In T141020#2488916, @Tegel wrote:Here: https://meta.wikimedia.org/wiki/Special:CentralAuth/%E6%97%A5%E6%9C%AC%E8%84%B1%E7%A8%8E%E5%85%9A
is another newly created account with one unattached account.
Description
Description
Details
Details
Customize query in gerrit
Related Objects
Related Objects
- Mentioned In
- T57420: Remove local wiki password hash when CentralAuth has attached account
T143289: Frequent "User NAME exists locally but is not attached" in logs
T137551: Logout does not work when the loginwiki account is unattached
T141020: Users with detached local accounts after rename during train deployment of 1.27.0-wmf.11 - Mentioned Here
- T149356: "User 'User' exists locally but is not attached." error logged occasionally on registration
T119736: Could not find local user data for {Username}@{wiki}
T137551: Logout does not work when the loginwiki account is unattached
T141020: Users with detached local accounts after rename during train deployment of 1.27.0-wmf.11
Event Timeline
Comment Actions
mysql:wikiadmin@db1094 [centralauth]> select * from localuser where lu_name = ' 日本脱税党'; +---------------+-----------------+-----------------------+--------------------+ | lu_wiki | lu_name | lu_attached_timestamp | lu_attached_method | +---------------+-----------------+-----------------------+--------------------+ | jawikiquote | 日本脱税党 | 20160722191303 | login | | mediawikiwiki | 日本脱税党 | 20160722190604 | login | | metawiki | 日本脱税党 | 20160722190603 | new | +---------------+-----------------+-----------------------+--------------------+ 3 rows in set (0.00 sec) mysql:wikiadmin@db1094 [centralauth]> select * from localnames where ln_name = '日本脱税党'; +---------------+-----------------+ | ln_wiki | ln_name | +---------------+-----------------+ | jawikiquote | 日本脱税党 | | loginwiki | 日本脱税党 | | mediawikiwiki | 日本脱税党 | | metawiki | 日本脱税党 | +---------------+-----------------+ 4 rows in set (0.00 sec)
and the loginwiki account does indeed exist.
This is extra bad due to T137551.
Comment Actions
Created by CentralAuthCreateLocalAccountJob, which says registration failed for global account '日本脱税党'.
Comment Actions
That's logged in CentralAuthUser::register which as far as I can see could only be called from CentralAuthHooks::onLocalUserCreated after passing a !$centralUser->exists() check. So probably the job is scheduled and executed so fast that it runs before the transaction for the registration is committed.
Comment Actions
The odd thing about that error is that it comes from CentralAuthUser::register(), which shouldn't have been called from CentralAuthCreateLocalAccountJob at all.
To make this happen, first CentralAuthUser::getInstance( $user )->exists() would have to be true to avoid erroring out in CentralAuthCreateLocalAccountJob, but then the LocalUserCreated hook would have to find that CentralAuthUser::getMasterInstance( $user )->exists() returns false. So, maybe if the CA cache was updated but the transaction wasn't committed yet, then the job got picked up and run before that transaction commit happened.
Comment Actions
mysql:wikiadmin@db1086 [centralauth]> SELECT COUNT(*) FROM localnames LEFT OUTER JOIN localuser ON ln_wiki = lu_wiki AND ln_name = lu_name WHERE lu_name IS NULL; +----------+ | COUNT(*) | +----------+ | 1567 | +----------+ 1 row in set (5 min 43.16 sec)
Of course some of that could be due to T119736 or something else entirely and does not necessarily represent real unattached accounts.
Comment Actions
Change 300679 had a related patch set uploaded (by Gergő Tisza):
Do not schedule local account creation jobs until central transaction is committed
Comment Actions
A new unattached account is created every couple minutes. The first account is from 20160719202514.
SELECT gu_name, ln_wiki, gu_registration FROM localnames LEFT OUTER JOIN localuser ON ln_wiki = lu_wiki AND ln_name = lu_name JOIN globaluser ON ln_name = gu_name WHERE lu_name IS NULL ORDER BY gu_registration DESC
A new unattached account is created every couple minutes. The first account is from 20160719202514.
Comment Actions
Change 300679 merged by jenkins-bot:
Do not schedule local account creation jobs until central transaction is committed
Comment Actions
Mentioned in SAL [2016-07-23T00:37:41Z] <tgr> doing an emergency deploy of https://gerrit.wikimedia.org/r/#/c/300679 for T141160, creates dozens of new users per hour to be unattached on loginwiki which probably has weird consequences
Comment Actions
Change 300690 had a related patch set uploaded (by Gergő Tisza):
Do not schedule local account creation jobs until central transaction is committed
Comment Actions
Change 300690 merged by jenkins-bot:
Do not schedule local account creation jobs until central transaction is committed
Comment Actions
Mentioned in SAL [2016-07-23T01:00:46Z] <tgr@tin> Synchronized php-1.28.0-wmf.11/extensions/CentralAuth/includes/CentralAuthPrimaryAuthenticationProvider.php: T141160 (duration: 00m 28s)
Comment Actions
Mentioned in SAL [2016-07-23T01:01:25Z] <tgr@tin> Synchronized php-1.28.0-wmf.11/extensions/CentralAuth/includes/CentralAuthHooks.php: T141160 (duration: 00m 27s)
Comment Actions
Mentioned in SAL [2016-07-23T01:02:06Z] <tgr@tin> Synchronized php-1.28.0-wmf.11/extensions/CentralAuth/includes/CentralAuthPlugin.php: T141160 (duration: 00m 29s)
Comment Actions
No more cases since the patch was deployed so it seems like it worked. The full list of affected users is
(921 users).Comment Actions
Are any unattached accounts actually being created? Or are we just seeing transient errors when the CentralAuthCreateLocalAccountJob for loginwiki races with the redirect to Special:CentralAuth/start on loginwiki?
Comment Actions
You are right; running the query from T141160#2489124 did not find any; also, spot-checked users look okay (and the loginwiki account creation timestamp matches with the others). Still would be nice to prevent the errors; filed T149356.