Enforce 2FA for all users on private wikis in WMF production
Open, In Progress, MediumPublic
Actions

Assigned To

Authored By

	Catrope
	Wed, Jun 3, 10:37 PM

Project Tags

Referenced Files

None

Subscribers

Description

Once the technical capability exists (T420792), we should require all users on private wikis to have 2FA.

Phase 1: inactive private wikis (late June 2026)
- advisorswiki
- auditcomwiki
- boardgovcomwiki
- chairwiki
- ecwikimedia
- execwiki
- fdcwiki
- grantswiki
- iegcomwiki
- ilwikimedia
- internalwiki
- movementroleswiki
- noboard_chapterswikimedia
- projectcomwiki
- searchcomwiki
- spcomwiki
- transitionteamwiki
- wg_enwiki
Phase 2: WMF-internal wikis (time TBD)
- collabwiki
- legalteamwiki
- officewiki
...other phases TBD
- arbcom_cswiki
- arbcom_dewiki
- arbcom_enwiki
- arbcom_fiwiki
- arbcom_itwiki
- arbcom_nlwiki
- arbcom_plwiki
- arbcom_ruwiki
- arbcom_zhwiki
- boardwiki
- chapcomwiki
- checkuserwiki
- conductwiki
- electcomwiki
- id_internalwikimedia
- ombudsmenwiki
- otrs_wikiwiki
- stewardwiki
- sysop_itwiki
- sysop_plwiki
- techconductwiki
- u4cwiki
- wikimaniateamwiki

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	Set $wmgOATHAuthRequire2FAForAll = true for various private wikis	operations/mediawiki-config	master	+5 -0
	Set $wmgOATHAuthRequire2FAForAll = true for all private wikis	operations/mediawiki-config	master	+0 -4

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
In Progress	Reedy	T428103 Enforce 2FA for all users on private wikis in WMF production
Open	None	T420792 Allow 2FA to be enforced for all accounts on a private wiki
Resolved	Reedy	T423899 Create maintenance script to send notifications that they need to enable 2FA for continued access to the wiki
Resolved	Reedy	T423900 Create notification to tell users they need to enable 2FA on the wiki
Resolved	mszwarc	T424252 Create a maintenance script to make 2FA stats for a wiki (non blocked users)
Open	None	T428738 Create wrapper around Recover2FAForUser to send to all users that don't have 2FA
Resolved	Reedy	T424251 Make a maintenance script version of Special:Recover2FAForUser
Open	None	T428739 Refactor expiring recovery codes (and ExpiringRecoveryCodeGenerator) to allow user to only have expiring recovery codes for intial 2FA
Resolved	Reedy	T428754 Don't necessarily require a confirmed email on ExpiringRecoveryCodeGenerator
Open	None	T428795 Confirm/handle adding initial 2FA codes to createAndPromote.php
Open	None	T428980 Managing 2FA after logging in with a recovery code should not require another recovery code
Resolved	Reedy	T428104 Notify users on phase 1 private wikis that 2FA enforcement is coming
Open	None	T428737 Create a page to be used for $wgOATH2FARequiredGroupRemovalPages for private wikis

Event Timeline

Catrope created this task.Wed, Jun 3, 10:37 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptWed, Jun 3, 10:37 PM

Catrope added a subtask: T420792: Allow 2FA to be enforced for all accounts on a private wiki.Wed, Jun 3, 10:37 PM

JJMC89 changed the task status from Open to Stalled.Wed, Jun 3, 10:39 PM

JJMC89 edited projects, added: Wikimedia-Site-requests; removed: MediaWiki-extensions-OATHAuth.

Catrope created subtask T428104: Notify users on phase 1 private wikis that 2FA enforcement is coming.Wed, Jun 3, 10:39 PM

Johannnes89 subscribed.Thu, Jun 4, 6:30 AM

HouseBlaster subscribed.Fri, Jun 5, 2:13 AM

sbassett changed the task status from Stalled to In Progress.Tue, Jun 9, 4:37 PM

sbassett triaged this task as Medium priority.

sbassett moved this task from Incoming to In Progress on the Security-Team board.

sbassett added a project: SecTeam-Processed.

sbassett changed the status of subtask T428104: Notify users on phase 1 private wikis that 2FA enforcement is coming from Open to In Progress.

Reedy closed subtask T428104: Notify users on phase 1 private wikis that 2FA enforcement is coming as Resolved.Tue, Jun 9, 9:33 PM

Change #1299644 had a related patch set uploaded (by Reedy; author: Reedy):

[operations/mediawiki-config@master] Set $wmgOATHAuthRequire2FAForAll = true for various private wikis

https://gerrit.wikimedia.org/r/1299644

Change #1299645 had a related patch set uploaded (by Reedy; author: Reedy):

[operations/mediawiki-config@master] Set $wmgOATHAuthRequire2FAForAll = true for all private wikis

https://gerrit.wikimedia.org/r/1299645

Reedy created subtask T428737: Create a page to be used for $wgOATH2FARequiredGroupRemovalPages for private wikis.Wed, Jun 10, 11:44 AM

Reedy updated the task description. (Show Details)Wed, Jun 10, 12:07 PM

Restricted Application added subscribers: ZhaoFJx, Stang. · View Herald TranscriptWed, Jun 10, 12:07 PM

JJMC89 awarded a token.Wed, Jun 10, 2:57 PM

Enforce 2FA for all users on private wikis in WMF productionOpen, In Progress, MediumPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

Enforce 2FA for all users on private wikis in WMF production
Open, In Progress, MediumPublic
Actions

Related Objects
Search...