Topic on Extension talk:PluggableAuth

Fixed by https://gerrit.wikimedia.org/r/c/mediawiki/extensions/LDAPAuthentication2/+/966807

after updating wiki we are seeing that for some users after login. we use 1.39.5 (f78a5fb) 06:10, October 10, 2023 . Note some users can login , others not. here is the full error: [c1f8b982694f124ffaf407db] /mediawiki/index.php?title=Special:UserLogin&returnto=Special%3ARecentChanges TypeError: preg_match(): Argument #2 ($subject) must be of type string, array given Backtrace: from /var/www/mediawiki/includes/parser/Sanitizer.php(1899)

1. 0 /var/www/mediawiki/includes/parser/Sanitizer.php(1899): preg_match()
2. 1 /var/www/mediawiki/extensions/PluggableAuth/includes/PrimaryAuthenticationProvider.php(194): Sanitizer::validateEmail()
3. 2 /var/www/mediawiki/extensions/PluggableAuth/includes/PrimaryAuthenticationProvider.php(163): MediaWiki\Extension\PluggableAuth\PrimaryAuthenticationProvider->updateUserRealNameAndEmail()
4. 3 /var/www/mediawiki/includes/auth/AuthManager.php(606): MediaWiki\Extension\PluggableAuth\PrimaryAuthenticationProvider->continuePrimaryAuthentication()
5. 4 /var/www/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(374): MediaWiki\Auth\AuthManager->continueAuthentication()
6. 5 /var/www/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(504): AuthManagerSpecialPage->performAuthenticationStep()
7. 6 /var/www/mediawiki/includes/htmlform/HTMLForm.php(729): AuthManagerSpecialPage->handleFormSubmit()
8. 7 /var/www/mediawiki/includes/specialpage/AuthManagerSpecialPage.php(435): HTMLForm->trySubmit()
9. 8 /var/www/mediawiki/includes/specialpage/LoginSignupSpecialPage.php(320): AuthManagerSpecialPage->trySubmit()
10. 9 /var/www/mediawiki/includes/specialpage/SpecialPage.php(701): LoginSignupSpecialPage->execute()
11. 10 /var/www/mediawiki/includes/specialpage/SpecialPageFactory.php(1428): SpecialPage->run()
12. 11 /var/www/mediawiki/includes/MediaWiki.php(316): MediaWiki\SpecialPage\SpecialPageFactory->executePath()
13. 12 /var/www/mediawiki/includes/MediaWiki.php(904): MediaWiki->performRequest()
14. 13 /var/www/mediawiki/includes/MediaWiki.php(562): MediaWiki->main()
15. 14 /var/www/mediawiki/index.php(50): MediaWiki->run()
16. 15 /var/www/mediawiki/index.php(46): wfIndexMain()
17. 16 {main}

note this only happens to those who have not logged in lately..

What version of PluggableAuth and other related extensions are you using?

PluggableAuth 7.0.0 (211d5ba) 05:47, August 15, 2023

LDAPAuthentication2 2.0.1

the other Ldap extensions are 2.0.0

I'll work on getting debug set up.

Also, please turn on debug logging and include relevant portions of the log.

[LDAPProvider] Found user DN: 'uid=amy,ou=People,dc=test,dc=com'

[LDAPProvider] MediaWiki\Extension\LDAPProvider\Client::getSearchString: User DN is: 'uid=amy,ou=People,dc=test,dc=com'

[DBConnection] Wikimedia\Rdbms\LoadBalancer::getLocalConnection: reused a connection for localAutoCommit/0

[DBQuery] SqlBagOStuff::fetchBlobs [0s] localhost: SELECT keyname,value,exptime FROM `objectcache` WHERE keyname = 'fbcwiki:ldap-provider: user-info:amy:ou=People,dc=test,dc=com' AND (exptime >= '20231015232138')

[LDAPProvider] Ran LDAP search for '(uid=amy)' in 0.0020978450775146 seconds.

[DBConnection] Wikimedia\Rdbms\LoadBalancer::getLocalConnection: reused a connection for localAutoCommit/0

[DBQuery] Wikimedia\Rdbms\DatabaseMysqlBase::getServerId [0s] localhost: SELECT @@server_id AS id

[DBQuery] SqlBagOStuff::modifyTableSpecificBlobsForSet [0.003s] localhost: REPLACE INTO `objectcache` (keyname,value,exptime) VALUES ('fbcwiki: ldap-provider:user-info:amy:ou=People,dc=test,dc=com',.......

