Extension:OATHAuth

From mediawiki.org
Translate this page; This page contains changes which are not marked for translation.
Not to be confused with Extension:OAuth.
This extension comes with MediaWiki 1.31 and above. Thus you do not have to download it again. However, you still need to follow the other instructions provided.
MediaWiki extensions manual
OATHAuth
Release status: stable
Implementation User rights , Special page , Page action
Description Provides two-factor authentication for logging in
Author(s) Ryan Lane
Latest version Continuous updates
Compatibility policy Snapshots releases along with MediaWiki. Master is not backward compatible.
MediaWiki >= 1.42
Database changes Yes
Tables oathauth_users
License GPL-2.0-or-later AND GPL-3.0-or-later
Download
  • $wgOATHRequiredForGroups
  • $wgOATHAuthWindowRadius
  • $wgOATHExclusiveRights
  • $wgOATHAuthAccountPrefix
  • $wgOATHAuthDatabase

  • oathauth-enable
  • oathauth-api-all
  • oathauth-disable-for-user
  • oathauth-view-log
  • oathauth-verify-user
Quarterly downloads 113 (Ranked 58th)
Public wikis using 1,459 (Ranked 205th)
Translate the OATHAuth extension if it is available at translatewiki.net
Issues Open tasks · Report a bug

The OathAuth extension provides two-factor authentication support. By default, this includes a time-based one-time password (TOTP) implementation that allows users to generate 2FA codes from their phone or desktop app. Client support is available for most feature phones, smartphones and desktops.

This extension has nothing to do with OAuth, which is a totally different protocol.

Usage[edit]

The help page on Two-factor authentication provides information for end users on how to use this extension. However the special page used will also guide users.

Installation[edit]

  • Download and move the extracted OATHAuth folder to your extensions/ directory.
    Developers and code contributors should install the extension from Git instead, using:cd extensions/
    git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth
  • Only when installing from Git, run Composer to install PHP dependencies, by issuing composer install --no-dev in the extension directory. (See task T173141 for potential complications.)
  • Add the following code at the bottom of your LocalSettings.php file:
    wfLoadExtension( 'OATHAuth' );
    
  • Run the update script which will automatically create the necessary database tables that this extension needs.
  • Configure as required.
  • It is strongly recommended to setup caching when using OATHAuth. This will improve performance, but also the security of your wiki if you're using OATHAuth. If you are only running one application/web server and have php-apcu installed, and no specific cache configured, MediaWiki will likely fallback to using APCu. If you are using multiple application/web server it is advised to setup local cluster caching that can be used by all hosts. Examples include Memcached .
  • Yes Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Configuration[edit]

Parameters[edit]

Configuration Flag Default Value Description
$wgOATHAuthWindowRadius 4 The number of token windows in each direction that should be valid.

This tells OATH to accept tokens for a range of effectively ((1 + 2 * $wgOATHAuthWindowRadius) * 30) seconds. This range of valid windows is centered around the current time. The purpose of this configuration variable is to account for differences between the user's clock and the server's clock. However, it is recommended to keep it as low as possible.

$wgOATHAuthDatabase false The database domain. Only used in a multi-database environment.
$wgOATHAuthSecret false The base OATHAuth secret for this wiki from which all encryption keys are derived.

If false, the value of $wgSecretKey is used.

$wgOATHAuthAccountPrefix false The prefix used for the OATHAuth user account name and the issuer used for the account.

If false, the value of $wgSitename is used.

$wgOATHExclusiveRights [] Set of permissions that are revoked from users who did not log in using two-factor authentication.
$wgOATHRequiredForGroups [] Sets a list of user groups that are required to have two-factor authentication enabled. Use 'user' if you want all logged in users to be required to have two-factor authentication enabled.

OATHAuth also adds a key to the $wgRateLimits array to define rate limits for authentication attempts:

		'badoath' => [
			'&can-bypass' => false,
			'user' => [ 10, 60 ],
			'user-global' => [ 10, 60 ],
		]

Note that the user-global key is available only since 1.35. Earlier version have to rely on user and perhaps ip-all. See the documentation of $wgRateLimits for details.

User permission[edit]

Granting access to enable OATHAuth

Users should be given access to the oathauth-enable user right so that they can enable it at Special:OATHAuth (a link to which appears at Special:Preferences).

$wgGroupPermissions['user']['oathauth-enable'] = true;

The above will grant all registered users access to enable OATHAuth.

Administration[edit]

Resetting a user token[edit]

In the event that a user both loses their token generator and the recovery tokens, two-factor authentication may be removed from the user by running the disableOATHAuthForUser maintenance script:

MediaWiki version:
1.40
$ ./maintenance/run OATHAuth:disableOATHAuthForUser <user>
MediaWiki version:
1.39
$ php ./extensions/OATHAuth/maintenance/disableOATHAuthForUser.php <user>

Where ‎<user> is the name of the user to have 2FA disabled.

Shared database tables[edit]

When using shared database tables, i.e. same set of users for different wikis, add oathauth_devices and oathauth_types to $wgSharedTables.

$wgSharedTables[] = 'oathauth_devices';
$wgSharedTables[] = 'oathauth_types';

See also[edit]