Jump to content

Help talk:OAuth

About this board

prefrences and oath?

AndreaDileva (talkcontribs)

i would like to know how to set my prefrences i looked in my history before and im bloked or i think i am because another ip is sharing my address and i have been thinking someone is using my ip address and email acct to do things i dont even know if this website is going to help me. can anyone give me advice?

AndreaDileva (talkcontribs)

i dont even know how to read your comment im sorry im learning how to use this sight

Tgr (WMF) (talkcontribs)
Reply to "prefrences and oath?"

Unable to get an access token

Dmytrodruppov (talkcontribs)

Could help to understand the issue? I am using this endpoint to get an access token https://www.wikidata.org/w/rest.php/oauth2/access_token?client_credentials=client_credentials and providing client id and client secret


"error": "access_denied",

"error_description": "The resource owner or authorization server denied the request.",

"hint": "Client 4ab9e80d07a34633cdeab291fd8ead6a is not usable by user with ID 0",

"message": "The resource owner or authorization server denied the request."


Tgr (WMF) (talkcontribs)
Reply to "Unable to get an access token"

Connecting Facebook to Wikipedia

White Gold AJ Gaspar (talkcontribs)
BDavis (WMF) (talkcontribs)
Reply to "Connecting Facebook to Wikipedia"

User login or registration with Oauth

Tribly (talkcontribs)

I would like to use Oauth to help people login or register on my wiki with sites such as Facebook, Twitter, Google, Microsoft etc. How do I go about that?

Tgr (WMF) (talkcontribs)
Reply to "User login or registration with Oauth"

Oauth2.0 JWT validation

Gam3 (talkcontribs)

What key is used to sign the JWT (Bearer Token) returned.

Tgr (WMF) (talkcontribs)

$wgOAuth2PrivateKey (as noted on the extension page).

Gam3 (talkcontribs)

That is the question I am asking. What is that variable set to by Wikipedia APi.

Tgr (WMF) (talkcontribs)

As the variable name might suggest, it's a private key.

Gam3 (talkcontribs)

And where can I find the public half of that key?

Tgr (WMF) (talkcontribs)

I don't think we are making it public. You are unlikely to need it, it's used by code that needs to authorize access based on OAuth grants.

In theory it could be made public though - if you have a use case, please file a task to discuss it.

Reply to "Oauth2.0 JWT validation"
Adam (Wiki Ed) (talkcontribs)

~Is there some clarification on where/why Oauth is disabled for blocked IPs. I'm seeing some failed login attempts for unblocked users operating on schoolblocked IPs and I want to know what the exact check is. thanks.

CSteipp (WMF) (talkcontribs)

Hi Adam, users shouldn't (can't) use OAuth to login-- the login api calls are explicitly disabled. Are you seeing failures when potential users are logging in to authorize the Consumer? Or is the Consumer's api calls failing, because it's running from a blocked IP?

Adam (Wiki Ed) (talkcontribs)

@CSteipp (WMF) thanks for the reply and sorry for not noticing it. I'm talking about the latter, (API calls failing). They're logged in or reported as much.

Tgr (WMF) (talkcontribs)

Blocking will work the same way for OAuth requests as normal requests (but keep in mind that the IP will be that of the server hosting the OAuth application, not the real user).

Some plans to make block handling more flexible are in T159889 and T110249.

RStPierre (talkcontribs)

I want to use batch processing in Quickstatements by I have this message : You can't create a new batch, because you are not autoconfirmed

Can someone help me obtain this confirmation. My account was created on november 1 and have made more than 30 contributions

BDavis (WMF) (talkcontribs)

d:Help:QuickStatements is probably a better place to get support for using the Quickstatements tool. I do see there a link to d:Wikidata:Autoconfirmed users which includes the text "Although the precise requirements for autoconfirmed status vary according to circumstances, most Wikidata user accounts that are more than four days old and have more than 50 edits are considered autoconfirmed." (talkcontribs)

Thank you BDavis

Reply to "Autoconfirmed users"

OAuth with no actions?

Dnaber (talkcontribs)

My application would like to know the usernames of Wikipedia users, so that people don't have to sign up for yet another service. It wouldn't actually run any action on Wikipedia. Does it make sense to use OAuth for that, or is there a better alternative?

Deskana (WMF) (talkcontribs)

Hi Dnaber,

You can retrieve a user's username using the API. The query you can use for this is: https://en.wikipedia.org/w/api.php?format=json&action=query&meta=userinfo

That said, I suspect what you're actually asking me is "Can my website somehow use OAuth as an authentication method, so that users can sign in using their Wikipedia credentials?". The answer to that is that you can, but you shouldn't. If it's being used for authentication, the OAuth protocol is susceptible to man-in-the-middle attacks. The use of HTTPS mitigates that somewhat, but the vulnerability is still theoretically there. We'd highly recommend not using OAuth for authentication.

We're exploring the possibility of making Wikimedia wikis an OpenID provider which would allow you to use Wikimedia credentials for authorisation. We don't know if or when we'll start working on that, though.

Please let me know if you need any more information.

This post was posted by Deskana (WMF), but signed as DGarry (WMF).

This post was hidden by Tgr (WMF) (history)
Tgr (WMF) (talkcontribs)

The above answer is now outdated. You can send an OAuth-authorized request to Special:OAuth/identify which will return user identity in a JWT (signed JSON token). As long as you properly validate the signature, this is safe and does not suffer from the vulnerability mentioned above.

Reply to "OAuth with no actions?"

Expected oauth_callback_confirmed

KermitLiu (talkcontribs)

I receive consumer key and secret key from wiki.

I have config consumer key and secret key in phabricator.

and callback url in wiki.

but the phabricator give me a exception :

Unhandled Exception (“Exception”)

Expected ‘oauth_callback_confirmed’ to be ‘true’!

could you give some help?

Tgr (WMF) (talkcontribs)

At a wild guess, poor error handling in your client library, which receives an error and tries to verify it as if it would be a valid token (in which case indeed it should have an oauth_callback_confirmed field).

KermitLiu (talkcontribs)

mediawiki as my wiki provider, phabricator as my consumer,

i use my wiki to try, https://github.com/wikimedia/mediawiki-oauthclient-php , demo directory , as my consumer, success.

and i add print commond, then the return parameter : key,secret, oauth_callback_confirmed .

but the phabricator as the cosumer, the phabricator give me a exception.

so, the wiki is wrong, or the phabricator is wrong?

KermitLiu (talkcontribs)
Tgr (WMF) (talkcontribs)

We use the same setup for Wikimedia's Phabritcator so it can't be that wrong. Again, my best guess is that I think you are getting an error (which can be caused by a lot of things, wrong token configuration, out-of-sync clock, cache problems...) and Phabricator does not show the error because it does not recognize it is an error. willProcessTokenRequestResponse seems to do the right thing so maybe your wiki is returning a fatal error. Check your logs to see if that's the case.

@MModell (WMF) might be able to provide more insight.

KermitLiu (talkcontribs)

thank you very much , i will try

MModell (WMF) (talkcontribs)

What url do you have set for the callback?

You need to specify the callback url like this:


Reply to "Expected oauth_callback_confirmed"

how do i search for application name with OAuth

2 (talkcontribs)

how do i search for application name with OAuth

Tgr (WMF) (talkcontribs)
Reply to "how do i search for application name with OAuth"