I agree that there should be some established procedure for cases where it becomes apparent action needs to be taken on a closed wiki.

@Base are you able to provide some examples to demonstrate a need for this? I am sure if something were to come up we could e-mail a staffer to handle it as to my knowledge there has been no prior case requiring this action.

In any case, it would be beneficial to establish a process to deal with potential cases of this nature - it could easily be to e-mail T&S and have them flag the appropriate person to handle it.

I recall a request in 2018 that I had to defer to someone else because it was closed and I did not have local account there. Chatted with @Legoktm back then but if this is doable I think it should be done — in the future we might not have a steward with access to that closed wiki.

Sysadmins can create the accounts manually server-side as necessary. Off the top of my head I'm not sure how we can fix this in a general manner but my auth stack knowledge is a bit outdated.

I think the creation of a maintenance script that would create accounts on all wikis for all members of a global group would be the solution here. It would then be possible to call that script after each steward election.

I've tried mwscriptwikiset createAndPromote.php closed.dblist --custom-groups=steward --force Base, but that a) yelled that I must pass a password (contrary to the docs, fixed that and uploaded 523694 for in-script fix), because account Base does not exist on (some) closed wikis b) when I ran mwscript createAndPromote.php --wiki=wikimania2005wiki --custom-groups=steward --force "Martin Urbanec" "some random password" to try it first with my own account, it said Cannot create account: The requested username is already taken by a user on another wiki.. It seems it's not possible to create an account on SUL closed wiki with createAndPromote.php.

Because of this, the only solution that comes to my mind is either introduce autocreateaccount right to CentralAuth, which will stay granted and allow everyone with a SUL account to create an account on a closed wiki, or maybe even just stop revoking createaccount? Given the log @Base linked, it's possible the right wasn't revoked all the time and it was revoked due to some reason I don't see now. Links to relevant tasks welcomed.

@Legoktm When you said "Sysadmins can create the accounts manually server-side as necessary", did you mean createAndPromote.php, or something else (eval.php and manual SQL queries come to my mind, both is something we would like to avoid)?

For the reasons mentioned above, @Base was promoted to a steward on some closed wikis. If this is not wanted, feel free to revert.

Change 540380 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Grant autocreateaccount to everyone on closed wikis

https://gerrit.wikimedia.org/r/540380

It seems autocreateaccount right exists. Then, my patch above would be the simplest solution :).

Change 540380 abandoned by Urbanecm:
Grant autocreateaccount to everyone on closed wikis

Reason:
let's try another approach

https://gerrit.wikimedia.org/r/540380

Change 542755 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Allow certain users to create account at closed wikis

https://gerrit.wikimedia.org/r/542755

Change 542755 merged by jenkins-bot:
[operations/mediawiki-config@master] Allow certain users to create account at closed wikis

https://gerrit.wikimedia.org/r/542755

Change 549078 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Add logger to passed closedwikiprovider check

https://gerrit.wikimedia.org/r/549078

Change 549079 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Do not mention user group in ClosedWikiProvider logging

https://gerrit.wikimedia.org/r/549079

Change 549078 merged by jenkins-bot:
[operations/mediawiki-config@master] Add logger to passed closedwikiprovider check

https://gerrit.wikimedia.org/r/549078

Change 549079 merged by jenkins-bot:
[operations/mediawiki-config@master] Do not mention user group in ClosedWikiProvider logging

https://gerrit.wikimedia.org/r/549079

Mentioned in SAL (#wikimedia-operations) [2019-11-06T12:36:43Z] <urbanecm@deploy1001> Synchronized wmf-config/CommonSettings.php: SWAT: a239b14: Allow certain users to create account at closed wikis (T222117; 1/2) (duration: 00m 59s)

Mentioned in SAL (#wikimedia-operations) [2019-11-06T12:38:03Z] <urbanecm@deploy1001> Synchronized wmf-config/InitialiseSettings.php: SWAT: a239b14: Allow certain users to create account at closed wikis (T222117; 2/2) (duration: 01m 00s)

Tested with MarcoAurelio (test) on an ad-hoc global user group with autocreateaccount permissions on. I could create accounts at closed wikis: aa.wikipedia and bg.wikinews. Waiting for @Urbanecm testing on his side.

Change 549138 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Instrument logging to ClosedWikiProvider

https://gerrit.wikimedia.org/r/549138

Change 549138 merged by jenkins-bot:
[operations/mediawiki-config@master] Instrument logging to ClosedWikiProvider

https://gerrit.wikimedia.org/r/549138

Mentioned in SAL (#wikimedia-operations) [2019-11-06T18:28:33Z] <urbanecm@deploy1001> Synchronized wmf-config/CommonSettings.php: SWAT: Instrument logging to ClosedWikiProvider (T222117) (duration: 01m 01s)

Mentioned in SAL (#wikimedia-operations) [2019-11-06T18:34:49Z] <urbanecm@deploy1001> Synchronized wmf-config/CommonSettings.php: Fix typo (T222117) (duration: 01m 00s)

In T222117#5640901, @MarcoAurelio wrote:

Tested with MarcoAurelio (test) on an ad-hoc global user group with autocreateaccount permissions on. I could create accounts at closed wikis: aa.wikipedia and bg.wikinews. Waiting for @Urbanecm testing on his side.

Works for me, however, @Majavah was able to create a lot of accounts.