Page MenuHomePhabricator

CentralAuth's Special:GlobalGroupMembership setup catch-22
Closed, ResolvedPublic

Description

CentralAuth's Special:GlobalGroupMembership (aka Special:GlobalUserRights) only allows users to use it who are already in a global group that confers the 'globalgroupmembership' right -- no local group can apply this property.

While this sounds nice, it seems to involve a bit of a chicken-and-egg problem: without diving into the raw database, there's nobody who can add the first global op user to the appropriate group.

T19308: CentralAuth's global logs (gblrights/globalauth) should be global or central instead of local requests entirely *removing* the global right and replacing it with *only* a local right, for a different reason -- ensuring that it can only be run from a single wiki. This appears to be motivated by logging issues -- apparently we don't (or didn't, don't know the current status) have global logs for global actions like this, so the logs go into the local wiki where they might not be seein.

Either way, it would be useful to have some way to actually set it in the first place...

Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:36 PM
bzimport set Reference to bz29435.
bzimport added a subscriber: Unknown Object (MLST).
brion created this task.Jun 16 2011, 6:32 PM
vvv added a comment.Jun 16 2011, 6:34 PM

migrateStewards.php does that.

brion added a comment.Jun 16 2011, 6:56 PM

migrateStewards.php isn't necessarily going to be run -- if you start your wiki on CentralAuth to begin with, you have nothing to migrate.

vasilvv: You're set as assignee here, do you plan to work on this or should the assignee be reset to default? (And the ticket has "high priority" set for nearly three years which might be unrealistic)

vvv added a comment.Mar 11 2014, 2:22 PM

No, and I don't actually believe that this is a serious issue. Bootstrapping CentralAuth is not something which really happens often (it probably happens mostly in dev environment -- and developers can deal with command-line tools and direct database access).

  • Bug 43916 has been marked as a duplicate of this bug. ***
  • Bug 31897 has been marked as a duplicate of this bug. ***
Glaisher lowered the priority of this task from Medium to Lowest.Aug 22 2015, 3:23 PM
Glaisher added a subscriber: Glaisher.
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 22 2015, 3:23 PM
Luke081515 raised the priority of this task from Lowest to Needs Triage.Feb 21 2016, 2:25 PM
Luke081515 added a subscriber: Luke081515.

This is annoying, if you try to setup a cluster with CA.

Restricted Application added a subscriber: StudiesWorld. · View Herald TranscriptFeb 21 2016, 2:25 PM
TTO updated the task description. (Show Details)Dec 21 2016, 12:32 PM
TTO added a subscriber: TTO.
hoo added a subscriber: hoo.May 8 2018, 10:10 PM
Rxy added a subscriber: Rxy.May 8 2018, 10:22 PM

Change 432048 had a related patch set uploaded (by Rxy; owner: Rxy):
[mediawiki/extensions/CentralAuth@master] Restrict global actions to specified wikis

https://gerrit.wikimedia.org/r/432048

Change 450422 had a related patch set uploaded (by Rxy; owner: Rxy):
[mediawiki/extensions/CentralAuth@master] Change permission check from global permission to user permission

https://gerrit.wikimedia.org/r/450422

Rxy moved this task from Backlog to In progress - Development on the User-Rxy board.
Rxy triaged this task as Medium priority.Aug 21 2018, 5:55 PM

Change 450422 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Change permission check from global permission to user permission

https://gerrit.wikimedia.org/r/450422

Rxy closed this task as Resolved.Oct 16 2018, 6:27 PM
Rxy moved this task from In progress - Development to Development on the User-Rxy board.