[DBConnection] Wikimedia\Rdbms\LoadBalancer::getLocalConnection: reused a connection for localAutoCommit/0

[LDAPAuthentication2] LDAP login succeeded.

[DBQuery] Wikimedia\Rdbms\DatabaseMysqlBase::open [0s] localhost: SET group_concat_max_len = 262144, `sql_mode` =

[DBConnection] Wikimedia\Rdbms\LoadBalancer::getLocalConnection: opened new connection for local/0

[DBPerformance] Expectation (masterConns <= 0) by MediaWiki::main not met (actual: 2): [connect to localhost (fbcwiki)]

1. 0 /var/www/mediawiki/includes/libs/rdbms/TransactionProfiler.php(219): Wikimedia\Rdbms\TransactionProfiler->reportExpectationViolated()
2. 1 /var/www/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(980): Wikimedia\Rdbms\TransactionProfiler->recordConnection()
3. 2 /var/www/mediawiki/includes/libs/rdbms/loadbalancer/LoadBalancer.php(944): Wikimedia\Rdbms\LoadBalancer->getServerConnection()
4. 3 /var/www/mediawiki/includes/libs/rdbms/database/DBConnRef.php(95): Wikimedia\Rdbms\LoadBalancer->getConnectionInternal()
5. 4 /var/www/mediawiki/includes/libs/rdbms/database/DBConnRef.php(101): Wikimedia\Rdbms\DBConnRef->ensureConnection()
6. 5 /var/www/mediawiki/includes/libs/rdbms/database/DBConnRef.php(344): Wikimedia\Rdbms\DBConnRef->__call()
7. 6 /var/www/mediawiki/includes/user/User.php(416): Wikimedia\Rdbms\DBConnRef->selectRow()
8. 7 /var/www/mediawiki/includes/user/User.php(1660): User->load()
9. 8 /var/www/mediawiki/extensions/LDAPAuthentication2/src/PluggableAuth.php(130): User->getId()
10. 9 /var/www/mediawiki/extensions/PluggableAuth/includes/PluggableAuthLogin.php(101): MediaWiki\Extension\LDAPAuthentication2\PluggableAuth->aut

henticate()

1. 10 /var/www/mediawiki/includes/specialpage/SpecialPage.php(701): MediaWiki\Extension\PluggableAuth\PluggableAuthLogin->execute()
2. 11 /var/www/mediawiki/includes/specialpage/SpecialPageFactory.php(1428): SpecialPage->run()
3. 12 /var/www/mediawiki/includes/MediaWiki.php(316): MediaWiki\SpecialPage\SpecialPageFactory->executePath()
4. 13 /var/www/mediawiki/includes/MediaWiki.php(904): MediaWiki->performRequest()
5. 14 /var/www/mediawiki/includes/MediaWiki.php(562): MediaWiki->main()
6. 15 /var/www/mediawiki/index.php(50): MediaWiki->run()
7. 16 /var/www/mediawiki/index.php(46): wfIndexMain()
8. 17 {main}

[DBQuery] Wikimedia\Rdbms\Database::beginIfImplied (User::load) [0s] localhost: BEGIN

[DBQuery] User::load [0s] localhost: SELECT actor_id,actor_user,actor_name FROM `actor` WHERE actor_name = 'Amy' LIMIT 1 [DBConnection] Wikimedia\Rdbms\LoadBalancer::getLocalConnection: reused a connection for local/0

If you want I could email or upload a more complete log.....

Well,

TypeError: preg_match(): Argument #2 ($subject) must be of type string, array given Backtrace: from /var/www/mediawiki/includes/parser/Sanitizer.php(1899)

coming from

extensions/PluggableAuth/includes/PrimaryAuthenticationProvider.php(194): Sanitizer::validateEmail()

lets me think that either the LDAP server returns an odd value for what you have configured in emailattribute. Can you please check that value, e.g. by running extensions/LDAPProvider/maintenance/ShowUserInfo.php for the affected user?

