Extension talk:PluggableAuth/2019

This page used the Structured Discussions extension to give structured discussions. It has since been converted to wikitext, so the content and history here are only an approximation of what was actually displayed at the time these comments were made.

When reporting an error, please be sure to include version information for MediaWiki and all relevant extensions as well as configuration information. Also, please turn on debug logging as described at Manual:How to debug#Logging and include the relevant portions of the debug log.

PluggableAuth redirect loop?

Latest comment: 7 years ago2 comments2 people in discussion

Hello, I am trying to setup configure mw 1.27 to work with LDAP. I have run into quite a few problems. Currently I am stuck at a strange redirection problem that seems to be stemming from PluggableAuth. It is possible that it is also the result of LDAPProvider or LDAPAuthentication2 (I also tried LDAPAuthorization and had a similar issue), but when I comment these extensions out from LocalSettings.php, I have the same problem.

Basically the problem is that when I click login on one of my pages, I get a 310 error. Usually this happens at /wiki/Special:PluggableAuthLogin although sometimes I get the error from the url that you will see in the log below. Here is what is in the debug error log when this happens.

[error] [37b6db1354b5c013cec3c6a9] /scripts/index.php?title=Special:UserLogin/return&wpLoginToken=b606d79460f454d03d796f4340015b065c2d47d9%2B%5C ErrorException from line 3306 of /srv/services/mediawiki/mediawiki/includes/db/Database.php: PHP Notice: Uncommitted DB writes (transaction from DatabaseBase::query (JobQueueDB::doGetSiblingQueuesWithJobs)).

#0 [internal function]: MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 /srv/services/mediawiki/mediawiki/includes/db/Database.php(3306): trigger_error(string)

#2 [internal function]: DatabaseBase->__destruct()

This sort of error gets printed to the debug log many times, sometimes as often as once every second. I can make this stop by running php runJobs.php, which runs without error. I am inheriting a somewhat shaky mediawiki installation, but the runJobs script and the upgrade script both seem to behave correctly. 2601:603:4E00:676D:19D6:D965:9A22:5FB0 (talk) 08:09, 3 January 2019 (UTC)Reply

Could you please check if $wgPluggableAuth_EnableAutoLogin is set to true? If so, please set it to false. If you need auto authentication with LDAP please use Extension:Auth remoteuser. Osnard (talk) 06:58, 9 January 2019 (UTC)Reply

SimpleSaml and PluggableAuth never get logged in

Latest comment: 7 years ago14 comments2 people in discussion

MediaWiki 1.31.1

PHP 7.0.33

MySQL 5.6.41

PluggableAuth 5.4

SimpleSaml 4.1

I am setting up SimpleSaml with PluggableAuth on my MW site. The SimpleSaml setup is working properly, but after I "login" it never shows that I am logged in. This happens when I try to visit a protected page such as Special:Preferences or when I specifically login. I have also tried to create an account on the site and it returns the error "The supplied credentials could not be used for account creation." I have turned on logging and when I specifically try to create an account I find the message:

[authentication] MediaWiki\Auth\AuthManager::continueAccountCreation: Primary creation failed because no provider accepted

Googling I can't find anyone else who has had this problem. If someone has seen this before, I would appreciate the help. Whitechad (talk) 20:10, 8 January 2019 (UTC)Reply

It would be helpful to see any other logged messages from PluggableAuth and SimpleSAMLphp leading up to that error. Did you grant the autocreateaccount permission to all users? Cindy.cicalese (talk) 04:30, 10 January 2019 (UTC)Reply

Yes, autocreateaccount and createaccount are set for the (all) users category. I'm not sure what part of the log would be helpful. The logs for a simple login do not show any overt errors. Here is a good chunk of that part of the log. Hope this is not too long. I will include the log for the overt account creation action in a separate post.

Start request GET /wiki/Special:PluggableAuthLogin

...

FORWARDED-REQUEST-URI: /wiki/Special:PluggableAuthLogin

...

COOKIE: SimpleSAML=8456MODIFIED1a7d8bb1400f4a8e; sil_session=ud4igv6dlrMODIFIEDtusm4v7ce

[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff

[caches] LocalisationCache: using store LCStoreDB

[session] Session "ud4igv6dlrMODIFIEDtusm4v7ce" requested without UserID cookie

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "00.00.52.217", "UserAgent": "Mozilla\/5.0 ...", "ChronologyProtection": false, "ChronologyPositionIndex": 0

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[SQLBagOStuff] Connection 14396943 will be used for SqlBagOStuff

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

... session marked dirty ...

[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 1):

query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')

#0 /home/ethn/webap/sil/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 1)

#1 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1547135195.6482, true, 1)

#2 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')

#3 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')

#4 /home/ethn/webap/sil/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')

#5 /home/ethn/webap/sil/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')

#6 /home/ethn/webap/sil/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 1547138795)

#7 /home/ethn/webap/sil/includes/libs/objectcache/CachedBagOStuff.php(65): SqlBagOStuff->set('sil:MWSession:8...', Array, 1547138795, 1)

#8 /home/ethn/webap/sil/includes/session/SessionBackend.php(738): CachedBagOStuff->set('sil:MWSession:8...', Array, 1547138795, 1)

#9 /home/ethn/webap/sil/includes/session/SessionBackend.php(607): MediaWiki\Session\SessionBackend->save()

#10 /home/ethn/webap/sil/includes/session/SessionBackend.php(291): MediaWiki\Session\SessionBackend->autosave()

#11 /home/ethn/webap/sil/includes/session/Session.php(127): MediaWiki\Session\SessionBackend->persist()

#12 /home/ethn/webap/sil/includes/session/PHPSessionHandler.php(357): MediaWiki\Session\Session->persist()

#13 [internal function]: MediaWiki\Session\PHPSessionHandler->write('845613398615561...', 'a:0:{}')

#14 /home/ethn/simplesamlphp/lib/SimpleSAML/SessionHandlerPHP.php(348): session_write_close()

#15 /home/ethn/simplesamlphp/lib/SimpleSAML/Session.php(169): SimpleSAML\SessionHandlerPHP->setCookie('SimpleSAML', '0881da0aa24331a...', Array)

#16 /home/ethn/simplesamlphp/lib/SimpleSAML/Session.php(287): SimpleSAML_Session->__construct()

#17 /home/ethn/simplesamlphp/lib/SimpleSAML/Auth/Simple.php(96): SimpleSAML_Session::getSessionFromRequest()

#18 /home/ethn/webap/sil/extensions/SimpleSAMLphp/SimpleSAMLphp.class.php(42): SimpleSAML\Auth\Simple->requireAuth()

#19 /home/ethnologue/webap/sil/extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): SimpleSAMLphp->authenticate(NULL, NULL, NULL, NULL, NULL)

#20 /home/ethn/webap/sil/includes/specialpage/SpecialPage.php(522): PluggableAuthLogin->execute(NULL)

#21 /home/ethn/webap/sil/includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#22 /home/ethn/webap/sil/includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))

#23 /home/ethn/webap/sil/includes/MediaWiki.php(861): MediaWiki->performRequest()

#24 /home/ethn/webap/sil/includes/MediaWiki.php(524): MediaWiki->main()

#25 /home/ethn/webap/sil/index.php(42): MediaWiki->run()

#26 {main}

[session] Saving all sessions on shutdown

... session marked dirty ...

[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 2):

query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')

#0 /home/ethn/webap/sil/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 2)

#1 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1547135195.6629, true, 1)

#2 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')

#3 /home/ethn/webap/sil/includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')

#4 /home/ethn/webap/sil/includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')

#5 /home/ethn/webap/sil/includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')

#6 /home/ethn/webap/sil/includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 1547138795)

#7 /home/ethn/webap/sil/includes/libs/objectcache/CachedBagOStuff.php(65): SqlBagOStuff->set('sil:MWSession:0...', Array, 1547138795, 1)

#8 /home/ethn/webas/sil/includes/session/SessionBackend.php(738): CachedBagOStuff->set('sil:MWSession:0...', Array, 1547138795, 1)

#9 /home/ethn/webap/sil/includes/session/SessionBackend.php(607): MediaWiki\Session\SessionBackend->save()

#10 /home/ethnologue/webap/sil/includes/session/SessionBackend.php(291): MediaWiki\Session\SessionBackend->autosave()

#11 /home/ethn/webap/sil/includes/session/Session.php(127): MediaWiki\Session\SessionBackend->persist()

#12 /home/ethn/webap/sil/includes/session/PHPSessionHandler.php(357): MediaWiki\Session\Session->persist()

#13 [internal function]: MediaWiki\Session\PHPSessionHandler->write('0881da0aa24331a...', 'a:0:{}')

#14 /home/ethn/webap/sil/includes/session/SessionManager.php(470): session_write_close()

#15 [internal function]: MediaWiki\Session\SessionManager->shutdown()

[DBConnection] Wikimedia\Rdbms\{closure}: closing connection to database 'localhost'. Whitechad (talk) 16:28, 10 January 2019 (UTC)Reply

And here is the log of the account creation event that says it failed because "no provider accepted". I just simply clicked on Create Account at the top of the page and put in a username. Nothing else. It returns a message on the page as follows.

