MediaWiki extensions manual

OAuth Release status: stableCategory:Stable extensions
Implementation	User identity Category:User identity extensions, User rights Category:User rights extensions, API Category:API extensions
Description	Allow users to safely authorize another application ("consumer") to use the MediaWiki action API on their behalf.
Author(s)	Aaron Schulz, Chris Steipp, Brad Jorsch, Robert Vogel, Dejan Savuljesku
Latest version	1.1.0 (continuous updates)
Compatibility policy	Snapshots releases along with MediaWiki. Master is not backward compatible.Category:Extensions with release branches compatibility policy
Database changes	Yes
Tables	oauth_accepted_consumer oauth_registered_consumer
License	GNU General Public License 2.0 or later
Download	Download extension Git [?]: Browse repository (Phabricator · GitHub) Gerrit code review Git commit log Download source tarball Category:Extensions in Wikimedia version control
Help	Help:OAuth
Parameters $wgOAuth2PublicKey $wgOAuth2RequireCodeChallengeForPublicClients $wgMWOAuthCentralWiki $wgMWOAuthSecureTokenTransfer $wgMWOAuthSharedUserSource $wgOAuth2GrantExpirationInterval $wgOAuthAutoApprove $wgMWOauthDisabledApiModules $wgOAuth2EnabledGrantTypes $wgMWOAuthNonceCacheType $wgOAuthGroupsToNotify $wgMWOAuthRequestExpirationAge $wgOAuth2RefreshTokenTTL $wgMWOAuthSessionCacheType $wgMWOAuthReadOnly $wgOAuth2PrivateKey $wgMWOAuthSharedUserIDs $wgOAuthSecretKey
Added rights mwoauthproposeconsumer mwoauthupdateownconsumer mwoauthmanageconsumer mwoauthsuppress mwoauthviewsuppressed mwoauthviewprivate mwoauthmanagemygrants Category:Extensions which add rights
Hooks used AbuseFilter-builder Category:AbuseFilter-builder extensions AbuseFilter-computeVariable Category:AbuseFilter-computeVariable extensions AbuseFilter-generateUserVars Category:AbuseFilter-generateUserVars extensions ApiRsdServiceApis Category:ApiRsdServiceApis extensions BeforeCreateEchoEvent Category:BeforeCreateEchoEvent extensions ChangeTagCanCreate Category:ChangeTagCanCreate extensions ChangeTagsListActive Category:ChangeTagsListActive extensions GetPreferences Category:GetPreferences extensions ListDefinedTags Category:ListDefinedTags extensions LoadExtensionSchemaUpdates Category:LoadExtensionSchemaUpdates extensions LoginFormValidErrorMessages Category:LoginFormValidErrorMessages extensions MergeAccountFromTo Category:MergeAccountFromTo extensions MessagesPreLoad Category:MessagesPreLoad extensions SetupAfterCache Category:SetupAfterCache extensions SpecialPageAfterExecute Category:SpecialPageAfterExecute extensions SpecialPageBeforeFormDisplay Category:SpecialPageBeforeFormDisplay extensions SpecialPage_initList Category:SpecialPage initList extensions TestCanonicalRedirect Category:TestCanonicalRedirect extensions
Hooks provided OAuthReplaceMessage
Quarterly downloads	61 (Ranked 60th)
Public wikis using	982 (Ranked 246th)
Translate the OAuth extension if it is available at translatewiki.net
Vagrant role	oauth
Issues	Open tasks · Report a bug

The OAuth extension implements an OAuth server in MediaWiki that supports both the OAuth 1.0a and OAuth 2.0 protocol versions. It allows third party developers to securely develop applications ("consumers"), to which users can give a limited set of permissions ("grants"), so that the application can use the MediaWiki action API on the user's behalf.

Requirements

• OAuth relies on the object cache for temporary tokens and sessions. This should work as long as cache configuration settings are sane. (Older versions required Memcached explicitly.)
• Currently, only MySQL and SQLite database backends are supported
• If the MediaWiki installation is private (i.e. users need to log in to have read access), Special:OAuth will need to be added to the white list.

Installation

• Download and move the extracted OAuth folder to your extensions/ directory.
  Developers and code contributors should install the extension from Git instead, using:cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/OAuth
• Only when installing from Git, run Composer to install PHP dependencies, by issuing composer install --no-dev in the extension directory. (See T173141 for potential complications.)Category:Extensions requiring Composer with git
• Add the following code at the bottom of your LocalSettings.php file:

  wfLoadExtension( 'OAuth' );
  

• Run the update script which will automatically create the necessary database tables that this extension needs.
• Configure the general parameters as required.
• Configure the user rights by putting them into the relevant groups in $wgGroupPermissions.
• Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Vagrant installation:

• If using Vagrant , install with vagrant roles enable oauth --provision

To assign a permission to some group, for example to sysops, you add following line to LocalSettings.php:

$wgGroupPermissions['sysop']['mwoauthproposeconsumer'] = true;

Configuration

[
"authorization_code",
"refresh_token",
"client_credentials"
]

Endpoints

{
  "clients": [
    {
      "client_key": "xxxxxxxxxxxxxx",
      "name": "TestFromCurl1807",
      "version": "2.0",
      "email": "admin@example.com",
      "callback_url": "http://example.com",
      "scopes": [
        "authonly"
      ],
      "registration": "20200818230806",
      "stage": 0,
      "oauth_version": 2,
      "description": "foo",
      "allowed_grants": [
        "authorization_code"
      ],
      "registration_formatted": "23:08, 18 August 2020"
    }
  ],
  "total": 1
}

{
  "name": "Example",
  "client_key": "xxxxxxxxxx",
  "secret": "xxxxxxxxxx",
  "access_token": "xxxxxxxxxx"
}

{
  "name": "Example",
  "client_key": "xxxxxxxxxx",
  "secret": "xxxxxxxxxx",
  "access_token": "xxxxxxxxxx"
}

See also

• Extension:OATHAuth - A similarly named extension which implements a second authentication factor using OATH-based one-time passwords.
• Extension:WSOAuth – A MediaWiki extension that lets your wiki delegate authentication to any OAuth provider using PluggableAuth, including a wiki that is running Extension:OAuth.
• Oauthclient-php – A client library for OAuth consumers.

This extension is being used on one or more Wikimedia projects. This probably means that the extension is stable and works well enough to be used by such high-traffic websites. Look for this extension's name in Wikimedia's CommonSettings.php and InitialiseSettings.php configuration files to see where it's installed. A full list of the extensions installed on a particular wiki can be seen on the wiki's Special:Version page.

This extension is included in the following wiki farms/hosts and/or packages: Miraheze Category:Extensions included in Miraheze ProWikiCategory:Extensions included in ProWiki wiki.gg Category:Extensions included in wiki.gg WikiForgeCategory:Extensions included in WikiForge This is not an authoritative list. Some wiki farms/hosts and/or packages may contain this extension even if they are not listed here. Always check with your wiki farms/hosts or bundle to confirm.