Page MenuHomePhabricator

Enable SUL accounts on Governance wiki
Closed, ResolvedPublic

Description

Enable SUL account support and permit editing on talk pages, user pages, and translations.

Migration plan

  • Restrict editing on GovWiki to editors as previously discussed (needed, as the next step will let random people in)
  • Enable CentralAuth extension, allowing local account holders to log in (this is disabled on normal wikis, but we want it enabled at GovWiki for some short transitional/migration period)
  • Inform all enabled account holders CentralAuth is available. Offer them the possibility to manually merge their account via Special:MergeAccount if they want to, making it clear it will be eventually done by us (well, me). This is not a strictly required step, however, I personally prefer having control over when migration for my account happens, so I thought it's good to give notice and a possibility for self-service if someone wants to.
  • Wait 7 days
  • Merge all existing accounts to (some) global account. Since that process is hard to explain using text-only, there's a diagram for it. Green blocks in the diagram are actions I can do myself, actions that need to be assisted by someone else are in orange.
  • Ensure there are no left unmigrated accounts.
  • Disable logging in via local account credentials (this is to make GovWiki's behavior same as behavior of all other SUL wikis; local credentials were temporarily kept enabled for transitional purposes as part of step 2).

Migration progress for accounts

Staff

  • foundationwiki removed, SUL does not exist
  • foundationwiki removed, SUL unlocked (NEEDS ITS)
    • Contact ITS to check account holder status
    • Process accounts as directed by ITS
  • foundationwiki removed, SUL locked
  • foundationwiki enabled, SUL not found
  • foundationwiki enabled, SUL locked (NEEDS ITS)
    • Contact ITS to check account holder status
    • Process accounts as directed by ITS
  • foundationwiki enabled, SUL unlocked
    • Send notification that SUL is available
    • Wait 7 days (until November 4, 2021)
    • Merge remaining accounts

Volunteers

  • foundationwiki removed, SUL not found
    • Create (unlocked) SUL
    • Consider lifting local block
  • foundationwiki removed, SUL exists
    • Merge
    • Consider lifting local block
  • foundationwiki enabled, SUL not found
  • foundationwiki enabled, SUL found
    • Send notification that SUL is available
    • Wait 7 days
    • Merge remaining accounts

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change 717506 merged by jenkins-bot:

[operations/mediawiki-config@master] Connect foundationwiki to SUL

https://gerrit.wikimedia.org/r/717506

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:03:19Z] <urbanecm> urbanecm@mwmaint1002:~$ mwscript extensions/CentralAuth/maintenance/migratePass0.php --wiki=foundationwiki # T205347, with 717506 pulled to mwmaint1002

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:11:41Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: 6f557db4ad82aa3ec80550a423d538099bf305fa: Connect foundationwiki to SUL (T205347) (duration: 01m 03s)

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:14:42Z] <urbanecm@deploy1002> Synchronized wmf-config/CommonSettings.php: 6f557db4ad82aa3ec80550a423d538099bf305fa: Connect foundationwiki to SUL (T205347; 1/3) (duration: 01m 03s)

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:16:26Z] <urbanecm@deploy1002> Synchronized dblists/fishbowl.dblist: 6f557db4ad82aa3ec80550a423d538099bf305fa: Connect foundationwiki to SUL (T205347; 2/3) (duration: 01m 03s)

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:17:32Z] <urbanecm@deploy1002> Synchronized wmf-config/config/foundationwiki.yaml: 6f557db4ad82aa3ec80550a423d538099bf305fa: Connect foundationwiki to SUL (T205347; 3/3) (duration: 01m 02s)

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:27:12Z] <urbanecm> [urbanecm@mwmaint1002 ~]$ mwscript extensions/CentralAuth/maintenance/migrateAccount.php --wiki=foundationwiki --safe --auto --userlist users.txt # T205347, users.txt is P17626

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:35:17Z] <urbanecm> [urbanecm@mwmaint1002 ~/foundationwiki-sul]$ mwscript extensions/CentralAuth/maintenance/attachAccount.php --wiki=foundationwiki --userlist users.txt # T205347; users.txt is at P17627

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:45:06Z] <urbanecm> [urbanecm@mwmaint1002 ~/foundationwiki-sul]$ mwscript extensions/CentralAuth/maintenance/migrateAccount.php --wiki=foundationwiki --safe --auto --userlist users.txt # T205347, users.txt is at P17628

Mentioned in SAL (#wikimedia-operations) [2021-10-28T12:48:48Z] <urbanecm> [urbanecm@mwmaint1002 ~/foundationwiki-sul]$ mwscript extensions/CentralAuth/maintenance/migrateAccount.php --wiki=foundationwiki --safe --auto --userlist users.txt # T205347, users.txt P17629

Mentioned in SAL (#wikimedia-operations) [2021-10-28T14:25:51Z] <urbanecm> [urbanecm@mwmaint1002 ~/foundationwiki-sul]$ mwscript extensions/CentralAuth/maintenance/attachAccount.php --wiki=foundationwiki --userlist users.txt # T205347, users.txt P17630

I am getting

There seems to be a problem with your login session; this action has been canceled as a precaution against session hijacking. Please resubmit the form.

