Authentication Types
Reference
Only one authenticator is active at a time on a wiki, chosen as described in Select the Authenticator. The authenticators below are part of XWiki.
| Authenticator | authclass value | Description |
|---|---|---|
| Standard | none, this is the default | Checks the password stored in the user's profile. Shown as "Standard XWiki Authenticator" in the wiki administration. |
| Container | com.xpn.xwiki.user.impl.xwiki.AppServerTrustedAuthServiceImpl | Trusts the user the Servlet container already authenticated, and falls back to the standard authenticator when there is none. See Configure Container Authentication. |
| Kerberos | com.xpn.xwiki.user.impl.xwiki.AppServerTrustedKerberosAuthServiceImpl | Behaves like Container, extracting the user name out of a Kerberos principal. See Configure Kerberos SSO Authentication. |
| Groovy | com.xpn.xwiki.user.impl.xwiki.GroovyAuthServiceImpl | Runs an authenticator written in Groovy and stored in a wiki page. See Set Up a Groovy Authenticator in a Wiki Page. |
The values above go into the xwiki.authentication.authclass property, described in the Authentication Parameters.
Form and Basic Credentials
The standard authenticator collects credentials in one of two ways, selected with the xwiki.authentication property: form, the default, serves the login form, while basic answers an unauthenticated request with an HTTP Basic challenge.
A single request can ask for Basic authentication without changing the configuration, by adding the basicauth parameter to the URL:
https://username:[email protected]/xwiki/bin/view/Main/WebHome?basicauth=1Authenticators Provided by Extensions
- OpenID Connect Authenticator, to authenticate against an OpenID Connect provider.
- LDAP Authenticator, to authenticate against an LDAP directory.
To write an authenticator of your own, follow Create a Custom Authenticator.
Active Directory
An Active Directory server is reached either through the LDAP Authenticator above, configured by hand, or through the Active Directory Application — a paying application from XWiki SAS that adds a visual configuration editor, settings applied without restarting the server, and support.
FAQ
Which authenticator is used when none is configured?
The standard one, which checks the password stored in the user's profile.
Can an authenticator be combined with another?
Only when it does so itself: Container and Kerberos authentication fall back to the standard authenticator, so the login form keeps working for users who have a password.
