Page MenuHomePhabricator

PAWS can not login, OAuth error: API error mwoauth-invalid-authorization
Closed, ResolvedPublic

Description

Yesterday I could login as usual, but today I can not login at all. I tried on two accounts (bot and my original) but without success.

Terminal output (shame I can not copy/paste from there):


Welcome to PAWS!
Please behave responsibly
Getting Started: https://www.mediawiki.org/wiki/Manual:Pywikibot/PAWS
Questions? Need help? Find us on #pywikibot on IRC on freenode!
File bugs at https://phabricator.wikimedia.org/maniphest/task/create/?projects=PAWS
MABot@PAWS:~$ pwb.py login
WARNING: API error mwoauth-invalid-authorization: The authorization headers in your request are not valid: No approved grant was fou
nd for that authorization token.
Traceback (most recent call last):
  File "/srv/paws/pwb/pwb.py", line 263, in <module>
    if not main():
  File "/srv/paws/pwb/pwb.py", line 257, in main
    run_python_file(filename, [filename] + args, argvu, file_package)
  File "/srv/paws/pwb/pwb.py", line 121, in run_python_file
    main_mod.__dict__)
  File "/srv/paws/pwb/scripts/login.py", line 193, in <module>
    main()
  File "/srv/paws/pwb/scripts/login.py", line 176, in main
    site.login(sysop)
  File "/srv/paws/pwb/pywikibot/site.py", line 2065, in login
    self.getuserinfo(force=True)
  File "/srv/paws/pwb/pywikibot/site.py", line 2148, in getuserinfo
    uidata = uirequest.submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 1896, in submit
    self._add_defaults()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 1699, in _add_defaults
    MediaWikiVersion(self.site.version()) >= MediaWikiVersion('1.25wmf5')):
  File "/srv/paws/pwb/pywikibot/site.py", line 2725, in version
    version = self.siteinfo.get('generator', expiry=1).split(' ')[1]
  File "/srv/paws/pwb/pywikibot/site.py", line 1676, in get
    preloaded = self._get_general(key, expiry)
  File "/srv/paws/pwb/pywikibot/site.py", line 1622, in _get_general
    default_info = self._get_siteinfo(props, expiry)
  File "/srv/paws/pwb/pywikibot/site.py", line 1548, in _get_siteinfo
    data = request.submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 2342, in submit
    self._data = super(CachedRequest, self).submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 2175, in submit
    % (self.site, info))
pywikibot.exceptions.NoUsername: Failed OAuth authentication for wikipedia:es: The authorization headers in your request are not val
id: No approved grant was found for that authorization token.
<class 'pywikibot.exceptions.NoUsername'>
CRITICAL: Closing network session.
MABot@PAWS:~$

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

I can confirm this happened on both Dvorapa and Dvorapa bot :( I can't reproduce it on my account though.

I've added additional OAuth related tags to see if someone with more OAuth knowledge could help...

@yuvipanda I can login and pwb.py login -lang:cs works fine. Account UrbanecmBot was used.

Tgr added a subscriber: Tgr.Aug 27 2016, 6:20 PM

Well, what token are you using?

(copy text from a command prompt window)

@Tgr this is at paws.wmflabs.org, so after the user logs in, we inject the
credentials into pywikibot using this code:
https://github.com/yuvipanda/paws/blob/master/singleuser/user-config.py

Hi, I have the same problem for pwb.py login.py -lang:fr after disconnet / close / shutdown all

pywikibot.exceptions.NoUsername: Failed OAuth authentication for wikipedia:fr: The authorization headers in your request are not valid: No
 approved grant was found for that authorization token.                                                                                   
<class 'pywikibot.exceptions.NoUsername'>

PAWS was working for me last weekend.

Maybe try to force password login using pwb.py login -pass -lang:fr for example as a workaround?

I've got the same error, with and without good password, preceded by

WARNING: The -pass argument is not implemented yet. See: https://phabricator.wikimedia.org/T102477

Ok. So try to remove lines from # If OAuth integration is available, take it to the end of file in file named /srv/paws/user-config.py, then try to login normally. This should allow you to use PAWS using password. The server will try to revert your changes as soon as possible so when it will not work, try to do it again. Or, you can try to add unset CLIENT_ID to .bashrc file.

Tgr added a comment.Aug 29 2016, 1:25 AM

@yuvipanda, but what are those credentials? Sharing the client_id/access_key should be safe and it's hard to debug the problem without that.

ah, sure. 0a73e346a40b07262b6e36bdba01cba4 is the client_id.

