Description
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T348573 All Wikimedia extensions that store their data outside the main database should use a virtual database domain | |||
| Resolved | matmarex | T358985 Admin account created by the installer isn't made global by CentralAuth | |||
| Resolved | ArielGlenn | T348486 Migrate CentralAuth to use a virtual database domain |
Event Timeline
Change 971967 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[operations/mediawiki-config@master] use virtual db domain for CentralAuth
Change 971971 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[mediawiki/extensions/GlobalBlocking@master] use virtual db domain for CentralAuth database
Took a stab at the GlobalBlocking change first, as it's smaller and simpler to my eyes. Not tested whatsoever.
Change 973812 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[mediawiki/extensions/CentralAuth@master] Use virtual db domains for CentralAuth
Change 973857 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[mediawiki/extensions/OATHAuth@master] Use virtual domain for OATHAuth database
Change 973857 abandoned by ArielGlenn:
[mediawiki/extensions/OATHAuth@master] Use virtual domain for OATHAuth database
Reason:
Abandoned in favour of https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/966600
Change 971967 merged by jenkins-bot:
[operations/mediawiki-config@master] use virtual db domain for CentralAuth and GlobalBlocking
Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:10:15Z] <ariel@deploy2002> Started scap: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]]
Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:11:42Z] <ariel@deploy2002> ariel: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:20:48Z] <ariel@deploy2002> Finished scap: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]] (duration: 10m 33s)
Change 971971 merged by jenkins-bot:
[mediawiki/extensions/GlobalBlocking@master] use virtual db domain for GlobalBlocking database
Change 1009904 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/vagrant@master] centralauth: Add virtual domain
Change 1009904 merged by jenkins-bot:
[mediawiki/vagrant@master] centralauth: Add virtual domain
Change #973812 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Use virtual db domains for CentralAuth
Done in production but we'll need to either notify third-party users or provide fallback behavior for old-style configuration.
I was looking at this search result, and thought there'd be no results, but there still are a few:
https://codesearch.wmcloud.org/deployed/?q=CentralAuthDatabase%5Cb&files=&excludeFiles=&repos=
The ones for Quibble and testing seem harmless/unused, but the SessionManager usage looks suspicious to me. That appears to be unconditionally reading CentralAuthDatabase from GlobalVarConf a key that, despite per extension.json, this no longer existing. I guess that passes in CI because for Quibble, we re-create it with the value of wgDBname, but without it, I would expect a ConfigException for unset config key. Or alternatively, a PHP Notice for passing null into BagOStuff::makeKey().
Do we need something else there, in order to ensure the session keys remain set the same?
My understanding is that, while a bit unlikely to be used in practice, is that CentralAuth allows multiple instances of itself within the same set of servers that share a Memcached cluster. As it will put the database domain in the cache/session key to vary it that way explicitly. We might not need to continue supporting that, though. But, we do probably need some kind of patch to fix single-instance way that we use it in production.
Change #1034142 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@master] Temporarily restore $wgCentralAuthDatabase
Change #1034142 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Temporarily restore $wgCentralAuthDatabase
Change #1034173 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.6] Temporarily restore $wgCentralAuthDatabase
Change #1034173 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.6] Temporarily restore $wgCentralAuthDatabase
Mentioned in SAL (#wikimedia-operations) [2024-05-21T08:47:30Z] <tgr@deploy1002> Started scap: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]]
Mentioned in SAL (#wikimedia-operations) [2024-05-21T08:50:25Z] <tgr@deploy1002> tgr: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2024-05-21T09:05:16Z] <tgr@deploy1002> Finished scap: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]] (duration: 17m 45s)
Yeah this was resolved. Still needs some (non-urgent) follow-up per https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1034142/comment/ee84ebf5_8960026c/.
Thanks. Though presumably following the completion of this train that patch will be reverted, which will complete it?
No, the patch is needed until we figure out what to do about the usage of the DB name in the cache keys. Reverting it would be less bad than having it deployed only to a subset of the servers, but it would still log people out one time.
Change #1035722 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[mediawiki/extensions/CentralAuth@master] move fallback initialization of vitual db domain setting to onRegistration
Change #1035853 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):
[mediawiki/extensions/CentralAuth@master] Introduce a new config var for Central Auth session keys
Change #1035722 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Move fallback initialization of virtual db domain setting to onRegistration
Change #1035853 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Derive session keys from db name using virtual db domain config