The supplied credentials could not be used for account creation.

After sifting through the code, I have determined that message is the same error as the one in the log below indicating no provider accepted. I am not sure if this problem is what is causing the previous login attempts through my IdP to fail, but it seems likely since at this point it needs to be able to automatically create the account. I am grateful for your help!

Start request POST /index.php?title=Special:CreateAccount&returnto=Special:ListGroupRights

...

FORWARDED-REQUEST-URI: /index.php?title=Special:CreateAccount&returnto=Special:ListGroupRights

...

COOKIE: SimpleSAML=845613398615561a7d8bb140MODIFIED; sil_session=ud4igv6dlrbnbhct1e0MODIFIED; SimpleSAMLAuthToken=_5b8576f3f3eca74a4cd4e5f9035Modified; UseDC=master; UseCDNCache=false

[caches] cluster: EmptyBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff

[caches] LocalisationCache: using store LCStoreDB

[session] Session "ud4igv6dlrbnbhct1e0MODIFIED" requested without UserID cookie

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "00.00.52.217", "UserAgent": "Mozilla\/5.0 ...", "ChronologyProtection": false, "ChronologyPositionIndex": 0

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[SQLBagOStuff] Connection 14400034 will be used for SqlBagOStuff

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[MessageCache] MessageCache::load: Loading en... local cache is empty, global cache is expired/volatile, loading from database

[authevents] Captcha shown on account creation

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): SimpleCaptcha->createAuthenticationRequest/SimpleCaptcha->storeCaptcha/CaptchaSessionStore->store/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform

Parser: using preprocessor: Preprocessor_DOM

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" save: dataDirty=1 metaDirty=0 forcePersist=0

User::getBlockedStatus: checking...

QuickTemplate::__construct was called with no Config instance passed to it

[TitleBlacklist-cache] Updated sil:title_blacklist_entries with 0 entries.

User::getBlockedStatus: checking...

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->beginAccountCreation/MediaWiki\Auth\AuthManager->removeAuthenticationSessionData/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty

[CryptRand] 0 bytes of randomness leftover in the buffer.

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->beginAccountCreation/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" save: dataDirty=1 metaDirty=0 forcePersist=0

User::getBlockedStatus: checking...

[SpamBlacklist] Loading email regex...

[SpamBlacklist] no files specified

[captcha] ConfirmEdit: passed; new account 'Whitechad'

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): SimpleCaptcha->passCaptcha/SimpleCaptcha->clearCaptcha/CaptchaSessionStore->clear/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty

[authevents] Captcha submitted on account creation

[authentication] MediaWiki\Auth\AuthManager::continueAccountCreation: Primary creation failed because no provider accepted

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->beginAccountCreation/MediaWiki\Auth\AuthManager->continueAccountCreation/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" save: dataDirty=1 metaDirty=0 forcePersist=0

[authevents] Account creation attempt

[authevents] Captcha shown on account creation

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" data dirty due to dirty(): SimpleCaptcha->createAuthenticationRequest/SimpleCaptcha->storeCaptcha/CaptchaSessionStore->store/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

QuickTemplate::__construct was called with no Config instance passed to it

[session] SessionBackend "ud4igv6dlrbnbhct1e0MODIFIED" save: dataDirty=1 metaDirty=0 forcePersist=0

SiteStats::loadAndLazyInit: reading site_stats from replica DB

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

MediaWiki::preOutputCommit: LBFactory shutdown completed

[cookie] setcookie: "UseDC", "master", "1547136059", "/", "", "1", "1"

[cookie] setcookie: "UseCDNCache", "false", "1547136059", "/", "", "1", "1"

OutputPage::sendCacheControl: private caching; **

Request ended normally

[session] Saving all sessions on shutdown

[DBConnection] Wikimedia\Rdbms\{closure}: closing connection to database 'localhost'. Whitechad (talk) 16:35, 10 January 2019 (UTC)Reply

You should not need to use Special:CreateAccount to create the account; account creation should happen automatically as part of the authentication workflow if the remove identity provider authenticates a user that has not previously logged in to the wiki. In fact, you should disable manual account creation by removing the createaccount permission from all users (while retaining the autocreateaccount permission).

It would be helpful to see any additional lines that begin with [PluggableAuth] or [SimpleSAMLphp] generated during the login process. I only see the beginning of the workflow with:

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

but I need to see what happens next.

A common problem has to do with session storage. Please see Extension:SimpleSAMLphp#Known_Bugs. Cindy.cicalese (talk) 19:50, 10 January 2019 (UTC)Reply

I added $wgMainCacheType = CACHE_DB; and disabled createaccount for all users.

I didn't remove much from those logs and not any of the saml or pluggableauth lines. When hitting the Special:Preferences page and going through the login procedure here are the log lines on either side of those lines you pasted. It does not appear that there is much to go on. There are no other lines in the log that start with either extension name. I am happy to send you the complete log file via email if you wish, but pasting it here formats it badly.

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[SQLBagOStuff] Connection 14694459 will be used for SqlBagOStuff

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[session] SessionBackend "8877d4411777523a1MODIFIED" is unsaved, marking dirty in constructor

[session] SessionBackend "8877d4411777523a1MODIFIED" save: dataDirty=1 metaDirty=1 forcePersist=0

[session] SessionBackend "8877d4411777523a1MODIFIED" force-persist due to persist()

[session] SessionBackend "8877d4411777523a1MODIFIED" save: dataDirty=0 metaDirty=1 forcePersist=1

[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 1):

query-m: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('X')

#0 /includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated('writes', 'query-m: REPLAC...', 1)

#1 /includes/libs/rdbms/database/Database.php(1256): Wikimedia\Rdbms\TransactionProfiler->recordQueryCompletion('query-m: REPLAC...', 1547231758.8469, true, 1)

#2 /includes/libs/rdbms/database/Database.php(1151): Wikimedia\Rdbms\Database->doProfiledQuery('REPLACE INTO `o...', 'REPLACE /* SqlB...', true, 'SqlBagOStuff::s...')

#3 /includes/libs/rdbms/database/Database.php(2741): Wikimedia\Rdbms\Database->query('REPLACE INTO `o...', 'SqlBagOStuff::s...')

#4 /includes/libs/rdbms/database/DatabaseMysqlBase.php(516): Wikimedia\Rdbms\Database->nativeReplace('`objectcache`', Array, 'SqlBagOStuff::s...')

#5 /includes/objectcache/SqlBagOStuff.php(361): Wikimedia\Rdbms\DatabaseMysqlBase->replace('objectcache', Array, Array, 'SqlBagOStuff::s...')

