Wiki source code of Authentication
Last modified by Eleni Cojocariu on 2026/08/11 17:41
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | Authentication is the process XWiki uses to determine who is making a request. A wiki uses one authenticator at a time: the standard one checks the password stored in the user's profile, while others hand that decision over to the [[Servlet container>>documentation.xs.admin.installation.methods.install-xwiki-war.configure-servlet-container.WebHome]], an [[LDAP directory>>extensions:Extension.LDAP.Authenticator.WebHome]], an [[OpenID Connect provider>>extensions:Extension.OpenID Connect.OpenID Connect Provider.WebHome]], or to code of your own. An authenticator that hands it over brings the provider's own notion of who a user is, so the wiki holds [[User Profiles and External Identities>>documentation.xs.admin.authentication.user-profiles-external-identities.WebHome]], which is what makes [[copying such a wiki to another environment>>documentation.xs.admin.instance-cloning.WebHome]] a case of its own. | ||
| 2 | |||
| 3 | [[Authentication Types>>documentation.xs.admin.authentication.types.WebHome]] lists what is available, and [[Select the Authenticator>>documentation.xs.admin.authentication.select-authenticator.WebHome]] shows where the choice is made. Three authenticators need server-side setup of their own: [[Configure Container Authentication>>documentation.xs.admin.authentication.configure-container.WebHome]], [[Set Up a Groovy Authenticator in a Wiki Page>>documentation.xs.admin.authentication.set-groovy-authenticator.WebHome]] and [[Configure Kerberos SSO Authentication>>documentation.xs.admin.authentication.configure-kerberos-sso.WebHome]]. | ||
| 4 | |||
| 5 | Whichever authenticator is active, the session is carried by cookies, so a browser that refuses them cannot stay logged in from one page to the next. Their lifetime and protection, and the pages the login flow redirects to, come from the [[Authentication Parameters>>documentation.xs.admin.authentication.parameters.WebHome]]. | ||
| 6 | |||
| 7 | Two things sit beside authentication rather than inside it. Repeated failed logins can disable an account or demand a [[CAPTCHA>>extensions:Extension.CAPTCHA API.WebHome]], through strategies configured in the same administration section and documented by the [[Authentication API>>extensions:Extension.Authentication Security Module.WebHome]] extension. And the messages a user receives after requesting a password reset or a forgotten user name are wiki pages, which an administrator can [[Customize the Authentication Mail Templates>>documentation.xs.admin.authentication.customize-mail-templates.WebHome]]. |
