TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in AccessTokenEntity.php
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Assigned To

Authored By

	• dancy
	Feb 18 2026, 7:43 PM

Description

Error

mwversion: 1.46.0-wmf.16
timestamp: 2026-02-18T19:39:00.688Z
phpversion: 8.3.30
reqId: d72cb5a1-8f3a-46c4-b0ca-a40bbb8a0126
Find reqId in Logstash

normalized_message

[{reqId}] {exception_url}   TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in /srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/Entity/AccessToke

Frame	Location	Call
from	/srv/mediawiki/php-1.46.0-wmf.16/vendor/league/oauth2-server/src/Entities/Traits/TokenEntityTrait.php(102)
#0	/srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/Entity/AccessTokenEntity.php(79)	MediaWiki\Extension\OAuth\Entity\AccessTokenEntity->setUserIdentifier(null)
#1	/srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/Repository/AccessTokenRepository.php(56)	MediaWiki\Extension\OAuth\Entity\AccessTokenEntity->__construct(MediaWiki\Extension\OAuth\Entity\ClientEntity, array, string, null)
#2	/srv/mediawiki/php-1.46.0-wmf.16/vendor/league/oauth2-server/src/Grant/AbstractGrant.php(437)	MediaWiki\Extension\OAuth\Repository\AccessTokenRepository->getNewToken(MediaWiki\Extension\OAuth\Entity\ClientEntity, array, null)
#3	/srv/mediawiki/php-1.46.0-wmf.16/vendor/league/oauth2-server/src/Grant/ClientCredentialsGrant.php(57)	League\OAuth2\Server\Grant\AbstractGrant->issueAccessToken(DateInterval, MediaWiki\Extension\OAuth\Entity\ClientEntity, null, array, array)
#4	/srv/mediawiki/php-1.46.0-wmf.16/vendor/league/oauth2-server/src/AuthorizationServer.php(179)	League\OAuth2\Server\Grant\ClientCredentialsGrant->respondToAccessTokenRequest(GuzzleHttp\Psr7\ServerRequest, League\OAuth2\Server\ResponseTypes\BearerTokenResponse, DateInterval)
#5	/srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/AuthorizationProvider/AccessToken.php(22)	League\OAuth2\Server\AuthorizationServer->respondToAccessTokenRequest(GuzzleHttp\Psr7\ServerRequest, MediaWiki\Extension\OAuth\Response)
#6	/srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/Rest/Handler/AccessToken.php(50)	MediaWiki\Extension\OAuth\AuthorizationProvider\AccessToken->getAccessTokens(GuzzleHttp\Psr7\ServerRequest, MediaWiki\Extension\OAuth\Response)
#7	/srv/mediawiki/php-1.46.0-wmf.16/includes/Rest/Module/Module.php(472)	MediaWiki\Extension\OAuth\Rest\Handler\AccessToken->execute()
#8	/srv/mediawiki/php-1.46.0-wmf.16/includes/Rest/Module/Module.php(301)	MediaWiki\Rest\Module\Module->executeHandler(MediaWiki\Extension\OAuth\Rest\Handler\AccessToken)
#9	/srv/mediawiki/php-1.46.0-wmf.16/includes/Rest/Router.php(484)	MediaWiki\Rest\Module\Module->execute(string, MediaWiki\Rest\RequestFromGlobals)
#10	/srv/mediawiki/php-1.46.0-wmf.16/includes/Rest/Router.php(443)	MediaWiki\Rest\Router->doExecute(string, MediaWiki\Rest\RequestFromGlobals)
#11	/srv/mediawiki/php-1.46.0-wmf.16/includes/Rest/EntryPoint.php(181)	MediaWiki\Rest\Router->execute(MediaWiki\Rest\RequestFromGlobals)
#12	/srv/mediawiki/php-1.46.0-wmf.16/includes/MediaWikiEntryPoint.php(180)	MediaWiki\Rest\EntryPoint->execute()
#13	/srv/mediawiki/php-1.46.0-wmf.16/rest.php(25)	MediaWiki\MediaWikiEntryPoint->run()
#14	/srv/mediawiki/w/rest.php(3)	require(string)
#15	{main}

Impact

~112 hits in the first 15 minutes of rolling 1.46.0-wmf.16 to group1, and persistent since then.

Notes

Seems to be new for the 1.46.0-wmf.16

Details

Request URL: https://meta.wikimedia.org/w/rest.php/oauth2/access_token

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Do not pass null to AccessTokenEntity::setUserIdentifier()	mediawiki/extensions/OAuth	wmf/1.46.0-wmf.16	+3 -1
	Do not pass null to AccessTokenEntity::setUserIdentifier()	mediawiki/extensions/OAuth	master	+3 -1

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved	Release	• dancy	T413807 1.46.0-wmf.16 deployment blockers
		Resolved	PRODUCTION ERROR	Tgr	T417820 TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in AccessTokenEntity.php

Event Timeline

• dancy created this task.Feb 18 2026, 7:43 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptFeb 18 2026, 7:43 PM

• dancy added a project: MediaWiki-extensions-OAuth.Feb 18 2026, 7:44 PM

Restricted Application added a project: MediaWiki-Platform-Team. · View Herald TranscriptFeb 18 2026, 7:44 PM

Almost certainly fallout of the upgrade work in T261462: Migrate OAuth extension back from wikimedia/oauth2-server fork to upstream

• dancy updated the task description. (Show Details)Feb 18 2026, 7:58 PM

https://gerrit.wikimedia.org/r/c/mediawiki/vendor/+/1229647/4/league/oauth2-server/src/Entities/Traits/TokenEntityTrait.php

* @param string|int|null $identifier The identifier of the user -> * @param non-empty-string $identifier The identifier of the user

We are working on this in T417278: Choosing client credentials grant for OAuth 2 results in an access token (JWT) with the 'sub' field empty. Sorry, I was sure nothing uses this in production.