#6 /includes/objectcache/SqlBagOStuff.php(376): SqlBagOStuff->setMulti(Array, 1547235358)

#7 /includes/libs/objectcache/CachedBagOStuff.php(65): SqlBagOStuff->set('sil:MWSession:8...', Array, 1547235358, 1)

#8 /includes/session/SessionBackend.php(738): CachedBagOStuff->set('sil:MWSession:8...', Array, 1547235358, 1)

#9 /includes/session/SessionBackend.php(607): MediaWiki\Session\SessionBackend->save()

#10 /includes/session/SessionBackend.php(291): MediaWiki\Session\SessionBackend->autosave()

#11 /includes/session/Session.php(127): MediaWiki\Session\SessionBackend->persist()

#12 /includes/session/PHPSessionHandler.php(357): MediaWiki\Session\Session->persist()

#13 [internal function]: MediaWiki\Session\PHPSessionHandler->write('8877d4411777523...', 'a:0:{}')

#14 /home/simplesamlphp/lib/SimpleSAML/SessionHandlerPHP.php(348): session_write_close()

#15 /home/simplesamlphp/lib/SimpleSAML/Session.php(169): SimpleSAML\SessionHandlerPHP->setCookie('SimpleSAML', '5c55557fb6cb542...', Array)

#16 /home/simplesamlphp/lib/SimpleSAML/Session.php(287): SimpleSAML_Session->__construct()

#17 /home/simplesamlphp/lib/SimpleSAML/Auth/Simple.php(96): SimpleSAML_Session::getSessionFromRequest()

#18 /extensions/SimpleSAMLphp/SimpleSAMLphp.class.php(42): SimpleSAML\Auth\Simple->requireAuth()

#19 /extensions/PluggableAuth/includes/PluggableAuthLogin.php(31): SimpleSAMLphp->authenticate(NULL, NULL, NULL, NULL, NULL)

#20 /includes/specialpage/SpecialPage.php(522): PluggableAuthLogin->execute(NULL)

#21 /includes/specialpage/SpecialPageFactory.php(568): SpecialPage->run(NULL)

#22 /includes/MediaWiki.php(288): SpecialPageFactory::executePath(Object(Title), Object(RequestContext))

#23 /includes/MediaWiki.php(861): MediaWiki->performRequest()

#24 /includes/MediaWiki.php(524): MediaWiki->main()

#25 /index.php(42): MediaWiki->run()

#26 {main} Whitechad (talk) 18:56, 11 January 2019 (UTC)Reply

I noticed that your versions of SimpleSAMLphp and PluggableAuth are a bit behind. Newer versions have improved debugging. Please upgrade and see if that helps. If it does not, feel free to email me the log. Cindy.cicalese (talk) 03:06, 12 January 2019 (UTC)Reply

Not sure how I missed that last update. It is updated now as well as the two modules. The log does not look different so I decided to try adding some additional logging lines to see exactly where it is failing. Here is a snippet of code from the execute function in PluggableAuthLogin.php that I have added the bolded debug lines.

public function execute( $param ) {

wfDebugLog( 'PluggableAuth', 'In execute()' );

$authManager = AuthManager::singleton();

$user = $this->getUser();

$pluggableauth = PluggableAuth::singleton();

$error = null;

wfDebugLog( 'PluggableAuth', 'CW: PluggableAuthLogin.php line 29' );

if ( $pluggableauth ) {

wfDebugLog( 'PluggableAuth', 'CW: if PluggableAuth' );

if ( $pluggableauth->authenticate( $id, $username, $realname, $email, $error ) ) {

wfDebugLog( 'PluggableAuth', 'CW: Authenticate' );

if ( is_null( $id ) ) {

wfDebugLog( 'PluggableAuth', 'CW: ID is null' );

$user->loadDefaults( $username );

$user->mName = $username;

$user->mRealName = $realname;

$user->mEmail = $email;

$user->mEmailAuthenticated = wfTimestamp();

$user->mTouched = wfTimestamp();

wfDebugLog( 'PluggableAuth', 'Authenticated new user: ' . $username );

} else {

The resulting log with one line on either side looks like this.

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[PluggableAuth] CW: Class exists. Instance created.

[PluggableAuth] CW: PluggableAuthLogin.php line 29

[PluggableAuth] CW: if PluggableAuth

[session] SessionBackend

It gets past the line 29 debug statement and the if PluggableAuth line, but it never gets past the $pluggableauth->authenticate... line. That goes to the abstract public function authenticate() to check the constructor, but it seems to fail somehow. If I comment the "if" line out and put in "if (true) {" instead my debug lines below there show up, but then other errors show up which I presume that if is there to catch. Does this help you have an idea about what is happening? Whitechad (talk) 18:33, 14 January 2019 (UTC)Reply

The way PluggableAuth/SimpleSAMLphp works, a redirect to Special:PluggableAuthLogin occurs, which is what you see above. Then, the authenticate() function will redirect to the remote identity provider for authentication. You will not see that remote interaction in the MediaWiki debug log. The remote identity provider will then redirect back to Special:PluggableAuthLogin usually with some cookies set to indicate the success/failure of the authentication process. You should be seeing that second redirect to Special:PluggableAuthLogin in your debug log with additional debugging output showing whether the authentication was successful or not. You should also look for debug lines that begin with [authentication]. You should be able to see the authentication cookies in the header of the second request to Special:PluggableAuthLogin. Cindy.cicalese (talk) 15:54, 19 January 2019 (UTC)Reply

Hi Cindy,

I appreciate the time you are taking to help me with this. Your description of what should happen is helpful, but not enough to solve the problem. I have traced your simpleSAMLphp.php code up to where on line 151 it calls $saml->requireAuth(). That goes into the simpleSAML code and I have traced through that to where it sends a request to my IdP. Using the SAML Tracer plugin for Firefox I can see that the IdP posts back to https://domain.com/simplesaml/www/module.php/saml/sp/saml2-acs.php/default-sp. It has the cookies attached and then redirects to my home page.

If the requireAuth statement failed it should be caught and logged in SimpleSAMLphp.php line 154. This does not happen, but neither does it get to my own added debug log line just after that try catch statement. This presumably means that the authenticate function never returns true (line 165) and the anticipated [authentication] lines in the log are also missing. I'm not sure what the implications are of this except that it never tries to create a user or login an existing one. I am simply redirected to my home page without any errors logged. I never see in the logs a "[PluggableAuth] Authenticated existing user: ..." line from PluggableAuthLogin.php execute function near the top of that file.

I assume that the code is working fine and that I have something wrong in my config. Maybe my authsource? I am at a place where I am just going to have to let this go. If you have anything to add that might help I will be grateful. Thanks again for all your efforts!

'default-sp' => array(

'saml:SP',

'RelayState' => 'https://domain.com:443/wiki/Main_Page',

'privatekey' => 'saml.pem',

'certificate' => 'saml.crt',

'sign.authnrequest' => true,

'sign.logout' => true,

'validate.logout' => true,

// The entity ID of this SP. // Can be NULL/unset, in which case an entity ID is generated based on the metadata URL.

'entityID' => null,

// The entity ID of the IdP this should SP should contact. // Can be NULL/unset, in which case the user will be shown a list of available IdPs.

'idp' => 'my.idp.url',

// The URL to the discovery service. // Can be NULL/unset, in which case a builtin discovery service will be used.

'discoURL' => null,

... The rest of the settings in the array are left commented out...

), Whitechad (talk) 16:58, 25 January 2019 (UTC)Reply

That is so odd. You could try putting debugging statements inside the try clause just before and after the call to requireAuth to see if it makes it past that statement. If it does not get to the statement after, something is going wrong in requireAuth. I'm assuming that you have tested your simpleSAMLphp installation as described at https://simplesamlphp.org/docs/stable/simplesamlphp-sp#section_5. Cindy.cicalese (talk) 23:57, 25 January 2019 (UTC)Reply

After lots more debugging and tracing code, I finally discovered that the state was not being saved. I setup sqlite and that problem went away. Phew! Now I have one problem left that none of the solutions I can find elsewhere are solving. I can get authenticated and a new account is created and logged in, but just after

https://domain.com/simplesaml/www/module.php/saml/sp/saml2-acs.php/default-sp

is loaded the location is set to

https://domain.com:80/wiki/Special:PluggableAuthLogin.

I can't figure out why it is getting port 80 appended to the url. I have my baseurlpath set with https and no port number (adding the port seems to throw an error). I set the RelayState in my default-sp with https and with the port as 443. I can't figure out what I have misconfigured to cause this. Any ideas? Whitechad (talk) 23:26, 30 January 2019 (UTC)Reply

I figured out the issue with port 80. I needed to put in a baseURL in the config filein addition to the baseurlpath. Hopefully this info will help someone out. Whitechad (talk) 22:23, 1 February 2019 (UTC)Reply

Excellent! I'm glad you got it working! Cindy.cicalese (talk) 16:16, 3 February 2019 (UTC)Reply

PluggableAuth & Symfony

Latest comment: 7 years ago6 comments2 people in discussion

Good evening,

First off, I'd like to thank you for your work on this plugin. It's a lot easier to work with this than try to understand MediaWiki's documentation for their AuthManager. That being said, however, I am still having issues getting this plugin to work properly. I've got my AuthProvider subclass pulling the necessary information from Symfony's security token and passing it to the authorize function (and PluggableAuth confirming that the user is authorized in debug), but I still receive the error: "Login failed in primary authentication by PluggableAuthPrimaryAuthenticationProvider". There also seems to be numerous messages about the session data being dirty, but I'm not sure if that's relevant or normal operation.