Tgr added a comment.Aug 29 2016, 6:26 AM

The access token is 7cb5b315a11d0dcbe46d1c90332dd210 for Dvorapa (timestamp: 20160827125759) and 0d64b706435230a05213f605ff1ad8ac for Framawiki (20160829061415). Does that match the PAWS data?

Hmm, nope that doesn't match.

Also, @Dvorapa @Framawiki please do not use password based login. This is highly insecure - I've filed T144151 to disable it on PAWS. In the meantime, you two should probably change your passwords. I understand it's frustrating to not be able to use this, I'll try to get it sorted in the next week with help from @Tgr.

@yuvipanda Okay, so sorry for my advice :). I wanted to give them access to the service somehow and not reveal them passwords :). BTW, when they run chmod 600 on lwp files and keep them in this mode (so only them should be able to read it), will it be more secure?

BTW, when I use password based login at labs, I can see *.lwp has 644 mode by default. I think this is not right and probably pwb should create files like this with 600 mode by default. So I'm going to change my bot password right now and enable OAuth login for my user account too :).

This do not affect only WMF services but all users who uses password based login at computers with more than one user account in it...

I filled T144157 for set up PWB as I described.

Ok, i understand. (@yuvipanda, I just send you an email)

Hi, I have tested now with "framawiki" and it still not work. "framabot" looks ok.
I have save all files. @yuvipanda Can you try to reset any content in your server for "framawiki" account ?

Hello! I unfortunately won't have time to look into this for at least two more weeks (all of ops are travelling to our offsite). I'll check back with @Tgr and debug when I'm back. In the meantime, I assume you can just use the @framabot account without issues?

No problem, I understand. I have a shell acces on tool labs too, so it is not urgent. And yes i have checked tonight, my second account work on paws, so i can run my tests. See you next time :)

Restricted Application added a subscriber: pywikibot-bugs-list. · View Herald TranscriptJan 10 2017, 8:50 PM

I solved it by updating pwb git repo on PAWS and uploading own preferences file. I only can not stop server (everything would be back broken). But time to time, PAWS stops my server somehow automatically and I have to update git repo and load own preferences file again. Not easy though :/

BTW is there some manual how to use other login options than a password?

@Dvorapa As said before don't use password auth please. Regarding the other methods you can use OAuth (documented at https://www.mediawiki.org/wiki/Manual:Pywikibot/OAuth). If you use this, the user-config must be 600 as it contains info required for logging in and making actions.

BTW you may request access to Tool-labs (https://wikitech.wikimedia.org/wiki/Help:Tool_Labs) and then use pywikibot there. It is much easier than using PAWS.

Abbe98 added a subscriber: Abbe98.EditedFeb 10 2017, 2:24 PM

@Dvorapa you need to add a user-config.py file to your root directory see the following file as an example. That should be all needed for authentication on PAWS.

The version of Pywikibot installed by default is over a year old, I might do a pull request updating it later today.

@Urbanecm I'd like to avoid password in PAWS (in order to avoid this bug and/or be more secure), therefore I asked, what are the options. Thank you for links, I am browsing them. Two questions: I understand OAuth is more secure, but why? If I set OAuth tokens and stuff for PAWS, can I still use password on my PC at home?

Dvorapa added a comment.EditedFeb 10 2017, 5:04 PM

@Urbanecm BTW if pywikibot on Tool-labs is much easier to use than PAWS, what is the advantage of PAWS? I haven't tried Tool-labs yet, because I haven't needed to and because of some bugs Tool-labs has got (discussed in some of our previous talks). I love the way how PAWS works as it works exactly how I need (except this bug, naturally :D)

The step 1 of manual to start using OAuth does not work. It looks like the page is called differently.

@Dvorapa when you use passwords on PAWS I believe they are public to all PAWS users.

Yes, you can even comment the OAuth line and log in using password. When I said easier I meant you can use crons, grid, you have access to replicas etc. PAWS can be used everywhere (some firewalls may block 22), you dont need to set up anything to get it working, just log in And use.

The page is called Special:OAuthConsumerRegistration/propose but It must be used at meta.

Removing the extension tag as there does not seem to be anything actionable on that side.

On second thought I'll keep the tag and hide it on the workboard. Sorry for the noise.

