Udvidelse:OATHAuth

This page is a translated version of the page Extension:OATHAuth and the translation is 17% complete.

Other languages:

English • ‎Türkçe • ‎dansk • ‎polski • ‎中文 • ‎日本語

Ikke at forveksle med Extension:OAuth.

This extension comes with MediaWiki 1.31 and above. Thus you do not have to download it again. However, you still need to follow the other instructions provided.

**MediaWiki extensions manual**
OATHAuth Release status: stabil

Implementation	User rights , Special page , Page action
Beskrivelse	Provides two-factor authentication for logging in
Forfatter(e)	Ryan Lane
Latest version	Continuous updates
Compatibility policy	master
MediaWiki	1.29+
Database changes	Ja
Tabeller	oathauth_users
Licens	GPL-2.0-or-later AND GPL-3.0-or-later
Download	Download extension Git ^[?]: Download Git master browse repository (GitHub) commit history repository contributors (GitHub) code review
Parametre $wgOATHExclusiveRights $wgOATHAuthWindowRadius $wgOATHAuthSecret $wgOATHAuthAccountPrefix $wgOATHAuthDatabase
Added rights oathauth-enable oathauth-api-all oathauth-disable-for-user oathauth-verify-user oathauth-view-log
Hooks used AuthChangeFormFields GetPreferences LoadExtensionSchemaUpdates TwoFactorIsEnabled getUserPermissionsErrors
Translate the OATHAuth extension if it is available at translatewiki.net
Check usage and version matrix.
Issues	Open tasks · Report a bug

The OATHAuth extension is a time-based one-time password (TOTP) implementation. It provides two-factor authentication via something you have (your phone or desktop client) and something you know (your user name/password). Client support is available for most feature phones, smartphones and desktops (see Client implementations).

This extension has nothing to do with OAuth, which is a totally different protocol.

Usage

The help page on Two-factor authentication provides information for end users on how to use this extension. However the special page used will also guide users.

Installation

Download and place the file(s) in a directory called OATHAuth in your extensions/ folder.
Only when installing from git run Composer to install PHP dependencies, by issuing composer install --no-dev in the extension directory. (See task T173141 for potential complications.)
Add the following code at the bottom of your LocalSettings.php:
```
wfLoadExtension( 'OATHAuth' );
```
Run the update script which will automatically create the necessary database tables that this extension needs.
Configure as required.
Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Configuration

Parametre

Configuration Flag	Standardværdi	Beskrivelse
`$wgOATHAuthWindowRadius`	`4`	The number of token windows in each direction that should be valid. This tells OATH to accept tokens for a range of effectively `((1 + 2 * $wgOATHAuthWindowRadius) * 30)` seconds. This range of valid windows is centered around the current time. The purpose of this configuration variable is to account for differences between the user's clock and the server's clock. However, it is recommended to keep it as low as possible.
`$wgOATHAuthDatabase`	`false`	Databasedomæmet. Only used in a multi-database environment.
`$wgOATHAuthSecret`	`false`	The base OATHAuth secret for this wiki from which all encryption keys are derived. If `false`, the value of `$wgSecretKey` is used.
`$wgOATHAuthAccountPrefix`	`false`	The prefix used for the OATHAuth user account name and the issuer used for the account. If `false`, the value of `$wgSitename` is used.
`$wgOATHExclusiveRights`	`[]`	Set of permissions that are revoked from users who did not log in using two-factor authentication.

OATHAuth also adds a key to the $wgRateLimits array to define rate limits for authentication attempts:

		'badoath' => [
			'&can-bypass' => false,
			'user' => [ 10, 60 ],
			'user-global' => [ 10, 60 ],
		]

Note that the user-global key is available only since 1.35. Earlier version have to rely on user and perhaps ip-all. See the documentation of $wgRateLimits for details.

User permission

Granting access to enable OATHAuth

Users should be given access to the oathauth-enable user right so that they can enable it at Special:OATHAuth (a link to which appears at Special:Preferences).

$wgGroupPermissions['user']['oathauth-enable'] = true;

The above will grant all registered users access to enable OATHAuth.

Administration

Resetting a user token

In the event that a user both loses their token generator AND the recovery tokens; two-factor authentication may be removed from the user by deleting their row from the oathauth_users database table. A sysadmin with shell access may type on a command line cd /path/to/mediawiki/extensions/OATHAuth/maintenance/ and then execute php disableOATHAuthForUser.php "username" where "username" is the user to have 2FA disabled to have it disabled.

Se også

This extension is being used on one or more Wikimedia projects. This probably means that the extension is stable and works well enough to be used by such high-traffic websites. Look for this extension's name in Wikimedia's CommonSettings.php and InitialiseSettings.php configuration files to see where it's installed. A full list of the extensions installed on a particular wiki can be seen on the wiki's Special:Version page.