CentralAuth should eliminate global user groups from global accounts before the account deletion/unattachment

Are there any use cases for global account deletion/unattachement these days? I'm wondering if it's possible to just delete those features instead of adding more complexity to that logic.

In T299650#7636797, @Majavah wrote:

CentralAuth should eliminate global user groups from global accounts before the account deletion/unattachment

Are there any use cases for global account deletion/unattachement these days? I'm wondering if it's possible to just delete those features instead of adding more complexity to that logic.

There were 9 account deletions in the last 5 years (https://meta.wikimedia.org/wiki/Special:Log?type=globalauth&user=&page=&wpdate=&tagfilter=&subtype=delete). For most of them I don't really understand why it was performed.

In T299650#7636797, @Majavah wrote:

CentralAuth should eliminate global user groups from global accounts before the account deletion/unattachment

Are there any use cases for global account deletion/unattachement these days? I'm wondering if it's possible to just delete those features instead of adding more complexity to that logic.

At least on WMF wikis I have not encountered the need to delete global accounts in ages after SUL-Finalization. However CentralAuth is also used elsewhere, and I think it'd be great to fix the underlying issue so this stops happening in the future.

Another approach could be preventing global account deletions with global permissions, asking the steward to remove the user from these groups first; if that's simpler.

Mentioned in SAL (#wikimedia-operations) [2022-01-24T19:09:38Z] <taavi> deleted centralauth.global_user_groups for 10 non-existent users T299650

Manually deleted those rows:

wikiadmin@10.64.48.109(centralauth)> SELECT gu_id, gu_name FROM globaluser WHERE gu_id IN (99, 456, 6888, 25914, 1498691, 1936335, 3159104, 3179225);
Empty set (0.001 sec)

wikiadmin@10.64.48.109(centralauth)> SELECT gug_user, gug_group, gug_expiry FROM global_user_groups WHERE gug_user IN (99, 456, 6888, 25914, 1498691, 1936335, 3159104, 3179225);
+----------+-------------------------+------------+
| gug_user | gug_group               | gug_expiry |
+----------+-------------------------+------------+
|       99 | Cabal                   | NULL       |
|       99 | steward                 | NULL       |
|      456 | steward                 | NULL       |
|     6888 | global-sysop            | NULL       |
|    25914 | global-rollbacker       | NULL       |
|  1498691 | steward                 | NULL       |
|  1936335 | global-interface-editor | NULL       |
|  3159104 | global-rollbacker       | NULL       |
|  3159104 | global-sysop            | NULL       |
|  3179225 | global-rollbacker       | NULL       |
+----------+-------------------------+------------+
10 rows in set (0.001 sec)

wikiadmin@10.64.48.109(centralauth)> DELETE FROM global_user_groups WHERE gug_user IN (99, 456, 6888, 25914, 1498691, 1936335, 3159104, 3179225);
Query OK, 10 rows affected (0.001 sec)

wikiadmin@10.64.48.109(centralauth)> SELECT gug_user, gug_group, gug_expiry FROM global_user_groups WHERE gug_user IN (99, 456, 6888, 25914, 1498691, 1936335, 3159104, 3179225);
Empty set (0.000 sec)

Remaining action items are fixing global group deletion (https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/755719/) and account deletion creating these stale rows.