I've gone ahead and just set the authorize function to pass static information to PluggableAuth (id null, and username, email, and real name all set to strings) to simply test, and receive the same issue as before. Would you be able to provide any insight to what may be going on? I can send you a complete log if necessary. Hlcounterstrike (talk) 20:52, 7 March 2019 (UTC)Reply

Thank you for your kind words.

Yes, seeing the log would be helpful, especially the part before the error. The message about the session data being dirty is normal. It is interesting that even your static test is failing. Could you please also provide the code you are using for the authenticate function? Cindy.cicalese (talk) 13:25, 8 March 2019 (UTC)Reply

I appreciate the help on this matter.


IP: (Redacted)
Start request GET /university/wiki/index.php?title=Special:UserLogin
HTTP HEADERS:
ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
ACCEPT-ENCODING: gzip, deflate, br
ACCEPT-LANGUAGE: en-US,en;q=0.9
CONNECTION: keep-alive
DNT: 1
HOST: new.certainty3d.com
REFERER: https://new.certainty3d.com/university/wiki/
UPGRADE-INSECURE-REQUESTS: 1
USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927707 will be used for SqlBagOStuff
[session] SessionBackend "e60eer465i25v3(Redacted)" is unsaved, marking dirty in constructor
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=1 forcePersist=0
[cookie] already deleted setcookie: "certain1_wiki_session", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiUserID", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiToken", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "forceHTTPS", "", "1520520908", "/", "", "", "1"
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[session] SessionBackend "e60eer465i25v3(Redacted)" force-persist due to persist()
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=0 metaDirty=1 forcePersist=1
[cookie] setcookie: "certain1_wiki_session", "e60eer465i25v3(Redacted)", "0", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiUserID", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiToken", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "forceHTTPS", "", "1520520908", "/", "", "", "1"
[session] SessionBackend "e60eer465i25v3(Redacted)" Taking over PHP session
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=0 metaDirty=1 forcePersist=1
[cookie] already set setcookie: "certain1_wiki_session", "e60eer465i25v3(Redacted)", "0", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiUserID", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "certain1_wikiToken", "", "1520520908", "/", "", "1", "1"
[cookie] already deleted setcookie: "forceHTTPS", "", "1520520908", "/", "", "", "1"
[SQLBagOStuff] Connection 5927707 will be used for SqlBagOStuff
[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache
Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform
Parser: using preprocessor: Preprocessor_DOM
Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): LoginSignupSpecialPage->execute/SpecialUserLogin->getToken/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
QuickTemplate::__construct was called with no Config instance passed to it
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[authentication] MediaWiki\Auth\LegacyHookPreAuthenticationProvider::testForAuthentication: No username in $reqs, skipping hooks
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): MediaWiki\Auth\ThrottlePreAuthenticationProvider->testForAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->beginAuthentication/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[authentication] Primary login with PluggableAuthPrimaryAuthenticationProvider returned REDIRECT
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): MediaWiki\Auth\AuthManager->beginAuthentication/MediaWiki\Auth\AuthManager->continueAuthentication/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
MediaWiki::preOutputCommit: primary transaction round committed
MediaWiki::preOutputCommit: pre-send deferred updates completed
MediaWiki::preOutputCommit: LBFactory shutdown completed
OutputPage::sendCacheControl: private caching;  **
Request ended normally
[session] Saving all sessions on shutdown
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
wfClientAcceptsGzip: client accepts gzip.
MediaWiki\OutputHandler::handleGzip() is compressing output
IP: (Redacted)
Start request GET /university/wiki/index.php?title=Special:PluggableAuthLogin
HTTP HEADERS:
ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
ACCEPT-ENCODING: gzip, deflate, br
ACCEPT-LANGUAGE: en-US,en;q=0.9
CONNECTION: keep-alive
COOKIE: certain1_wiki_session=e60eer465i25v3(Redacted)
DNT: 1
HOST: new.certainty3d.com
REFERER: https://new.certainty3d.com/university/wiki/
UPGRADE-INSECURE-REQUESTS: 1
USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[session] Session "e60eer465i25v3(Redacted)" requested without UserID cookie
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927710 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[PluggableAuth] In execute()
[PluggableAuth] Getting PluggableAuth singleton
[PluggableAuth] Class name: SymfonyAuthProvider
[AuthBridge] [Auth] Begin Symfony Authentication
[SQLBagOStuff] Connection 5927710 will be used for SqlBagOStuff
[PluggableAuth] Authenticated existing user: David
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[PluggableAuth] User is authorized.
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
MediaWiki::preOutputCommit: primary transaction round committed
MediaWiki::preOutputCommit: pre-send deferred updates completed
MediaWiki::preOutputCommit: LBFactory shutdown completed
Unstubbing $wgLang on call of $wgLang::hasVariants from OutputPage->sendCacheControl
User: loading options for user 1 from override cache.
OutputPage::sendCacheControl: private caching;  **
Request ended normally
[session] Saving all sessions on shutdown
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
wfClientAcceptsGzip: client accepts gzip.
MediaWiki\OutputHandler::handleGzip() is compressing output
IP: (Redacted)
Start request GET /university/wiki/index.php?title=Special:UserLogin/return&wpLoginToken=12d309e7fd6254f15e36088b(Redacted)
HTTP HEADERS:
ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
ACCEPT-ENCODING: gzip, deflate, br
ACCEPT-LANGUAGE: en-US,en;q=0.9
CONNECTION: keep-alive
COOKIE: certain1_wiki_session=e60eer465i25v3(Redacted)
DNT: 1
HOST: new.certainty3d.com
REFERER: https://new.certainty3d.com/university/wiki/
UPGRADE-INSECURE-REQUESTS: 1
USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[session] Session "e60eer465i25v3(Redacted)" requested without UserID cookie
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927712 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): AuthManagerSpecialPage->handleReturnBeforeExecute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
MediaWiki::preOutputCommit: primary transaction round committed
MediaWiki::preOutputCommit: pre-send deferred updates completed
MediaWiki::preOutputCommit: LBFactory shutdown completed
Unstubbing $wgLang on call of $wgLang::hasVariants from OutputPage->sendCacheControl
OutputPage::sendCacheControl: private caching;  **
Request ended normally
[session] Saving all sessions on shutdown
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
wfClientAcceptsGzip: client accepts gzip.
MediaWiki\OutputHandler::handleGzip() is compressing output
IP: (Redacted)
Start request GET /university/wiki/index.php?title=Special:UserLogin
HTTP HEADERS:
ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
ACCEPT-ENCODING: gzip, deflate, br
ACCEPT-LANGUAGE: en-US,en;q=0.9
CONNECTION: keep-alive
COOKIE: certain1_wiki_session=e60eer465i25v3(Redacted)
DNT: 1
HOST: new.certainty3d.com
REFERER: https://new.certainty3d.com/university/wiki/
UPGRADE-INSECURE-REQUESTS: 1
USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[session] Session "e60eer465i25v3(Redacted)" requested without UserID cookie
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927714 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): AuthManagerSpecialPage->handleReturnBeforeExecute/MediaWiki\Auth\AuthManager->removeAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[SQLBagOStuff] Connection 5927714 will be used for SqlBagOStuff
[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache
Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform
Parser: using preprocessor: Preprocessor_DOM
Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct
QuickTemplate::__construct was called with no Config instance passed to it
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->continuePrimaryAuthentication/MediaWiki\Auth\AuthManager->removeAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty
[authentication] Login failed in primary authentication by PluggableAuthPrimaryAuthenticationProvider
[session] SessionBackend "e60eer465i25v3(Redacted)" data dirty due to dirty(): AuthManagerSpecialPage->handleFormSubmit/AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->continueAuthentication/MediaWiki\Session\Session->remove/MediaWiki\Session\SessionBackend->dirty
[session] SessionBackend "e60eer465i25v3(Redacted)" save: dataDirty=1 metaDirty=0 forcePersist=0
[authevents] Login attempt
QuickTemplate::__construct was called with no Config instance passed to it
MediaWiki::preOutputCommit: primary transaction round committed
MediaWiki::preOutputCommit: pre-send deferred updates completed
MediaWiki::preOutputCommit: LBFactory shutdown completed
OutputPage::sendCacheControl: private caching;  **
Request ended normally
[session] Saving all sessions on shutdown
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
wfClientAcceptsGzip: client accepts gzip.
MediaWiki\OutputHandler::handleGzip() is compressing output
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[caches] LocalisationCache: using store LCStoreDB
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927717 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[SQLBagOStuff] Connection 5927717 will be used for SqlBagOStuff
[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927719 will be used for SqlBagOStuff
[SQLBagOStuff] Connection 5927719 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[caches] cluster: SqlBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: SqlBagOStuff, session: SqlBagOStuff
[caches] LocalisationCache: using store LCStoreDB
[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.
[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {
"IPAddress": "(Redacted)",
"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.121 Safari\/537.36",
"ChronologyProtection": false,
"ChronologyPositionIndex": 0,
"ChronologyClientId": null
}
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.
[SQLBagOStuff] Connection 5927721 will be used for SqlBagOStuff
[SQLBagOStuff] Connection 5927721 will be used for SqlBagOStuff
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.
[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database 'localhost'.

