Page MenuHomePhabricator

Migrate CentralAuth to use a virtual database domain
Closed, ResolvedPublic

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Change 971967 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[operations/mediawiki-config@master] use virtual db domain for CentralAuth

https://gerrit.wikimedia.org/r/971967

Change 971971 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/extensions/GlobalBlocking@master] use virtual db domain for CentralAuth database

https://gerrit.wikimedia.org/r/971971

Took a stab at the GlobalBlocking change first, as it's smaller and simpler to my eyes. Not tested whatsoever.

Change 973812 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/extensions/CentralAuth@master] Use virtual db domains for CentralAuth

https://gerrit.wikimedia.org/r/973812

Change 973857 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/extensions/OATHAuth@master] Use virtual domain for OATHAuth database

https://gerrit.wikimedia.org/r/973857

Change 973857 abandoned by ArielGlenn:

[mediawiki/extensions/OATHAuth@master] Use virtual domain for OATHAuth database

Reason:

Abandoned in favour of https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/966600

https://gerrit.wikimedia.org/r/973857

Change 971967 merged by jenkins-bot:

[operations/mediawiki-config@master] use virtual db domain for CentralAuth and GlobalBlocking

https://gerrit.wikimedia.org/r/971967

Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:10:15Z] <ariel@deploy2002> Started scap: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]]

Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:11:42Z] <ariel@deploy2002> ariel: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-12-14T08:20:48Z] <ariel@deploy2002> Finished scap: Backport for [[gerrit:971967|use virtual db domain for CentralAuth and GlobalBlocking (T348486)]] (duration: 10m 33s)

Change 971971 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@master] use virtual db domain for GlobalBlocking database

https://gerrit.wikimedia.org/r/971971

Change 1009904 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/vagrant@master] centralauth: Add virtual domain

https://gerrit.wikimedia.org/r/1009904

Change 1009904 merged by jenkins-bot:

[mediawiki/vagrant@master] centralauth: Add virtual domain

https://gerrit.wikimedia.org/r/1009904

Change #973812 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Use virtual db domains for CentralAuth

https://gerrit.wikimedia.org/r/973812

Done in production but we'll need to either notify third-party users or provide fallback behavior for old-style configuration.

I was looking at this search result, and thought there'd be no results, but there still are a few:

https://codesearch.wmcloud.org/deployed/?q=CentralAuthDatabase%5Cb&files=&excludeFiles=&repos=

The ones for Quibble and testing seem harmless/unused, but the SessionManager usage looks suspicious to me. That appears to be unconditionally reading CentralAuthDatabase from GlobalVarConf a key that, despite per extension.json, this no longer existing. I guess that passes in CI because for Quibble, we re-create it with the value of wgDBname, but without it, I would expect a ConfigException for unset config key. Or alternatively, a PHP Notice for passing null into BagOStuff::makeKey().

Do we need something else there, in order to ensure the session keys remain set the same?

My understanding is that, while a bit unlikely to be used in practice, is that CentralAuth allows multiple instances of itself within the same set of servers that share a Memcached cluster. As it will put the database domain in the cache/session key to vary it that way explicitly. We might not need to continue supporting that, though. But, we do probably need some kind of patch to fix single-instance way that we use it in production.

Change #1034142 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] Temporarily restore $wgCentralAuthDatabase

https://gerrit.wikimedia.org/r/1034142

Change #1034142 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Temporarily restore $wgCentralAuthDatabase

https://gerrit.wikimedia.org/r/1034142

Change #1034173 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.6] Temporarily restore $wgCentralAuthDatabase

https://gerrit.wikimedia.org/r/1034173

Change #1034173 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.43.0-wmf.6] Temporarily restore $wgCentralAuthDatabase

https://gerrit.wikimedia.org/r/1034173

Mentioned in SAL (#wikimedia-operations) [2024-05-21T08:47:30Z] <tgr@deploy1002> Started scap: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]]

Mentioned in SAL (#wikimedia-operations) [2024-05-21T08:50:25Z] <tgr@deploy1002> tgr: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-05-21T09:05:16Z] <tgr@deploy1002> Finished scap: Backport for [[gerrit:1034173|Temporarily restore $wgCentralAuthDatabase (T348486)]] (duration: 17m 45s)

Yeah this was resolved. Still needs some (non-urgent) follow-up per https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CentralAuth/+/1034142/comment/ee84ebf5_8960026c/.

Thanks. Though presumably following the completion of this train that patch will be reverted, which will complete it?

No, the patch is needed until we figure out what to do about the usage of the DB name in the cache keys. Reverting it would be less bad than having it deployed only to a subset of the servers, but it would still log people out one time.

Change #1035722 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/extensions/CentralAuth@master] move fallback initialization of vitual db domain setting to onRegistration

https://gerrit.wikimedia.org/r/1035722

Change #1035853 had a related patch set uploaded (by ArielGlenn; author: ArielGlenn):

[mediawiki/extensions/CentralAuth@master] Introduce a new config var for Central Auth session keys

https://gerrit.wikimedia.org/r/1035853

Change #1035722 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Move fallback initialization of virtual db domain setting to onRegistration

https://gerrit.wikimedia.org/r/1035722

Change #1035853 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Derive session keys from db name using virtual db domain config

https://gerrit.wikimedia.org/r/1035853