| Aklapper | |
| Jan 4 2022, 10:19 AM |
| F34907235: Screen Shot 2022-01-04 at 8.27.05 AM.png | |
| Jan 4 2022, 3:29 PM |
| F34906920: Screenshot from 2022-01-04 11-18-12.png | |
| Jan 4 2022, 10:19 AM |
Go to https://wikitech.wikimedia.org/wiki/Special:CreateAccount and fill out all fields.
Get an error ⧼authmanager-authplugin-create-fail⧽ (literally).
This was reported in https://www.mediawiki.org/wiki/Topic:Wngszzt4a01micef by @MarcoFalda, coming from T252788.
I can confirm this problem. This problem blocks code contributions.
Enabling ldap debug logging confirms it's an issue with writing to ldap but nothing more useful:
2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Entering getDomain 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 basedn is ou=people,dc=wikimedia,dc=org 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Using uid as the naming attribute, dn is: uid=majavah-test-aaa,ou=people,dc=wikimedia,dc=org 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 User account's objectclasses: inetorgperson::person::ldappublickey::posixaccount::shadowaccount 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Adding user 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Entering getBaseDN 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Entering getDomain 2022-01-04 10:29:48 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 basedn is ou=people,dc=wikimedia,dc=org 2022-01-04 10:29:50 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 id returned: 36829 2022-01-04 10:29:50 [9cc9a31f-285d-408a-a91c-62a08e6e266f] labweb1001 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Failed to add user
no user was written to ldap:
taavi@mwmaint1002 ~ $ ldapsearch -x 'uid=majavah-test-aaa' # extended LDIF # # LDAPv3 # base <dc=wikimedia,dc=org> (default) with scope subtree # filter: uid=majavah-test-aaa # requesting: ALL # # search result search: 2 result: 0 Success # numResponses: 1
Also probably worth noting that the spambot account creations seems to have stopped just when the year changed. Not sure how the few accounts created after that happened though?
Change 751405 had a related patch set uploaded (by Majavah; author: Majavah):
[mediawiki/extensions/LdapAuthentication@master] Include ldap errno on account creation debug logs
Change 751405 merged by jenkins-bot:
[mediawiki/extensions/LdapAuthentication@master] Include ldap errno on account creation debug logs
Change 751192 had a related patch set uploaded (by Majavah; author: Majavah):
[mediawiki/extensions/LdapAuthentication@wmf/1.38.0-wmf.13] Include ldap errno on account creation debug logs
Change 751193 had a related patch set uploaded (by Majavah; author: Majavah):
[mediawiki/extensions/LdapAuthentication@wmf/1.38.0-wmf.16] Include ldap errno on account creation debug logs
Change 751192 merged by jenkins-bot:
[mediawiki/extensions/LdapAuthentication@wmf/1.38.0-wmf.13] Include ldap errno on account creation debug logs
Change 751193 merged by jenkins-bot:
[mediawiki/extensions/LdapAuthentication@wmf/1.38.0-wmf.16] Include ldap errno on account creation debug logs
Mentioned in SAL (#wikimedia-operations) [2022-01-04T12:34:11Z] <taavi@deploy1002> Synchronized php-1.38.0-wmf.13/extensions/LdapAuthentication/includes/LdapAuthenticationPlugin.php: Backport: [[gerrit:751192|Include ldap errno on account creation debug logs (T298508)]] (duration: 00m 58s)
With the above patch deployed we now get this error:
2022-01-04 12:32:23 [286d9efb-2900-46e0-a245-e0ef2f3db2c8] labweb1002 labswiki 1.38.0-wmf.13 ldap INFO: 2.2.0 Failed to add user (errno 19)
taavi@labweb1002 ~ $ mwscript shell.php labswiki Psy Shell v0.10.8 (PHP 7.2.34-18+0~20210223.60+debian10~1.gbpb21322+wmf5 — cli) by Justin Hileman >>> ldap_err2str( 19 ); => "Constraint violation"
The ldap search query limit was properly raised (it's in a custom acl, not the default value), can you try again now?
Change 751455 had a related patch set uploaded (by Ammarpad; author: Ammarpad):
[mediawiki/extensions/LdapAuthentication@master] Provide i18n for old AuthPlugin messages
Change 751455 merged by jenkins-bot:
[mediawiki/extensions/LdapAuthentication@master] Provide i18n for old AuthPlugin messages
