Jump to content
MediaWiki

Extension:NetworkAuth

From mediawiki.org
Languages:
MediaWiki was not designed to support per-page or partial-page access restrictions. If you require this level of control, you are strongly advised to use a content management system that supports it natively.

Patches or third-party extensions claiming to provide access control, when in use with MediaWiki, may not work in all cases, potentially exposing confidential data. Use them at your own risk. Neither the MediaWiki developers nor the Wikimedia Foundation are responsible for any data leaks that may result. This message is added to all extensions of this nature and may not reflect the actual security status of this extension.

For more information, see Security issues with authorization extensions .
MediaWiki extensions manual
NetworkAuth
Release status: stable
Implementation User identity , User rights , Hook
Description Allows to automatically authenticate users coming from certain network addresses
Author(s) Olaf Lenz (Olenz talk )
Latest version 2.2
MediaWiki >= 1.35.0
Database changes No
License GNU General Public License 2.0 or later
Download
  • $wgNetworkAuthUsers
  • $wgNetworkAuthSpecialUsers
Translate the NetworkAuth extension if it is available at translatewiki.net
Issues Open tasks · Report a bug

The NetworkAuth extension is intended to bind particular network addresses to specific users. When the wiki is accessed from a specific network address, they will be automatically logged in with the specified user name. When a wiki is configured not to allow anonymous read and/or write access, the extension can be used to grant read and write access for users from particular network addresses (e.g., from the intranet of a company).

Installation

[edit ]
  • Download and move the extracted NetworkAuth folder to your extensions/ directory.
    Developers and code contributors should install the extension from Git instead, using:
    cdextensions/
    gitclonehttps://gerrit.wikimedia.org/r/mediawiki/extensions/NetworkAuth
    
  • Add the following code at the bottom of your LocalSettings.php file:
    wfLoadExtension( 'NetworkAuth' );
    
  • Configure as required.
  • Yes Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Configuration

[edit ]

To configure the extension, set the configuration parameter $wgNetworkAuthUsers in LocalSettings.php , and optionally the configuration parameter $wgNetworkAuthSpecialUsers.

Basic configuration

[edit ]

The configuration parameter $wgNetworkAuthUsers is an array that can contain one or several arrays to configure what user is logged in when a wiki page is loaded from a specific network address. NetworkAuth only becomes active when a user is not logged in already. When NetworkAuth detects an attempt to load a page by an anonymous user, it will check whether the source IP address of the request is matched by any of the records in $wgNetworkAuthUsers. If it is, it will log in to the specified user.

The username defined in the configuration must be for a user that already exists in MediaWiki.

Example
wfLoadExtension( 'NetworkAuth' );
// Log-in unlogged users from these networks
$wgNetworkAuthUsers[] = [
	'iprange' => [
 '127.0.0.1',
	 '10.1.10.0/24',
	 '10.2.10.152/32'
 ],
	'user' => 'NetworkAuthUser',
];
// Log-in unlogged users when IP matches this regular expression
$wgNetworkAuthUsers[] = [
	'ippattern' => '/10\.1\.10\..*/',
	'user' => 'NetworkAuthUser',
];
// Log-in unlogged users when IP’s reverse DNS lookup matches this domain
$wgNetworkAuthUsers[] = [
	'hostpattern' => '/.*\.domain\.example\.com/i',
	'user' => 'AdminComputer',
];
/* To use the contents of the page MediaWiki:Networkauth-ips
 * (Where the page is formatted as a '*' followed by either an IP or range)
 */
$wgNetworkAuthUsers[] = [
	'ipmsg' => 'networkauth-ips',
	'user' => 'Foo',
];

Optional configuration

[edit ]
Personal header when connected with a user configured in $wgNetworkAuthSpecialUsers

It might be a good idea not to use NetworkAuth to log in to a normal user account but to a special user account instead that exists exclusively for this purpose (e.g., "NetworkAuthUser"). In that case, one can add this account to the configuration parameter $wgNetworkAuthSpecialUsers. Users in this list do not get the normal list of Personal Urls. Instead, the PersonalUrls show:

  • that the user is logged in via the NetworkAuth extension
  • the IP address of the user
  • a link to log out
  • a link to log in
Example
$wgNetworkAuthSpecialUsers[] = 'NetworkAuthUser';


See also

[edit ]

AltStyle によって変換されたページ (->オリジナル) /