扩展:谷たに歌登うたのぼり录

**MediaWiki扩展手しゅ册さつ**
GoogleLogin; 发行状じょう态：测试版ばん
实现	用よう户身份, 特殊とくしゅ页面
描述	可用かよう您的Google帐户的てき登とう录。
作者さくしゃ	Florian Schmidt (Florianschmidtwelzow留とめ言げん)
最新さいしん版本はんぽん	0.4.0-git
MediaWiki	>= 1.39.0
数かず据すえ库更改こうかい	是これ
表ひょう	googlelogin_allowed_domains; user_google_user
许可协议	MIT授權條じょう款
下した載の	下した載の扩展 ; Git [?]: 下しも载Git master; 浏览存そん储库 (GitHub); 提ひさげ交历史し; 存そん储库貢獻こうけん者しゃ (GitHub); 代だい码复核かく; ; README
	参さん数すう $wgGLAPIKey; $wgGLAllowedDomainsStrict; $wgGLAppId; $wgGLAllowedDomainsDB; $wgGLAuthoritativeMode; $wgGLSecret; $wgGLEnableEchoEvents; $wgGLAllowedDomains;
	添加てんか权限 managegooglelogin; managegooglelogindomains;
	使用しよう的てき函数かんすう钩 ApiMain::moduleManager; AuthChangeFormFields; BeforeCreateEchoEvent; EchoGetBundleRules; LoadExtensionSchemaUpdates; MergeAccountFromTo; UserLogoutComplete; UserMergeAccountDeleteTables;
	有ゆう关兼容よう性せい概がい述じゅつ，请参见版本はんぽん生命せいめい周期しゅうき
季き度ど下か載の量りょう	64 (Ranked 72nd)
	前ぜん往translatewiki.net翻譯ほんやくGoogleLogin扩展
問題もんだい	开启的てき任にん务 · 报告错误

This page is a translated version of the page Extension:GoogleLogin and the translation is 24% complete.

The GoogleLogin extension allows wiki users to log in with their Google account. The extension uses the Google API to request basic profile information from Google (such as the account ID, the full name and the email address).

必要ひつよう条件じょうけん

要よう使用しよう此扩展てん，您至少しょう需要じゅよう：

MediaWiki 1.36+
MySQL/MariaDB （没ぼつ有ゆうPostgreSQL或あるSQLite支持しじ）
PHP 7.3+
谷たに歌か开发者しゃ访问权限
Web应用程ほど序じょ的てきAPI凭もたれ据すえ（客きゃく户端ID和わ客きゃく户端密みつ钥）
运行composer update --no-dev的てき能力のうりょく

安あん裝そう

下しも载文ぶん件けん，并将解かい压后的てきGoogleLogin文ぶん件けん夹移动到extensions/目め录中。
开发者しゃ和代かずよ码贡献けんじ人じん员应从Git安あん装そう扩展，输入：cd extensions/ git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/GoogleLogin
只ただ有ゆう從したがえgit安あん裝そう才ざい运行Composer来らい安あん装そうPHP依よ赖，通つう过发行ぎょうcomposer install --no-dev至いたり扩展目め录。（参まいり见工こう單たんT173141了解りょうかい潜在せんざい问题。）
将はた下しも列代れつだい码放置ほうち在ざい您的LocalSettings.php 的てき底部ていぶ：
```
wfLoadExtension( 'GoogleLogin' );
```
运行更新こうしん脚本きゃくほん，它将自じ动创建けん此扩展てん必须依赖的数すう据すえ库表。
配置はいち所しょ需的参さん数すう
确保./wiki/extensions/GoogleLogin/cache对于Web服ふく务器的てき用よう户是可か写うつし的てき
完成かんせい – 在ざい您的wiki上じょう导航至いたりSpecial:Version，以验证已成功せいこう安やす装そう扩展。

配置はいち

The extension provides two configuration variables to set the Client ID and Client Secret (you get this pair in the Google Developer Console (see below), remove "<" and ">").

$wgGLSecret = '<your-client-secret>';
$wgGLAppId = '<your-client-id>';

其他配置はいち参さん数すう

配置はいち变量	默だま认值	描述
`$wgGLAllowedDomains`^{[gerrit 1]}	`''`	An array of mail domains, which are allowed to use with GoogleLogin, e.g. `[ 'example.com' ];`. Default: all domains are allowed. 如果已やめ设置，则需要よう运行"updatePublicSuffixArray.php"维护脚本きゃくほん。
`$wgGLAllowedDomainsDB`^{[gerrit 2]}	`false`	If set to true, GoogleLogin uses the database to check, if an email domain of the primary email-address of a Google account is allowed to login.
`$wgGLAllowedDomainsStrict`^{[gerrit 1]}	`false`	Only observed, if `$wgGLAllowedDomains` is an array. If set to true, the email domain will be checked completely against the allowed domains (instead of only the TLD), e.g.: test.example.com isn't allowed if `$wgGLAllowedDomainsStrict` is true and example.com is an allowed domain. test.example.com is allowed if `$wgGLAllowedDomainsStrict` is false and example.com is an allowed domain.
`$wgGLAPIKey`^{[gerrit 3]}	`''`	Key for public API access. Used only for admin actions to check, if the user has a Google Plus profile or not.
`$wgGLAuthoritativeMode`^{[gerrit 4]}	`false`	Controls the Authoritative mode of GoogleLogin.
`$wgGLEnableEchoEvents`	`true`

