select gu_name, gu_email from globaluser where gu_id in (select oad_user from oathauth_devices where oad_type = (select oat_id from oathauth_types where oat_name = 'webauthn'));

Action needed to keep your Wikimedia WebAuthn login working

Hi! You are receiving this message because you are one of the few people using WebAuthn (two-factor login via a hardware key or smartphone or certain operating system features) for authentication on Wikimedia websites.

Wikimedia wikis are switching to a unified login domain (auth.wikimedia.org). WebAuthn passkeys are bound to a specific domain and become invalid once you have to log in via a different domain. WebAuthn isn't fully supported on Wikimedia wikis, the number of people using it is tiny, and building a migration workflow would have been a considerable amount of work, so we are just asking everyone to manually replace or remove WebAuthn passkeys.

(This email is somewhat late - we started switching wikis to use the new login domain a week ago, and you should have been notified then, but due to some unexpected issues with how WebAuthn worked on the new domain, this has been delayed. I apologize for any inconvenience this might have caused.)

== Instructions for logging in with your old WebAuthn passkey ==

If your wiki user account uses WebAuthn and you need to log in, you can log in as follows:

* Visit the wiki where you normally log in.
* Get the web address of the login page, e.g. by right-clicking "Log in" in the top right corner of the page and choosing "Copy link address" or similar.
* Append `&usesul3=0` to the copied address, and use this address to log in.

For example, on English Wikipedia, you might use https://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page&usesul3=0 to log in.

== Instructions for removing your old WebAuthn passkey ==

* Visit the user preferences page on the wiki where you normally log in.
* Click "Manage" next to "Two-factor authentication: Web Authentication (WebAuthn)"
* Click "Disable" next to "Web Authentication (WebAuthn)"
* Click "Confirm and continue"
* Perform the second-factor check (e.g. insert the hardware key, or tap your mobile phone)

== Instructions for adding a new passkey on the new, central authentication domain ==

Once you have removed your old passkey, you can add a new one that is for the central domain as follows:

* Visit https://auth.wikimedia.org/metawiki/wiki/Special:Manage_Two-factor_authentication
* You will probably need to log in again
* Click "Enable" next to "Web Authentication (WebAuthn)"
* Enter a nickname for the new passkey
* Follow your browser's instructions for selecting and using an authentication device

== Instructions for logging in with your new WebAuthn passkey ==

We are rolling out the use of the new domain gradually, so depending on various factors, you might or might not get the central auth.wikimedia.org domain when you try to log in. Your new passkey will only work on this domain. To ensure you always get the new domain:

* Visit the wiki where you normally log in.
* Get the web address of the login page, e.g. by right-clicking "Log in" in the top right corner of the page and choosing "Copy link address" or similar.
* Append `&usesul3=1` to the copied address, and use this address to log in.

For example, on English Wikipedia, you might use https://en.wikipedia.org/w/index.php?title=Special:UserLogin&returnto=Main+Page&usesul3=1 to log in.

The rollout will take about a week; after that, login will always use the new central domain, and you don't need to do anything special for WebAuthn to work. (This will also fix the longstanding problem with WebAuthn where you had to initiate login on one specific wiki for it to work.)

== Feedback & more information ==

For more information about the new central login domain, see the project page:
https://www.mediawiki.org/wiki/MediaWiki_Platform_Team/SUL3

To report problems with these instructions, or for other kinds of feedback about this email, you can use the relevant task in our issue tracker:
https://phabricator.wikimedia.org/T389064

or you can just reply to this email (though using the task would be preferable).

----
Gergő Tisza
software engineer, Wikimedia Foundation / MediaWiki Platform Team

32c32,37
< require_once __DIR__ . '/WikimediaMaintenance.php';
---
> $IP = getenv( 'MW_INSTALL_PATH' );
> if ( $IP === false ) {
> 	$IP = __DIR__ . '/../../..';
> }
> 
> require_once "$IP/extensions/WikimediaMaintenance/WikimediaMaintenance.php";
235c240
< 		if ( !$user->canReceiveEmail() ) {
---
> 		if ( !$user->isEmailConfirmed() ) {

mwscript /home/tgr/T389064/sendBulkEmails.php --wiki=metawiki \
    --subject 'Action needed to keep your Wikimedia WebAuthn login working' \
    --body /home/tgr/T389064/body.txt \
    --from 'Tgr (WMF)' \
    --to /home/tgr/T389064/users-with-webauthn.txt
  | tee email-log.txt

Action needed to keep your Wikimedia WebAuthn login working (correction)

Hi again,

a correction to the previous email: going to
https://auth.wikimedia.org/metawiki/wiki/Special:Manage_Two-factor_authentication
to set up WebAuthn on the new central domain only works if you have 2FA permissions on Meta-Wiki, but many people only have that on once specific wiki. In that case, you need to go to
https://auth.wikimedia.org/<wikiid>/wiki/Special:Manage_Two-factor_authentication
where <wikiid> is the short identifier (also known as the wiki ID or database name) for the wiki where you normally log in with WebAuthn; e.g. for English Wikipedia it's
https://auth.wikimedia.org/enwiki/wiki/Special:Manage_Two-factor_authentication

(If you aren't sure what is the short identifier for your wiki, you can look it up at https://db-names.toolforge.org/ - you can type the domain name in the search bar at the top; the value you'll need is in the "Database name" column.)

Also note that having multiple two-factor mechanisms at the same time is not yet supported. If you are going to switch between WebAuthn and TOTP, you need to fully disable the active one before enabling the other, even though the user interface looks like you could do it in a single step. WebAuthn is still experimental, and this is one of the unfinished parts.

Sorry for the confusion.