Tgr closed this task as "Resolved".
Tgr added a comment.

  In T408721#11331018 <https://phabricator.wikimedia.org/T408721#11331018>, 
@Tgr wrote:
  
  > https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OAuth/+/1198714 does 
change `UserStatementProvider::getUserProfile()` though and that would probably 
also break OAuth 1 clients so we need to fix that as well.
  
  ...it actually doesn't. UserStatementProvider is used in the JWT that's 
returned as the response body for the OAuth 1 `Special:OAuth/identity` endpoint 
and  the OAuth 2 / OIDC `oauth2/resource/profile` endpoint, which is internally 
mostly unrelated from the JWT that's used as the access token. Only the access 
token is changed by the patch.
  
  It's not great to have a JWT subject in the access token that's different 
from the JWT subject in the identity token, so maybe we should rethink that. 
But it won't break anything. So I think we are done here.

TASK DETAIL
  https://phabricator.wikimedia.org/T408721

EMAIL PREFERENCES
  https://phabricator.wikimedia.org/settings/panel/emailpreferences/

_______________________________________________
pywikibot-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]

Reply via email to