Product Safety and Integrity is going to remove 2FA-less users from groups that require 2FA by policy. First, we are going to notify these users, by e-mail and using an on-wiki notification.
We'll use a similar approach to the one used for sending the BoT 2025 elections notification.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Restricted Task | |||||
| Open | None | T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis | |||
| Resolved | mszwarc | T414907 Enforce 2FA-requiring groups using $wgRestrictedGroups | |||
| Resolved | mszwarc | T418580 Deploy 2FA requirement using $wgRestrictedGroups to Wikimedia production, instead of OATHAuth's custom config | |||
| Resolved | mszwarc | T419111 Send Echo notification to 2FA-less users who are required to have 2FA |
Change #1248473 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@master] Add a script to send mandatory 2FA Echo notification
The patch has been accepted; moving to Ready, waiting for the notification to be sent to wikis (which will happen next week)
Change #1248473 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@master] Add a script to send mandatory 2FA Echo notification
Change #1248806 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.18] Add a script to send mandatory 2FA Echo notification
Change #1248806 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.18] Add a script to send mandatory 2FA Echo notification
Mentioned in SAL (#wikimedia-operations) [2026-03-09T07:02:23Z] <mszwarc@deploy2002> Started scap sync-world: Backport for [[gerrit:1248806|Add a script to send mandatory 2FA Echo notification (T419111)]], [[gerrit:1248821|Set $wgOATH2FARequiredGroupRemovalPages for interface-admins (T417880)]]
Mentioned in SAL (#wikimedia-operations) [2026-03-09T07:22:30Z] <mszwarc@deploy2002> mszwarc: Backport for [[gerrit:1248806|Add a script to send mandatory 2FA Echo notification (T419111)]], [[gerrit:1248821|Set $wgOATH2FARequiredGroupRemovalPages for interface-admins (T417880)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Mentioned in SAL (#wikimedia-operations) [2026-03-09T07:37:04Z] <mszwarc@deploy2002> Finished scap sync-world: Backport for [[gerrit:1248806|Add a script to send mandatory 2FA Echo notification (T419111)]], [[gerrit:1248821|Set $wgOATH2FARequiredGroupRemovalPages for interface-admins (T417880)]] (duration: 34m 41s)
Change #1249095 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@master] Hide 2fa-warning Echo category from preferences
Change #1249095 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@master] Hide 2fa-warning Echo category from preferences
Change #1249291 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.18] Hide 2fa-warning Echo category from preferences
Change #1249291 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.18] Hide 2fa-warning Echo category from preferences
Mentioned in SAL (#wikimedia-operations) [2026-03-09T14:29:40Z] <mszwarc@deploy2002> Started scap sync-world: Backport for [[gerrit:1249291|Hide 2fa-warning Echo category from preferences (T419111)]]
Mentioned in SAL (#wikimedia-operations) [2026-03-09T14:31:26Z] <mszwarc@deploy2002> mszwarc: Backport for [[gerrit:1249291|Hide 2fa-warning Echo category from preferences (T419111)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Mentioned in SAL (#wikimedia-operations) [2026-03-09T14:35:47Z] <mszwarc@deploy2002> Finished scap sync-world: Backport for [[gerrit:1249291|Hide 2fa-warning Echo category from preferences (T419111)]] (duration: 06m 07s)
Change #1249898 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@master] Send2FAWarningNotifications: Support reading users from file
Change #1249898 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@master] Send2FAWarningNotifications: Support reading users from file
Change #1250066 had a related patch set uploaded (by Mszwarc; author: Mszwarc):
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.19] Send2FAWarningNotifications: Support reading users from file
Change #1250066 merged by jenkins-bot:
[mediawiki/extensions/WikimediaMessages@wmf/1.46.0-wmf.19] Send2FAWarningNotifications: Support reading users from file
Mentioned in SAL (#wikimedia-operations) [2026-03-11T07:36:46Z] <mszwarc@deploy2002> Started scap sync-world: Backport for [[gerrit:1249921|Display list of 2FA-req. groups on AccountSecurity for 2FA-less users (T419422)]], [[gerrit:1250066|Send2FAWarningNotifications: Support reading users from file (T419111)]]
Mentioned in SAL (#wikimedia-operations) [2026-03-11T07:56:08Z] <mszwarc@deploy2002> mszwarc: Backport for [[gerrit:1249921|Display list of 2FA-req. groups on AccountSecurity for 2FA-less users (T419422)]], [[gerrit:1250066|Send2FAWarningNotifications: Support reading users from file (T419111)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Mentioned in SAL (#wikimedia-operations) [2026-03-11T08:09:53Z] <mszwarc@deploy2002> Finished scap sync-world: Backport for [[gerrit:1249921|Display list of 2FA-req. groups on AccountSecurity for 2FA-less users (T419422)]], [[gerrit:1250066|Send2FAWarningNotifications: Support reading users from file (T419111)]] (duration: 33m 07s)