Page MenuHomePhabricator

Allow multiple different 2FA devices
Open, Needs TriagePublic

Description

Creating as an umbrella for T232336: Separate recovery codes into a separate MFA method and T230042: Allow multiple totp devices

It should be possible to have TOTP and WebAuthn enabled

[21:28:13] <AntiComposite> I know it was just deployed, but is there a reason that OATHAuth only supports TOTP _or_ WebAuthn (U2F)?
[21:29:40] <AntiComposite> Every other service I use that supports WebAuthn supports both at the same time, which means I can use my hardware key on my laptop but fall back to my TOTP generator for my phone, where WebAuthn isn't supported in the browser.

db migration progress

checkuserwiki + techconductwiki DONE
remaining private wikis DONE
fishbowls DONE
wikitech DONE
ca wikis

  • WRITE_BOTH | READ_OLD
  • run script
  • WRITE_BOTH | READ_NEW
  • WRITE_NEW | READ_NEW

Details

Other Assignee
pmiazga
SubjectRepoBranchLines +/-
mediawiki/extensions/OATHAuthmaster+75 -21
mediawiki/extensions/WebAuthnmaster+23 -1
mediawiki/extensions/OATHAuthmaster+76 -18
mediawiki/extensions/OATHAuthmaster+575 -131
mediawiki/extensions/OATHAuthmaster+5 -11
mediawiki/extensions/OATHAuthmaster+18 -7
mediawiki/extensions/OATHAuthmaster+10 -6
mediawiki/extensions/OATHAuthmaster+50 -128
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+2 -2
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+2 -4
operations/mediawiki-configmaster+2 -2
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
mediawiki/extensions/OATHAuthmaster+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.20+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.22+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.22+13 -3
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.20+13 -3
mediawiki/extensions/OATHAuthmaster+13 -3
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+3 -0
operations/mediawiki-configmaster+2 -0
mediawiki/extensions/OATHAuthmaster+0 -2
Show related patches Customize query in gerrit

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change 949168 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@wmf/1.41.0-wmf.20] Keep both tables up-to-date on WRITE_BOTH

https://gerrit.wikimedia.org/r/949168

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:29:27Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:949169|Keep both tables up-to-date on WRITE_BOTH (T242031)]], [[gerrit:949168|Keep both tables up-to-date on WRITE_BOTH (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:31:04Z] <taavi@deploy1002> taavi: Backport for [[gerrit:949169|Keep both tables up-to-date on WRITE_BOTH (T242031)]], [[gerrit:949168|Keep both tables up-to-date on WRITE_BOTH (T242031)]] synced to the testservers mwdebug1001.eqiad.wmnet, mwdebug1002.eqiad.wmnet, mwdebug2001.codfw.wmnet, mwdebug2002.codfw.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Change 949188 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Keep both tables up-to-date on WRITE_BOTH

https://gerrit.wikimedia.org/r/949188

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:40:26Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:949169|Keep both tables up-to-date on WRITE_BOTH (T242031)]], [[gerrit:949168|Keep both tables up-to-date on WRITE_BOTH (T242031)]] (duration: 10m 58s)

Change 949161 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_BOTH for OAuth multiple devices to techconductwiki

https://gerrit.wikimedia.org/r/949161

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:44:25Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:949161|Set WRITE_BOTH for OAuth multiple devices to techconductwiki (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:45:58Z] <taavi@deploy1002> taavi: Backport for [[gerrit:949161|Set WRITE_BOTH for OAuth multiple devices to techconductwiki (T242031)]] synced to the testservers mwdebug1002.eqiad.wmnet, mwdebug2001.codfw.wmnet, mwdebug2002.codfw.wmnet, mwdebug1001.eqiad.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Mentioned in SAL (#wikimedia-operations) [2023-08-16T03:53:32Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:949161|Set WRITE_BOTH for OAuth multiple devices to techconductwiki (T242031)]] (duration: 09m 07s)

Mentioned in SAL (#wikimedia-operations) [2023-08-16T08:03:53Z] <taavi> mwscript extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php techconductwiki # T242031

