Page MenuHomePhabricator

PluggableAuth fails with clientlogin API
Closed, InvalidPublicBUG REPORT


List of steps to reproduce (step by step, including full links if applicable):

import requests

url = ''

s = requests.Session()

params = {
    'action': 'query',
    'meta': 'tokens',
    'type': 'login',
    'format': 'json'

# it's a self-signed cert on a test system, I don't care about verifying it
resp = s.get(url=url, params=params, verify=False)

logintoken = resp.json()['query']['tokens']['logintoken']

data = {
    'action': 'clientlogin',
    'username': 'uckelman',
    'password': 'mypassword',
    'loginreturnurl': '',
    'logintoken': logintoken,
    'format': 'json'

resp =, data=data)


Run the test program:

python3 -W ignore

What happens?:

[uckelman@test tmp]$ python3 -W ignore 
{'clientlogin': {'status': 'FAIL', 'message': 'The supplied credentials could not be authenticated.', 'messagecode': 'authmanager-authn-no-primary'}}

What should have happened instead?:

I should receive a sucess message and cookies for having logged in.

Software version (if not a Wikimedia wiki), browser information, screenshots, other information, etc:

Fedora package: mediawiki-1.35.2-1.fc34.noarch

See this discussion for more details.

Event Timeline

It turns out this wasn't a bug, but a misunderstanding of what parameters were required. (See the discussion linked above for further details.)