Maniphest T368468

Cannot switch 2FA method between TOTP and WebAuthn: InvalidArgumentException: User already has a key from a different module enabled (totp)
Closed, ResolvedPublicPRODUCTION ERROR
Actions

Description

Steps to replicate the issue:

Set up 2FA using TOTP or WebAuthn using Special:Manage Two-factor authentication (e.g. on enwiki)
On Special:Manage Two-factor authentication, under "Switch to an alternative method", select "Enable" for the method that was not set up
Go through login and 2FA confirmation process
Confirm switching method (click button)
Go through setup process for new method

What happens?:

An error message is shown:

[c4fa815b-f152-4751-87fd-2e0305ef9bbf] Fatal exception of type "InvalidArgumentException"

What should have happened instead?:

The 2FA method should have been switched.

Other information (browser name/version, screenshots, etc.):

I have tried this (including using different WebAuthn keys) on these platforms:

Chrome / Chrome OS 126.0.6478.120
Firefox 127.0.1 on Debian 12.5

Error

mwversion: 1.43.0-wmf.10
reqId: c4fa815b-f152-4751-87fd-2e0305ef9bbf
Find reqId in Logstash

normalized_message

[{reqId}] {exception_url}   InvalidArgumentException: User already has a key from a different module enabled (totp)

exception.trace

from /srv/mediawiki/php-1.43.0-wmf.10/extensions/OATHAuth/src/OATHUserRepository.php(162)
#0 /srv/mediawiki/php-1.43.0-wmf.10/extensions/WebAuthn/src/Authenticator.php(330): MediaWiki\Extension\OATHAuth\OATHUserRepository->createKey(MediaWiki\Extension\OATHAuth\OATHUser, MediaWiki\Extension\WebAuthn\Module\WebAuthn, array, string)
#1 /srv/mediawiki/php-1.43.0-wmf.10/extensions/WebAuthn/src/HTMLForm/WebAuthnAddKeyForm.php(74): MediaWiki\Extension\WebAuthn\Authenticator->continueRegistration(stdClass)
#2 [internal function]: MediaWiki\Extension\WebAuthn\HTMLForm\WebAuthnAddKeyForm->onSubmit(array, MediaWiki\Extension\WebAuthn\HTMLForm\WebAuthnAddKeyForm)
#3 /srv/mediawiki/php-1.43.0-wmf.10/includes/htmlform/HTMLForm.php(792): call_user_func(array, array, MediaWiki\Extension\WebAuthn\HTMLForm\WebAuthnAddKeyForm)
#4 /srv/mediawiki/php-1.43.0-wmf.10/includes/htmlform/HTMLForm.php(673): MediaWiki\HTMLForm\HTMLForm->trySubmit()
#5 /srv/mediawiki/php-1.43.0-wmf.10/includes/htmlform/HTMLForm.php(689): MediaWiki\HTMLForm\HTMLForm->tryAuthorizedSubmit()
#6 /srv/mediawiki/php-1.43.0-wmf.10/extensions/OATHAuth/src/HTMLForm/OATHAuthOOUIHTMLForm.php(81): MediaWiki\HTMLForm\HTMLForm->show()
#7 /srv/mediawiki/php-1.43.0-wmf.10/extensions/OATHAuth/src/Special/OATHManage.php(247): MediaWiki\Extension\OATHAuth\HTMLForm\OATHAuthOOUIHTMLForm->show(NULL)
#8 /srv/mediawiki/php-1.43.0-wmf.10/extensions/OATHAuth/src/Special/OATHManage.php(185): MediaWiki\Extension\OATHAuth\Special\OATHManage->addCustomContent(MediaWiki\Extension\WebAuthn\Module\WebAuthn)
#9 /srv/mediawiki/php-1.43.0-wmf.10/extensions/OATHAuth/src/Special/OATHManage.php(105): MediaWiki\Extension\OATHAuth\Special\OATHManage->addModuleHTML(MediaWiki\Extension\WebAuthn\Module\WebAuthn)
#10 /srv/mediawiki/php-1.43.0-wmf.10/includes/specialpage/SpecialPage.php(719): MediaWiki\Extension\OATHAuth\Special\OATHManage->execute(NULL)
#11 /srv/mediawiki/php-1.43.0-wmf.10/includes/specialpage/SpecialPageFactory.php(1694): MediaWiki\SpecialPage\SpecialPage->run(NULL)
#12 /srv/mediawiki/php-1.43.0-wmf.10/includes/actions/ActionEntryPoint.php(502): MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#13 /srv/mediawiki/php-1.43.0-wmf.10/includes/actions/ActionEntryPoint.php(145): MediaWiki\Actions\ActionEntryPoint->performRequest()
#14 /srv/mediawiki/php-1.43.0-wmf.10/includes/MediaWikiEntryPoint.php(200): MediaWiki\Actions\ActionEntryPoint->execute()
#15 /srv/mediawiki/php-1.43.0-wmf.10/index.php(58): MediaWiki\MediaWikiEntryPoint->run()
#16 /srv/mediawiki/w/index.php(3): require(string)
#17 {main}

