to install wikibase, draw in people through an easy, social media login, and have them input and curate data, which then will be federated back to wikidata.

So what I would like to ask is to allow PluggableAuth (possibly with WSOAuth?) to work with multiple providers.

@Addshore has been trying to tackle this problem

https://www.mediawiki.org/wiki/Core_Platform_Team/Initiatives/Adding_Multiple_Identity_Providers_to_PluggableAuth

Event Timeline

Sorry for the delayed response. I was on vacation last week.

This would indeed be a useful new feature that I would be happy to have in the extension. I'm happy to discuss any design trade offs and to review the code.

FYI, I have a WIP patch to make some structural improvements to the PluggableAuth code (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PluggableAuth/+/606057). I will likely break it into several patches, since its scope grew a bit. Also, I'm considering changing the extension from master compatibility mode to release branch compatibility mode in order to remove some backward compatibility code and to support the new hook system. Depending upon the timing, this might affect @Addshore's patch.

Change 754947 had a related patch set uploaded (by Cicalese; author: Cicalese):

[mediawiki/extensions/PluggableAuth@master] Allow PluggableAuth to work with multiple authenication plugin instances

https://gerrit.wikimedia.org/r/754947

cicalese triaged this task as Medium priority.
cicalese moved this task from Backlog to In Progress on the MediaWiki-extensions-Pluggable-Auth board.

Change 754947 merged by jenkins-bot:

[mediawiki/extensions/PluggableAuth@master] Allow PluggableAuth to work with multiple authentication plugin instances

https://gerrit.wikimedia.org/r/754947

This capability is now fully available in PluggableAuth version 6.0. It requires a compatible authentication provider. OpenID Connect version 6.0 is compatible, and compatible versions of SimpleSAMLphp, WSOAuth, and others are in progress.