| Tsevener | |
| Jan 22 2025, 6:28 PM |
| F58250624: Screenshot 2025-01-22 at 12.25.53 PM.png | |
| Jan 22 2025, 6:28 PM |
App should allow you to log in
Error message displays "The supplied credentials could not be authenticated".
App version: 7.7.0 (but could be earlier)
OS versions: iOS 18
Device model: Simulator, iPhone 16
Device language: EN
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Resolved | kostajh | T294511 2021 Security Team wikireplicas audit | |||
| Declined | None | T284948 Raw IPs of logged-out users disclosed in wiki-replicas | |||
| Resolved | Niharika | T324492 Temporary accounts - MVP | |||
| Open | None | T326816 [Epic] Update features for temporary accounts | |||
| Resolved | HNordeenWMF | T329913 [Epic] Update Mobile Apps Team-owned products that may be affected by Temporary Accounts | |||
| Resolved | HNordeenWMF | T373067 [Epic] Temporary Accounts on iOS | |||
| Resolved | Tgr | T384007 SUL3 Phase 1: All new account creation on group 0 and group 1 wikis | |||
| Resolved | BUG REPORT | DAlangi_WMF | T384523 [BUG] Failure to login to pilot wiki after temp account creation |
I saw this happening on Android as well
Error message: "The supplied credentials could not be authenticated"
Steps to recreate:
@Tgr Apps use action=clientlogin to login directly onto the target wiki (not through auth.wikimedia.org).
We're currently seeing behavior on testwiki where, if the user has a temp account, then tries to login or create an account (while having temp account cookies), it returns an error saying The supplied credentials could not be authenticated.
Is there a way to work around this, short of clearing cookies before logging in?
Interesting. I can reproduce in a browser using Special:ApiSandbox, but not on Special:CreateAccount using usesul3=0, even though those are supposed to use the same logic.
@DAlangi_WMF I suppose this is a side effect of rECAUb70494996345: SUL3: Don't fallback to SUL2 login wiki for temp accounts. I wrote there there probably aren't any other situations in which a temp user uses an API and the outcome depends on the SUL3 flag but clearly that was wrong.
This seems to be affecting the api.php entry-point because I wasn't able to reproduce this via index.php entry-point. That works fine.
I can confirm that login and signup with an active temporary action causes this problem with clientlogin API. Looking into this now.
Change #1114990 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):
[mediawiki/extensions/CentralAuth@master] SUL3: Allow temp users to authenticate (login/signup) via the API
Change #1114990 merged by jenkins-bot:
[mediawiki/extensions/CentralAuth@master] SUL3: Allow temp users to authenticate (login/signup) via the API
Change #1115106 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):
[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.14] SUL3: Allow temp users to authenticate (login/signup) via the API
The bug fix has been merged and I've created backport for 1.44.0-wmf.14 but I'm not sure this is needed. @Tgr mentioned that since it happens only for testwikis, it maybe not be needed. Do we need it? If not, I can abandon it and we just wait for it to go out normally.
Just checking in back on this @Tsevener / @HNordeenWMF if by end of day today or early tomorrow (https://wikitech.wikimedia.org/wiki/Deployments#deploycal-item-20250204T0400) you can test to see if we still have the issue. The change that was submitted last week will be automatically deployed to testwikis today.
Please let us know if the issue still persists after the deployment.
@DAlangi_WMF it's still happening for me on iOS and Android on Test Wiki (just tested).
Thank you for testing. I just checked the production logs on SAL: https://sal.toolforge.org/log/7rYgz5QBvg159pQrIR-z and it looks like deployment of 1.44.0-wmf.15 to testwikis (https://test.wikipedia.org/wiki/Special:Version) just happened like 2.5hrs ago from now which contains the changes (https://www.mediawiki.org/wiki/MediaWiki_1.44/wmf.15#CentralAuth) and should be live now on testwikis.
Whenever you get a chance, could you double check and see if it still happens again. I suspect that at the time you tested, the changes may not have been live that's why you still encountered the issue. Thank you for doing this and looking forward to your feedback.
From my testing scenario on testwiki, I could no longer reproduce the issue.
Change #1115106 abandoned by D3r1ck01:
[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.14] SUL3: Allow temp users to authenticate (login/signup) via the API
Reason:
Looks like this is no longer needed.
Ah nice, and thank you for confirming with us. I'll leave this one to either you or @HNordeenWMF to mark as resolved. Thank you :)