Release status: stable
|Implementation||User rights, Special page, Page action|
|Description||An HMAC based One Time Password extension, providing two-factor authentication.|
|Latest version||0.2.2 (2016-10-11)|
|License||GNU General Public License 2.0 or later|
Translate the OATHAuth extension if it is available at translatewiki.net
|Check usage and version matrix.|
|Open tasks · Report a bug|
The OATHAuth extension is a time-based one-time password (TOTP) implementation. It provides two-factor authentication via something you have (your phone or desktop client) and something you know (your user name/password). Client support is available for most feature phones, smartphones and desktops (see Client implementations). This extension has nothing to do with OAuth, which is a totally different protocol.
- Download and place the file(s) in a directory called
- Add the following code at the bottom of your LocalSettings.php:
wfLoadExtension( 'OATHAuth' );
- Run the update script which will automatically create the necessary database tables that this extension needs.
- Done - Navigate to Special:Version on your wiki to verify that the extension is successfully installed.
To users running MediaWiki 1.26 or earlier:
The instructions above describe the new way of installing this extension using
wfLoadExtension() If you need to install this extension on these earlier versions (MediaWiki 1.26 and earlier), instead of
wfLoadExtension( 'OATHAuth' );, you need to use:
Resetting a user token
In the event that a user both loses their token generator AND the recovery tokens; two-factor authentication may be removed from the user by deleting their row from the
oathauth_users database table.
- 0.1.0 - May 9, 2012
- Initial version
- Missing functionality to act as a standalone extension, currently reuses a hook in LdapAuthentication. Standalone support to come in next version.
- 0.2.0 - March 28, 2014
- Added use of TwoFactorIsEnabled hook
- Switched from using ChainAuth hook to using AbortChangePassword and AbortLogin hooks
- Added use of $wgRedactedFunctionArguments variable
- 0.2.1 - May 11, 2014
- Code-base cleanup
- 0.2.2 - October 11, 2016
- Switch to using extension.json
- Added "oathvalidate" API action
- Added caching of OATH tokens
- Added SQLite support
- Removed support for pre-AuthManager MediaWiki
- Help:Two-factor authentication
- Wikimedia Security Team/Two-factor Authentication for CentralAuth wikis
- meta:Help:Two-factor authentication
|This extension is being used on one or more Wikimedia projects. This probably means that the extension is stable and works well enough to be used by such high-traffic websites. Look for this extension's name in Wikimedia's CommonSettings.php and InitialiseSettings.php configuration files to see where it's installed. A full list of the extensions installed on a particular wiki can be seen on the wiki's Special:Version page.|