Page MenuHomePhabricator

Allow multiple different 2FA devices
Closed, ResolvedPublic

Description

Creating as an umbrella for T232336: Separate recovery codes into a separate 2FA module and T230042: Allow multiple TOTP devices

It should be possible to have TOTP and WebAuthn enabled

[21:28:13] <AntiComposite> I know it was just deployed, but is there a reason that OATHAuth only supports TOTP _or_ WebAuthn (U2F)?
[21:29:40] <AntiComposite> Every other service I use that supports WebAuthn supports both at the same time, which means I can use my hardware key on my laptop but fall back to my TOTP generator for my phone, where WebAuthn isn't supported in the browser.

db migration progress

checkuserwiki + techconductwiki DONE
remaining private wikis DONE
fishbowls DONE
wikitech DONE
ca wikis

  • WRITE_BOTH | READ_OLD
  • run script
  • WRITE_BOTH | READ_NEW
  • WRITE_NEW | READ_NEW

Details

Other Assignee
Tgr
Related Changes in Gerrit:
SubjectRepoBranchLines +/-
mediawiki/extensions/WebAuthnREL1_43+40 -69
mediawiki/extensions/WebAuthnREL1_43+9 -1
mediawiki/extensions/OATHAuthREL1_43+65 -107
mediawiki/extensions/OATHAuthREL1_43+2 -0
mediawiki/extensions/OATHAuthREL1_43+26 -14
mediawiki/extensions/OATHAuthREL1_43+21 -19
mediawiki/extensions/WebAuthnREL1_44+40 -69
mediawiki/extensions/OATHAuthmaster+2 -17
mediawiki/extensions/OATHAuthREL1_44+65 -107
mediawiki/extensions/OATHAuthREL1_44+640 -14
mediawiki/extensions/WebAuthnmaster+40 -69
mediawiki/extensions/OATHAuthmaster+65 -107
mediawiki/extensions/OATHAuthmaster+640 -14
mediawiki/extensions/OATHAuthmaster+12 -38
mediawiki/extensions/OATHAuthmaster+26 -14
mediawiki/extensions/OATHAuthmaster+0 -61
mediawiki/extensions/OATHAuthmaster+37 -31
mediawiki/extensions/OATHAuthmaster+2 -0
mediawiki/extensions/WebAuthnmaster+0 -11
mediawiki/extensions/OATHAuthmaster+21 -19
mediawiki/extensions/WebAuthnmaster+9 -1
mediawiki/extensions/OATHAuthmaster+12 -16
mediawiki/extensions/WebAuthnmaster+1 -1
mediawiki/extensions/WebAuthnmaster+19 -49
mediawiki/extensions/OATHAuthmaster+0 -11
mediawiki/extensions/WebAuthnmaster+15 -22
mediawiki/extensions/OATHAuthmaster+85 -21
mediawiki/extensions/OATHAuthmaster+96 -57
mediawiki/extensions/WebAuthnmaster+15 -25
mediawiki/extensions/OATHAuthmaster+18 -27
mediawiki/extensions/OATHAuthmaster+1 -1
mediawiki/extensions/OATHAuthmaster+21 -12
mediawiki/extensions/WebAuthnmaster+15 -1
mediawiki/extensions/OATHAuthmaster+18 -7
mediawiki/extensions/OATHAuthmaster+19 -7
mediawiki/extensions/OATHAuthmaster+5 -11
mediawiki/extensions/OATHAuthmaster+575 -131
mediawiki/extensions/OATHAuthmaster+50 -128
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+2 -2
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+2 -4
operations/mediawiki-configmaster+2 -2
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
operations/mediawiki-configmaster+1 -0
mediawiki/extensions/OATHAuthmaster+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.20+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.22+17 -22
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.22+13 -3
mediawiki/extensions/OATHAuthwmf/1.41.0-wmf.20+13 -3
mediawiki/extensions/OATHAuthmaster+13 -3
operations/mediawiki-configmaster+1 -1
operations/mediawiki-configmaster+3 -0
operations/mediawiki-configmaster+2 -0
mediawiki/extensions/OATHAuthmaster+0 -2
Show related patches Customize query in gerrit

Related Objects

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Change #1132632 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Auth: Add authentication request indicating used module

https://gerrit.wikimedia.org/r/1132632

Change #1114128 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Implement function to get module from key

https://gerrit.wikimedia.org/r/1114128

Change #1133116 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/WebAuthn@master] Stop trying to disable other modules before enabling WebAuthn

https://gerrit.wikimedia.org/r/1133116

Change #1133117 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] OATHManage: Drop use of OATHUser::getModule()

https://gerrit.wikimedia.org/r/1133117

Change #1133118 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/OATHAuth@master] Drop OATHUserRepository::persist()

https://gerrit.wikimedia.org/r/1133118

Moving back to your inbox since this could use some code reviews again :-)

After these patches the only remaining thing is implementing an interface that lets users choose a method to login with.

