Since T209749, holders of oathauth-verify-user can view if user is enrolled in 2FA. This should be assigned to the stewards at meta, so they can query for 2FA status before granting sensitive rights.
Description
Description
Details
Details
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Assign oathauth-verify-user to stewards | operations/mediawiki-config | master | +1 -0 |
Related Objects
Related Objects
Event Timeline
Comment Actions
Change 593286 had a related patch set uploaded (by Urbanecm; owner: Urbanecm):
[operations/mediawiki-config@master] Assign oathauth-verify-user to stewards
Comment Actions
Just to confirm, what is the output of Special:VerifyOATHForUser? Is it a binary yes/no, or does it provide other information?
Comment Actions
To summarize, a binary information. For your convinience, here are screenshots of that form:
Query form:
Yes:
No:
The log looks like this:
21:26, 29 April 2020 Martin Urbanec talk contribs block checked if User:Martin Urbanec had two-factor authentication enabled (test)
and is available only to those who can view 2FA enrollment status (as-of today, no one, once this gets resolved, the stewards).
Comment Actions
To summarize, a binary information. For your convinience, here are screenshots of that form:
Query form:
Yes:
No:
The log looks like this:
21:26, 29 April 2020 Martin Urbanec talk contribs block checked if User:Martin Urbanec had two-factor authentication enabled (test)
and is available only to those who can view 2FA enrollment status (as-of today, no one, once this gets resolved, the stewards).
Staff should be able to get access via the global group?
Comment Actions
To clarify, this ticket is about the stewards only. Traditionally, the stewards don't change staff's power without direct request to do so made by the Foundation. So, if and how staff will have this depends on further discussion and is out of scope. I hope this makes sense.
Comment Actions
Just spoke with Jan and the privacy team in Legal, and both are comfortable with proceeding in applying this right to the Stewards group.
I'm not sure about the staff thing just yet. I don't think it is necessary since those who need this data can access it through the databases.
Comment Actions
Change 593286 merged by jenkins-bot:
[operations/mediawiki-config@master] Assign oathauth-verify-user to stewards
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2020-04-30T23:05:41Z] <urbanecm@deploy1001> Synchronized wmf-config/InitialiseSettings.php: SWAT: cf5f7ff: Assign oathauth-verify-user to stewards (T251447) (duration: 01m 05s)