Extension:OATHAuth

From MediaWiki.org
Jump to navigation Jump to search
This extension comes with MediaWiki 1.31 and above. Thus you do not have to download it again. However, you still need to follow the other instructions provided.
MediaWiki extensions manualManual:Extensions
Crystal Clear action run.svg
OATHAuth

Release status:Extension status stable

ImplementationTemplate:Extension#type User rights, Special page, Page action
DescriptionTemplate:Extension#description Provides two-factor authentication for logging in
Author(s)Template:Extension#username Ryan Lane
Latest versionTemplate:Extension#version Continuous updates
Compatibility policyCompatibility#mediawiki_extensions master
MediaWikiTemplate:Extension#mediawiki 1.27+
Database changesTemplate:Extension#needs-updatephp Yes
LicenseTemplate:Extension#license GNU General Public License 2.0 or later
Download
ParametersTemplate:Extension#parameters
  • $wgOATHAuthWindowRadius
  • $wgOATHAuthDatabase
  • $wgOATHAuthSecret
  • $wgOATHAuthAccountPrefix
Added rightsTemplate:Extension#rights
  • oathauth-enable
  • oathauth-api-all
Hooks usedTemplate:Extension#hook
AuthChangeFormFieldsManual:Hooks/AuthChangeFormFields
TwoFactorIsEnabled
LoadExtensionSchemaUpdatesManual:Hooks/LoadExtensionSchemaUpdates
GetPreferencesManual:Hooks/GetPreferences

Translate the OATHAuth extension if it is available at translatewiki.net

Check usage and version matrix.

IssuesPhabricator

Open tasks · Report a bug

The OATHAuth extension is a time-based one-time password (TOTP) implementation. It provides two-factor authentication via something you have (your phone or desktop client) and something you know (your user name/password). Client support is available for most feature phones, smartphones and desktops (see Client implementations).

This extension has nothing to do with OAuth, which is a totally different protocol.

Usage[edit]

The help page on Two-factor authentication provides information for end users on how to use this extension. Howerver the special page used will also guide users.

Installation[edit]

  • Download and place the file(s) in a directory called OATHAuth in your extensions/ folder.
  • Add the following code at the bottom of your LocalSettings.php:
    wfLoadExtension( 'OATHAuth' );
    
  • Run the update script which will automatically create the necessary database tables that this extension needs.
  • Configure as required.
  • YesY Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Configuration[edit]

Parameters[edit]

Configuration Flag Default Value Description
$wgOATHAuthWindowRadius 4 The number of token windows in each direction that should be valid. This tells OATH to accept tokens for a range of effectively ((1 + 2 * $wgOATHAuthWindowRadius) * 30) seconds. This range of valid windows is centered around the current time. The purpose of this configuration variable is to account for differences between the user's clock and the server's clock. However, it is recommended to keep it as low as possible.
$wgOATHAuthDatabase false The database domain. Only used in a multi-database environment.
$wgOATHAuthSecret false The base OATHAuth secret for this wiki from which all encryption keys are derived. If false, the value of $wgSecretKey is used.
$wgOATHAuthAccountPrefix false The prefix used for the OATHAuth user account name and the issuer used for the account. If false, the value of $wgSitename is used.

User permission[edit]

Granting access to enable OATHAuth

Users should be given access to the oathauth-enable user right so that they can enable it at Special:OATHAuth (a link to which appears at Special:Preferences).

$wgGroupPermissions['user']['oathauth-enable'] = true;

The above will grant all registered users access to enable OATHAuth.

Administration[edit]

Resetting a user token

In the event that a user both loses their token generator AND the recovery tokens; two-factor authentication may be removed from the user by deleting their row from the oathauth_users database table. A sysadmin with shell access may type on a command line cd /path/to/mediawiki/extensions/OATHAuth/maintenance/ and then execute php disableOATHAuthForUser.php "<username>" where <username> is the user to have 2FA disabled to have it disabled.

See also[edit]