Change #1133116 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Stop trying to disable other modules before enabling WebAuthn

https://gerrit.wikimedia.org/r/1133116

Change #1114129 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Backlink keys back to a module

https://gerrit.wikimedia.org/r/1114129

Change #1114130 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Update preferences button to support multiple key types

https://gerrit.wikimedia.org/r/1114130

Change #1114133 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Mark OATHUser::getModule() as deprecated

https://gerrit.wikimedia.org/r/1114133

Change #1133117 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] OATHManage: Drop use of OATHUser::getModule()

https://gerrit.wikimedia.org/r/1133117

Change #1133118 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Drop OATHUserRepository::persist()

https://gerrit.wikimedia.org/r/1133118

Change #1134383 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@master] [WIP] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134383

Change #1134384 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@master] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134384

Change #1136134 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@master] Do not show warning about "switching" authentication methods

https://gerrit.wikimedia.org/r/1136134

Change #1136134 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Do not show warning about "switching" authentication methods

https://gerrit.wikimedia.org/r/1136134

Change #1132632 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Auth: Add authentication request indicating used module

https://gerrit.wikimedia.org/r/1132632

Change #1134383 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134383

Change #1134384 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134384

Change #1174095 had a related patch set uploaded (by Reedy; author: Majavah):

[mediawiki/extensions/OATHAuth@REL1_44] Auth: Add authentication request indicating used module

https://gerrit.wikimedia.org/r/1174095

Change #1174096 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@REL1_44] Fix multi-key handling

https://gerrit.wikimedia.org/r/1174096

Change #1174095 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_44] Auth: Add authentication request indicating used module

https://gerrit.wikimedia.org/r/1174095

Change #1174096 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_44] Fix multi-key handling

https://gerrit.wikimedia.org/r/1174096

Change #1172901 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@master] Allow using multiple modules

https://gerrit.wikimedia.org/r/1172901

@Mstyles @Catrope do we have some sort of checklist of what's needed before enabling?

Alternatively, we could say this task is done, since they are now possible (just intentionally disabled for now).

Tgr updated Other Assignee, added: Tgr; removed: pmiazga.Jul 31 2025, 5:36 PM

Alternatively, we could say this task is done, since they are now possible (just intentionally disabled for now).

Yes we'll mark this as done, and as a part of this quarter's rollout, there will be a plan to enable multiple authenticators

Change #1172901 abandoned by Reedy:

[mediawiki/extensions/OATHAuth@master] Allow using multiple modules

https://gerrit.wikimedia.org/r/1172901

Change #1190593 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@REL1_44] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190593

Change #1190606 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@REL1_43] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190606

Change #1190593 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_44] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190593

Change #1190630 had a related patch set uploaded (by Reedy; author: Majavah):

[mediawiki/extensions/OATHAuth@REL1_43] Backlink keys back to a module

https://gerrit.wikimedia.org/r/1190630

Change #1190630 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_43] Backlink keys back to a module

https://gerrit.wikimedia.org/r/1190630

Change #1190741 had a related patch set uploaded (by Reedy; author: Majavah):

[mediawiki/extensions/OATHAuth@REL1_43] OATHManage: Drop use of OATHUser::getModule()

https://gerrit.wikimedia.org/r/1190741

Change #1190745 had a related patch set uploaded (by Reedy; author: Majavah):

[mediawiki/extensions/OATHAuth@REL1_43] Mark OATHUser::getModule() as deprecated

https://gerrit.wikimedia.org/r/1190745

Change #1190746 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@REL1_43] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190746

Change #1190741 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_43] OATHManage: Drop use of OATHUser::getModule()

https://gerrit.wikimedia.org/r/1190741

Change #1190745 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_43] Mark OATHUser::getModule() as deprecated

https://gerrit.wikimedia.org/r/1190745

Change #1190746 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@REL1_43] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190746

Change #1190762 had a related patch set uploaded (by Reedy; author: Majavah):

[mediawiki/extensions/WebAuthn@REL1_43] Implement function to get module from key

https://gerrit.wikimedia.org/r/1190762

Change #1190762 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_43] Implement function to get module from key

https://gerrit.wikimedia.org/r/1190762

Change #1190606 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_43] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190606