谷たに歌か开发者しゃ控ひかえ制せい台だい中ちゅう的てき设置

To use this extension you need a Google developer account and access to the developer console. This is a very simple step-by-step guide (see also Googles help page on this):

Open Google developer console

Read and accept the terms of service

Create your first project

Go to APIs and services

Click + CREATE CREDENTIALS

Select OAuth client ID

Select as Web application as APPLICATION TYPE, as Authorized JavaScript origins type in your domain name (no wildcards and directories allowed!)

Type in your Authorized redirect URI like this example:

If your domain is example.com and you have installed MediaWiki in Root of your domain, the redirect URI is as follows: https://example.com/index.php/Special:GoogleLoginReturn

Click create and copy the Client ID and Client Secret to the configuration variables in LocalSettings.php

Special page "Special:GoogleLoginReturn"

The allowed redirect URI in Google developer console must be in the wiki's content language. If your wiki was set to German as the content language, then use Spezial:GoogleLoginReturn. In case you used the wrong language, all authentication requests will fail with the error code redirect uri mismatch.

调试

Normally, you can see the error message on all generic error pages. Sometimes there are Internal Errors, called Exceptions. In this case, please add $wgShowExceptionDetails with value true in LocalSettings.php to see the complete Exception message. For a support request, please provide always the lines of the Exception.

在ざい私人しじん维基上じょう使用しよう

If you have set your Wiki to private with

$wgGroupPermissions['*']['read'] = false;

you have to whitelist the "Special:GoogleLoginReturn" page, so that anonymous users can access the callback URL after being redirected from the authentication provider. You can do this by adding the following line to your LocalSettings.php:

$wgWhitelistRead = [ 'Special:GoogleLoginReturn' ];

The name of the special page must be in the wiki's content language. If your wiki was e.g. set to German as the content language, then use Spezial:Benutzerkonto_anlegen. In case you used the wrong language, all authentication requests will fail and redirect you to "Special:Login".

Administer allowed domains on-wiki

The user interface to manage the list of allowed domains.

GoogleLogin provides a feature to restrict the login with Google to specific Email address domains (such as gmail.com, googlemail.com or every other (own) domain). This feature is especially interesting for companies, who use their own domain names with Google Apps. The list of domains, which are allowed to login with Google, are managed in an array in the LocalSettings.php (the $wgGLAllowedDomains configuration option). Since version 0.4.0, GoogleLogin also provides a way to manage the list of allowed domains on the wiki itself. The allowed domains are saved in the database when this feature is enabled and can be change (remove/add) through a graphical user interface (a special page) or through the MediaWiki API.

注意ちゅうい：一旦启用了数据库中域的管理，就无法ほう在ざいLocalSettings.php中ちゅう管理かんり允まこと许的域いき列れつ表ひょう。

To enable the feature to manage the allowed domains in the database, just set the $wgGLAllowedDomainsDB configuration variable to true in your LocalSettings.php. You also want to assign the new managegooglelogindomains user right to one group you're a member of (please keep in mind, that all users with this user right are allowed to change the list of allowed domains, so consider to add this right to an administrator-level group only!). An example configuration could look like:

$wgGLSecret = 'your-secret';
$wgGLAppId = 'your-app-id';
$wgGLAllowedDomainsDB = true;
$wgGroupPermissions['sysop']['managegooglelogindomains'] = true;

You now need to run the update.php script again, so that the necessary database changes are applied to your database. After the update process is completed, you can navigate to the special page Special:GoogleLoginAllowedDomains on your wiki. You'll get a page where you can add new domains, which are allowed to login with their Google account and you can remove them, once they was added.

Configuration parameter "$wgGLAPIKey"

This configuration option still exists, but it's now used for more than just the Special:ManageGoogleLogin special page. It's now used to get the name of a user on Special:RemoveCredentials to make it easier to the user to identify the correct Google account (instead of just showing the Google ID). If the key isn't correct or isn't supplied, GoogleLogin will show the Google ID only. For a good user experience, it's highly suggested to supply this api key now.