Impact

Notes

Details

MediaWiki Version: 1.43.0-wmf.10
Request URL: https://en.wikipedia.org/wiki/Special:Manage_Two-factor_authentication

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
Fix multi-key handling	Reedy	mediawiki/extensions/WebAuthn	REL1_43	+40 -69
Fix multi-key handling	Reedy	mediawiki/extensions/WebAuthn	REL1_44	+40 -69
Fix multi-key handling	Gergő Tisza	mediawiki/extensions/WebAuthn	master	+40 -69
Stop trying to disable other modules before enabling WebAuthn	Majavah	mediawiki/extensions/WebAuthn	master	+0 -11

Customize query in gerrit

Related Objects
Search...

Status	Subtype	Assigned	Task
Resolved	PRODUCTION ERROR	Tgr	T368468 Cannot switch 2FA method between TOTP and WebAuthn: InvalidArgumentException: User already has a key from a different module enabled (totp)
Resolved		taavi	T242031 Allow multiple different 2FA devices
Resolved		Reedy	T268564 Convert OATHAuth to AbstractSchema
Resolved		taavi	T330502 Create oathauth_types and oathauth_devices tables
Resolved		Marostegui	T348693 Drop oathauth_users table from production

Event Timeline

Tol created this task.Jun 25 2024, 10:49 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 25 2024, 10:50 PM

Pppery added a project: Wikimedia-production-error.Jun 25 2024, 11:44 PM

I was able to duplicate this error using another account (TolTest), which did not previously have 2FA enabled. I also found that this error occurs when switching between 2FA methods in either way (TOTP to WebAuthn or WebAuthn to TOTP).

Tol renamed this task from Cannot switch 2FA method from TOTP to WebAuthn to Cannot switch 2FA method between TOTP and WebAuthn.Jun 26 2024, 2:57 AM

Tol updated the task description. (Show Details)

Hi @Tol, thanks for taking the time to report this! Please file text as text so text can be searched for; text as an image cannot be searched for. :)

Aklapper renamed this task from Cannot switch 2FA method between TOTP and WebAuthn to Cannot switch 2FA method between TOTP and WebAuthn: InvalidArgumentException: User already has a key from a different module enabled (totp).Jun 26 2024, 9:10 AM

Aklapper updated the task description. (Show Details)

Aklapper changed the subtype of this task from "Bug Report" to "Production Error".

Aklapper set Request URL to https://en.wikipedia.org/wiki/Special:Manage_Two-factor_authentication.

Aklapper set Release Version to 1.43.0-wmf.10.

In T368468#9925395, @Aklapper wrote:

Hi @Tol, thanks for taking the time to report this! Please file text as text so text can be searched for; text as an image cannot be searched for. :)

Ah; sorry. I didn't realise the purpose of the UUID there. I'll remember this for next time; thanks for letting me know!

Krinkle added a project: MediaWiki-Platform-Team.Jul 25 2024, 3:24 PM

Krinkle moved this task from Untriaged to Jun 2024 on the Wikimedia-production-error board.

In T368468#9924559, @Bugreporter wrote:

See also: T354701: Enable migration of WebAuthn credentials to central domain by @Tgr

It's not really related to that. Probably caused by the one of patches from T242031: Allow multiple different 2FA devices?