Upon trying to login to wmfwiki (tried both my SUL and my WMFwiki passwords).

On @Urbanecm_WMF's suggestion I've tried to do the same in anonymous tab: it worked, with my wmfwiki password. It seems that my wmfwiki account is unattached now, so SUL finalisation is no more :)

It also seems that my 2FA is disabled now and I do not see an option to enable it (the latter makes sense, I am not an admin), unless I attach the account to SUL I guess. My email is also not confirmed now. As a note I am using a different email on my wmfwiki account than on my SUL account, not sure if it plays any role.

Change 735408 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] foundationwiki: Revoke editsitejson and editinterface from users

https://gerrit.wikimedia.org/r/735408

Change 735408 merged by jenkins-bot:

[operations/mediawiki-config@master] foundationwiki: Revoke editsitejson and editinterface from users

https://gerrit.wikimedia.org/r/735408

Mentioned in SAL (#wikimedia-operations) [2021-10-28T15:43:08Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: bcc910fffbad3a776aa2465740ac42e9e8ffa26c: foundationwiki: Revoke editsitejson and editinterface from users (T205347) (duration: 01m 04s)

It also seems that my 2FA is disabled now and I do not see an option to enable it (the latter makes sense, I am not an admin), unless I attach the account to SUL I guess. My email is also not confirmed now. As a note I am using a different email on my wmfwiki account than on my SUL account, not sure if it plays any role.

That's interesting -- I still see you as 2FA-enrolled in foundationwiki's database.

I think this happens because the wiki is now in a weird state -- half of the accounts are migrated to SUL and half is not. I don't think it needs to be in-depth investigated, as this is a "once in N years" scenario, and connecting your account to SUL should fix it instantly (if not, let me know!).

Mentioned in SAL (#wikimedia-operations) [2021-10-28T16:17:50Z] <urbanecm> Attach BStorm (WMF)@foundationwiki to SUL (T205347)

Change 735432 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] foundationwiki: Use shared OAuth tables

https://gerrit.wikimedia.org/r/735432

Change 735432 merged by jenkins-bot:

[operations/mediawiki-config@master] foundationwiki: Use shared OAuth tables

https://gerrit.wikimedia.org/r/735432

Mentioned in SAL (#wikimedia-operations) [2021-10-28T19:12:07Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: 60413dcece4a9e5ec125be49315dc22ec3b85cc7: foundationwiki: Use shared OAuth tables (T205347) (duration: 01m 04s)

Change 735438 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily

https://gerrit.wikimedia.org/r/735438

Change 735438 merged by jenkins-bot:

[operations/mediawiki-config@master] foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily

https://gerrit.wikimedia.org/r/735438

Mentioned in SAL (#wikimedia-operations) [2021-10-28T20:13:04Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: c23e7ab0f88a64b8f656e06949518fb816b2dd56: foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily (T205347) (duration: 00m 55s)

Change 735443 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] Make foundationwiki a standard CentralAuth wiki

https://gerrit.wikimedia.org/r/735443

Mentioned in SAL (#wikimedia-operations) [2021-10-29T16:22:29Z] <urbanecm> [urbanecm@mwmaint1002 ~]$ mwscript extensions/CentralAuth/maintenance/attachAccount.php --wiki=foundationwiki --userlist users.txt # T205347, users.txt is at P17639

Mentioned in SAL (#wikimedia-operations) [2021-10-29T16:37:33Z] <urbanecm> [urbanecm@mwmaint1002 ~]$ mwscript extensions/CentralAuth/maintenance/attachAccount.php --wiki=foundationwiki --userlist users.txt # T205347, users.txt is at P17640

Mentioned in SAL (#wikimedia-operations) [2021-10-29T16:41:28Z] <urbanecm> Connect Babel AutoCreate@foundationwiki to SUL (T205347)

