Maniphest T192025

Define Grants for CentralAuth
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Rxy
	Apr 11 2018, 8:26 PM

Description

I'm now using API with OAuth clients for some tasks for semi automated.
However, currently can not global block or remove that via API with OAuth Clients due to not defined related GrantPermissions for CentralAuth.
Of course, I can use APIs if I set a main session to bot. but I don't want share my main sessions with bot for insecure.

For this, I propose to define a related GrantPermissions (centralauth-lock, centralauth-oversight).

If we had this, we do not need to share a passwords or an user sessions with bots for using automated process.

It means we can be improve our security for user not sharing password with bots or similar .

Details

	Subject	Repo	Branch	Lines +/-
	Add GrantPermissions with centralauth-lock, centralauth-oversight	mediawiki/extensions/CentralAuth	master	+13 -2

Customize query in gerrit

Related Objects

Mentioned In: T203129: Define Suppress grants
T185349: No possibility to run lock via botpasswords
Mentioned Here: T192024: Define Grants for global blocking

Event Timeline

Rxy created this task.Apr 11 2018, 8:26 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 11 2018, 8:26 PM

If we had this, we do not need to share a passwords or an user sessions with bots for using automated process.

Just in case someone starts to wonder. We have never ever shared accounts, passwords or sessions to perform stewardry job.

Change 425660 had a related patch set uploaded (by Rxy; owner: Rxy):
[mediawiki/extensions/CentralAuth@master] Add GrantPermissions with centralauth-lock, centralauth-oversight

https://gerrit.wikimedia.org/r/425660

gerritbot added a project: Patch-For-Review.Apr 11 2018, 8:40 PM

In T192025#4124911, @MarcoAurelio wrote:

If we had this, we do not need to share a passwords or an user sessions with bots for using automated process.

Just in case someone starts to wonder. We have never ever shared accounts, passwords or sessions to perform stewardry job.

same as T192024#4124948

MarcoAurelio mentioned this in T185349: No possibility to run lock via botpasswords.Apr 16 2018, 3:50 PM

Change 425660 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Add GrantPermissions with centralauth-lock, centralauth-oversight

https://gerrit.wikimedia.org/r/425660

ReleaseTaggerBot added a project: MW-1.32-notes (WMF-deploy-2018-04-24 (1.32.0-wmf.1)).Apr 18 2018, 9:00 PM

MarcoAurelio closed this task as Resolved.Apr 19 2018, 8:54 AM

MarcoAurelio removed a project: Patch-For-Review.

Rxy merged a task: T185349: No possibility to run lock via botpasswords.May 9 2018, 3:53 AM

Rxy added subscribers: Luke081515, JJMC89.

Rxy mentioned this in T203129: Define Suppress grants.Aug 29 2018, 11:00 PM