Framawiki renamed this task from PAWS can not login to PAWS can not login, OAuth error: API error mwoauth-invalid-authorization.Apr 25 2017, 7:44 PM
Framawiki updated the task description. (Show Details)
Framawiki added a subscriber: MarcoAurelio.

@MarcoAurelio Hint: reinstalling pywikibot inside paws terminal was a solution for me ;)

@Dvorapa: would you please tell me how to do that? I am new to the PAWS
platform. Thanks.

I have the same problem after i login i write pwb.py commonscat -start:Category:! -summary:Přidáno commonscat za použití bota and it respond this:
WARNING CommonscatBot.init set the Bot.site property; this is only needed when the Bot accesses many sites.

Retrieving 50 pages from wikipedia:cs.

Kategorie:'s-Hertogenbosch <<<

Commonscat template is already on Kategorie:'s-Hertogenbosch

WARNING API error mwoauth-invalid-authorization-invalid-user: The authorization headers in your request are for a user that does not exist here

0 pages read

0 pages written

Execution time: 1 seconds

Script terminated by exception:

ERROR NoUsername: Failed OAuth authentication for commons:commons: The authorization headers in your request are for a user that does not exist

here

Traceback (most recent call last):

File "/srv/paws/pwb/pwb.py", line 263, in <module>

  if not main():

File "/srv/paws/pwb/pwb.py", line 257, in main

  run_python_file(filename, [filename] + args, argvu, file_package)

File "/srv/paws/pwb/pwb.py", line 121, in run_python_file

  main_mod.__dict__)

File "/srv/paws/pwb/scripts/commonscat.py", line 549, in <module>

  main()

File "/srv/paws/pwb/scripts/commonscat.py", line 541, in main

  bot.run()

File "/srv/paws/pwb/pywikibot/bot.py", line 1525, in run

  super(Bot, self).run()

File "/srv/paws/pwb/pywikibot/bot.py", line 1434, in run

  self.treat(page)

File "/srv/paws/pwb/scripts/commonscat.py", line 254, in treat

  self.addCommonscat(page)

File "/srv/paws/pwb/scripts/commonscat.py", line 305, in addCommonscat

  currentCommonscatTarget)

File "/srv/paws/pwb/scripts/commonscat.py", line 453, in checkCommonscatLink

  commonsPage = pywikibot.Page(commonsSite, "Category:" + name)

File "/srv/paws/pwb/pywikibot/tools/__init__.py", line 1448, in wrapper

  return obj(*__args, **__kw)

File "/srv/paws/pwb/pywikibot/page.py", line 2179, in __init__

  super(Page, self).__init__(source, title, ns)

File "/srv/paws/pwb/pywikibot/page.py", line 163, in __init__

  self._link = Link(title, source=source, defaultNamespace=ns)

File "/srv/paws/pwb/pywikibot/page.py", line 5086, in __init__

  self._defaultns = self._source.namespaces[defaultNamespace]

File "/srv/paws/pwb/pywikibot/site.py", line 1014, in namespaces

  self._namespaces = NamespacesDict(self._build_namespaces())

File "/srv/paws/pwb/pywikibot/site.py", line 2612, in _build_namespaces

  is_mw114 = MediaWikiVersion(self.version()) >= MediaWikiVersion('1.14')

File "/srv/paws/pwb/pywikibot/site.py", line 2725, in version

  version = self.siteinfo.get('generator', expiry=1).split(' ')[1]

File "/srv/paws/pwb/pywikibot/site.py", line 1676, in get

  preloaded = self._get_general(key, expiry)

File "/srv/paws/pwb/pywikibot/site.py", line 1622, in _get_general

  default_info = self._get_siteinfo(props, expiry)

File "/srv/paws/pwb/pywikibot/site.py", line 1548, in _get_siteinfo

  data = request.submit()

File "/srv/paws/pwb/pywikibot/data/api.py", line 2342, in submit

  self._data = super(CachedRequest, self).submit()

File "/srv/paws/pwb/pywikibot/data/api.py", line 2175, in submit

  % (self.site, info))

pywikibot.exceptions.NoUsername: Failed OAuth authentication for commons:commons: The authorization headers in your request are for a user that

does not exist here

<class 'pywikibot.exceptions.NoUsername'>

CRITICAL: Closing network session.

Urbanecm added a comment.EditedJul 15 2017, 7:11 PM

Just login on Commons manually before you run the bot for the first time.

The account was already created on commonswiki, per CentalAuth.

