Deploy SUL3 to all wikis but only enable it for account creation and login on test wikis.
(See full rollout plan here.)
Description
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T345245 Mitigate phase-out of third-party cookies in Wikimedia production | |||
| Resolved | Tgr | T345249 Mitigate phase-out of third-party cookies in CentralAuth | |||
| Open | None | T348388 SUL3: Use a dedicated domain for login and account creation | |||
| Resolved | Tgr | T383729 SUL3 Phase 0: Account creation and login on test wikis | |||
| Resolved | Tgr | T377187 Set up auth.wikimedia.org | |||
| Resolved | matmarex | T379811 Update URL structure for SUL3 shared domain | |||
| Resolved | sbassett | T378722 Application Security Review Request : SUL3 | |||
| Resolved | Tgr | T380574 Add SUL3 authentication domain to deploy canary checks |
Event Timeline
Change #1111330 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Enable SUL3 on test wikis
Change #1111330 merged by jenkins-bot:
[operations/mediawiki-config@master] Enable SUL3 on test wikis
Mentioned in SAL (#wikimedia-operations) [2025-01-14T22:07:37Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1111330|Enable SUL3 on test wikis (T383729)]]
Mentioned in SAL (#wikimedia-operations) [2025-01-14T22:14:01Z] <tgr@deploy2002> tgr: Backport for [[gerrit:1111330|Enable SUL3 on test wikis (T383729)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
https://auth.wikimedia.org/enwiki/wiki/Special:UserLogin works but https://auth.wikimedia.org/testwiki/wiki/Special:CentralAutoLogin/checkLoggedIn?useformat=desktop&type=redirect&returnUrlToken=...&wikiid=testwiki&usesul3=1&useformat=desktop dies with Translate requires UniversalLanguageSelector to be installed. TranslationNotifications requires MassMessage to be installed.
This is a problem re: T380574: Add SUL3 authentication domain to deploy canary checks - we need tests to catch this kind of error.
I guess it's just because enwiki and testwiki have different extensions enabled (enwiki does not use Translate). https://auth.wikimedia.org/testwiki/wiki/Special:UserLogin does show the same error. We can't just check every wiki via the canary checks though.
I guess we could do two things:
- Cycle through https://auth.wikimedia.org/<wiki>/wiki/Special:UserLogin for all SUL wikis and collect errors. Handy as a tool, not feasible as a scap/CI check.
- Somehow process which extensions depend on which other extensions (extjsonuploader?), make the list of disabled extensions in CommonSettings machine-readable, and verify that whenever an extension is disabled, all the extensions that depend on it are also disabled. Like above, nice tool, can't really be automated.
https://auth.wikimedia.org/enwiki/favicon.ico dies with unknown endpoint is not allowed on the shared domain. Apparently favicon.php pulls in the entire MediaWiki stack just to stream the favicon.
Change #1111343 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Yet more authentication domain overrides
Change #1111344 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Add entry point names to all entry points under w/
Change #1111345 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/CentralAuth@master] Add 'fatal-error' to allowed entry points
Change #1111585 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Enable SUL3 on test wikis, second attempt
Change #1111344 merged by jenkins-bot:
[operations/mediawiki-config@master] Add entry point names to all entry points under w/
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:08:07Z] <lucaswerkmeister-wmde@deploy2002> Started scap sync-world: Backport for [[gerrit:1111344|Add entry point names to all entry points under w/ (T383729)]]
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:14:53Z] <lucaswerkmeister-wmde@deploy2002> lucaswerkmeister-wmde, tgr: Backport for [[gerrit:1111344|Add entry point names to all entry points under w/ (T383729)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:24:56Z] <lucaswerkmeister-wmde@deploy2002> Finished scap sync-world: Backport for [[gerrit:1111344|Add entry point names to all entry points under w/ (T383729)]] (duration: 16m 48s)
Change #1111343 merged by jenkins-bot:
[operations/mediawiki-config@master] Yet more authentication domain overrides
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:27:18Z] <lucaswerkmeister-wmde@deploy2002> Started scap sync-world: Backport for [[gerrit:1111343|Yet more authentication domain overrides (T383729 T373737)]], [[gerrit:1111598|Move Beta Cluster favicons to this repository]], [[gerrit:1075211|Replace favicon.php with static.php (T374997)]]
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:34:58Z] <lucaswerkmeister-wmde@deploy2002> tgr, matmarex, lucaswerkmeister-wmde: Backport for [[gerrit:1111343|Yet more authentication domain overrides (T383729 T373737)]], [[gerrit:1111598|Move Beta Cluster favicons to this repository]], [[gerrit:1075211|Replace favicon.php with static.php (T374997)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:43:10Z] <lucaswerkmeister-wmde@deploy2002> Finished scap sync-world: Backport for [[gerrit:1111343|Yet more authentication domain overrides (T383729 T373737)]], [[gerrit:1111598|Move Beta Cluster favicons to this repository]], [[gerrit:1075211|Replace favicon.php with static.php (T374997)]] (duration: 15m 52s)
Change #1111585 merged by jenkins-bot:
[operations/mediawiki-config@master] Enable SUL3 on test wikis, second attempt
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:45:57Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1111585|Enable SUL3 on test wikis, second attempt (T383729)]]
Mentioned in SAL (#wikimedia-operations) [2025-01-15T14:52:39Z] <tgr@deploy2002> tgr: Backport for [[gerrit:1111585|Enable SUL3 on test wikis, second attempt (T383729)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Mentioned in SAL (#wikimedia-operations) [2025-01-15T15:13:54Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1111585|Enable SUL3 on test wikis, second attempt (T383729)]] (duration: 27m 56s)
Change #1111345 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] Add 'fatal-error' to allowed entry points