Change 735674 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] foundationwiki: Disable direct account creation

https://gerrit.wikimedia.org/r/735674

Mentioned in SAL (#wikimedia-operations) [2021-10-29T17:42:57Z] <urbanecm> [urbanecm@mwmaint1002 /srv/mediawiki/php/maintenance]$ mwscript reassignEdits.php --wiki=foundationwiki --norc 'Neil P. Quinn-WMF' 'Neil Shah-Quinn (WMF)' # part of SUL finalisation at foundationwiki, T205347

Mentioned in SAL (#wikimedia-operations) [2021-10-29T17:47:34Z] <urbanecm> Connect Neil Shah-Quinn (WMF)@foundationwiki to SUL (T205347)

Mentioned in SAL (#wikimedia-operations) [2021-10-29T22:57:45Z] <urbanecm> [urbanecm@mwmaint1002 ~]$ mwscript extensions/CentralAuth/maintenance/attachAccount.php --wiki=foundationwiki --userlist users.txt # T205347, users.txt is at P17641

Change 735674 merged by jenkins-bot:

[operations/mediawiki-config@master] foundationwiki: Disable direct account creation

https://gerrit.wikimedia.org/r/735674

Mentioned in SAL (#wikimedia-operations) [2021-11-01T11:00:03Z] <urbanecm> 10:59:03 Synchronized wmf-config/InitialiseSettings.php: c236232bc48f4a61e98ffd2a93a23375bbb46287: foundationwiki: Disable direct account creation (T205347) (duration: 00m 56s)

Change 736293 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] foundationwiki: Set wgCentralAuthCookies to true

https://gerrit.wikimedia.org/r/736293

Change 736293 merged by jenkins-bot:

[operations/mediawiki-config@master] foundationwiki: Set wgCentralAuthCookies to true

https://gerrit.wikimedia.org/r/736293

Mentioned in SAL (#wikimedia-operations) [2021-11-02T17:44:06Z] <urbanecm@deploy1002> Synchronized wmf-config/CommonSettings.php: 339be07a35de1fa3846b845376695d68a9d743fd: foundationwiki: Set wgCentralAuthCookies to true (T205347) (duration: 00m 54s)

Most accounts are now migrated. Only few dozens of them are now remaining, which belong to two categories:

  1. staff with no global account yet (ITS is aware, and no action is necessary for now)
  2. volunteers with a matching global account that do not have a matching email

For the second group of accounts, they need to be manually verified. A list of such accounts is available at this public spreadsheet. If you're reading, and you want to help, feel free to request edit access (mentioning your Phabricator username) – I'll highly appreciate any hlep.

Mentioned in SAL (#wikimedia-operations) [2021-10-29T17:42:57Z] <urbanecm> [urbanecm@mwmaint1002 /srv/mediawiki/php/maintenance]$ mwscript reassignEdits.php --wiki=foundationwiki --norc 'Neil P. Quinn-WMF' 'Neil Shah-Quinn (WMF)' # part of SUL finalisation at foundationwiki, T205347

this should probably be done with AKlapper and AKlapper (WMF) as there's currently two accounts due to the latter visiting the wiki

Mentioned in SAL (#wikimedia-operations) [2021-10-29T17:42:57Z] <urbanecm> [urbanecm@mwmaint1002 /srv/mediawiki/php/maintenance]$ mwscript reassignEdits.php --wiki=foundationwiki --norc 'Neil P. Quinn-WMF' 'Neil Shah-Quinn (WMF)' # part of SUL finalisation at foundationwiki, T205347

this should probably be done with AKlapper and AKlapper (WMF) as there's currently two accounts due to the latter visiting the wiki

Not unless Andre asks me to :-). It's ordinary for staff members to have work and volunteer accounts (cf. Martin Urbanec and Martin Urbanec (WMF)), and those shouldn't be reassigned under normal cases.

For Neil, his name changed, and got multiple (local) foundationwiki _and_ global accounts. So, that was bit of a special case.

Not unless Andre asks me to :-). It's ordinary for staff members to have work and volunteer accounts (cf. Martin Urbanec and Martin Urbanec (WMF)), and those shouldn't be reassigned under normal cases.

For Neil, his name changed, and got multiple (local) foundationwiki _and_ global accounts. So, that was bit of a special case.