I login on Commons manually but then it write
pywikibot.exceptions.NoUsername: Failed OAuth authentication for wikipedia:ar: The authorization headers in your request are for a user that does not exist here

Why are you trying to edit wikipedia:ar then? By the way try pwb.py commonscat -start:Category:! -summary:"Přidáno commonscat za použití bota" (note the quotes).

Hmm... I've got it. The tools tries to browse ALL wikis per interwiki. You'll need to visit all wikis when logged in to be sure you have an account at all of them. This is totally irelevant to PAWS.

When i login site that is writen in the error the error show another wiki

As I said: The script tries to login at all existent wikis so you'll have to create your account at it by visiting it for the first time.

WalterKlosse added a comment.EditedJul 15 2017, 8:04 PM

Yes....but it existing thousands of wikipedias

You're not right. Only 308 Wikipedias and 909 wikis in together ;). You may use https://meta.wikimedia.org/wiki/User:Krinkle/Tools/Global_SUL when signed as your bot to create an account at all wikis by a script.

urbanecm@notebook ~/Dokumenty/wikimedia/developer/operations/mediawiki-config/dblists 
$ wc -l wikipedia.dblist 
308 wikipedia.dblist
urbanecm@notebook ~/Dokumenty/wikimedia/developer/operations/mediawiki-config/dblists 
$ wc -l all.dblist
909 all.dblist
urbanecm@notebook ~/Dokumenty/wikimedia/developer/operations/mediawiki-config/dblists 
$

You're welcome.

@yuvipanda and others: I am experiencing this problem as well in PAWS (WARNING: API error mwoauth-invalid-authorization: The authorization headers in your request are not valid: No approved grant was found for that authorization token., see full error message here). From the details in this task I was not able to recover the PAWS tool for me, so do we have a solution meanwhile?

@MisterSynergy can you (and others!) try out a new install at https://paws.tools.wmflabs.org? All your old files will still be here, but the authentication (and other code) is vastly improved and stable. I'll point paws.wmflabs.org to this in the next few days. Try it out and see if that solves your problem?

Thanks!

@yuvipanda It works as expected for me.

Works for me as well.

@yuvipanda

marcoaurelio@PAWS:~$ pwb.py login -family:wikibooks -lang:es
Traceback (most recent call last):
  File "/srv/paws/pwb/pwb.py", line 262, in <module>
    if not main():
  File "/srv/paws/pwb/pwb.py", line 255, in main
    run_python_file(filename, [filename] + args, argvu, file_package)
  File "/srv/paws/pwb/pwb.py", line 121, in run_python_file
    main_mod.__dict__)
  File "/srv/paws/pwb/scripts/login.py", line 190, in <module>
    main()
  File "/srv/paws/pwb/scripts/login.py", line 173, in main
    site.login(sysop)
  File "/srv/paws/pwb/pywikibot/site.py", line 2086, in login
    'right': self._username[sysop]})
pywikibot.exceptions.NoUsername: Logged in on wikibooks:es via OAuth as MarcoAurelio, but expect as None
<class 'pywikibot.exceptions.NoUsername'>
CRITICAL: Closing network session.
marcoaurelio@PAWS:~$
marcoaurelio@PAWS:~$ pwb.py redirect do -family:wikibooks -lang:es
Traceback (most recent call last):
  File "/srv/paws/pwb/pwb.py", line 262, in <module>
    if not main():
  File "/srv/paws/pwb/pwb.py", line 255, in main
    run_python_file(filename, [filename] + args, argvu, file_package)
  File "/srv/paws/pwb/pwb.py", line 121, in run_python_file
    main_mod.__dict__)
  File "/srv/paws/pwb/scripts/redirect.py", line 828, in <module>
    main()
  File "/srv/paws/pwb/scripts/redirect.py", line 821, in main
    pywikibot.Site().login()
  File "/srv/paws/pwb/pywikibot/site.py", line 2086, in login
    'right': self._username[sysop]})
pywikibot.exceptions.NoUsername: Logged in on wikibooks:es via OAuth as MarcoAurelio, but expect as None
<class 'pywikibot.exceptions.NoUsername'>
CRITICAL: Closing network session.
marcoaurelio@PAWS:~$

@MarcoAurelio - is that showing up at paws.tools.wmflabs.org and not at paws.wmflabs.org? Or is it showing up at both?

@MarcoAurelio - is that showing up at paws.tools.wmflabs.org and not at paws.wmflabs.org? Or is it showing up at both?

