Page MenuHomePhabricator

Prepare for temporary accounts deployment on metawiki
Closed, ResolvedPublic

Description

Background

Temporary accounts will first be deployed to testwiki and loginwiki, but not metawiki.

The reason for not deploying to metawiki to begin with is to reduce the capacity for vandalism from this new type of user during our testing phase.

Normally when a new user is created, an account for them is created on metawiki via CentralAuthCreateLocalAccountJob. This will fail before temporary accounts are deployed on metawiki.

Once temporary accounts are deployed on metawiki, we will then need to make sure that a script is run to make an account for any temporary accounts that predate the metawiki deployment. This might involve running createLocalAccount.php or creating a new script specifically for doing the same thing for all existing temporary accounts.

What needs doing
  • Before testwiki deployment: ensure that CentralAuthCreateLocalAccountJob will fail gracefully after the testwiki deployment
  • Just after metawiki deployment: run a maintenance script to ensure local accounts are made there for existing temp users.

Event Timeline

Marking as a testwiki blocker for:

  • Before testwiki deployment: ensure that CentralAuthCreateLocalAccountJob fails gracefully after the testwiki deployment

We'll have to test this locally. Once we're happy with that, we should mark this as a pilot wiki blocker.

We'll have to test this locally. Once we're happy with that, we should mark this as a pilot wiki blocker.

Could we test this on beta wikis?

AFAIK the beta wiki metawiki has temporary accounts disabled and based on my reading of the config seems to have wgCentralAuthAutoCreateWikis defined as including metawiki.

From what I can see in https://meta.wikimedia.beta.wmflabs.org/wiki/Special:Log, temporary accounts are not autocreated. Furthermore, reading the code that does this autocreate indicates to me that the CentralAuthCreateLocalAccountJob does not attempt to repeat the job if the autocreation fails (https://gerrit.wikimedia.org/g/mediawiki/extensions/CentralAuth/+/41bcbb12941b18e0a7159d93291faad57ec480d4/includes/User/CentralAuthCreateLocalAccountJob.php#112) and does not create any logs other than debug or info if the username is not usable (which would be the case in a temporary account creation attempt on a non-temporary account wiki). As such, it seems that it should fail gracefully.

Thanks @Dreamy_Jazz. That looks correct to me, and my local testing supports that it will fail gracefully. Details below.

We'll have to test this locally. Once we're happy with that, we should mark this as a pilot wiki blocker.

Could we test this on beta wikis?

AFAIK the beta wiki metawiki has temporary accounts disabled

Looks correct: config

and based on my reading of the config seems to have wgCentralAuthAutoCreateWikis defined as including metawiki.

Looks correct: config

From what I can see in https://meta.wikimedia.beta.wmflabs.org/wiki/Special:Log, temporary accounts are not autocreated. Furthermore, reading the code that does this autocreate indicates to me that the CentralAuthCreateLocalAccountJob does not attempt to repeat the job if the autocreation fails (https://gerrit.wikimedia.org/g/mediawiki/extensions/CentralAuth/+/41bcbb12941b18e0a7159d93291faad57ec480d4/includes/User/CentralAuthCreateLocalAccountJob.php#112) and does not create any logs other than debug or info if the username is not usable (which would be the case in a temporary account creation attempt on a non-temporary account wiki). As such, it seems that it should fail gracefully.

Agreed.

I tested this locally too, with two wikis (mediawiki and mediawiki2). I created a temporary account on mediawiki, which queued up CentralAuthCreateLocalAccountJob on mediawiki2. Steps:

  • Set $wgCentralAuthAutoCreateWikis = ['mediawiki', 'mediawiki2'] on mediawiki
  • Enabled temporary accounts on mediawiki
  • Disabled temporary accounts on mediawiki2
  • Set $wgJobRunRate = 0 on mediawiki2
  • Autocreated a temporary account on mediawiki by making a logged-out edit
  • Manually ran the job queue in mediawiki2 and saw output:
2024-07-14 13:17:23 CentralAuthCreateLocalAccountJob Special: name=~600035 from=mediawiki session={"ip":"::1","headers":"array(...)","sessionId":"jolkerm0bijfagpe77dsj2adtojrp9un","userId":512} requestId=8186da9e5d68b955dbfe89af namespace=-1 title= (id=286,timestamp=20240714131646) STARTING
2024-07-14 13:17:23 CentralAuthCreateLocalAccountJob Special: name=~600035 from=mediawiki session={"ip":"::1","headers":"array(...)","sessionId":"","userId":0} requestId=8186da9e5d68b955dbfe89af namespace=-1 title= (id=286,timestamp=20240714131646) t=37 good
  • Confirmed that the job was deleted form the job table
  • Confirmed that the user ~600035 was not created on mediawiki2
Tchanders claimed this task.