@taavi could you check this issue? Looks like it's related to our previous 2FA work. I'll be happy to review it.

• larissagaulia moved this task from Inbox, needs triage to Radar on the MediaWiki-Platform-Team board.Jul 30 2024, 2:54 PM

• larissagaulia edited projects, added: MediaWiki-Platform-Team (Radar); removed: MediaWiki-Platform-Team.

Please don't assign tasks to people without asking first; I'll try to have a look at this at some point but my time at the moment is rather limited and this is quite low on my list of interests at the moment so I don't want to create the appearance I'm actively working on it.

Reedy moved this task from Backlog to Bugs on the MediaWiki-extensions-OATHAuth board.Aug 31 2024, 4:22 PM

Tgr added a parent task: T242031: Allow multiple different 2FA devices.Sep 30 2024, 10:03 AM

This issue has been reported on Miraheze's Phorge: https://issue-tracker.miraheze.org/T12944

Error

mwversion: 1.44.0-wmf.20
reqId: 86a6dc8a-447e-41d6-ad1c-fa20a570000c
Find reqId in Logstash

normalized_message

[{reqId}] {exception_url}   InvalidArgumentException: User already has a key from a different module enabled (webauthn)

Frame	Location	Call
from	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/OATHUserRepository.php(163)
#0	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/HTMLForm/TOTPEnableForm.php(266)	MediaWiki\Extension\OATHAuth\OATHUserRepository->createKey(MediaWiki\Extension\OATHAuth\OATHUser, MediaWiki\Extension\OATHAuth\Module\TOTP, array, string)
#1	/srv/mediawiki/php-1.44.0-wmf.20/includes/htmlform/HTMLForm.php(824)	MediaWiki\Extension\OATHAuth\HTMLForm\TOTPEnableForm->onSubmit(array, MediaWiki\Extension\OATHAuth\HTMLForm\TOTPEnableForm)
#2	/srv/mediawiki/php-1.44.0-wmf.20/includes/htmlform/HTMLForm.php(705)	MediaWiki\HTMLForm\HTMLForm->trySubmit()
#3	/srv/mediawiki/php-1.44.0-wmf.20/includes/htmlform/HTMLForm.php(721)	MediaWiki\HTMLForm\HTMLForm->tryAuthorizedSubmit()
#4	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/HTMLForm/OATHAuthOOUIHTMLForm.php(81)	MediaWiki\HTMLForm\HTMLForm->show()
#5	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/Special/OATHManage.php(246)	MediaWiki\Extension\OATHAuth\HTMLForm\OATHAuthOOUIHTMLForm->show(null)
#6	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/Special/OATHManage.php(184)	MediaWiki\Extension\OATHAuth\Special\OATHManage->addCustomContent(MediaWiki\Extension\OATHAuth\Module\TOTP)
#7	/srv/mediawiki/php-1.44.0-wmf.20/extensions/OATHAuth/src/Special/OATHManage.php(102)	MediaWiki\Extension\OATHAuth\Special\OATHManage->addModuleHTML(MediaWiki\Extension\OATHAuth\Module\TOTP)
#8	/srv/mediawiki/php-1.44.0-wmf.20/includes/specialpage/SpecialPage.php(729)	MediaWiki\Extension\OATHAuth\Special\OATHManage->execute(null)
#9	/srv/mediawiki/php-1.44.0-wmf.20/includes/specialpage/SpecialPageFactory.php(1737)	MediaWiki\SpecialPage\SpecialPage->run(null)
#10	/srv/mediawiki/php-1.44.0-wmf.20/includes/actions/ActionEntryPoint.php(503)	MediaWiki\SpecialPage\SpecialPageFactory->executePath(string, MediaWiki\Context\RequestContext)
#11	/srv/mediawiki/php-1.44.0-wmf.20/includes/actions/ActionEntryPoint.php(145)	MediaWiki\Actions\ActionEntryPoint->performRequest()
#12	/srv/mediawiki/php-1.44.0-wmf.20/includes/MediaWikiEntryPoint.php(202)	MediaWiki\Actions\ActionEntryPoint->execute()
#13	/srv/mediawiki/php-1.44.0-wmf.20/index.php(58)	MediaWiki\MediaWikiEntryPoint->run()
#14	/srv/mediawiki/w/index.php(3)	require(string)
#15	{main}

Impact

Notes

Reedy merged a task: T389379: Cannot enable WebAuthn.Mar 19 2025, 4:32 PM

Reedy added a subscriber: Wellverywell.