Change 949629 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set WRITE_BOTH for OAuth multiple devices to checkuserwiki

https://gerrit.wikimedia.org/r/949629

Change 949629 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_BOTH for OAuth multiple devices to checkuserwiki

https://gerrit.wikimedia.org/r/949629

Mentioned in SAL (#wikimedia-operations) [2023-08-18T01:34:32Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:949629|Set WRITE_BOTH for OAuth multiple devices to checkuserwiki (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-08-18T01:36:13Z] <taavi@deploy1002> taavi: Backport for [[gerrit:949629|Set WRITE_BOTH for OAuth multiple devices to checkuserwiki (T242031)]] synced to the testservers mwdebug1002.eqiad.wmnet, mwdebug2001.codfw.wmnet, mwdebug2002.codfw.wmnet, mwdebug1001.eqiad.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Mentioned in SAL (#wikimedia-operations) [2023-08-18T01:42:21Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:949629|Set WRITE_BOTH for OAuth multiple devices to checkuserwiki (T242031)]] (duration: 07m 48s)

Mentioned in SAL (#wikimedia-operations) [2023-08-21T19:29:08Z] <taavi> run extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php on checkuserwiki, T242031

Change 951367 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for all fishbowls

https://gerrit.wikimedia.org/r/951367

Change 951367 merged by jenkins-bot:

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for all fishbowls

https://gerrit.wikimedia.org/r/951367

Mentioned in SAL (#wikimedia-operations) [2023-08-24T08:25:31Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:951367|Set OATHAuth multiple devices WRITE_BOTH for all fishbowls (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-08-24T08:27:05Z] <taavi@deploy1002> taavi: Backport for [[gerrit:951367|Set OATHAuth multiple devices WRITE_BOTH for all fishbowls (T242031)]] synced to the testservers mwdebug1001.eqiad.wmnet, mwdebug2001.codfw.wmnet, mwdebug2002.codfw.wmnet, mwdebug1002.eqiad.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Mentioned in SAL (#wikimedia-operations) [2023-08-24T08:33:16Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:951367|Set OATHAuth multiple devices WRITE_BOTH for all fishbowls (T242031)]] (duration: 07m 45s)

Mentioned in SAL (#wikimedia-operations) [2023-08-24T11:31:35Z] <taavi> foreachwikiindblist fishbowl extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php | tee oathauth-multiple-fishbowl.log # T242031

Change 952184 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for all privates

https://gerrit.wikimedia.org/r/952184

Change 952185 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set OATHAuth multiple devices READ_NEW for checkuser, techconduct

https://gerrit.wikimedia.org/r/952185

Change 952184 merged by jenkins-bot:

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for all privates

https://gerrit.wikimedia.org/r/952184

Change 952185 merged by jenkins-bot:

[operations/mediawiki-config@master] Set OATHAuth multiple devices READ_NEW for checkuser, techconduct

https://gerrit.wikimedia.org/r/952185

Mentioned in SAL (#wikimedia-operations) [2023-08-28T17:32:10Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:952184|Set OATHAuth multiple devices WRITE_BOTH for all privates (T242031)]], [[gerrit:952185|Set OATHAuth multiple devices READ_NEW for checkuser, techconduct (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-08-28T17:33:42Z] <taavi@deploy1002> taavi: Backport for [[gerrit:952184|Set OATHAuth multiple devices WRITE_BOTH for all privates (T242031)]], [[gerrit:952185|Set OATHAuth multiple devices READ_NEW for checkuser, techconduct (T242031)]] synced to the testservers mwdebug1001.eqiad.wmnet, mwdebug2001.codfw.wmnet, mwdebug1002.eqiad.wmnet, mwdebug2002.codfw.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD opti

Mentioned in SAL (#wikimedia-operations) [2023-08-28T17:39:51Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:952184|Set OATHAuth multiple devices WRITE_BOTH for all privates (T242031)]], [[gerrit:952185|Set OATHAuth multiple devices READ_NEW for checkuser, techconduct (T242031)]] (duration: 07m 41s)

Mentioned in SAL (#wikimedia-operations) [2023-09-07T09:14:47Z] <taavi> foreachwikiindblist private extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php | tee oathauth-multiple-private.log # T242031

