Maniphest T421852

Drop $wgOATHRequiredForGroups and related code
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Reedy
	Mar 31 2026, 9:15 AM

Project Tags

Referenced Files

None

Subscribers

Description

https://codesearch.wmcloud.org/search/?q=OATHRequiredForGroups&files=&excludeFiles=&repos=

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Drop $wgOATHRequiredForGroups	mediawiki/extensions/OATHAuth	master	+1 -133
	extension.json: Mark $wgOATHRequiredForGroups as deprecated	mediawiki/extensions/OATHAuth	master	+1 -1

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Resolved		Reedy	T421852 Drop $wgOATHRequiredForGroups and related code
		Resolved		mszwarc	T390386 Be able to force OATHAuth for certain global user groups
		Resolved		mszwarc	T410076 Allow technically enforcing policies for restricted global groups
		Resolved		mszwarc	T422119 Check restricted global groups when granting
		Resolved		mszwarc	T422123 Support declaring conditions for global groups
		Resolved		mszwarc	T422133 Make GlobalGroupAssignmentService check conditions for global groups
		Resolved		mszwarc	T422138 Reflect the group restrictions on Special:GlobalUserRights
		Resolved		mszwarc	T422605 Add 'scope' option in $wgRestrictedGroups
		Resolved		mszwarc	T423074 Prevent members of a 2FA-enforced global group from disabling 2FA
		Resolved		mszwarc	T423075 Display global group restrictions on Special:GlobalGroupPermissions
		Resolved		mszwarc	T423686 Add support for disabled global groups
		Resolved		mszwarc	T423687 Extract permission management from CentralAuthUser
		Resolved		mszwarc	T423855 Move permission management from SpecialGlobalGroupPermissions into GlobalGroupLookup
		Resolved		mszwarc	T425395 Add a script to demote ineligible users from restricted global groups
		Resolved		Reedy	T424558 Document how to replace $wgOATHRequiredForGroups usages

Event Timeline

Reedy created this task.Mar 31 2026, 9:15 AM

Restricted Application added a project: Product Safety and Integrity. · View Herald TranscriptMar 31 2026, 9:15 AM

Restricted Application added a subscriber: Aklapper. · View Herald Transcript

Reedy mentioned this in T396061: Groups requiring 2FA via $wgOATHRequiredForGroups do not clearly warn users without 2FA that their permissions were truncated.Mar 31 2026, 9:15 AM

Reedy added a subtask: T390386: Be able to force OATHAuth for certain global user groups.

A_smart_kitten subscribed.Mar 31 2026, 1:04 PM

Reedy updated the task description. (Show Details)Apr 1 2026, 12:24 PM

Reedy moved this task from Backlog to Features/Improvements on the MediaWiki-extensions-OATHAuth board.Apr 1 2026, 12:34 PM

Do we need to deprecate it first? Or can we just do it (after doing T424558)...

WMF usages are replaced, translatewiki.net still uses it...

Change #1277655 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] extension.json: Mark as deprecated

https://gerrit.wikimedia.org/r/1277655

gerritbot added a project: Patch-For-Review.Apr 27 2026, 5:43 PM

Change #1277669 had a related patch set uploaded (by Reedy; author: Reedy):

[mediawiki/extensions/OATHAuth@master] Drop $wgOATHRequiredForGroups

https://gerrit.wikimedia.org/r/1277669

Reedy closed subtask T424558: Document how to replace $wgOATHRequiredForGroups usages as Resolved.Apr 27 2026, 6:27 PM

Change #1277655 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] extension.json: Mark $wgOATHRequiredForGroups as deprecated

https://gerrit.wikimedia.org/r/1277655

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.26; 2026-04-28).Apr 27 2026, 10:00 PM

Change #1277669 merged by jenkins-bot:

[mediawiki/extensions/OATHAuth@master] Drop $wgOATHRequiredForGroups

https://gerrit.wikimedia.org/r/1277669

ReleaseTaggerBot added a project: MW-1.47-notes (1.47.0-wmf.1; 2026-05-05).Apr 29 2026, 12:01 AM

Maintenance_bot removed a project: Patch-For-Review.Apr 29 2026, 12:31 AM

Reedy closed this task as Resolved.May 4 2026, 1:18 PM

Reedy claimed this task.

mszwarc mentioned this in T418581: Remove or deprecate 2FA-enforcing code from OATHAuth.May 5 2026, 8:22 AM

mszwarc closed subtask T390386: Be able to force OATHAuth for certain global user groups as Resolved.Wed, May 27, 7:49 AM