Sorry for the late reply @yuvipanda. I will test again just to be sure but if my memory does not fail it was at paws.tools.

matej_suchanek removed a subscriber: matej_suchanek.
Chicocvenancio closed this task as Resolved.May 25 2018, 2:16 PM
Chicocvenancio claimed this task.
Chicocvenancio added a subscriber: Chicocvenancio.

A lot has changed since the creation of this bug, and it has been almost 10 months without information, I'm assuming this has been solved/is no longer valid.

Viztor reopened this task as Open.Nov 6 2018, 5:23 PM
Viztor added a subscriber: Viztor.

This is still an existing bug. So if I fill in my home wiki information in user-config.py. it work successfully, but not if I don't.
I have a theory about what happened, so basically the script is trying to log me into a wikimedia site which i haven't accessed yet, maybe there is a default test wiki? I'm not exactly sure of the internal mechanism, but given the aforementioned fact, this is the best theory I can came up with for now.

Chicocvenancio closed this task as Resolved.Nov 6 2018, 5:26 PM

@Viztor please open a new bug if you have an issue. The original issue issue here was under very different circumstances from today's PAWS installation.

This is still an existing bug. So if I fill in my home wiki information in user-config.py. it work successfully, but not if I don't.
I have a theory about what happened, so basically the script is trying to log me into a wikimedia site which i haven't accessed yet, maybe there is a default test wiki? I'm not exactly sure of the internal mechanism, but given the aforementioned fact, this is the best theory I can came up with for now.

There always must be your home wiki in user-config.py. You can use generate_user_files.py to add your home wiki to the user-config.py file.

Or define it in code.

Or use -lang:xx arg for provided scripts.
The default used wiki used is http://test.wikipedia.org/.

Dvorapa added a comment.EditedNov 6 2018, 9:08 PM

Or use -lang:xx arg for provided scripts.
The default used wiki used is http://test.wikipedia.org/.

You'll need to use also -user parameter usually to make it work.

PAWS will auto connect your username to several wikis.

I'm trying tologin, but I'm getting this-

WARNING: API error mwoauth-invalid-authorization-invalid-user: The authorization headers in your request are for a user that does not exist here
Traceback (most recent call last):
  File "/srv/paws/pwb/pwb.py", line 250, in <module>
    if not main():
  File "/srv/paws/pwb/pwb.py", line 243, in main
    run_python_file(filename, [filename] + args, argvu, file_package)
  File "/srv/paws/pwb/pwb.py", line 95, in run_python_file
    main_mod.__dict__)
  File "/srv/paws/pwb/scripts/login.py", line 198, in <module>
    main()
  File "/srv/paws/pwb/scripts/login.py", line 180, in main
    site.login(sysop, autocreate=autocreate)
  File "/srv/paws/pwb/pywikibot/site.py", line 2076, in login
    raise e
  File "/srv/paws/pwb/pywikibot/site.py", line 2067, in login
    self.getuserinfo(force=True)
  File "/srv/paws/pwb/pywikibot/site.py", line 2165, in getuserinfo
    uidata = uirequest.submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 1966, in submit
    self._add_defaults()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 1506, in _add_defaults
    and self.site.mw_version >= '1.25wmf5'):
  File "/srv/paws/pwb/pywikibot/site.py", line 2767, in mw_version
    mw_ver = MediaWikiVersion(self.version())  File "/srv/paws/pwb/pywikibot/site.py", line 2750, in version
    expiry=1).split(' ')[1]
  File "/srv/paws/pwb/pywikibot/site.py", line 1670, in get
    preloaded = self._get_general(key, expiry)
  File "/srv/paws/pwb/pywikibot/site.py", line 1616, in _get_general
    default_info = self._get_siteinfo(props, expiry)
  File "/srv/paws/pwb/pywikibot/site.py", line 1539, in _get_siteinfo
    data = request.submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 2234, in submit
    self._data = super(CachedRequest, self).submit()
  File "/srv/paws/pwb/pywikibot/data/api.py", line 2061, in submit
    % (self.site, info))
pywikibot.exceptions.NoUsername: Failed OAuth authentication for wikipedia:test: The authorization headers in your requestare for a user that does not exist here
CRITICAL: Exiting due to uncaught exception <class 'pywikibot.exceptions.NoUsername'>

I have created accounts on all wikis using https://meta.wikimedia.org/wiki/User:Krinkle/Tools/Global_SUL.

@Mohinem how are you trying to login? There is no login required for Wikimedia wikis.