OAuth fails CI due to missing RSA tokens
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Anomie
	Feb 5 2020, 6:57 PM

Project Tags

Referenced Files

None

Subscribers

Description

13:51:49 1) RestStructureTest::testPathParameters with data set "Handler /oauth2/resource/{{type}}" (array('/oauth2/resource/{{type}}', 'MediaWiki\Extensions\OAuth\Re...actory'))
13:51:49 === Logs generated by test case
13:51:49 [objectcache] [debug] MainWANObjectCache using store {class} {"class":"EmptyBagOStuff"}
13:51:49 ===
13:51:49 Key file "file://" permissions are not correct, recommend changing to 600 or 660 instead of 755
13:51:49 
13:51:49 /workspace/src/vendor/league/oauth2-server/src/CryptKey.php:59
13:51:49 /workspace/src/vendor/league/oauth2-server/src/ResourceServer.php:50
13:51:49 /workspace/src/extensions/OAuth/src/ResourceServer.php:46
13:51:49 /workspace/src/extensions/OAuth/src/ResourceServer.php:35
13:51:49 /workspace/src/extensions/OAuth/src/Rest/Handler/Resource.php:28
13:51:49 /workspace/src/vendor/wikimedia/object-factory/src/ObjectFactory.php:172
13:51:49 /workspace/src/vendor/wikimedia/object-factory/src/ObjectFactory.php:102
13:51:49 /workspace/src/includes/Rest/Router.php:296
13:51:49 /workspace/src/vendor/wikimedia/testing-access-wrapper/src/TestingAccessWrapper.php:72
13:51:49 /workspace/src/tests/phpunit/structure/RestStructureTest.php:47
13:51:49 /workspace/src/tests/phpunit/MediaWikiIntegrationTestCase.php:416
13:51:49 /workspace/src/maintenance/doMaintenance.php:99

league/oauth2-server assumes the use of self-encoded access tokens, which requires a "CryptKey" instance representing a configured RSA key.

We don't actually need self-encoded tokens for MediaWiki, but since the library requires it we need to either supply the RSA keys to make it work or replace BearerTokenValidator and use of AccessTokenTrait in AccessTokenEntity with some other implementation.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Fixes to make CI pass again	Anomie	mediawiki/extensions/OAuth	master	+42 -12

Customize query in gerrit

Related Objects

Mentioned In: T361619: PHP Notice: Key file permissions are not correct, recommend changing to 600 or 660 instead of 644
T244423: jwt.io shows owner-only tokens with an invalid "exp" claim date

Event Timeline

Anomie created this task.Feb 5 2020, 6:57 PM

Restricted Application added subscribers: Liuxinyu970226, • Aklapper. · View Herald TranscriptFeb 5 2020, 6:57 PM

Anomie added a project: Platform Team Workboards (Clinic Duty Team).Feb 5 2020, 6:58 PM

Change 570398 had a related patch set uploaded (by Anomie; owner: Anomie):
[mediawiki/extensions/OAuth@master] Set $wgOAuth2(Public|Private)Key for CI

https://gerrit.wikimedia.org/r/570398

gerritbot added a project: Patch-For-Review.Feb 5 2020, 6:59 PM

Anomie moved this task from Inbox to Waiting for Review on the Platform Team Workboards (Clinic Duty Team) board.Feb 5 2020, 6:59 PM

Anomie moved this task from Uncategorized to Needs Review on the MediaWiki-extensions-OAuth board.

Anomie mentioned this in T244423: jwt.io shows owner-only tokens with an invalid "exp" claim date.Feb 6 2020, 4:30 PM

Change 570398 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Fixes to make CI pass again

https://gerrit.wikimedia.org/r/570398

ReleaseTaggerBot added a project: MW-1.35-notes (1.35.0-wmf.19; 2020-02-11).Feb 7 2020, 1:00 AM

Maintenance_bot removed a project: Patch-For-Review.Feb 7 2020, 1:10 AM

Anomie closed this task as Resolved.Feb 7 2020, 6:48 PM