Alternatively some handler of hook IsValidEmailAddr is messing up the e-mail address. But this seems unlikely.

sudo -u www-data php  extensions/LDAPProvider/maintenance/ShowUserInfo.php --username amy  --domain test.com

uid => amy 
mail => 
  0 => amy@test.com  
memberof => 
  0 => cn=nextcloud,ou=groups,dc=test,dc=com 
  1 => cn=UNIX Users,ou=groups,dc=test,dc=com 
givenname => Amy 
sn => O'test
cn => Amy O'test 
dn => uid=amy,ou=People,dc=test,dc=com

Hello

Is there a way for me  to further debug if some handler of hook IsValidEmailAddr is messing up the e-mail address ?

Well

mail => 
  0 => amy@test.com

is probably already the explanation.

It should more be

mail => amy@test.com

Unfortunately I can not tell why your LDAP server returns this value or why this only occurs for some users.

Can you check the same command with a user that hasn't got a problem?

well in our ldap a person can have more then one email address .

the ones which have more then one email address do have an issue logging in to wiki. for instance I can login and my returned from extensions/LDAPProvider/maintenance/ShowUserInfo.php is: rob@test

amy has 5 different email addresses with these as prefix :

 0 =>
 1 =>

..

 4 =>

we use openldap .

so the ones who can log in have just one email address, and ShowUserInfo.php returns something like

rob@test

without a 0 => prefix

is there a way to turn off email checking in LocalSettings.php ?

I have created a patch for this on https://gerrit.wikimedia.org/r/c/mediawiki/extensions/LDAPAuthentication2/+/966807

You can download the patched extension code via https://gerrit.wikimedia.org/r/changes/mediawiki%2Fextensions%2FLDAPAuthentication2~966807/revisions/2/archive?format=tgz

If you confirm this fixes the issue we can merge and release it.

I got this error after untaring the file into extensions/PluggableAuth

Fatal error: Uncaught Exception: It was attempted to load LDAPAuthentication2 twice, from /var/www/mediawiki/extensions/LDAPAuthentication2/extension.json and /var/www/mediawiki/extensions/PluggableAuth/extension.json. in /var/www/mediawiki/includes/registration/ExtensionProcessor.php:772 Stack trace: #0 /var/www/mediawiki/includes/registration/ExtensionProcessor.php(280): ExtensionProcessor->extractCredits() #1 /var/www/mediawiki/includes/registration/ExtensionRegistry.php(421): ExtensionProcessor->extractInfo() #2 /var/www/mediawiki/includes/registration/ExtensionRegistry.php(276): ExtensionRegistry->readFromQueue() #3 /var/www/mediawiki/includes/Setup.php(278): ExtensionRegistry->loadFromQueue() #4 /var/www/mediawiki/includes/WebStart.php(86): require_once('...') #5 /var/www/mediawiki/index.php(44): require('...') #6 {main} thrown in /var/www/mediawiki/includes/registration/ExtensionProcessor.php on line 772

here is a directory listing:

1. ls -l

total 236

-rw-r--r-- 1 www-data www-data 135 Oct 18 18:34 CODE_OF_CONDUCT.md

-rw-r--r-- 1 www-data www-data 1212 Oct 18 18:34 composer.json

-rw-r--r-- 1 www-data www-data 1070 Jan 27 2023 COPYING

drwxr-xr-x 2 www-data www-data 4096 Aug 16 19:33 docs/

-rw-r--r-- 1 www-data www-data 1645 Oct 18 18:34 extension.json

-rw-r--r-- 1 www-data www-data 493 Oct 18 18:34 Gruntfile.js

drwxr-xr-x 2 www-data www-data 4096 Oct 18 18:34 i18n/

drwxr-xr-x 4 www-data www-data 4096 Aug 16 19:33 includes/

-rw-r--r-- 1 www-data www-data 241 Oct 18 18:34 package.json

-rw-r--r-- 1 www-data www-data 191732 Oct 18 18:34 package-lock.json

-rw-r--r-- 1 www-data www-data 265 Oct 18 18:34 README.mediawiki

drwxr-xr-x 2 www-data www-data 4096 Oct 18 18:34 src/

drwxr-xr-x 4 www-data www-data 4096 Jan 27 2023 tests/

The patch is an update to LDAPAuthentication2, not PluggableAuth. You should be untarring it into extensions/LDAPAuthentication2, not extensions/PluggableAuth.

Hello Cindy.

the patch fixed the issue.   

thank you very much!

I'm glad that worked for you.