Help talk:OAuth

Previous page history was archived for backup purposes at Help talk:OAuth/LQT Archive 1 on 2015-06-25.

~Is there some clarification on where/why Oauth is disabled for blocked IPs. I'm seeing some failed login attempts for unblocked users operating on schoolblocked IPs and I want to know what the exact check is. thanks.

Hi Adam, users shouldn't (can't) use OAuth to login-- the login api calls are explicitly disabled. Are you seeing failures when potential users are logging in to authorize the Consumer? Or is the Consumer's api calls failing, because it's running from a blocked IP?

@CSteipp (WMF) thanks for the reply and sorry for not noticing it. I'm talking about the latter, (API calls failing). They're logged in or reported as much.

Blocking will work the same way for OAuth requests as normal requests (but keep in mind that the IP will be that of the server hosting the OAuth application, not the real user).

Some plans to make block handling more flexible are in T159889 and T110249.

I want to use batch processing in Quickstatements by I have this message : You can't create a new batch, because you are not autoconfirmed

Can someone help me obtain this confirmation. My account was created on november 1 and have made more than 30 contributions

d:Help:QuickStatements is probably a better place to get support for using the Quickstatements tool. I do see there a link to d:Wikidata:Autoconfirmed users which includes the text "Although the precise requirements for autoconfirmed status vary according to circumstances, most Wikidata user accounts that are more than four days old and have more than 50 edits are considered autoconfirmed."

Thank you BDavis

My application would like to know the usernames of Wikipedia users, so that people don't have to sign up for yet another service. It wouldn't actually run any action on Wikipedia. Does it make sense to use OAuth for that, or is there a better alternative?

Hi Dnaber,

You can retrieve a user's username using the API. The query you can use for this is: https://en.wikipedia.org/w/api.php?format=json&action=query&meta=userinfo

That said, I suspect what you're actually asking me is "Can my website somehow use OAuth as an authentication method, so that users can sign in using their Wikipedia credentials?". The answer to that is that you can, but you shouldn't. If it's being used for authentication, the OAuth protocol is susceptible to man-in-the-middle attacks. The use of HTTPS mitigates that somewhat, but the vulnerability is still theoretically there. We'd highly recommend not using OAuth for authentication.

We're exploring the possibility of making Wikimedia wikis an OpenID provider which would allow you to use Wikimedia credentials for authorisation. We don't know if or when we'll start working on that, though.

Please let me know if you need any more information.

This post was posted by Deskana (WMF), but signed as DGarry (WMF).

The above answer is now outdated. You can send an OAuth-authorized request to Special:OAuth/identify which will return user identity in a JWT (signed JSON token). As long as you properly validate the signature, this is safe and does not suffer from the vulnerability mentioned above.

I receive consumer key and secret key from wiki.

I have config consumer key and secret key in phabricator.

and callback url in wiki.

but the phabricator give me a exception :

Unhandled Exception (“Exception”)

Expected ‘oauth_callback_confirmed’ to be ‘true’!

could you give some help?

At a wild guess, poor error handling in your client library, which receives an error and tries to verify it as if it would be a valid token (in which case indeed it should have an oauth_callback_confirmed field).

mediawiki as my wiki provider, phabricator as my consumer,

i use my wiki to try, https://github.com/wikimedia/mediawiki-oauthclient-php , demo directory , as my consumer, success.

and i add print commond, then the return parameter ： key,secret, oauth_callback_confirmed .

but the phabricator as the cosumer, the phabricator give me a exception.

so, the wiki is wrong, or the phabricator is wrong?

the library use https://github.com/wikimedia/phabricator-extensions

We use the same setup for Wikimedia's Phabritcator so it can't be that wrong. Again, my best guess is that I think you are getting an error (which can be caused by a lot of things, wrong token configuration, out-of-sync clock, cache problems...) and Phabricator does not show the error because it does not recognize it is an error. willProcessTokenRequestResponse seems to do the right thing so maybe your wiki is returning a fatal error. Check your logs to see if that's the case.

@MModell (WMF) might be able to provide more insight.

thank you very much , i will try

What url do you have set for the callback?

You need to specify the callback url like this:

https://your.phabricator.url/auth/login/mediawiki:/

how do i search for application name with OAuth

You can get a list via Special:OAuthListConsumers. Search capabilities are very limited though.

If I grant OAuth access to "Library Card", I will apparently share my e-mail address with it. I'm obviously fine with one WMF project seeing the e-mail address I use on another WMF project, but does this mean my e-mail address is shared with The Wikipedia Library partner companies? What other info is shared with these companies? The privacy policy link only leads to the general WMF privacy policy.

This is a question specific to the particular OAuth Application and not the general OAuth service. It can only be answered by someone with knowledge of the application itself. I believe that the "Data Retention and Handling" section https://wikipedialibrary.wmflabs.org/terms/ covers your question, but I encourage you to contact the project directly if you have further concerns.

Checking my "Manage connected applications" page after having been notified of a failed login attempt under a new device I have found out that a "Library Card [1.6]" (Publisher: Jsn.sherman) is connected to my account by using the OAuth protocol. Could somebody pls. advise me what this means? Thanks. ~~~~

That you have at some point logged into The Wikipedia Library Card Platform, and as part of the process authorized it to read your identity and email address on the Wikimedia sites. It's not related to failed logins in any way.

Hi,

I plan to show how to use mix'n'match to a group of newbies and I want to know if there's restrictions for using OAuth for new accounts (like "only autoconfirmed shall pass").

There are no restrictions to users (see that — new acc, no edits, no flags), but developers of tools might add any restrictions in own source code. Sorry for my English.

There might be unintentional limitations coming from the fact that requests through that tool all use the same IP. So if something has an IP-level rate limit for non-autoconfirmed accounts (and several things do, e.g. 8 edits per minute), that will apply. Although for an IRL presentation with everyone using the same internet connection, such limitations would apply to non-OAuth actions as well.

@Magnus Manske: Do it is the case with mix'n'match ?

So, how do I register my application? It seems like that's a thing that should be mentioned on the Help page...

Never mind, found it, and added to the Help page.

Hi Magnus,

Thanks for adding that link. It's possible I might make a help page for OAuth developers in the future which we can put that on, but for now I think it's helpful to have on the main help page.

Your application's already been approved. Let me know if I can help more.

This post was posted by Deskana (WMF), but signed as DGarry (WMF).

Ok thanx

I registered this application on 20 June, is there any thing I need to do to get an approval?

You can just use it, but it is currently not useful, since you don't make "Edit existing pages" applicable to consumer.

I would like an answer to this too. I have a consumer for "Video Editing Server" that was proposed 10 days ago, and it is still not approved. In its proposed state, only my user account can use it to let the app get an access token. This is inhibiting other people from developing and testing.