@Tgr could I (politely) bug you for a status update?

Change #1090973 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] [WIP] attachAccount: Allow specifying which wikis to attach a user on

https://gerrit.wikimedia.org/r/1090973

@Tgr asked for review, and the query looks correct to me.

UTC 19:00
I was working in svwiki and wikidata (Edge, Windows 10). I clicked in Wikidata on a link to https://k8s-status.toolforge.org/namespaces/tool-deltabot/. No problem. BUT, I got logged out from svwiki, but not from wikidata. I'm still logged in on my mobile.

List of affected accounts: F57698265

Wrt cleanup, what we need to do here is to find all the non-Wikitech accounts where

1. the account is not attached to a central account
2. but the central account exists
3. and there is an identically-named Wikitech account

and attach those to the global account.

@Tgr yes. tl.wiktionary.org account is attached successfully.

Someone who has been affected by this, such as @eugrus or @Robertsky, would you be able to double-check the fix by going to a wiki where you don't have a local account (you can find one via Special:CentralAuth) and logging in if needed?

In T378289#10288451, @Tgr wrote:

There have been 195 Not centralizing auto-created user {username}, central account doesn't exist and 133 Not centralizing auto-created user {username}, unattached accounts exist errors since we enabled logging.

Mentioned in SAL (#wikimedia-operations) [2024-11-12T21:27:13Z] <urbanecm@deploy2002> Finished scap sync-world: Backport for [[gerrit:1088770|Fix warning about missing central account for temp users (T378289)]], [[gerrit:1088771|Check session provider when autocreating (T378289)]] (duration: 16m 11s)

Mentioned in SAL (#wikimedia-operations) [2024-11-12T21:13:32Z] <urbanecm@deploy2002> urbanecm, tgr: Backport for [[gerrit:1088770|Fix warning about missing central account for temp users (T378289)]], [[gerrit:1088771|Check session provider when autocreating (T378289)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2024-11-12T21:11:02Z] <urbanecm@deploy2002> Started scap sync-world: Backport for [[gerrit:1088770|Fix warning about missing central account for temp users (T378289)]], [[gerrit:1088771|Check session provider when autocreating (T378289)]]

Change #1088771 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.2] Check session provider when autocreating

https://gerrit.wikimedia.org/r/1088771

Change #1088770 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.2] Fix warning about missing central account for temp users

https://gerrit.wikimedia.org/r/1088770

In T372702#10143809, @kostajh wrote:

This task is a concern for Temporary accounts project, in that once a user is logged out of their temporary account, there's no way to log back into it. Is it possible to instrument how often these unexpected logouts are happening, bucketed for named and temporary accounts?

We did not backport due to scap issues (T379589). It will happen today.

Could I get a status update on this? I sit on the Ombuds Commission. While we have not officially taken this up as a case, we have discussed it informally since it has the potential to lead to a user's IP address being leaked. The OC is charged with monitoring infringements of the WMF privacy policy and our purview includes being able to "suggest suitable changes to policies or software", hence our interest in this particular issue.

can this be done for https://meta.wikimedia.org/wiki/Special:CentralAuth?target=BHARATHESHA_ALASANDEMAJALU also, user couldn't login to wikis where there accounts are unattached

And 1513 UTC this morning.

Change #1088771 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.2] Check session provider when autocreating

https://gerrit.wikimedia.org/r/1088771

Change #1088770 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@wmf/1.44.0-wmf.2] Fix warning about missing central account for temp users

https://gerrit.wikimedia.org/r/1088770

Let's backport the (hopefully) fix on Monday. After that, we can run attachAccount.php on the affected accounts.

I just logged out of Wikipedia, cleared the browser cache and cookies (using Firefox's "forget about this site" from History), logged back in - and now I can't repeat the problem any more. So maybe there was just something weird about my machine's stored cookies. But perhaps other users having the "getting logged out" problem could try the same thing (close all browser instances, click on link on Desktop, check if logged in, go to watchlist) to see if they can replicate it.

I've noticed some odd behaviour lately, which may or may not be related, but I'll mention it just in case.
I normally have a persistent login to en.wikipedia.org ("Keep me logged in ...") and it generally works - if I start the browser then go to https://en.wikipedia.org/wiki/Special:Watchlist. But today, if I close my browser then click on a link to a Wikipedia page that I had saved on my desktop, or a link to a Wikipedia article in my e-mail program (Thunderbird) the browser opens on the page but appears to NOT be logged in. If I go to another random page I still appear not logged in. But if I then go to https://en.wikipedia.org/wiki/Special:Watchlist (which requires me to be logged in) I appear to be logged in again (without entering username and password).
This happens every time at the moment. I can't say how often it has been doing this, because usually I open the browser first rather than following a link to a Wikipedia page from something other than the browser (eg link on desktop, or in e-mail client) when the browser is not already running.

I have become logged out again between 23:00 and 9:30 UTC, but only on desktop browser, not mobile. User name: Doc_Taxon

Change #1087978 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Check session provider when autocreating

https://gerrit.wikimedia.org/r/1087978

1420 UTC this morning.

Change #1088354 merged by jenkins-bot:

[mediawiki/extensions/CentralAuth@master] Fix warning about missing central account for temp users

https://gerrit.wikimedia.org/r/1088354

And another logout, at some point between 15:19 and 18:36 UTC today 7 November.

Change #1088354 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] Fix warning about missing central account for temp users

https://gerrit.wikimedia.org/r/1088354

In T378289#10292885, @Tgr wrote:

Not centralizing auto-created user {username}, central account doesn't exist errors are all from temp users, and all on temp-enabled wikis. (@kostajh FYI)

Change #1087978 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/CentralAuth@master] [WIP] Check session provider when autocreating

https://gerrit.wikimedia.org/r/1087978

@Tgr: Can it be possible that this is not a cookie bug but any malware or virus accessing the session cookies?

Not centralizing auto-created user {username}, central account doesn't exist errors are all from temp users, and all on temp-enabled wikis. (@kostajh FYI)

And again this morning. 1401 UTC is when I noticed it.

I was also logged out on desktop this morning, last logged in views would have been around 03:00 UTC, first request this morning was a few minutes ago (15:25 UTC)

There have been 195 Not centralizing auto-created user {username}, central account doesn't exist and 133 Not centralizing auto-created user {username}, unattached accounts exist errors since we enabled logging.

I've just been logged out again, it happened some time between 12:36 and 13:10 UTC today (4 November). Switching browsers was not a factor this time, I made an edit in Firefox then went and did some stuff in other Firefox tabs, then came back to a Wikipedia tab I'd left open, clicked edit and found I'd been logged out.

In T199393#10280167, @gerritbot wrote:

Change #1083959 merged by jenkins-bot:

[mediawiki/core@master] auth: Use READ_LATEST intead of READ_LOCKING for account creation checks

https://gerrit.wikimedia.org/r/1083959