My authenticate function after testing with passing static data:


public function authenticate(&$id, &$username, &$realname, &$email, &$errorMessage){
      wfDebugLog( 'AuthBridge', '[Auth] Begin Symfony Authentication');
      // Let's set up an error message. Upon error, this should be
      // overwritten, so if we hard-fail we can provide an accurate
      // reason as to why.
      $errorMessage = 'error-unknown';
      $params = [];
      $id = null;
      $username = $email = 'email@email.com';
      $realname = 'David';
      return true;
}

Hlcounterstrike (talk) 15:18, 8 March 2019 (UTC)Reply

I don't see anything obviously and definitively wrong, but I do have several questions.

Which version of PluggableAuth are you using?

In your static test, I believe you should use a username that does not have a '@' in it. Also, if the user already exists, you should set $id to the user ID of that user.

It is odd that you get:

[PluggableAuth] User is authorized.

with no indication of an error after it, but you then get:

[authentication] Login failed in primary authentication by PluggableAuthPrimaryAuthenticationProvider

later. The fact that you are setting $errorMessage to something other than null should cause an error, actually, but you should also see an error message. That's why I'm wondering if you're using an older version of PluggableAuth. Cindy.cicalese (talk) 17:14, 12 March 2019 (UTC)Reply

I set up a brand new wiki to test some things. I had the errormessage being overwritten in my authentication class, so I've gone and removed that so Pluggable would give me errors. The login form is now giving me the error: "Auto-creation of a local account failed: You have not specified a valid username". I plugged in testing1 for the username (which should be valid by any means) in the static authentication function, but that didn't seem to do much. I've also gone and manually traced through some of PluggableAuthPrimaryAuthenticationProvider and it seems to be running User::newFromName just fine (and returning a valid user object) so I don't know where the issue lies.

I think I'd grabbed the latest version of PluggableAuth. The extension.json says 5.6.

I was trying to test the autocreation of the user in the static function I had set up, but did attempt to manually set the ID to an existing user to see if logging in to an existing user would work. Didn't seem to in my initial test. Hlcounterstrike (talk) 17:16, 12 March 2019 (UTC)Reply

So I think what may have been causing all of these problems was having that error message set.

I didn't immediately see changes because of caching, but it seems to be working now in the new test wiki I had set up. I'll let you know if it gets resolved. Hlcounterstrike (talk) 17:49, 12 March 2019 (UTC)Reply

PluggableAuth - IIS

Latest comment: 7 years ago3 comments3 people in discussion

MediaWiki Verison: 1.31

PHP Version: 7.2.1

Web Server: IIS

Good Afternoon,

I have recently installed the above. In order to have this setup correctly I am looking to have it so that only users with the correct AD group can access it AND so that when they do access it they are logged in automatically.

I have been looking at the LDAP hub to try and understand what is required to achieve this but it's all quite confusing.

Before I start installing extentions I wanted clarification on this particular extention.

Am I right in understanding that this extension is primarily used to allow users to login automatically? If so, would authenticating via a windows prompt (Windows Authentication, Basic Authentication) be applicable to this?

Based on the configuration items listed I don't fully understand how it would pass the login variables set via Windows prompt or alternative method.

Lastly am I also correct in saying that an alternative plugin would be required that prevents users from accessing the application if they do not have the required groups? Watcher91 (talk) 15:36, 25 April 2019 (UTC)Reply

> Am I right in understanding that this extension is primarily used to allow users to login automatically?

The extension is used to integrate with a external authentication provider. It is possible to configure the extension (using the $wgPluggableAuth_EnableAutoLogin configuration variable) so that the authentication workflow is initiated automatically, rather than having the user have to click on the Login link.

> If so, would authenticating via a windows prompt (Windows Authentication, Basic Authentication) be applicable to this?

I'm not familiar with the Windows environment from this perspective. Depending upon how you have your external authentication provider configured, it is possible that, if the user is already logged in to the environment, the authentication will happen without requiring additional interaction from the user.

> Based on the configuration items listed I don't fully understand how it would pass the login variables set via Windows prompt or alternative method.

If you use Azure ADFS, you might be interested in using this extension, PluggableAuth, with the OpenIDConnect extension (see Extension:OpenID Connect#Example: Using it against Azure ADFS). Authenticating with Azure may also be possible with Extension:SimpleSAMLphp, but I'm not sure of the configuration for that. @Osnard may be able to help you with that.

> Lastly am I also correct in saying that an alternative plugin would be required that prevents users from accessing the application if they do not have the required groups?

Yes, PluggableAuth separates the process of proving who you are (authentication) from determining what you have access to (authorization). Extension:SimpleSAMLphp does provide this additional functionality for controlling access by groups. Cindy.cicalese (talk) 12:44, 26 April 2019 (UTC)Reply

MS Azure AD can act as a SAML IdP, so Extension:SimpleSAMLphp can also be used. Osnard (talk) 06:22, 30 April 2019 (UTC)Reply

simplesamlphp works fine by itself but SSO doesn't

Latest comment: 7 years ago5 comments3 people in discussion

I badly need support because after a month of trial and errors I am out of resources.

I am working in a bank environment, trying to let bank users - properly logged in the bank intranet - to access an external Mediawiki hosted on Internet by SSO .

The situation is as follows:

I set up and configured simplesamlphp. If a bank employee calls <server>/simplesaml and uses the "test authentication sources" feature he/she retrieves properly the authentication data
however, if the person clicks on the button "Accedi with SSO" - that calls or should call PluggableAuth, nothing happens

I am quite sure the problem relies on Mediawiki configuration and perhaps I am not understanding properly how the system should work.

Both extensions are installed

PluggableAuth 5.6 (cdeff81)12:18, 11 ott 2018

SimpleSAMLphp 4.2 (72b213a)12:57, 11 ott 2018

In LocalSettings there are the following lines

$wgPluggableAuth_EnableAutoLogin = true;

$wgPluggableAuth_EnableLocalLogin = true;

$wgPluggableAuth_EnableLocalProperties = false;

$wgPluggableAuth_ButtonLabel = 'Accedi con SSO';

$wgPluggableAuth_ExtraLoginFields = [];

$wgSimpleSAMLphp_InstallDir = '/var/simplesamlphp';

$wgSimpleSAMLphp_AuthSourceId = 'url'; // this is the IP provider URL

$wgSimpleSAMLphp_RealNameAttribute = 'RealNameAttribute';

$wgSimpleSAMLphp_EmailAttribute ='EmailAttribute';

$wgSimpleSAMLphp_UsernameAttribute = 'UsernameAttribute';

The mediawiki log file lists the following errors

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[session] Session "a68mahldoabm6k6sh07lcoudfd8hm8dg" requested without UserID cookie

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: connected to database 0 at 'localhost'.

[SQLBagOStuff] Connection 2998 will be used for SqlBagOStuff

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

// I have translated here the error message into Italian

[SimpleSAMLphp] Errore con la fonte di autenticazione URL

[PluggableAuth] Authentication failure.

[PluggableAuth] ERROR: Errore con la fonte di autenticazione URL

[CryptRand] 0 bytes of randomness leftover in the buffer.

[session] SessionBackend "a68mahldoabm6k6sh07lcoudfd8hm8dg" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "a68mahldoabm6k6sh07lcoudfd8hm8dg" save: dataDirty=1 metaDirty=0 forcePersist=0

[DBPerformance] Expectation (writes <= 0) by MediaWiki::main not met (actual: 1):

query-m: REPLACE INTO `mw_objectcache` (keyname,value,exptime) VALUES ('X')

....

