Reported at https://www.mediawiki.org/wiki/Topic:Ybk8j4rz9c0v7ta4
It is unclear what the resolution should be but it appears that a particular set of AbuseFilter rules (autocreateaccount) and the use of an NetworkSession auth scheme will cause AbuseFilter to believe that an account was created automatically.
A long-term solution is T354487: Apply local policy during CentralAuth autocreation as a "block" (logged-in) instead of "prevent" (logged-out). For now, you can force create local account in that wiki as a workaround.
I tried creating the account with the createAndPromote.php script, but it gets rejected in the same way that the normal account creation gets rejected. I'm not sure how else to go about creating the account?
Nope, I'm not an admin or a steward. Any of my "elevated" access is primarily through shell access. I could plausibly temporarily grant myself admin, but not sure that's appropriate.
This is moot now, given NetworkSession being disabled in T373826, but the correct maintenance script to run appears to be createLocalAccount.php from the CentralAuth extension, not createAndPromote.php from core.
How does AbuseFilter prevent autocreation? Permission checks should be skipped since NetworkSession returns true for canAlwaysAutocreate().
It uses a preAuthenticationProvider, defining both testForAccountCreation and testUserForCreation. Code at https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/AbuseFilter/+/refs/heads/master/includes/AbuseFilterPreAuthenticationProvider.php
Hm, I guess we can't just skip testUserForCreation, it's used for non-permission-related things like preventing CentralAuth username conflicts. So the way to go is probably to pass in the "can always autocreate" flag and let the provider decide what's appropriate.
@EBernhardson do you want to make a patch for that?
Change #1071013 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):
[mediawiki/core@master] auth: Pass canAlwaysAutocreate from session to pre-auth providers
Change #1071014 had a related patch set uploaded (by Ebernhardson; author: Ebernhardson):
[mediawiki/extensions/AbuseFilter@master] Skip auth checks when autocreate is allowed by provider
Change #1071014 merged by jenkins-bot:
[mediawiki/extensions/AbuseFilter@master] Skip auth checks when autocreate is allowed by provider
Change #1071013 merged by jenkins-bot:
[mediawiki/core@master] auth: Pass canAlwaysAutocreate from session to pre-auth providers