Hello Ryan,

If you are feeling adventurous, you can fix the plugin yourself.

I'm always feeling adventurous! I'm primarily a .Net, SQL 2005 man. Hence, working with this PHP and MySQL setup is a bit of a learning curve. It is good fun, though, and I appreciate the guidance.

I am narrowing in on the problem. InitUser() results in an "HTTP 500 - Internal server error", whether it is called from the custom plugin or the generic create user.

To reframe the issue, the "Create account" form fails with an HTTP 500. This is with a default install of MediaWiki.

Now, I have PHP configured to throw exceptions into the Windows Application log. None are present when this error occurs. This says to me that it is an logical rather than a syntactical error. My thinking is that it has something to do with the MySQL script not executing properly.

Any suggestions on where to look or how to gather more detailed debugging information?

J Wolfgang Goerlich

I have the the plugin installed and running without an error. I made the suggested modifications (below). Now, Mediawiki pages default to the "Login Required" prompt. From what I can tell, Auth_remote_user_hook() is never called.

Any suggestions on the next step?

Oops, I probably should have told you to make sure you declare the global variable before you use it. It should be:

global $wgHooks; $wgHooks['AutoAuthenticate'][] = 'Auth_remote_user_hook';

Hmmm. More information. The problem is in registering the users, I think. Running "select * from user;" in MySQL returns only the users that I have manually created.

On 12/21/06, J Wolfgang Goerlich jwgoerlich@gmail.com wrote:

...

Oops, I probably should have told you to make sure you declare the global variable before you use it.

Oh! Yes, of course, the value needs to be global in order for the other modules to access it. Made the change and verified the 'Auth_remote_user_hook' is called. That is one step forward.

Now, the web page does not load. It gets into a continuous redirection loop. If I remove the redirection code (see below), then it comes back to the "Login Required" prompt.

The fun continues.

J Wolfgang Goerlich

// if it worked: refer to login page, otherwise, exit header( "Location: http" . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on" ? "s" : "") . "://" . $_SERVER['SERVER_NAME'] . ":" . $_SERVER['SERVER_PORT'] . ( isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : "/" . ( isset($_SERVER['URL']) ? $_SERVER['PATH_INFO'] . ( $_SERVER['QUERY_STRING'] ? "?" . $_SERVER['QUERY_STRING'] : "" ) : "" ) ) );

The password cannot be blank. So, we define a universal password for all accounts. The code below will automatically login for accounts that I manually create. It is not yet automatically creating accounts.

You should use a randomly created password, or blank the password out later in the authentication plugin's initUser() function. It is possible for people to manually log in using SpecialUserlogin and the authenticate function. This would allow people to log in as anyone. To get an idea of how to do this, look at the SSLAuthentication plugin, the Shibboleth plugin, or my plugin. The former two create a random password, the latter blanks out the password.

function Auth_remote_user_hook() {

global $wgUser; global $wgRequest; global $_REQUEST;

// Universal Password for all users $pass = "1Some2Secret3Password4"; // 1Some2Secret3Password4

// HTTP refer to login page $httprefer = "Location: http" . (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == "on" ? "s" : "") . "://" . $_SERVER['SERVER_NAME'] . ":" . $_SERVER['SERVER_PORT'] . ( isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : "/" . ( isset($_SERVER['URL']) ? $_SERVER['PATH_INFO'] . ( $_SERVER['QUERY_STRING'] ? "?" . $_SERVER['QUERY_STRING'] : "" ) : "" ) );

I don't really see the need for the httprefer variable, more on that below.

// For a few special pages, don't do anything. $title = $wgRequest->getVal('title') ; if ($title == 'Special:Userlogout' || $title == 'Special:Userlogin') { return; }

// Do nothing if session is valid $wgUser = User::loadFromSession(); if ($wgUser->isLoggedIn()) { return; }

// Do little if user already exists // (set the _REQUEST variable so that Login knows we're authenticated) $username = get_current_user(); $u = User::newFromName( $username ); if (is_null($u)) { # Invalid username or some other error -- force login, just return return; }

$wgUser = $u; if ($u->getId() != 0) {

// Populate the userlogin form's username and password 

(Userlogin.php)

$_REQUEST['wpName'] = $username;
$_REQUEST['wpPassword'] = $pass;
header($httprefer);

I don't get this part... Why are you changing request variables and sending out headers? I don't think you should be doing this.

// Make call to load session name, otherwise can't save

if( !isset($wgCommandLineMode) && !isset( 

$_COOKIE[session_name()] ) ) { User::SetupSession(); }

// Set the cookies, save the settings, and return

$wgUser->setCookies(); $wgUser->saveSettings(); return; }

// Ok, now we need to create a user.

$wgUser->setPassword=$pass;

include 'includes/SpecialUserlogin.php'; $form = new LoginForm( $wgRequest ); $form->initUser( $wgUser );

$form->mName = $username; $form->mPassword = $pass; $form->mRetype = $pass; $form->mCreateaccount = true; $form->mRemember = true; $form->mRealName = $username;

Why are you setting this stuff after you create the user (form->initUser)? And why aren't you doing it through the authentication plugin's initUser() function? Normally all of this stuff is set before the user is created.

header($httprefer);

Again. It is a little strange to be sending out headers here.

$wgUser->setCookies(); $wgUser->saveSettings();

return;

}

You aren't setting up a session for the new user... Call $wgUser->setupSession(); before you call setCookies().

V/r,

Ryan Lane

I tried filling the request variables and calling the form-post because the initUser() did not appear to set the values. They still do not. Perhaps I am missing some necessary code in that block? (See below.)

Have you bothered to look at how I do this in my plugin? My code is working with mediawiki 1.6+, and the part you are having problems with should be almost 100% what you need line for line. (you can ignore the $wgAuth->printDebug statements).

$wgAuth->printDebug("User does not exist in local database; creating.",1);

//Require SpecialUserlogin so that we can get a loginForm require_once('SpecialUserlogin.php');

//This section contains a silly hack for MW global $wgLang; global $wgContLang; global $wgRequest; if(!isset($wgLang)) { $wgLang = $wgContLang; $wgLangUnset = true; }

$wgAuth->printDebug("Creating LoginForm.",1);

//This creates our form that'll let us create a new user in the database $lf = new LoginForm($wgRequest);

//The user we'll be creating... $wgUser = &$tmpuser; $wgUser->setName($wgContLang->ucfirst($mungedUsername));

$wgAuth->printDebug("Creating User.",1);

//Create the user $lf->initUser($wgUser);

//Update the user's settings $wgAuth->updateUser($wgUser);

//Initialize the user $wgUser->setupSession(); $wgUser->setCookies();

Funny enough I just noticed I call my plugin's updateUser() function, and not initUser() (and now looking at SpecialUserlogin.php and initUser(), I don't actually even need to call that...).

In MediaWiki 1.8 and below it looks like $lf->initUser() didn't automatically call $u->saveSettings(), so you'll need to make sure to call it yourself. Since $lf->initUser() calls $wgAuth->initUser(), you should make all changes required in that function, and manually call saveSettings() on the user object. This is pretty confusing behavior between the versions of MediaWiki, especially since $lf->initUser() didn't previously save settings and it does now, and the LoginForm used to save settings after $wgAuth->updateUser() was called and now it isn't.

Best bet is to update user info in updateUser() and initUser() in your plugin, and call saveSettings() in both. Who knows what wacky changes will be made in the future.

V/r,

Ryan Lane