If we decide to avoid this, I suppose we could use auth.wikimedia.org/loginwiki, or the auth.wikimedia.org version of the wiki where the user signed up, as the representative of the central domain. Other than that, I don't think there's a way to suppress autocreation, it's happening very early in the MediaWiki request lifecycle.

This generates a lot of log noise on small wikis.

Yeah, there's also the side-effects of noise in RCFeed for tooling. And, multiplying growth in non-temporary rows for user and log tables on a dozen s3-cluster wiki databases.

In T387357#10583617, @Tgr wrote:

If we decide to avoid this, I suppose we could use auth.wikimedia.org/loginwiki, or the auth.wikimedia.org version of the wiki where the user signed up, as the representative of the central domain. […]

Between a constant URL and a dynamic URL, I think a constant URL would keep the system easier to understand.

You may want to consider auth.wikimedia.org/metawiki as the contant URL. That would reduce overlap between SUL3 and SUL2, and make it easier to phase out loginwiki without requiring another change in the future.

The other option would be having something like a noautocreate=1 URL parameter suppress autocreation in Setup.php. That's hacky but would have some other use cases (e.g. T385752: Using special globalcontributions is causing clients to attach to other projects triggering autocreated accounts (especially mlwiki)). There are even more compelling use cases for "don't always autocreate when you have session cookies" more generally (that can't always be solved with a query parameter), such as T21161: Don't autologin if local account doesn't exist (don't autocreate if user doesn't explicitly login).

It's probably not as simple as it sounds though - what should Session::getUser() return? (Probably not a non-existent named user, that would violate assumptions all across the codebase.) What session provider should own the request? What should happen when something calls persist()? So I'd rather not go there, especially not in a hurry.

Change #1123776 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[operations/mediawiki-config@master] Set $wgCentralAuthSharedDomainCallback

https://gerrit.wikimedia.org/r/1123776

Change #1123777 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] SUL3: Use a central wiki for autologin

https://gerrit.wikimedia.org/r/1123777

In T387357#10585694, @Krinkle wrote:

You may want to consider auth.wikimedia.org/metawiki as the constant URL. That would reduce overlap between SUL3 and SUL2, and make it easier to phase out loginwiki without requiring another change in the future.

I ended up using loginwiki, mostly out of laziness (we already have a configuration setting for that). We can just switch $wgCentralAuthLoginWiki to meta if we want once we fully phased out SUL2 logins.
I don't think there is meaningful overlap - they don't share cookies, and functionality-wise loginwiki is nothing special.

Account autocreation in all edge login wikis somehow (though not always) happen in SUL2, so it is not something new to SUL3. See previous task T18864: Auto-login is creating accounts

Current example:

• View https://en.wikivoyage.org/w/index.php?title=Special:Log&page=&tagfilter=&type=newusers&user=&wpFormIdentifier=logeventslist&wpdate=&offset=&limit=500
• Choose an auto-created account and view Special:CentralAuth
• You may find the account may be created in all edge login wikis in same time

https://en.wikivoyage.org/wiki/Special:CentralAuth/Crackwood
https://en.wikivoyage.org/wiki/Special:CentralAuth/Bruhz333
https://en.wikivoyage.org/wiki/Special:CentralAuth/Damiandtess

In T387357#10594702, @Bugreporter wrote:

See previous task T18864: Auto-login is creating accounts

The task is very old (also mis-titled; autologin does create accounts, but the task is about edge login). Edge login does automatically not autocreate today. There's a condition here to avoid it (edge login is type=1x1).

Edge login does set valid session cookies on all domains, and the next request with a valid session cookie will autocreate, so it's not impossible to end up with a bunch of autocreations, if e.g. edge login happens twice in succession for some reason. But that should be rare.

https://en.wikivoyage.org/wiki/Special:CentralAuth/Crackwood
https://en.wikivoyage.org/wiki/Special:CentralAuth/Bruhz333
https://en.wikivoyage.org/wiki/Special:CentralAuth/Damiandtess

Two of those are very old, no idea how the system worked back then. Bruhz333 is a legitimate example, but again, I think such cases are rare.

Change #1123776 merged by jenkins-bot:

[operations/mediawiki-config@master] Set $wgCentralAuthSharedDomainCallback

https://gerrit.wikimedia.org/r/1123776

Mentioned in SAL (#wikimedia-operations) [2025-03-03T21:16:40Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1122683|Remove unused config variable $wgJsonConfigInterwikiPrefix]], [[gerrit:1123766|Fix inconsistent definitions for $wmgLocalServices['chart-renderer']]], [[gerrit:1123776|Set $wgCentralAuthSharedDomainCallback (T387357)]]

Mentioned in SAL (#wikimedia-operations) [2025-03-03T21:19:15Z] <tgr@deploy2002> matmarex, tgr: Backport for [[gerrit:1122683|Remove unused config variable $wgJsonConfigInterwikiPrefix]], [[gerrit:1123766|Fix inconsistent definitions for $wmgLocalServices['chart-renderer']]], [[gerrit:1123776|Set $wgCentralAuthSharedDomainCallback (T387357)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2025-03-03T21:26:46Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1122683|Remove unused config variable $wgJsonConfigInterwikiPrefix]], [[gerrit:1123766|Fix inconsistent definitions for $wmgLocalServices['chart-renderer']]], [[gerrit:1123776|Set $wgCentralAuthSharedDomainCallback (T387357)]] (duration: 10m 06s)

Change #1123777 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] SUL3: Use a central wiki for autologin

https://gerrit.wikimedia.org/r/1123777

Change #1124786 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.18] SUL3: Use a central wiki for autologin

https://gerrit.wikimedia.org/r/1124786

Change #1124786 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.18] SUL3: Use a central wiki for autologin

https://gerrit.wikimedia.org/r/1124786