Authoritative mode

Automatic account creation

Google Login supports a so called authoritative mode, in which, when enabled, a user account is automatically created with the Google account, which was used to login, is not associated with a local MediaWiki account already. This option is disabled by default and needs to be enabled with a configuration option. However, please read the following important information before doing so. This feature requires that the wiki's configuration strictly supports the following:

GoogleLogin needs to be the only primary authentication provider, e.g. set

$wgAuthManagerConfig = [
    'primaryauth' => [
        GoogleLogin\Auth\GooglePrimaryAuthenticationProvider::class => [
            'class' => GoogleLogin\Auth\GooglePrimaryAuthenticationProvider::class,
            'sort' => 0
        ]
    ],
    'preauth' => [],
    'secondaryauth' => []
];

The "@" sign needs to be whitelisted in the $wgInvalidUsernameCharacters configuration and adapt $wgUserrightsInterwikiDelimiter accordingly, e.g.

$wgInvalidUsernameCharacters = ':~';
$wgUserrightsInterwikiDelimiter = '~';

Autocreation of accounts needs to be enabled:

$wgGroupPermissions['*']['autocreateaccount'] = true;

The GoogleLogin authoritative mode needs to be enabled:

$wgGLAuthoritativeMode = true;

Enabling this feature also has the following influence:

The username of the account is the primary email field of the returned information from Google. This is not configurable.

If a local wiki account is already connected, this account is used to login, which means that an already existing account takes precedence over creating a new one.

The newly created account will automatically be linked with the Google account.

GoogleLogin will not let a user add or remove any further Google account connections (or the automatically created link) to prevent a user from being not able to login anymore.

GoogleLogin does not add a password during the account creation, if the authoritative mode is disabled and password login shall be enabled again, the user needs to reset their password.

Manual account creation

Google Login also supports a variant of the so called authoritative mode, in which, when configured, a user account is still manually created by the respective user but automatically mapped to the Google account, which was used when creating the account, if it is not already associated with a local MediaWiki account. Moreover only permissive Google accounts can register an account manually.

Creation of accounts needs to be enabled (also for private wikis):

$wgGroupPermissions['*']['createaccount'] = true;

If on a private wiki the following pages need to be accessible by everybody, e.g. for English language wikis:

$wgWhitelistRead = [
    'Special:Login',
    'Special:GoogleLoginReturn',
    'Special:CreateAccount',
    'Special:CreateAccount/return'
];

Note that the special pages need to be added in the wiki language.

The primary authentication provider needs to be disabled, i.e. set

$wgAuthManagerAutoConfig['primaryauth'] = [ ];

Enabling manual account creation has the same influence as automatic account creation does (see above), however with the following difference:

The user who creates the account is free in its naming, i.e. some sort of user name logic cannot be enforced.

If a local wiki account is already connected, an additional new account cannot be created manually, which means that an already existing account takes precedence over creating a new one.

Google API PHP Client

This Extension uses the Google API PHP Client (included in versions before 0.2.1), distributed under the Apache 2.0 License. The Client can be downloaded from GitHub.

Maintenance script "updatePublicSuffixArray.php"

The "updatePublicSuffixArray.php" maintenance script downloads a list of domain names which are valid to be used in the world. This is required in order for GoogleLogin to allow subdomains of a specific email domain when you have restricted the login with GoogleLogin for specific domains. This is only needed if $wgGLAllowedDomainsStrict is set to false (which is the default) and every time the setting configuration parameter $wgGLAllowedDomains was changed.

Version lifecycle

Please note that I support only the latest version of GoogleLogin. Any versions apart from the current release (which means the current MediaWiki release branch) and the current development version (aka master) are not supported anymore.

參考さんこう資料しりょう

Gerrit Code review

GoogleLogin 发行状じょう态：测试版ばん

实现	用よう户身份 , 特殊とくしゅ页面
描述	可用かよう您的Google帐户的てき登とう录。
作者さくしゃ	Florian Schmidt (Florianschmidtwelzow^{留とめ言げん})
最新さいしん版本はんぽん	0.4.0-git
MediaWiki	>= 1.39.0
数かず据すえ库更改こうかい	是これ
表ひょう	googlelogin_allowed_domains user_google_user
许可协议	MIT授權條じょう款
下した載の	下した載の扩展 Git ^[?]: 下しも载Git master 浏览存そん储库 (GitHub) 提ひさげ交历史し存そん储库貢獻こうけん者しゃ (GitHub) 代だい码复核かく README
参さん数すう $wgGLAPIKey $wgGLAllowedDomainsStrict $wgGLAppId $wgGLAllowedDomainsDB $wgGLAuthoritativeMode $wgGLSecret $wgGLEnableEchoEvents $wgGLAllowedDomains
添加てんか权限 managegooglelogin managegooglelogindomains
使用しよう的てき函数かんすう钩 ApiMain::moduleManager AuthChangeFormFields BeforeCreateEchoEvent EchoGetBundleRules LoadExtensionSchemaUpdates MergeAccountFromTo UserLogoutComplete UserMergeAccountDeleteTables
有ゆう关兼容よう性せい概がい述じゅつ，请参见版本はんぽん生命せいめい周期しゅうき
季き度ど下か載の量りょう	64 (Ranked 72^nd)
前ぜん往translatewiki.net翻譯ほんやくGoogleLogin扩展
問題もんだい	开启的てき任にん务 · 报告错误