Reedy renamed this task from TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in /srv/mediawiki/php-1.46.0-wmf.16/extensions/OAuth/src/Entity/AccessToke to TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in AccessTokenEntity.php.Feb 18 2026, 8:13 PM

Should probably do a quick fix rather than waiting for the client credentials issue to be fully worked out.

In T417820#11629590, @Tgr wrote:

Should probably do a quick fix rather than waiting for the client credentials issue to be fully worked out.

Yes please. :-)

Change #1240371 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OAuth@master] Do not pass null to AccessTokenEntity::setUserIdentifier()

https://gerrit.wikimedia.org/r/1240371

gerritbot added a project: Patch-For-Review.Feb 18 2026, 8:19 PM

Might be a train blocker, depending on what kind of clients use the client credentials endpoint (unfortunately we don't log the user agent for exceptions, and in any case the group 1 data wouldn't be that informative).

Change #1240371 merged by jenkins-bot:

[mediawiki/extensions/OAuth@master] Do not pass null to AccessTokenEntity::setUserIdentifier()

https://gerrit.wikimedia.org/r/1240371

Maintenance_bot removed a project: Patch-For-Review.Feb 18 2026, 8:30 PM

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.17; 2026-02-24).Feb 18 2026, 9:00 PM

FWIW the patch doesn't 100% restore the pre-upgrade behavior. Back then the user identifier was set to the empty string, now it's null, so the resulting JWT is slightly different. Probably doesn't make any difference.

• dancy added a parent task: T413807: 1.46.0-wmf.16 deployment blockers.Feb 18 2026, 10:49 PM

Thanks for the work on this. I'm holding the train until the fix is backported.

LucasWerkmeister mentioned this in T417839: Editing using OAuth 2 doesn’t work.Feb 18 2026, 10:58 PM

Don-vip awarded a token.Feb 18 2026, 11:01 PM

Don-vip subscribed.

Change #1240418 had a related patch set uploaded (by Jforrester; author: Gergő Tisza):

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Do not pass null to AccessTokenEntity::setUserIdentifier()

https://gerrit.wikimedia.org/r/1240418

gerritbot added a project: Patch-For-Review.Feb 19 2026, 1:09 AM

Aklapper merged a task: T417855: OAuth2 client_credentials grant fails with TypeError in AccessTokenEntity::setUserIdentifier on wmf.16.Feb 19 2026, 8:14 AM

Aklapper added a subscriber: RakhamDev.

Change #1240418 merged by jenkins-bot:

[mediawiki/extensions/OAuth@wmf/1.46.0-wmf.16] Do not pass null to AccessTokenEntity::setUserIdentifier()

https://gerrit.wikimedia.org/r/1240418

Mentioned in SAL (#wikimedia-operations) [2026-02-19T09:14:47Z] <hashar@deploy2002> Started scap sync-world: Backport for [[gerrit:1240418|Do not pass null to AccessTokenEntity::setUserIdentifier() (T417820)]], [[gerrit:1240430|Fix "iss" field missing in OAuth 2 access token JWT (T417839)]]

Mentioned in SAL (#wikimedia-operations) [2026-02-19T09:17:04Z] <hashar@deploy2002> reedy, jforrester, hashar: Backport for [[gerrit:1240418|Do not pass null to AccessTokenEntity::setUserIdentifier() (T417820)]], [[gerrit:1240430|Fix "iss" field missing in OAuth 2 access token JWT (T417839)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-02-19T09:23:25Z] <hashar@deploy2002> Finished scap sync-world: Backport for [[gerrit:1240418|Do not pass null to AccessTokenEntity::setUserIdentifier() (T417820)]], [[gerrit:1240430|Fix "iss" field missing in OAuth 2 access token JWT (T417839)]] (duration: 08m 37s)

Maintenance_bot removed a project: Patch-For-Review.Feb 19 2026, 9:30 AM

There have been no more errors since the deployment: https://logstash.wikimedia.org/goto/c5b92a6c37630d46f40122f5acfe1d22

ReleaseTaggerBot edited projects, added MW-1.46-notes (1.46.0-wmf.16; 2026-02-17); removed MW-1.46-notes (1.46.0-wmf.17; 2026-02-24).Feb 19 2026, 10:00 AM

Thanks everyone!

Tgr mentioned this in T419921: TypeError: MediaWiki\Extension\OAuth\ResourceServer::getUser(): Return value must be of type MediaWiki\User\User, false returned.Mar 13 2026, 8:29 AM

	F72182681: image.png
	Feb 19 2026, 9:51 AM

TypeError: MediaWiki\Extension\OAuth\Entity\AccessTokenEntity::setUserIdentifier(): Argument #1 ($identifier) must be of type string, null given, called in AccessTokenEntity.phpClosed, ResolvedPublicPRODUCTION ERRORActions