[error] [163ff528cec15b488ce720df] /dario/index.php/Speciale:PluggableAuthLogin ErrorException from line 78 of /var/www/html/dario/extensions/PluggableAuth/includes/PluggableAuthLogin.php: PHP Warning: count(): Parameter must be an array or an object that implements Countable

Please help. Thanks in advance for your support

Here there are my contact info

Carlo Tognoni

Milano - ITALY

Carlo.tognoni (talk) 17:27, 10 May 2019 (UTC)Reply

My guess is that there is something wrong with the form of $wgSimpleSAMLphp_AuthSourceId. As far as I can tell, the error message is returned from the simpleSAMLphp library when it tries to instantiate class SimpleSAML\\Auth\\Simple passing in the value of $wgSimpleSAMLphp_AuthSourceId. Cindy.cicalese (talk) 18:51, 10 May 2019 (UTC)Reply

Thank you very much for your support.

I have checked $wgSimpleSAMLphp_AuthSourceId and it is configured exactly as the idp in the authsources.php file.

Simplesaml works fine: if I try to login with SSO being outside the bank network it asks me for credentials, as I could expect.

Inside the bank network, it sends back all the user attributes.

It seems that PluggableAuth doesn't call the authentication process or doesn't wait a time long enough to let the idp answer. Checking the network traffic, there is a delay of about 1 second before MediaWiki returns to the login page.

my email address is carlo.tognoni (at) ct2.it

I will appreciate if you could contact me privately for consultancy support - I need to solve this problem urgently

Thanks again

Carlo Carlo.tognoni (talk) 08:29, 13 May 2019 (UTC)Reply

@osnard would you have availability to help @Carlo.tognoni? Cindy.cicalese (talk) 16:26, 13 May 2019 (UTC)Reply

Yes, he already contacted me. Thanks! Osnard (talk) 14:08, 17 May 2019 (UTC)Reply

ldap connect error

Latest comment: 7 years ago3 comments2 people in discussion

RESOLVED

The version of PHP being used was not configured with LDAP support.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Hi there,

with mediawiki 1.32.1 and LDAPAUTH2, LDAPProvider and PluggableAuth I get the following error:

[ce213266bdb4764c1a89a825] /wiki/wikname/index.php/Spezial:PluggableAuthLogin Error from line 244 of /pathtowiki/extensions/LDAPProvider/src/PlatformFunctionWrapper.php: Call to undefined function ldap_connect()

I put the domain config settings in the json file and set the path in LocalSettings.php:

$LDAPProviderDomainConfigs="/etc/mediawiki/ldapprovider.json";

What is missing? Fluxxuskb (talk) 16:02, 4 June 2019 (UTC)Reply

It sounds like the version of PHP you are using was not configured with LDAP support. See https://www.php.net/manual/en/book.ldap.php. Cindy.cicalese (talk) 16:13, 4 June 2019 (UTC)Reply

ok thanks that is part of the problem. Fluxxuskb (talk) 16:42, 4 June 2019 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Do not show Login page

Latest comment: 7 years ago7 comments2 people in discussion

RESOLVED

PluggableAuth requires MediaWiki 1.29 or later in order to bypass the Login page.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Hi,

First of all many thanks for writing the PluggableAuth plugin, this is really nice! Within a day I've managed to write my own plugin to authenticate against our CAS server. This all works fine, I can properly login and logout and it also handles our mechanism for Authorization based on LDAP membership.

The only thing I have not managed to configure is the flow of logging in. I click on the "Log in" link, which returns the Mediawiki Login page when I see the default Mediawiki Login button and the Login with PluggableAuth button. Since we don't allow a login into Mediawiki via a local wiki account, the additional step to click on the PluggableAuth button is for us an extra click we would like to avoid (since there would only be one option). Is there a way to configure PluggableAuth to directly execute the step which would happen when clicking on Login with PluggableAuth without showing the login buttons to the user?

Best regards,

Martin

131.176.243.9 (talk) 12:56, 24 June 2019 (UTC)Reply

Hi, Martin.

Thank you for the positive feedback :-)

Bypassing the login page is the default behavior of PluggableAuth, as long as the plugin does not add any other fields to the login page to gather custom information (i.e. adding fields to $wgPluggableAuth_ExtraLoginFields will add fields to the login form). It is unclear, if your plugin is not adding fields, why your plugin does not bypass the login page. You could try to compare to one of the other plugins (e.g. Extension:OpenID Connect) to see if you are doing something different. The code in MediaWiki core to bypass the login form is at https://phabricator.wikimedia.org/source/mediawiki/browse/master/includes/specialpage/LoginSignupSpecialPage.php$305.

Cindy Cindy.cicalese (talk) 17:08, 24 June 2019 (UTC)Reply

Hi Cindy,

I had a look at the OpenID connector and I don't see anything weird in my own connector, I don't explicitly set $wgPluggableAuth_ExtraLoginFields. What I find strange is that above the "Log in with PluggableAuth" button, I still see the standard "Log in" button for Local logins. If I add explicitly $wgPluggableAuth_EnableLocalLogin = false; in my LocalSettings.php file the button stays. Just to test it, I've added this before and after loading the PluggableAuth extension. I see no difference in behavior. I use PluggableAuth for Mediawiki 1.27, since this is what is currently available for me to test, we don't have a server running yet with a newer version. Is the version maybe too old and is it missing features?

Martin 131.176.243.9 (talk) 14:33, 25 June 2019 (UTC)Reply

Ah, yes, the code to bypass the Login page was only added to MediaWiki core in MW 1.29. So, regardless of which version of the PluggableAuth extension you use (you should ideally use the most recent version to get most functionality/bug fixes), you will need to use a more recent version of MediaWiki. Cindy.cicalese (talk) 16:11, 25 June 2019 (UTC)Reply

Good to know that bypassing the Login page was only implemented in MW1.29. I've requested with the person in charge of the test installation to upgrade Mediawiki to the latest LTS version (1.31), which also requires PHP7, then I will test my plugin again and let you know if it all work as expected. Many thanks for your quick support!

Martin 131.176.243.9 (talk) 08:49, 26 June 2019 (UTC)Reply

Our server now runs WM1.31 (the latest LTS version) together with PHP7.1 and it all works great now. The Login page is not shown anymore when I click on the Login link. Thanks again for your help!

Martin 131.176.243.9 (talk) 11:05, 27 June 2019 (UTC)Reply

Excellent! Cindy.cicalese (talk) 14:51, 27 June 2019 (UTC)Reply

The discussion above is closed. Please do not modify it. No further edits should be made to this discussion.

Empty redirect URL

Latest comment: 6 years ago13 comments3 people in discussion

RESOLVED

Configuration issue. Not a problem with PluggableAuth.

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

Configured Mediawiki to use the simplesamlphp with PluggableAuth extensions. But getting blank page (url : wiki.domain.com/index.php?title=Special:PluggableAuthLogin) when try to access wiki.domain.com but working when access wiki.internal.domain.com

- My wiki lives at wiki.internal.domain.com, but is exposed to the world at wiki.domain.com

in both causes authentication is success.

Details :

Media wiki, PluggableAuth, Simplesamlphp version : 1.32.2

Configuration

$wgSimpleSAMLphp_InstallDir = "D:\home\site\wwwroot\simplesamlphp";

$wgSimpleSAMLphp_AuthSourceId = "aadwiki";

$wgSimpleSAMLphp_UsernameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name';

$wgSimpleSAMLphp_RealNameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // Real Name attribute

$wgSimpleSAMLphp_EmailAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // email address attribute

$wgGroupPermissions['*']['autocreateaccount'] = true;

code

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "167.220.26.111",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[PluggableAuth] Authenticated existing user: ravicv

[error] [ea50d7447bb7b57d1992ec8e] /index.php?title=Special:PluggableAuthLogin ErrorException from line 174 of D:\home\site\wwwroot\includes\Hooks.php: PHP Warning: Parameter 1 to SimpleSAMLphp::populateGroups() expected to be a reference, value given

#0 D:\home\site\wwwroot\includes\Hooks.php(174): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 D:\home\site\wwwroot\includes\Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#2 D:\home\site\wwwroot\extensions\PluggableAuth\includes\PluggableAuthLogin.php(44): Hooks::run(string, array)

#3 D:\home\site\wwwroot\includes\specialpage\SpecialPage.php(569): PluggableAuthLogin->execute(NULL)

#4 D:\home\site\wwwroot\includes\specialpage\SpecialPageFactory.php(568): SpecialPage->run(NULL)

#5 D:\home\site\wwwroot\includes\MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#6 D:\home\site\wwwroot\includes\MediaWiki.php(860): MediaWiki->performRequest()

#7 D:\home\site\wwwroot\includes\MediaWiki.php(517): MediaWiki->main()

#8 D:\home\site\wwwroot\index.php(42): MediaWiki->run()

