Change 774401 had a related patch set uploaded (by Reedy; author: Reedy):

[operations/puppet@production] Keystone: Update deprecated action=oathvalidate calls

https://gerrit.wikimedia.org/r/774401

Seems this may come from 2 different User-Agents:

• Striker mwclient/0.10.1 (https://github.com/mwclient/mwclient)
  • This is Striker doing 2FA checks at login to https://toolsadmin.wikimedia.org/
  • https://github.com/wikimedia/labs-striker/blob/master/striker/mediawiki.py#L138-L146
• Keystone mwclient/0.10.1 (https://github.com/mwclient/mwclient)
  • This is Horizon doing 2FA checks at login to https://horizon.wikimedia.org/
  • https://github.com/wikimedia/puppet/blob/e1e13a59de3021afaa43c31745abbe348a93017d/modules/openstack/files/victoria/keystone/wmfkeystoneauth/wikitechclient.py#L53-L61
  • There are a few other copies of wikitechclient.py too due to the way that we vary files in the openstack module on release, but they should all be the same fix.

The code is remarkably similar because is was invented for Striker and then copied to Horizon where it replaced a more fragile prior implementation which required shared access to the 'labswiki' database owned by Wikitech (and suffered from replay attack vulnerabilities).

Change 774402 had a related patch set uploaded (by Reedy; author: Reedy):

[labs/striker@master] Update deprecated action=oathvalidate calls

https://gerrit.wikimedia.org/r/774402

Change 774401 merged by Andrew Bogott:

[operations/puppet@production] Keystone: Update deprecated action=oathvalidate calls

https://gerrit.wikimedia.org/r/774401

Change 774402 merged by jenkins-bot:

[labs/striker@master] Update deprecated action=oathvalidate calls

https://gerrit.wikimedia.org/r/774402