Change 955671 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for wikitech

https://gerrit.wikimedia.org/r/955671

Change 955670 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set OATHAuth multiple devices READ_NEW for all fishbows, privates

https://gerrit.wikimedia.org/r/955670

Change 955670 merged by jenkins-bot:

[operations/mediawiki-config@master] Set OATHAuth multiple devices READ_NEW for all fishbows, privates

https://gerrit.wikimedia.org/r/955670

Change 955671 merged by jenkins-bot:

[operations/mediawiki-config@master] Set OATHAuth multiple devices WRITE_BOTH for wikitech

https://gerrit.wikimedia.org/r/955671

Mentioned in SAL (#wikimedia-operations) [2023-09-07T13:29:12Z] <taavi@deploy1002> Started scap: Backport for [[gerrit:955670|Set OATHAuth multiple devices READ_NEW for all fishbows, privates (T242031)]], [[gerrit:955671|Set OATHAuth multiple devices WRITE_BOTH for wikitech (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-09-07T13:30:41Z] <taavi@deploy1002> taavi: Backport for [[gerrit:955670|Set OATHAuth multiple devices READ_NEW for all fishbows, privates (T242031)]], [[gerrit:955671|Set OATHAuth multiple devices WRITE_BOTH for wikitech (T242031)]] synced to the testservers mwdebug2001.codfw.wmnet, mwdebug2002.codfw.wmnet, mwdebug1001.eqiad.wmnet, mwdebug1002.eqiad.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Mentioned in SAL (#wikimedia-operations) [2023-09-07T13:38:04Z] <taavi@deploy1002> Finished scap: Backport for [[gerrit:955670|Set OATHAuth multiple devices READ_NEW for all fishbows, privates (T242031)]], [[gerrit:955671|Set OATHAuth multiple devices WRITE_BOTH for wikitech (T242031)]] (duration: 08m 52s)

Mentioned in SAL (#wikimedia-operations) [2023-09-07T13:38:55Z] <taavi> taavi@mwmaint1002 ~ $ mwscript extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php --wiki=labswiki | tee oathauth-multiple-labswiki.log # T242031

Change 959042 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set READ_NEW for Wikitech on OATHAuth multiple devices migration

https://gerrit.wikimedia.org/r/959042

Change 959043 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set WRITE_NEW for OATHAuth multiple devices on fishbowls/privates

https://gerrit.wikimedia.org/r/959043

Change 959042 merged by jenkins-bot:

[operations/mediawiki-config@master] Set READ_NEW for Wikitech on OATHAuth multiple devices migration

https://gerrit.wikimedia.org/r/959042

Change 959043 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_NEW for OATHAuth multiple devices on fishbowls/privates

https://gerrit.wikimedia.org/r/959043

Mentioned in SAL (#wikimedia-operations) [2023-09-20T07:05:06Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:959042|Set READ_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]], [[gerrit:959043|Set WRITE_NEW for OATHAuth multiple devices on fishbowls/privates (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-09-20T07:26:54Z] <taavi@deploy2002> taavi: Backport for [[gerrit:959042|Set READ_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]], [[gerrit:959043|Set WRITE_NEW for OATHAuth multiple devices on fishbowls/privates (T242031)]] synced to the testservers mwdebug2002.codfw.wmnet, mwdebug1001.eqiad.wmnet, mwdebug1002.eqiad.wmnet, mwdebug2001.codfw.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental X

Mentioned in SAL (#wikimedia-operations) [2023-09-20T07:41:16Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:959042|Set READ_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]], [[gerrit:959043|Set WRITE_NEW for OATHAuth multiple devices on fishbowls/privates (T242031)]] (duration: 36m 09s)

Change 961236 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set WRITE_NEW for Wikitech on OATHAuth multiple devices migration

https://gerrit.wikimedia.org/r/961236

Change 961237 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set WRITE_BOTH for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/961237

Change 961236 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_NEW for Wikitech on OATHAuth multiple devices migration

https://gerrit.wikimedia.org/r/961236

Mentioned in SAL (#wikimedia-operations) [2023-09-26T20:40:50Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:961236|Set WRITE_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-09-26T20:42:19Z] <taavi@deploy2002> taavi: Backport for [[gerrit:961236|Set WRITE_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]] synced to the testservers mwdebug1001.eqiad.wmnet, mwdebug2002.codfw.wmnet, mwdebug1002.eqiad.wmnet, mwdebug2001.codfw.wmnet, and mw-debug kubernetes deployment (accessible via k8s-experimental XWD option)