MBH subscribed.Mar 19 2025, 5:20 PM

Change #1133116 had a related patch set uploaded (by Majavah; author: Majavah):

[mediawiki/extensions/WebAuthn@master] Stop trying to disable other modules before enabling WebAuthn

https://gerrit.wikimedia.org/r/1133116

gerritbot added a project: Patch-For-Review.Apr 1 2025, 12:09 PM

Change #1133116 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Stop trying to disable other modules before enabling WebAuthn

https://gerrit.wikimedia.org/r/1133116

Maintenance_bot removed a project: Patch-For-Review.Apr 6 2025, 9:30 PM

Change #1134383 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/OATHAuth@master] [WIP] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134383

gerritbot added a project: Patch-For-Review.Apr 6 2025, 9:40 PM

ReleaseTaggerBot added a project: MW-1.44-notes (1.44.0-wmf.24; 2025-04-08).Apr 6 2025, 10:00 PM

Change #1134384 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@master] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134384

Nikerabbit added a project: affects-translatewiki.net.Apr 17 2025, 2:54 PM

waldyrious subscribed.May 3 2025, 4:01 PM

jeremyb subscribed.May 4 2025, 11:27 AM

Nemoralis subscribed.May 6 2025, 2:48 PM

taavi removed a parent task: T242031: Allow multiple different 2FA devices.May 6 2025, 5:21 PM

taavi added a subtask: T242031: Allow multiple different 2FA devices.

ReaperDawn subscribed.May 22 2025, 7:34 AM

This still shows up in the logs for 1.45.0-wmf.1. Any chance the six week old patch by Tgr could get a review?

Not really. The tgr work is based on the Taavi patch, which is currently marked as (-2: Proof of concept). It won't be merged if we review it until https://gerrit.wikimedia.org/r/c/mediawiki/extensions/OATHAuth/+/1132632 gets merged. This error is caused because the entire feature of allowing different 2FA methods is missing — not because it's broken. If I remember right, the system allows having multiple 2FA methods only for the same module (like multiple WebAuthn keys only), but it's still missing the possibility of having multiple keys from multiple modules ( WebAuth key and the regular 6-digit code).

Before we can fix this, we need to tackle T242031 first. Another approach would be to prevent this from happening by hiding/blocking the button that allows having multiple keys.

The error is kind of intentional - we could actually remove it and let users add multiple methods by just removing a throw clause, but that would lead to more confusing errors in other workflows. We could replace it with a nicer error page, but we are so close to properly supporting multiple methods now that I don't think it's worth the effort.

Alex44019 subscribed.Jun 16 2025, 9:48 AM

Change #1134384 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] Fix multi-key handling

https://gerrit.wikimedia.org/r/1134384

ReleaseTaggerBot added a project: MW-1.45-notes (1.45.0-wmf.13; 2025-08-05).Jul 29 2025, 5:00 PM

In T368468#10849370, @Tgr wrote:

We could replace it with a nicer error page, but we are so close to properly supporting multiple methods now that I don't think it's worth the effort.

In hindsight that wasn't great judgement. But now we do have a nicer error page (are throwing an ErrorPageError rather than a generic exception).

Tgr closed this task as Resolved.Jul 29 2025, 9:03 PM

Tgr claimed this task.

Mstyles closed subtask T242031: Allow multiple different 2FA devices as Resolved.Aug 20 2025, 6:56 PM

Change #1190593 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@REL1_44] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190593

Change #1190606 had a related patch set uploaded (by Reedy; author: Gergő Tisza):

[mediawiki/extensions/WebAuthn@REL1_43] Fix multi-key handling

https://gerrit.wikimedia.org/r/1190606

Change #1190593 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_44] Fix multi-key handling