#9 {main}

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth]

[PluggableAuth] ERROR: return to URL is null or empty Ravikzm (talk) 00:34, 10 July 2019 (UTC)Reply

could you file a bug for this in phabricator? ☠MarkAHershberger☢(talk)☣ 03:21, 10 July 2019 (UTC)Reply

You are using an old version of SimpleSAMLphp. That bug was fixed in version 4.4. The current version is 4.5. As best as I can tell from what you have above, you got REL1_32 from ExtensionDistributor, which corresponds to version 4.2. The more recent versions will work with MW 1.32. Cindy.cicalese (talk) 13:31, 10 July 2019 (UTC)Reply

Hi Cindy,

I have upgraded the PlugableAuth and Simplesamlphp to 5.7 and 4.5 respectively with MW 1.32.3. still I am seeing the same issue and getting "Fatal error authenticating user' message in UI.

also updated the SimpleSamlphp config to 1.17.4

Log

X-WAWS-UNENCODED-URL: /index.php?title=Special:PluggableAuthLogin

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" is unsaved, marking dirty in constructor

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531290464", "/", "", "", "1"

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "167.220.26.111",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[PluggableAuth] Authenticated existing user: ravicv

[SimpleSAMLphp] $wgSimpleSAMLphp_GroupMap is not an array

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth] ERROR: return to URL is null or empty

User: loading options for user 8944 from override cache.

[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache

Unstubbing $wgParser on call of $wgParser::getFreshParser from OutputPage->addWikiTextTitleInternal

Parser: using preprocessor: Preprocessor_DOM

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

MediaWiki::preOutputCommit: LBFactory shutdown completed

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): User->getEditToken/User->getEditTokenObject/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

User: loading options for user 8944 from override cache.

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

OutputPage::sendCacheControl: private caching; Ravikzm (talk) 14:40, 11 July 2019 (UTC)Reply

I have tried MW 1.33.0 and the issue persistent Ravikzm (talk) 17:20, 11 July 2019 (UTC)Reply

I see two errors there. The first is:

[SimpleSAMLphp] $wgSimpleSAMLphp_GroupMap is not an array

The second is:

[PluggableAuth] ERROR: return to URL is null or empty

When I have seen the second error, it is usually due to some underlying configuration error in the authentication library. I do see that you are able to authenticate the user, but the session has been cleared by the time you need to get the return to URL. It may be that the first error is causing the second error as a side effect. But, that seems somewhat unlikely (although I encourage you to fix that if you can - are you setting $wgSimpleSAMLphp_GroupMap or is it using its default value?). This seems to be a session-related error. Have you looked at Extension:SimpleSAMLphp#Known_Bugs? Cindy.cicalese (talk) 19:55, 11 July 2019 (UTC)Reply

I already verified the known bugs and changed to sql instead of phpsession when i got a infinite loop when authenticating with Azure AAD app.we do not have any group, so not set $wgSimpleSAMLphp_GroupMap and it using default Ravikzm (talk) 02:36, 12 July 2019 (UTC)Reply

I filed a bug and submitted a patch for the $wgSimpleSAMLphp_GroupMap warning: https://phabricator.wikimedia.org/T227956.

Regarding the null return to URL, I looked back at your original post and will restate the problem. You mention that logging in with wiki.internal.domain.com gives you a blank page (due to the null return to URL), but logging in with wiki.domain.com does not. The wiki lives at wiki.internal.domain.com, but is exposed to the world at wiki.domain.com. In both cases, you are actually logged in, even though you get the blank page. You can see that in the log:

[PluggableAuth] Authenticated existing user: ravicv

...

[PluggableAuth] User is authorized.

The null return to URL is an indication that the session got cleared or is inaccessible. I would capture the network response from the simpleSAMLphp library redirecting to PluggableAuthLogin, comparing between the access on the two different URLs. I'm wondering if there is an error in the simpleSAMLphp library configuration for the external URL where it is referring to the internal URL or something similar.

To give you some background, the workflow for authentication is as follows. Special:UserLogin redirects to Special:PluggableAuthLogin. The return to URL (the URL of the page to which you should return after authentication is complete) is saved in the session and then a redirect is done by the simpleSAMLphp library to the remote identity provider. When a response is received, the simpleSAMLphp library redirects back to Special:PluggableAuthLogin. The response is processed and then the return to URL is retrieved from the session for a redirect back to the correct page. What is happening here is that the URL is saved, but it is somehow inaccessible after the redirect back to Special:PluggableAuthLogin. The key seems to be the configuration related to the internal/external URLs. Cindy.cicalese (talk) 20:15, 13 July 2019 (UTC)Reply

when accessing the MW via external link (wiki.domain.com), the session ("wiki_session" [COOKIE: ARRAffinity=0e33341a591f61ae9bcf90304e488a9c9ec333dcd731e258d7545141a9e14669; wiki_session=j9v7futippng3mddd8676rmad5otusg7082] ) is not set and not sure from where the session name is picked (assuming based on DB name??). The wiki_session is set when I access the MW from wiki.internal.domain.com (see the logs below). Looks the missing session causing the problem.

In SimpleSamlPhp config, I haven't changed any thing related to sessions and configured to use Sqlite instead of PHPSession.

in Local settings I have the below configuration

## The protocol and server name to use in fully-qualified URLs

$wgServer = "https://wiki.domain.com";

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'SimpleSAMLphp' );

$wgSimpleSAMLphp_InstallDir = "D:\home\site\wwwroot\simplesamlphp";

$wgSimpleSAMLphp_AuthSourceId = "wiki";

$wgSimpleSAMLphp_UsernameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name';

$wgSimpleSAMLphp_RealNameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // Real Name attribute

$wgSimpleSAMLphp_EmailAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // email address attribute

$wgGroupPermissions['*']['autocreateaccount'] = true;

$wgUserrightsInterwikiDelimiter = "%";

$wgInvalidUsernameCharacters = "%:";

Wiki.domain.com log

IP: 1.1.1.1

Start request GET /index.php?title=Special:UserLogin

HTTP HEADERS:

CONTENT-TYPE:

CONTENT-LENGTH: 0

X-APPSERVICE-PROTO: https

X-FORWARDED-PROTO: https

X-ARR-SSL: 2048|256|C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA|C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=*.azurewebsites.net

X-FORWARDED-FOR: 1.1.1.1:37085

X-ORIGINAL-URL: /index.php?title=Special:UserLogin

WAS-DEFAULT-HOSTNAME: wiki.domain.com

X-SITE-DEPLOYMENT-ID: wikidomain

DISGUISED-HOST: wiki.domain.com

X-ARR-LOG-ID: b916f493-6952-4293-978d-4c59725928ce

CLIENT-IP: 1.1.1.1:37085

X-WAWS-UNENCODED-URL: /index.php?title=Special:UserLogin

UPGRADE-INSECURE-REQUESTS: 1

USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

REFERER: https://wiki.domain.com/

MAX-FORWARDS: 10

HOST: wiki.domain.com

COOKIE: ARRAffinity=0e33341a591f61ae9bcf90304e488a9c9ec333dcd731e258d7545141a9e14669

ACCEPT-LANGUAGE: en-US,en;q=0.9,ta;q=0.8

ACCEPT-ENCODING: gzip, deflate, br

ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

CONNECTION: Keep-Alive

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" is unsaved, marking dirty in constructor

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" force-persist due to persist()

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] setcookie: "wiki_session", "h06p6o4qts74nvdrf8j3goqf58a1778p", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" Taking over PHP session

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] already set setcookie: "wiki_session", "h06p6o4qts74nvdrf8j3goqf58a1778p", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache

Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform

Parser: using preprocessor: Preprocessor_DOM

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): LoginSignupSpecialPage->execute/SpecialUserLogin->getToken/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): MediaWiki\Auth\ThrottlePreAuthenticationProvider->testForAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): AuthManagerSpecialPage->performAuthenticationStep/MediaWiki\Auth\AuthManager->beginAuthentication/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): PluggableAuthPrimaryAuthenticationProvider->beginPrimaryAuthentication/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[authentication] Primary login with PluggableAuthPrimaryAuthenticationProvider returned REDIRECT

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): MediaWiki\Auth\AuthManager->beginAuthentication/MediaWiki\Auth\AuthManager->continueAuthentication/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=0 forcePersist=0

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "1.1.1.1",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