I know but the "Aklapper" account's only other wiki with edits is Wikimania which points out it's a duplicate account and his personal account is Malyacko according to AKlapper (WMF)'s meta userpage

Mentioned in SAL (#wikimedia-operations) [2021-11-10T12:06:18Z] <urbanecm> wikiadmin@10.64.48.109(centralauth)> delete from globalnames where gn_name='AAnctil (WMF)'; # to let OIT create that account globally, SULification of foundationwiki, T205347

Mentioned in SAL (#wikimedia-operations) [2021-11-10T12:06:40Z] <urbanecm> wikiadmin@10.64.48.109(centralauth)> select * from localnames where ln_name='AAnctil (WMF)'; # to let OIT create that account globally, SULification of foundationwiki, T205347

Mentioned in SAL (#wikimedia-operations) [2021-11-10T12:07:19Z] <urbanecm> wikiadmin@10.64.48.109(centralauth)> delete from localnames where ln_wiki='foundationwiki' and ln_name='AAnctil (WMF)'; # to let OIT create that account globally, SULification of foundationwiki, T205347

Mentioned in SAL (#wikimedia-operations) [2021-11-10T12:07:35Z] <urbanecm> wikiadmin@10.64.48.109(centralauth)> delete from localnames where ln_name='DJemielniak (WMF)' and ln_wiki='foundationwiki'; # to let OIT create that account globally, SULification of foundationwiki, T205347

Mentioned in SAL (#wikimedia-operations) [2021-11-10T12:07:44Z] <urbanecm> wikiadmin@10.64.48.109(centralauth)> delete from globalnames where gn_name='DJemielniak (WMF)'; # to let OIT create that account globally, SULification of foundationwiki, T205347

Staff accounts are almost done, only two WMF accounts are left. DJemielniak (WMF) and AAnctil (WMF) exist only at foundationwiki, and need to be created globally too. ITS (OIT) was asked to do that. In theory, migrateAccount.php would handle that just fine. However, since WMF-marked accounts for staff/board are handled by ITS only under normal circumstances, I decided to ask them to do the creations.

To make that possible, I had to temporarily remove those accounts from localnames/globalnames tables, which lets users to create account via SpecialCreateAccount normally. WMF-marked accounts are protected by title blacklist anyway, so this doesn't add any risk of someone else taking that account name (as it would with volunteers).

Change 737908 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] Revert \"[beta] Enable CentralAuth on foundationwiki\"

https://gerrit.wikimedia.org/r/737908

Change 737908 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert \"[beta] Enable CentralAuth on foundationwiki\"

https://gerrit.wikimedia.org/r/737908

Change 742492 had a related patch set uploaded (by Urbanecm; author: Urbanecm):

[operations/mediawiki-config@master] Revert \"foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily\"

https://gerrit.wikimedia.org/r/742492

Change 742492 merged by jenkins-bot:

[operations/mediawiki-config@master] Revert \"foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily\"

https://gerrit.wikimedia.org/r/742492

Mentioned in SAL (#wikimedia-operations) [2021-11-29T16:52:11Z] <urbanecm@deploy1002> Synchronized wmf-config/InitialiseSettings.php: 567f2a9d4883c9a98a3251f153ea0ad58d7774c6: Revert "foundationwiki: Set wmgLocalAuthLoginOnly=false temporarily" (T205347) (duration: 00m 56s)

Change 735443 merged by jenkins-bot:

[operations/mediawiki-config@master] Make foundationwiki a standard CentralAuth wiki

https://gerrit.wikimedia.org/r/735443

Mentioned in SAL (#wikimedia-operations) [2021-11-29T16:56:10Z] <urbanecm@deploy1002> Synchronized wmf-config/CommonSettings.php: bad34ed8d86b30eb4c240da0498ddfb44af30ea7: Make foundationwiki a standard CentralAuth wiki (T205347) (duration: 00m 56s)

@Varnent This is now done. All accounts were migrated, other SUL accounts can log in. Let me know if there's anything else to do.

Just FYI, the Foundation wiki passed 10,000 "registered users" (i.e., created user accounts) today, about 8,500 of which have been automatically created since 2021-10-28, when the wiki was first connected to SUL (so, roughly 200 per day). Not saying this is a Bad Thing, just reporting it in case anyone following this task is interested.

I don't think that's any issue. Wikis like Meta (33M) or English Wikipedia
(42M) already have a high number of users existing and operate just fine.

Let's call this resolved.

Change 987138 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[operations/mediawiki-config@master] add foundationwiki to the list of central auth login wikis

https://gerrit.wikimedia.org/r/987138

Change 987138 merged by jenkins-bot:

[operations/mediawiki-config@master] add foundationwiki to the list of central auth login wikis

https://gerrit.wikimedia.org/r/987138

Mentioned in SAL (#wikimedia-operations) [2024-01-11T14:21:39Z] <reedy@deploy2002> Synchronized wmf-config/InitialiseSettings.php: T205347 (duration: 07m 41s)