Page MenuHomePhabricator
Create Task
Maniphest T140127

"Can only obtain a centralauthtoken when using CentralAuth sessions" during auto-creation
Closed, DeclinedPublic
Actions

Description

It seems that during auto-creation of a local account (for an existing global user), you can not use CentralAuth tokens.

See T119736#2451220:

2016-07-10 13:41:27 [V4JQhwpAEHwAAEgXGxgAAAAV] mw1144 commonswiki 1.28.0-wmf.9 exception ERROR: [V4JQhwpAEHwAAEgXGxgAAAAV] /w/api.php?action=query&format=json&origin=https%3A%2F%2Fpl%2Ewikipedia%2Eorg&centralauthtoken=REDACTED&meta=userinfo&uiprop=groups%7Crights   UsageException from line 1487 of /srv/mediawiki/php-1.28.0-wmf.9/includes/api/ApiBase.php: Can only obtain a centralauthtoken when using CentralAuth sessions {"exception_id":"V4JQhwpAEHwAAEgXGxgAAAAV"}
[Exception UsageException] (/srv/mediawiki/php-1.28.0-wmf.9/includes/api/ApiBase.php:1487) Can only obtain a centralauthtoken when using CentralAuth sessions
  #0 /srv/mediawiki/php-1.28.0-wmf.9/extensions/CentralAuth/includes/api/ApiCentralAuthToken.php(51): ApiBase->dieUsage(string, string)
  #1 /srv/mediawiki/php-1.28.0-wmf.9/includes/api/ApiMain.php(1406): ApiCentralAuthToken->execute()
  #2 /srv/mediawiki/php-1.28.0-wmf.9/includes/api/ApiMain.php(471): ApiMain->executeAction()
  #3 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/ForeignWikiRequest.php(39): ApiMain->execute()
  #4 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/ForeignWikiRequest.php(78): EchoForeignWikiRequest->getCentralAuthToken(User)
  #5 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/ForeignWikiRequest.php(58): EchoForeignWikiRequest->getQueryParams(string)
  #6 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/ForeignWikiRequest.php(25): EchoForeignWikiRequest->getRequestParams()
  #7 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/NotifUser.php(710): EchoForeignWikiRequest->execute()
  #8 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/NotifUser.php(741): MWEchoNotifUser->getForeignData()
  #9 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/includes/NotifUser.php(488): MWEchoNotifUser->getForeignCount(string)
  #10 /srv/mediawiki/php-1.28.0-wmf.9/extensions/Echo/Hooks.php(1147): MWEchoNotifUser->resetNotificationCount()
  #11 /srv/mediawiki/php-1.28.0-wmf.9/includes/Hooks.php(195): EchoHooks::onUserSaveSettings(User)
  #12 /srv/mediawiki/php-1.28.0-wmf.9/includes/user/User.php(3952): Hooks::run(string, array)
  #13 /srv/mediawiki/php-1.28.0-wmf.9/includes/auth/AuthManager.php(1678): User->saveSettings()
  #14 /srv/mediawiki/php-1.28.0-wmf.9/includes/Setup.php(861): MediaWiki\Auth\AuthManager->autoCreateUser(User, string, boolean)
  #15 /srv/mediawiki/php-1.28.0-wmf.9/includes/WebStart.php(137): include(string)
  #16 /srv/mediawiki/php-1.28.0-wmf.9/api.php(38): include(string)
  #17 /srv/mediawiki/w/api.php(3): include(string)
  #18 {main}

Echo has been changed in rECHOe63b8799a480: ForeignWikiRequest: Bail early for non-global users (also backported) to stop trying to use CentralAuth here, but I'm wondering if we want this to/it could work.

Related Objects

Event Timeline

• Mattflaschen-WMF created this task.Jul 12 2016, 4:44 PM
Restricted Application added subscribers: Zppix, Aklapper. · View Herald TranscriptJul 12 2016, 4:44 PM
• Mattflaschen-WMF added projects: MediaWiki-extensions-CentralAuth, Collaboration-Team-Triage.Jul 12 2016, 4:44 PM
• Mattflaschen-WMF mentioned this in T119736: Could not find local user data for {Username}@{wiki}.Jul 12 2016, 4:53 PM
Anomie added a comment.Jul 12 2016, 5:26 PM

You also can't use API action=centralauthtoken when the user is authenticated using OAuth, which Echo trying to do seems to be what's behind T140006: With some accounts but not others, API throws badsession error on OAuth options update. Removing the requirement for a CentralAuthSession to be in use probably wouldn't fix that since the followup would just fail from having multiple top-priority SessionInfos, unless you're really good about isolating the recursive requests from any main-request state.

IMO FauxRequests to ApiMain are a bad idea in the first place, and all the more so when you're trying to do it before the local user is even set up completely.

jayvdb subscribed.Jul 13 2016, 12:25 AM
Tgr added a comment.Jul 18 2016, 6:05 PM

For OAuth this approach won't work in general as the client secret would be needed to sign the subrequest. What would be needed here is a way for a wiki to send a trusted request to another wiki in the same farm, kind of like sudo -u. Which is kind of scary security-wise. Also it's not clear how grants should be handled (when an OAuth consumer which does not have right X makes a request that does not need X on the target wiki but triggers a subrequest to another wiki which does need X).

• Mattflaschen-WMF added a comment.Jul 21 2016, 12:17 AM
In T140127#2454269, @Anomie wrote:

You also can't use API action=centralauthtoken when the user is authenticated using OAuth, which Echo trying to do seems to be what's behind T140006: With some accounts but not others, API throws badsession error on OAuth options update.

The use of centralauthtoken in saveSettings is resolved, but we still use it if they query ApiEchoUnreadNotificationPages or ApiEchoNotifications (latter depending on parameters). This shouldn't impact random people doing non-Echo things, but I've filed it as T140963: ForeignWikiRequest and getFromForeign will fail if OAuth or bot passwords are in use.

• Mattflaschen-WMF mentioned this in T140963: ForeignWikiRequest and getFromForeign will fail if OAuth or bot passwords are in use.Jul 21 2016, 12:21 AM
RandomDSdevel awarded a token.Aug 5 2016, 9:45 PM
• MZMcBride mentioned this in T112730: Failure to OAuth after login on mobile.Sep 30 2016, 2:21 AM
Aklapper edited projects, added: Growth-Team; removed: Collaboration-Team-Triage.Oct 12 2019, 4:08 AM
Aklapper removed subscribers: Anomie, • Mattflaschen-WMF.Oct 16 2020, 5:01 PM
MBinder_WMF added a project: Growth-Team-Filtering.Apr 15 2021, 6:59 PM
Ivi104 subscribed.Jan 6 2024, 11:06 PM
Bugreporter moved this task from Backlog to Central session, SSO (autologin) and centralauthtoken on the MediaWiki-extensions-CentralAuth board.Mar 5 2024, 11:46 AM
Urbanecm_WMF removed projects: Growth-Team-Filtering, Growth-Team.Oct 27 2025, 11:50 PM
Restricted Application added a project: MediaWiki-Core-Platform-Team. · View Herald TranscriptOct 27 2025, 11:50 PM
matmarex closed this task as Declined.Oct 30 2025, 9:10 PM
matmarex subscribed.

Declining based on the discussion from 2016, it seems that this isn't wanted.

The issue causing exceptions in production has been worked around in Echo by skipping these API requests for non-CentralAuth sessions (https://gerrit.wikimedia.org/g/mediawiki/extensions/Echo/+/9595c693c31e97f28dff8ca47344492cf4125a2f/includes/ForeignWikiRequest.php#77).

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits