Depends on T399198: Define standard JWT session data for supported session types. Probably all we want to do here is replacing the OAuthClaimStoreGetClaims hook provided by the OAuth extension (and used in the OAuthRateLimiter extension) with the core hook mentioned in that task.
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | JTweed-WMF | T398815 WE5.1.2 Verifiable MediaWiki sessions | |||
| Resolved | Tgr | T399199 Update OAuth 2.0 sessions to include new JWT session data from core | |||
| Resolved | BUG REPORT | Tgr | T408721 test_identity test of oauth_tests.TestOauthLoginManager fails on wpbeta |
Event Timeline
Comment Actions
Change #1181282 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Fall back to core RSA keys
Comment Actions
Probably all we want to do here is replacing the OAuthClaimStoreGetClaims hook provided by the OAuth extension (and used in the OAuthRateLimiter extension) with the core hook mentioned in that task.
That actually doesn't really make sense, since we want to set the claim asking for a higher rate limit on OAuth requests specifically. If someone has e.g. paid Wikimedia Enterprise for higher API rate limits, we want their OAuth-authenticated API requests to have higher quotas, but their cookie-authenticated API or web requests not (or do we?).
More pragmatically, OAuthRateLimiter is based on per-client settings, it would be a lot of refactoring with no obvious gain to make it user-based instead.
Comment Actions
JWTs generated in T399200: Update existing cookie-based sessions to include JWT cookie look like this:
{
"exp": <timestamp>,
"iat": <timestamp>,
"iss": "<meta-url>",
"jti": "<random>",
"sub": "mw:CentralAuth::<central-id>",
"sxp": <timestamp>
}JWTs currently generated by OAuth 2 look like this:
{
"aud": [ "<client-id>" ],
"exp": <timestamp>,
"iat": <timestamp>,
"iss": "<current-wiki-url>",
"jti": "<random>", // used as oauth2_access_tokens.oaat_identifier in the DB
"nbf": <timestamp>,
"scopes": [ ... ],
"sub": "<central-id>"
}Some of the difference is normal and necessary (cookie-based sessions aren't associated with a client application so there is nothing useful to put into aud; they also don't have any concept of scopes; OAuth 2 has a well-defined process of replacing an invalid access token, which can be triggered from the edge with the right kind of error response, while for cookies an edge error would effectively block the user from doing anything including logging in), some is immaterial (the random nonces for jti have a different format; OAuth sets nbf even though it's the same as iat so it's pointless). The rest should ideally be unified though:
- We should be consistent in what wiki use as the issuer (the current wiki vs. the central wiki of the farm - the central wiki probably makes more sense). Currently we use whichever wiki was used for the authorization dialog or refresh request.
- OAuth sub is just the central user ID. SessionManager sub is mw:<CentralIdLookup scope>:<central user ID>. The latter is more robust, and can be used for throttling etc. on the edge without risk of confusing users of different wikis (when at least one is non-SUL).
If we make changes on the OAuth side, we need to ensure backwards compatibility - invalidating current accept tokens at once would be quite disruptive.
Comment Actions
Change #1181308 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] [WIP] Align access token JWT format with core
Comment Actions
Change #1181282 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Fall back to core RSA keys
Comment Actions
Change #1191860 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Use central wiki as access token issuer
Comment Actions
Change #1198712 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Use GetSessionJwtData hook for OAuth 2 access token JWT
Comment Actions
Change #1198713 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Accept SessionManager-style 'sub' claims in access token
Comment Actions
Change #1198714 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Issue SessionManager-style 'sub' claims for non-owner-only
Comment Actions
Change #1191860 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Use central wiki as access token issuer
Comment Actions
Proposed Tech News message:
- The JWT issuer field in OAuth 2 access tokens for SUL wikis has been changed to https://meta.wikimedia.org. Old access tokens will continue working.
- The JWT subject field in OAuth 2 access tokens will soon change from <user id> to mw:<identity type>:<user id> where <identity type> is typically CentralAuth: (for SUL wikis) or local:<wiki id> (for other wikis). This is to avoid conflicts between different user ID types, and to make OAuth 2 access tokens and the sessionJwt cookie more consistent. Old access tokens will continue to work.
Comment Actions
Change #1200329 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[mediawiki/extensions/OAuth@master] Use canonical server as OAuth 1 /identify endpoint JWT issuer
Comment Actions
Change #1200329 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Use canonical server as OAuth 1 /identify endpoint JWT issuer
Comment Actions
Change #1198712 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Use GetSessionJwtData hook for OAuth 2 access token JWT
Comment Actions
@Tgr user-notice was added and I am following up if this will this be useful to communicate via Tech News? If yes, how can we word it?
Comment Actions
Change #1198713 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Accept SessionManager-style 'sub' claims in access token
Comment Actions
Change #1198714 merged by jenkins-bot:
[mediawiki/extensions/OAuth@master] Issue SessionManager-style 'sub' claims for non-owner-only
Comment Actions
I added it to https://meta.wikimedia.org/wiki/Tech/News/2025/46, feel free to edit it. I added links to all the technical terms like all the terms like JWT, SUL, OAuth, but I'm not sure whether that's right.
Comment Actions
Change #1202766 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Use prefixed 'sub' field in OAuth 2 access tokens on beta & testwiki
Comment Actions
Change #1202768 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Use prefixed 'sub' field in OAuth 2 access tokens
Comment Actions
Change #1202766 merged by jenkins-bot:
[operations/mediawiki-config@master] Use prefixed 'sub' field in OAuth 2 access tokens on beta cluster
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-06T23:02:29Z] <cjming@deploy2002> Started scap sync-world: Backport for [[gerrit:1201826|Use wikimedia.org as the "server" for the wiki-agnostic RESTbase specs]], [[gerrit:1202766|Use prefixed 'sub' field in OAuth 2 access tokens on beta cluster (T399199)]], [[gerrit:1202807|Re-run xLab MW Module Loaded experiment v2 (T401705)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-06T23:04:47Z] <cjming@deploy2002> cjming, tgr, aaron: Backport for [[gerrit:1201826|Use wikimedia.org as the "server" for the wiki-agnostic RESTbase specs]], [[gerrit:1202766|Use prefixed 'sub' field in OAuth 2 access tokens on beta cluster (T399199)]], [[gerrit:1202807|Re-run xLab MW Module Loaded experiment v2 (T401705)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-06T23:11:02Z] <cjming@deploy2002> Finished scap sync-world: Backport for [[gerrit:1201826|Use wikimedia.org as the "server" for the wiki-agnostic RESTbase specs]], [[gerrit:1202766|Use prefixed 'sub' field in OAuth 2 access tokens on beta cluster (T399199)]], [[gerrit:1202807|Re-run xLab MW Module Loaded experiment v2 (T401705)]] (duration: 08m 34s)
Comment Actions
Change #1181308 abandoned by Gergő Tisza:
[mediawiki/extensions/OAuth@master] [WIP] Align access token JWT format with core
Reason:
Ended up implementing it in a different way than what was sketched out here, will see how well it works out.
Comment Actions
Change #1202768 merged by jenkins-bot:
[operations/mediawiki-config@master] Use prefixed 'sub' field in OAuth 2 access tokens
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-19T14:58:45Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1202768|Use prefixed 'sub' field in OAuth 2 access tokens (T399199)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-19T15:03:37Z] <tgr@deploy2002> tgr: Backport for [[gerrit:1202768|Use prefixed 'sub' field in OAuth 2 access tokens (T399199)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-11-19T15:15:29Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1202768|Use prefixed 'sub' field in OAuth 2 access tokens (T399199)]] (duration: 16m 43s)