Page MenuHomePhabricator

SUL3 broke the ability to send new user's password via email
Closed, ResolvedPublicBUG REPORT

Description

Steps to replicate the issue (include links if applicable):

What happens?:

  • Process fails with error:

Failure: Could not create account for jeXed / EMAILREDACTED@DOMAIN.COM. response: {"warnings"=>{"main"=>{"*"=>"Unrecognized parameter: mailpassword."}}, "createaccount"=>{"status"=>"FAIL", "message"=>"The supplied credentials could not be used for account creation.", "messagecode"=>"authmanager-create-no-primary"}}

What should have happened instead?:
The account should have been created

Software version (on Special:Version page; skip for WMF-hosted wikis like Wikipedia):
WMF Production

Other information (browser name/version, screenshots, etc.):

image.png (332×1 px, 38 KB)

Event Timeline

Hmm... I am getting this error with a test account request as well. My first guess was that it's related to T390437, which just deployed.

The bot account that is used for fallback account creation (https://en.wikipedia.org/wiki/User:OutreachDashboardBot) didn't have an email set, so set one and verified it, but that didn't fix the problem. However, the Dashboard first tries creating it using the account of whoever is processing the requests, so I think these errors are coming from the actions attempted with our accounts rather than the bot account.

@kostajh: this is an error we haven't seen before, triggered by attempting to create an account via the API using OAuth credentials for the user who is trying to create the account. Is this related to the EmailAuth changes?

I don't think EmailAuth is related here. It's set only to log. @Tgr do you know what is going on here?

This error is used when no authentication provider thinks the supplied set of data is relevant to them. Some possible reasons:

  • you didn't provide some required field (e.g. neither a password nor an email address)
  • somehow SUL3 is enabled despite it generally being disabled for API requests, so the normal providers are not loaded
  • we broke account-creation-by-email handling when we switched from TemporaryPasswordPrimaryAuthenticationProvider to CentralAuthTemporaryPasswordPrimaryAuthenticationProvider in T151012: CentralAuth should have its own temporary password handling

The requests definitely include an email address (and no password). The account creation flow from the Dashboard was working at least as recently as March 28, so I assume it's something that changed in the April 1 deployment.

somehow SUL3 is enabled despite it generally being disabled for API requests, so the normal providers are not loaded

It's that one.
https://en.wikipedia.org/wiki/Special:ApiSandbox#action=query&format=json&meta=authmanagerinfo&formatversion=2&amirequestsfor=create&amimergerequestfields=1

I guess this must have been caused by rOMWC430edba28ba9: Enable SUL3 everywhere somehow, since otherwise enwiki has been using SUL3 signup for two weeks.

Tgr triaged this task as Unbreak Now! priority.Apr 1 2025, 8:16 PM

This will break the mobile apps, at a minimum.

Change #1133255 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/extensions/CentralAuth@master] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1133255

Tgr lowered the priority of this task from Unbreak Now! to High.Apr 1 2025, 11:18 PM

This will break the mobile apps, at a minimum.

Actually only affects account creation via the API where the creator is already logged in. Still not great.

DAlangi_WMF changed the task status from Open to In Progress.Apr 2 2025, 12:28 AM
DAlangi_WMF claimed this task.

Hi there, just to say that I'm also getting this issue, both username and email address have been provided in this instance.

We are also seeing this issue on the English Wikipedia Account Creation tool (ACC). For now, we have disabled API based account creations, but it would be nice to have it working again.

taavi renamed this task from outreachdashboard - unable to process account creation requests to SUL3 broke the ability to send new user's password via email.Apr 8 2025, 8:55 AM
taavi added subscribers: LuciferianThomas, Stang.

Any update on this? We still have account requests coming in regularly on Programs & Events Dashboard for editathons and such, and can't process them.

Change #1133255 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1133255

Sorry it took us a while to get to this. The fix would be deployed next week per the usual schedule. I wonder if we should backport it earlier?

Sorry it took us a while to get to this. The fix would be deployed next week per the usual schedule. I wonder if we should backport it earlier?

It would be nice to backport this since the week is still early.

Change #1145096 had a related patch set uploaded (by D3r1ck01; author: Derick Alangi):

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.28] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145096

Change #1145193 had a related patch set uploaded (by Bartosz Dziewoński; author: Derick Alangi):

[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.1] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145193

Change #1145096 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.28] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145096

Change #1145193 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.45.0-wmf.1] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145193

Mentioned in SAL (#wikimedia-operations) [2025-05-13T13:23:49Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1145096|SUL3: Fix account creation by username & email (with temp password) (T390751)]], [[gerrit:1145193|SUL3: Fix account creation by username & email (with temp password) (T390751)]]

Mentioned in SAL (#wikimedia-operations) [2025-05-13T13:30:20Z] <lucaswerkmeister-wmde@deploy1003> lucaswerkmeister-wmde, matmarex, d3r1ck01: Backport for [[gerrit:1145096|SUL3: Fix account creation by username & email (with temp password) (T390751)]], [[gerrit:1145193|SUL3: Fix account creation by username & email (with temp password) (T390751)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2025-05-13T13:37:57Z] <lucaswerkmeister-wmde@deploy1003> Finished scap sync-world: Backport for [[gerrit:1145096|SUL3: Fix account creation by username & email (with temp password) (T390751)]], [[gerrit:1145193|SUL3: Fix account creation by username & email (with temp password) (T390751)]] (duration: 14m 07s)

Mentioned in SAL (#wikimedia-operations) [2025-05-13T13:39:59Z] <lucaswerkmeister-wmde@deploy1003> Started scap sync-world: Backport for [[gerrit:1145096|SUL3: Fix account creation by username & email (with temp password) (T390751)]]

Following instructions in the commit message, I was able to create an account using API sandbox with password sent via email: https://test.wikipedia.org/w/index.php?title=Special:Log&logid=424666

I also confirmed that the same API request did not work before deploying the patch.

This is now fixed, and the fix is deployed to all wikis.

Mentioned in SAL (#wikimedia-operations) [2025-05-13T13:46:12Z] <lucaswerkmeister-wmde@deploy1003> d3r1ck01, lucaswerkmeister-wmde: Backport for [[gerrit:1145096|SUL3: Fix account creation by username & email (with temp password) (T390751)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Thanks! I just processed the backlog of account requests on Programs & Events Dashboard, and things are working normally again.

Change #1145239 had a related patch set uploaded (by Bartosz Dziewoński; author: Derick Alangi):

[mediawiki/extensions/CentralAuth@REL1_44] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145239

Change #1145239 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@REL1_44] SUL3: Fix account creation by username & email (with temp password)

https://gerrit.wikimedia.org/r/1145239