Currently, 2FA via OATHAuth is not compatible with CentralAuth's SSO. A user would have to enable 2FA on every SUL wiki individually (and setup 2FA on any future wikis the WMF deploys as soon as it's deployed), with a different secret, and login using the correct wiki's secret. Otherwise, an attacker can login using just a password on a SUL wiki where 2FA isn't enabled for the account, and CentralAuth will auto-login the user on any other wiki.
Description
Description
Details
Details
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • dpatrick | T107605 Support two-factor authentication on CentralAuth wikis | |||
| Resolved | Tgr | T110457 Update OATHAuth to use AuthManager | |||
| Resolved | csteipp | T130700 Create central OATHAuth table for CentralAuth wikis | |||
| Resolved | Parent5446 | T100376 Add user right for enabling two-factor authentication | |||
| Resolved | Parent5446 | T100374 Allow for using separate database for OATH credentials (for CentralAuth compatibility) | |||
| Resolved | Parent5446 | T55195 OATH token input should be on a separate page | |||
| Resolved | csteipp | T131420 Install Ex:OATH to beta |
Event Timeline
Comment Actions
Just a note that an RfC this year resulted in supported for 2FA on the English Wikipedia; https://en.wikipedia.org/wiki/Wikipedia:Village_pump_(proposals)/Archive_123#RfC:_Proposal_to_add_optional_multi-factor_authentication_to_the_English_Wikipedia
Comment Actions
Thanks @Samwalton9, I hand't seen that.
Right now, the extensions that handles 2FA on wiki (OATHAuth) only applies the setting on a single wiki, but SUL allows a user account to login on any wiki and then be logged in across projects. So we're not able to do this currently, unless a developer wants to make OAUTHAuth CentralAuth-aware.
Comment Actions
@Andrew - We're planning to merge a bunch of OATH patches this week, one which requires a maintenance script to be run on labswiki (updating the scratch token storage format). Is there a good time to schedule that with you?
Comment Actions
@csteipp, any deployer should have the rights to run the script, so finding someone to run it should be easy. I don't much care when you do it, although I typically schedule wikitech maintenance well away from any other maintenance or deployment windows since people are generally looking at wikitech docs while deploying.
Comment Actions
@Andrew, I probably should have given you more warning, but I've got this deployment schedule in about 30 mins. If anything looks odd, I'll revert. But like I said, there's very little chance of this affecting users.
Comment Actions
Change 289486 had a related patch set uploaded (by CSteipp):
Enable Ex:OATHAuth on test wikis, disabled for all users
Comment Actions
Change 289486 merged by jenkins-bot:
Enable Ex:OATHAuth on test wikis, disabled for all users
Comment Actions
OATH has been rolled out to testwiki and test2wiki. Everything seems to be working as expected. Assuming no issues come up, I'll make it available on all wikis (to Staff global group only) tomorrow in SWAT.
Comment Actions
Change 290271 had a related patch set uploaded (by CSteipp):
Enable Ex:OATH on CentralAuth wikis, limited rights
Comment Actions
Change 290271 merged by jenkins-bot:
Enable Ex:OATH on CentralAuth wikis, limited rights
Comment Actions
This was officially resolved as of the date that AuthManager was enabled on public wikis.
Comment Actions
Seconding to this comment. It would be great for checkusers, oversights and other people with non-public-data access.
Comment Actions
When I login my wiki account, I fill my user name and password. then I sowing this massage.- " Please enter a verification code from your authentication device
Token
Continue login"
I don't know what's token so I can't login wiki account. Please help me.