Authenticating Mediawiki with OAuth2

 

It's the year 2023 and there must be a way to authenticate Mediawiki (MW) with OAuth2. Currently the LTS version of Mediawiki is 1.39.1. My OAuth2 and OpenID provider is Keycloak. 

It can be accomplished with the extension OpenID Connect. It's simple, once you have the dependencies in place. I spent more time providing "composer" as a dependence than configuring the SSO part.

Hera are the relevant parts of  theDockerfile:

FROM registry.procempa.com.br/mediawiki:1.39.1




COPY composer.local.json composer.local.json

RUN  wget https://extdist.wmflabs.org/dist/extensions/PluggableAuth-REL1_39-e7de886.tar.gz &&\

wget https://extdist.wmflabs.org/dist/extensions/OpenIDConnect-REL1_39-0fefe8b.tar.gz &&\

tar -zxvf PluggableAuth-REL1_39-e7de886.tar.gz -C extensions &&\

tar -zxvf OpenIDConnect-REL1_39-0fefe8b.tar.gz -C extensions &&\

chown -R www-data:www-data extensions

#Composer as dependency for OpendIDConnect    

#https://tecadmin.net/how-to-install-and-use-php-composer-on-debian-11/

RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');" &&\

    php composer-setup.php --install-dir=/usr/local/bin --filename=composer &&\

    chmod +x /usr/local/bin/composer &&\

    composer update

This isn't the complete Dockerfile, but you get the picture: download and unzip the extensions PluggableAuth and OpenIDConnect and install composer. I did this because the simple "apt install -y composer" wasn't working in Debian 11 (the SO of the image) and I didn't have time to debug.

Notice that the Dockerfile copies a file named composer.local.json. It adds the extension as a dependency. The content of composer.local.json:

{

"extra": {

"merge-plugin": {

"include": [

"extensions/OpenIDConnect/composer.json"

]

}

}

}

Finally, just create the client in your Keycloak instance and add the relevant part of LocalSettings.php (replace providerURL, clientID and clientsecret, accordingly):

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'OpenIDConnect' );

$wgPluggableAuth_Config["Login using SSO"] = [

    'plugin' => 'OpenIDConnect',

    'data' => [

        'providerURL' => 'https://your-keycloak-url/auth/realms/your-healm',

        'clientID' => 'client_name',

        'clientsecret' => 'SECRET'

    ]

]

It worked for me.