Page MenuHomePhabricator

Support a nice sso experience with MediaWiki's OAuth
Open, MediumPublic

Description

was https://www.mediawiki.org/wiki/Wikimedia_MediaWiki_Core_Team/Backlog#OpenID_connect

The major use case for OpenID Connect is to have an OAuth compatible authentication scheme that gives strong assertions about the user's identity.

Related Objects

Event Timeline

csteipp raised the priority of this task from to Needs Triage.
csteipp updated the task description. (Show Details)
csteipp subscribed.
bd808 triaged this task as Medium priority.Feb 18 2015, 5:41 AM
bd808 subscribed.

(In case anyone's confused by the above, see: https://lists.wikimedia.org/pipermail/teampractices/2015-February/000637.html - just experimenting with a roadmap view.)

So what is the plan about this? Is this something a community contribution could help with?

So what is the plan about this? Is this something a community contribution could help with?

T254063: OAuth extension should support OpenID Connect and especially T254063#8081810 has some specifics. IMO the most useful thing would be to support the display parameter and figure out a way for for the OAuth authorization dialog to show up in a popup window, without being wrapped in a MediaWiki skin. But then, given it already sort of works, it would be great to hear from people trying to use it and whether they found any of the limitations problematic.

Or someone could take a bunch of common OIDC client frameworks and see how well they are supported by MediaWiki today. (Would implementing the .well-known endpoint make the client much easier to configure, for example?)

A related task seems to be "Write up a short guide for a tool provider to include Wikimedia OAuth as an option for to let users log in w/ their Wikimedia user account." (which is what T15631 was really asking for, I suspect.)

In T86869#8551767, @Sj wrote:

A related task seems to be "Write up a short guide for a tool provider to include Wikimedia OAuth as an option for to let users log in w/ their Wikimedia user account." (which is what T15631 was really asking for, I suspect.)

https://wikitech.wikimedia.org/wiki/Help:Toolforge/My_first_Flask_OAuth_tool is one framework specific attempt at that sort of documentation. https://www.mediawiki.org/wiki/OAuth/For_Developers has quite a bit of information on the general usage.