Page MenuHomePhabricator

[SUL3] Make edge-login to work for temporary accounts (on wikifarm with same parent domain)
Closed, DeclinedPublic

Description

Right now, in SUL3 mode, when an edit is made to a page and a temporary account is created on the local wiki, a corresponding central account is created on the shared domain/central wiki but edge-login doesn't seem to be working.

This happens when the authentication domain and a given wiki share a CentralAuth cookie domain.

This task is about making edge-login to work for temporary accounts in SUL3 and potentially even SUL2 mode.

Event Timeline

Edge login doesn't create accounts on wikis where the user doesn't have them yet, so for temporary accounts at the time of creation it's a no-op. (Which also means there is not much point in triggering it... although figuring out whether we are right after an account creation might be more hassle than worth it.)

We could change that, it would help with T355280: Try to connect to central session before temp user creation, but it would mean that whenever a temporary account is created, it would show up in the account creation list on a bunch of unrelated wikis, not just the one where the edit was made. That seems pretty confusing.

kostajh subscribed.

Adding to our sprint so that TSP can get feedback from folks on this.

I did some more local testing to verify my "expectation" of how temporary account might work across wikis. Please let me know if I'm wrong here.

What I expected was that: if I, as an anon user makes an edit on a wiki say "enwiki", they'll get a local session for a temporary account say ~2025-67, and a corresponding central account for the same username should be created in the central domain via Special:CentralLogin. At this point, my expectation is met and below are screenshots of that scenario.

Screenshot 2025-01-09 at 1.59.14 PM.png (3,330×2,074 px, 487 KB)

Screenshot 2025-01-09 at 1.59.25 PM.png (3,328×2,068 px, 471 KB)

So, at this point, we have a temporary central account and a local "enwiki" account for the same temporary user named ~2025-67 (and note that no edge-login happened - so this user is not available on other wikis yet).

Now I'll visit another wiki say "frwiki" to confirm that the temporary account is not active there and yes, as expected, it's not.

Screenshot 2025-01-09 at 1.59.41 PM.png (3,330×2,072 px, 369 KB)

Further more, I expected that when I try to make an edit on the "frwiki" from the same browser (that already has a temporary central session), CentralAuth should detect that a temporary central session already exists and use that to create a corresponding local session with account name ~2025-67, but to my surprise, this is not what happens. Instead, I get a brand new local account created on the "frwiki" (with handle ~2025-68) which also overrides the central account and takes over the previously created temporary central central account. At this point, the central account now is no longer ~2025-67 as before when the edit was made on "enwiki". It's ~2025-68 which is the central account created when I made the "frwiki" edit.

Screenshot 2025-01-09 at 1.59.59 PM.png (3,332×2,076 px, 517 KB)

Screenshot 2025-01-09 at 2.00.10 PM.png (3,324×2,074 px, 477 KB)

From the above, it means that even with a temporary central account, it's not reused across wikis for the same user editing, and I was expecting it to so that we don't have cases whereby a user with an already existing central temporary account on the same browser begins editing under a different temporary account just because they're on a different wiki (even with a central account active). Does that make sense? That means at best we have a local session for an account and a central session for that account and that's all. What then is the use of the temporary central account? What is the intention?

If this is by design then I'll like to be informed on why this is the case.

I did some more local testing to verify my "expectation" of how temporary account might work across wikis. Please let me know if I'm wrong here.

The way this is working in production currently is how it should also end up being after SUL3 rollout, e.g. if you start as a logged-out user at no.wikipedia.org and make an edit, you'll be logged-in as a temporary account. If you then visit test.wikipedia.org, you should still be logged-in with the same temporary account you had on no.wikipedia.org.

@DAlangi_WMF @Tgr what is the status of this task? We anticipate deploying temporary accounts to larger wikis in June.

@DAlangi_WMF @Tgr what is the status of this task? We anticipate deploying temporary accounts to larger wikis in June.

It seems like this only happens when all wikis (in the wiki farm) are on the same parent domain (like in my local development setup). But this doesn't happen in production as far as I can see.

So I don't think this blocks rolling out temp accounts to larger wikis except Tgr thinks otherwise. Sorry I missed your comment, only seeing it now.

• DAlangi_WMF renamed this task from [SUL3] Make edge-login to work for temporary accounts to [SUL3] Make edge-login to work for temporary accounts (on wikifarm with same parent domain).Jun 10 2025, 11:39 AM
kostajh claimed this task.

@DAlangi_WMF @Tgr what is the status of this task? We anticipate deploying temporary accounts to larger wikis in June.

It seems like this only happens when all wikis (in the wiki farm) are on the same parent domain (like in my local development setup). But this doesn't happen in production as far as I can see.

So I don't think this blocks rolling out temp accounts to larger wikis except Tgr thinks otherwise. Sorry I missed your comment, only seeing it now.

OK, then closing this. Thanks!

Tgr changed the task status from Resolved to Declined.Sep 7 2025, 6:49 PM

Changing status to reflect that we didn't fix this (since it wasn't relevant for Wikimedia production).