CannotCreateActorException: Cannot create an actor for a usable name that is not an existing user: user_name=<redacted>
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	Zabe
	Dec 30 2022, 5:12 PM

Description

Error

mwversion: 1.40.0-wmf.14
reqId: e9ee63fb-4b0a-4981-b3f2-f03c2099196b
Find reqId in Logstash

normalized_message

[{reqId}] {exception_url}   CannotCreateActorException: Cannot create an actor for a usable name that is not an existing user: user_name=<redacted>

exception.trace

from /srv/mediawiki/php-1.40.0-wmf.14/includes/user/ActorStore.php(630)
#0 /srv/mediawiki/php-1.40.0-wmf.14/includes/user/ActorStore.php(400): MediaWiki\User\ActorStore->validateActorForInsertion(User)
#1 /srv/mediawiki/php-1.40.0-wmf.14/extensions/CheckUser/src/Hooks.php(277): MediaWiki\User\ActorStore->acquireActorId(User, Wikimedia\Rdbms\DBConnRef)
#2 /srv/mediawiki/php-1.40.0-wmf.14/extensions/CheckUser/src/Hooks.php(467): MediaWiki\CheckUser\Hooks::insertIntoCuChangesTable(array, string, User)
#3 /srv/mediawiki/php-1.40.0-wmf.14/includes/HookContainer/HookContainer.php(160): MediaWiki\CheckUser\Hooks->onAuthManagerLoginAuthenticateAudit(MediaWiki\Auth\AuthenticationResponse, User, string, array)
#4 /srv/mediawiki/php-1.40.0-wmf.14/includes/HookContainer/HookRunner.php(882): MediaWiki\HookContainer\HookContainer->run(string, array)
#5 /srv/mediawiki/php-1.40.0-wmf.14/includes/auth/AuthManager.php(556): MediaWiki\HookContainer\HookRunner->onAuthManagerLoginAuthenticateAudit(MediaWiki\Auth\AuthenticationResponse, NULL, string, array)
#6 /srv/mediawiki/php-1.40.0-wmf.14/includes/auth/AuthManager.php(462): MediaWiki\Auth\AuthManager->continueAuthentication(array)
#7 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/AuthManagerSpecialPage.php(373): MediaWiki\Auth\AuthManager->beginAuthentication(array, string)
#8 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/AuthManagerSpecialPage.php(505): AuthManagerSpecialPage->performAuthenticationStep(string, array)
#9 /srv/mediawiki/php-1.40.0-wmf.14/includes/htmlform/HTMLForm.php(731): AuthManagerSpecialPage->handleFormSubmit(array, VFormHTMLForm)
#10 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/AuthManagerSpecialPage.php(436): HTMLForm->trySubmit()
#11 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/LoginSignupSpecialPage.php(321): AuthManagerSpecialPage->trySubmit()
#12 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/SpecialPage.php(700): LoginSignupSpecialPage->execute(NULL)
#13 /srv/mediawiki/php-1.40.0-wmf.14/includes/specialpage/SpecialPageFactory.php(1451): SpecialPage->run(NULL)
#14 /srv/mediawiki/php-1.40.0-wmf.14/includes/MediaWiki.php(322): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, RequestContext)
#15 /srv/mediawiki/php-1.40.0-wmf.14/includes/MediaWiki.php(913): MediaWiki->performRequest()
#16 /srv/mediawiki/php-1.40.0-wmf.14/includes/MediaWiki.php(571): MediaWiki->main()
#17 /srv/mediawiki/php-1.40.0-wmf.14/index.php(50): MediaWiki->run()
#18 /srv/mediawiki/php-1.40.0-wmf.14/index.php(46): wfIndexMain()
#19 /srv/mediawiki/w/index.php(3): require(string)
#20 {main}

Impact

Notes

The user name is from a locked account and the error is from a wiki where that account has no local account.

Details

MediaWiki Version: 1.40.0-wmf.14
Request URL: https://it.wikipedia.org/w/index.php?returnto=*&title=*

	Subject	Repo	Branch	Lines +/-
	Validate user exists before setting as performer of failed login	mediawiki/extensions/CheckUser	master	+14 -1

Customize query in gerrit

Event Timeline

Zabe created this task.Dec 30 2022, 5:12 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 30 2022, 5:12 PM

I guess this is because the failed login was to a locked account but the correct password was provided. As such the user was marked as the performer. Because the account is locked, it means the local account should not be created and as such the actor ID could not be generated.

It's not possible to get results for accounts with no local account using either Special:CheckUser or Special:Investigate, so having the performer as a non-existing user does not make sense in this case. The solution that I see is to check if the username given is associated with a local account, and if not then only use the IP address as the performer.

The method to solve this should not be to create the local account, as that would provide an indication that the password was correct when attempting to login to a locked account. For example, if the account was locked because it was compromised, this would allow a bad actor to determine if the password they have is the correct one for the account. They could then use this password on other sites in case there was password reuse.

Dreamy_Jazz triaged this task as High priority.Dec 30 2022, 10:10 PM

Change 873883 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Validate user exists before setting as performer of failed login

https://gerrit.wikimedia.org/r/873883

gerritbot added a project: Patch-For-Review.Dec 30 2022, 10:22 PM

Dreamy_Jazz claimed this task.Dec 30 2022, 10:27 PM

Dreamy_Jazz moved this task from General / Unsorted to Patches for review on the CheckUser board.

Dreamy_Jazz moved this task from Untriaged to Dec 2022 on the Wikimedia-production-error board.

Change 873883 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Validate user exists before setting as performer of failed login

https://gerrit.wikimedia.org/r/873883

Maintenance_bot removed a project: Patch-For-Review.Dec 30 2022, 11:30 PM

• Testwiki1 reassigned this task from Dreamy_Jazz to admin.Dec 30 2022, 11:48 PM

Dreamy_Jazz removed a subscriber: admin.Dec 30 2022, 11:50 PM

ReleaseTaggerBot added a project: MW-1.40-notes (1.40.0-wmf.17; 2023-01-02).Dec 31 2022, 12:00 AM

This particular error that was caused by the hook for logging logins doesn't seem to have any other case when there is the possibility for an account with no local account causing a error. A successful login should make the local account before this is called. As such I'm closing this as resolved.

Dreamy_Jazz moved this task from Patches for review to General / Unsorted on the CheckUser board.Dec 31 2022, 10:14 PM

CannotCreateActorException: Cannot create an actor for a usable name that is not an existing user: user_name=<redacted>Closed, ResolvedPublicPRODUCTION ERRORActions