Mentioned in SAL (#wikimedia-operations) [2023-09-26T20:48:29Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:961236|Set WRITE_NEW for Wikitech on OATHAuth multiple devices migration (T242031)]] (duration: 07m 38s)

Change 961237 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_BOTH for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/961237

Mentioned in SAL (#wikimedia-operations) [2023-09-28T13:45:58Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:961237|Set WRITE_BOTH for CA wikis on OATHAuth multiple devices (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-09-28T13:47:19Z] <taavi@deploy2002> taavi: Backport for [[gerrit:961237|Set WRITE_BOTH for CA wikis on OATHAuth multiple devices (T242031)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-09-28T13:57:28Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:961237|Set WRITE_BOTH for CA wikis on OATHAuth multiple devices (T242031)]] (duration: 11m 02s)

Mentioned in SAL (#wikimedia-operations) [2023-10-04T16:49:18Z] <taavi> taavi@mwmaint2002 ~ $ mwscript extensions/OATHAuth/maintenance/UpdateForMultipleDevicesSupport.php metawiki | tee T242031-sul.log # T242031

Change 963388 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set READ_NEW for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/963388

Change 963388 merged by jenkins-bot:

[operations/mediawiki-config@master] Set READ_NEW for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/963388

Mentioned in SAL (#wikimedia-operations) [2023-10-10T20:40:16Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:963388|Set READ_NEW for CA wikis on OATHAuth multiple devices (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-10-10T20:41:40Z] <taavi@deploy2002> taavi: Backport for [[gerrit:963388|Set READ_NEW for CA wikis on OATHAuth multiple devices (T242031)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-10-10T20:48:41Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:963388|Set READ_NEW for CA wikis on OATHAuth multiple devices (T242031)]] (duration: 08m 24s)

Change 964986 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Drop support for old device schema

https://gerrit.wikimedia.org/r/964986

Change 964987 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Make Key objects aware of their database IDs

https://gerrit.wikimedia.org/r/964987

Change 964988 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Make the TOTP disable form only remove that single key

https://gerrit.wikimedia.org/r/964988

Change 964989 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Do not use Module when disabling OAuth for a user

https://gerrit.wikimedia.org/r/964989

Change 964996 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/WebAuthn@master] WebAuthnKey: Store the key id

https://gerrit.wikimedia.org/r/964996

Change 965250 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/mediawiki-config@master] Set WRITE_NEW for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/965250

Change 965250 merged by jenkins-bot:

[operations/mediawiki-config@master] Set WRITE_NEW for CA wikis on OATHAuth multiple devices

https://gerrit.wikimedia.org/r/965250

Mentioned in SAL (#wikimedia-operations) [2023-10-11T20:55:53Z] <taavi@deploy2002> Started scap: Backport for [[gerrit:965250|Set WRITE_NEW for CA wikis on OATHAuth multiple devices (T242031)]]

Mentioned in SAL (#wikimedia-operations) [2023-10-11T20:57:13Z] <taavi@deploy2002> taavi: Backport for [[gerrit:965250|Set WRITE_NEW for CA wikis on OATHAuth multiple devices (T242031)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)

Mentioned in SAL (#wikimedia-operations) [2023-10-11T21:06:27Z] <taavi@deploy2002> Finished scap: Backport for [[gerrit:965250|Set WRITE_NEW for CA wikis on OATHAuth multiple devices (T242031)]] (duration: 10m 33s)

Change 964986 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Drop support for old device schema

https://gerrit.wikimedia.org/r/964986

Change 977109 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Replace more users of getModule() for enabled checks

https://gerrit.wikimedia.org/r/977109

Change 977110 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] ApiQueryOATH: do not use module to check enablement

https://gerrit.wikimedia.org/r/977110

larissagaulia updated Other Assignee, added: pmiazga.
larissagaulia added a subscriber: larissagaulia.

Thanks, Taavi. Piotr volunteered to take a look at the open patches. Please feel free to reach out to him :)