MediaWiki::preOutputCommit: LBFactory shutdown completed

OutputPage::sendCacheControl: private caching; **

[error] [1afd424d6312c4b62a65d370] /index.php?title=Special:UserLogin ErrorException from line 80 of D:\home\site\wwwroot\includes\libs\objectcache\WinCacheBagOStuff.php: PHP Warning: wincache_ucache_add(): function called with a key which already exists

#0 [internal function]: MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 D:\home\site\wwwroot\includes\libs\objectcache\WinCacheBagOStuff.php(80): wincache_ucache_add(string, string, integer)

#2 D:\home\site\wwwroot\includes\libs\objectcache\WANObjectCache.php(1385): WinCacheBagOStuff->add(string, integer, integer)

#3 D:\home\site\wwwroot\includes\libs\objectcache\WANObjectCache.php(1275): WANObjectCache->doGetWithSetCallback(string, integer, Closure, array)

#4 D:\home\site\wwwroot\includes\libs\rdbms\loadbalancer\LoadBalancer.php(1759): WANObjectCache->getWithSetCallback(string, integer, Closure, array)

#5 D:\home\site\wwwroot\includes\libs\rdbms\loadbalancer\LoadBalancer.php(1726): Wikimedia\Rdbms\LoadBalancer->masterRunningReadOnly(boolean, NULL)

#6 D:\home\site\wwwroot\includes\ReadOnlyMode.php(45): Wikimedia\Rdbms\LoadBalancer->getReadOnlyReason()

#7 D:\home\site\wwwroot\includes\ReadOnlyMode.php(29): ReadOnlyMode->getReason()

#8 D:\home\site\wwwroot\includes\GlobalFunctions.php(1199): ReadOnlyMode->isReadOnly()

#9 D:\home\site\wwwroot\includes\MediaWiki.php(962): wfReadOnly()

#10 D:\home\site\wwwroot\includes\MediaWiki.php(912): MediaWiki->triggerJobs()

#11 D:\home\site\wwwroot\includes\MediaWiki.php(731): MediaWiki->restInPeace(string, boolean)

#12 D:\home\site\wwwroot\includes\MediaWiki.php(754): MediaWiki->{closure}()

#13 D:\home\site\wwwroot\includes\MediaWiki.php(548): MediaWiki->doPostOutputShutdown(string)

#14 D:\home\site\wwwroot\index.php(42): MediaWiki->run()

#15 {main}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBQuery] PRAGMA case_sensitive_like = 1

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[DBQuery] SELECT DISTINCT job_cmd FROM job WHERE job_cmd IN ('deletePage','refreshLinks','deleteLinks','htmlCacheUpdate','sendMail','enotifNotify','fixDoubleRedirect','AssembleUploadChunks','PublishStashedFile','ThumbnailRender','recentChangesUpdate','refreshLinksPrioritized','refreshLinksDynamic','activityUpdateJob','categoryMembershipChange','clearUserWatchlist','cdnPurge','userGroupExpiry','clearWatchlistNotifications','enqueue','null')

Request ended normally

[session] Saving all sessions on shutdown

[DBConnection] Wikimedia\Rdbms\LoadBalancer::closeAll: closing connection to database ''.

IP: 1.1.1.1

Start request GET /index.php?title=Special:PluggableAuthLogin

HTTP HEADERS:

CONTENT-TYPE:

CONTENT-LENGTH: 0

X-APPSERVICE-PROTO: https

X-FORWARDED-PROTO: https

X-ARR-SSL: 2048|256|C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 2|CN=wiki.internal.domain.com

X-FORWARDED-FOR: 1.1.1.1:45361

X-ORIGINAL-URL: /index.php?title=Special:PluggableAuthLogin

WAS-DEFAULT-HOSTNAME: wiki.domain.com

X-SITE-DEPLOYMENT-ID: wikidomain

DISGUISED-HOST: wiki.internal.domain.com

X-ARR-LOG-ID: a4befab0-841b-48e2-b57f-55835085f27f

CLIENT-IP: 1.1.1.1:45361

X-WAWS-UNENCODED-URL: /index.php?title=Special:PluggableAuthLogin

UPGRADE-INSECURE-REQUESTS: 1

USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

REFERER: https://wiki.domain.com/

MAX-FORWARDS: 10

HOST: wiki.internal.domain.com

ACCEPT-LANGUAGE: en-US,en;q=0.9,ta;q=0.8

ACCEPT-ENCODING: gzip, deflate, br

ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

CONNECTION: Keep-Alive

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "5dbtjn52abbif1bim6tlr00ah9nb7cje" is unsaved, marking dirty in constructor

[session] SessionBackend "5dbtjn52abbif1bim6tlr00ah9nb7cje" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531777144", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777144", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777144", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777144", "/", "", "", "1"

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[session] Saving all sessions on shutdown

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "1.1.1.1",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

IP: 1.1.1.1

Start request GET /index.php?title=Special:PluggableAuthLogin

HTTP HEADERS:

CONTENT-TYPE:

CONTENT-LENGTH: 0

X-APPSERVICE-PROTO: https

X-FORWARDED-PROTO: https

X-ARR-SSL: 2048|256|C=US, S=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 2|CN=wiki.internal.domain.com

X-FORWARDED-FOR: 1.1.1.1:45361

X-ORIGINAL-URL: /index.php?title=Special:PluggableAuthLogin

WAS-DEFAULT-HOSTNAME: wiki.domain.com

X-SITE-DEPLOYMENT-ID: wikidomain

DISGUISED-HOST: wiki.internal.domain.com

X-ARR-LOG-ID: 9daa4ec8-41bc-43fa-9f02-acac7ef69dd1

CLIENT-IP: 1.1.1.1:45361

X-WAWS-UNENCODED-URL: /index.php?title=Special:PluggableAuthLogin

UPGRADE-INSECURE-REQUESTS: 1

USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

REFERER: https://login.microsoftonline.com/

MAX-FORWARDS: 10

HOST: wiki.internal.domain.com

COOKIE: SimpleSAMLSessionID=17cef629e8bfe6dc232d330074fd09c4; ARRAffinity=0e33341a591f61ae9bcf90304e488a9c9ec333dcd731e258d7545141a9e14669; SimpleSAMLAuthToken=_e6cb7456688c1425b79ddc21fc7ddcb5b24ee09687

ACCEPT-LANGUAGE: en-US,en;q=0.9,ta;q=0.8

ACCEPT-ENCODING: gzip, deflate, br

ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

CONNECTION: Keep-Alive

CACHE-CONTROL: max-age=0

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" is unsaved, marking dirty in constructor

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531777155", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777155", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777155", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777155", "/", "", "", "1"

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "1.1.1.1",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

[DBQuery] PRAGMA case_sensitive_like = 1

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[DBQuery] BEGIN DEFERRED

[DBQuery] SELECT user_id FROM user WHERE user_name = 'ravicv' LIMIT 1

[PluggableAuth] Authenticated existing user: ravicv

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth] ERROR: return to URL is null or empty

User: loading options for user 8944 from override cache.

[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache

Unstubbing $wgParser on call of $wgParser::getFreshParser from OutputPage->addWikiTextTitleInternal

Parser: using preprocessor: Preprocessor_DOM

[DBQuery] COMMIT

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

MediaWiki::preOutputCommit: LBFactory shutdown completed

[DBQuery] BEGIN DEFERRED

[DBQuery] SELECT page_id,page_len,page_is_redirect,page_latest,page_restrictions,page_content_model,page_namespace,page_title FROM page WHERE (page_namespace = '2' AND page_title = 'ravicv') OR (page_namespace = '3' AND page_title = 'ravicv') OR (page_namespace = '4' AND page_title IN ('Privacy_policy','About','General_disclaimer') )

[DBQuery] SELECT user_id FROM user_newtalk WHERE user_id = '8944' LIMIT 1

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" data dirty due to dirty(): User->getEditToken/User->getEditTokenObject/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[DBQuery] SELECT page_namespace,page_title,page_touched,page_len,page_latest FROM page WHERE (page_namespace = '8' AND page_title IN ('Common.js','Vector.js') )

User: loading options for user 8944 from override cache.

[session] SessionBackend "lu2vrklorssss8p8ko3ijor4fuq2cp4og45k" save: dataDirty=1 metaDirty=0 forcePersist=0

OutputPage::sendCacheControl: private caching; **

[DBQuery] COMMIT

[error] [69cf47e20cdcde01af853bf4] /index.php?title=Special:PluggableAuthLogin ErrorException from line 80 of D:\home\site\wwwroot\includes\libs\objectcache\WinCacheBagOStuff.php: PHP Warning: wincache_ucache_add(): function called with a key which already exists