Page MenuHomePhabricator
Create Task
Maniphest T399644

FY2025-26 WE4.6.2 Multiple Authenticators
Open, Needs TriagePublic
Actions

Description

Epic to track the work related to multiple authenticators for Q1 FY2025-26.

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
Enable New UI and Multiple Module support for OATHAuth in Wikimedia productionSBassettoperations/mediawiki-configmaster+3 -0
CommonSettings-labs.php: Enable OATHAuth new UI and multiple module testingReedyoperations/mediawiki-configmaster+4 -0
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedReedyT405787 Remove temporary feature flags for MW 1.45 release
 OpenNoneT399644 FY2025-26 WE4.6.2 Multiple Authenticators
 DuplicateNoneT399645 Allow multiple TOTP and security keys on Special:OATH
 ResolvedCatropeT399647 Redesign 2FA login UX for multiple authenticator support
 ResolvedMstylesT399648 Default to WebAuthn when available during login 2FA check
 ResolvedsbassettT399649 Show enabled 2FA details on Special:AccountSecurity
 ResolvedsbassettT399652 Allow Auth factors to be deleted easily
 ResolvedsbassettT399653 Inform users about recovery codes
 ResolvedCatropeT399654 Ensure Mobile Apps are supported with 2FA changes
 ResolvedTsevenerT403820 [iOS] Add support for selectable TOTP module when logging in with MFA.
 ResolvedDbrantT403819 [Android] Add support for selectable TOTP module when logging in with MFA.
 ResolvedCatropeT405250 [Android] Verify production app login with 2FA continues to work with MFA
 ResolvedCatropeT405251 [iOS] Verify production app login with 2FA continues to work with MFA
ResolvedCatropeT399655 Ensure testability of Multiple Authentication
 ResolvedTBurmeisterT399657 Update existing 2FA documentation
 ResolvedTBurmeisterT399656 Clearly document 2FA reset process
 OpenNoneT255370 Document best practices for user login for different types of applications if using 2FA
 ResolvedTBurmeisterT409768 Standardize 2FA terminology usage across docs and UI
 ResolvedTBurmeisterT192260 Add a link to help page on all two-factor authentification process steps
 ResolvedsbassettT399959 Assess and review existing tasks and patches related to supporting WE 4.6.2 2fa Multiple Authenticators work
 ResolvedsbassettT232336 Separate recovery codes into a separate 2FA module
 ResolvedtaaviT242031 Allow multiple different 2FA devices
 ResolvedReedyT268564 Convert OATHAuth to AbstractSchema
 ResolvedtaaviT330502 Create oathauth_types and oathauth_devices tables
 ResolvedMarosteguiT348693 Drop oathauth_users table from production
 OpenNoneT353962 Add new notifications for additional 2FA being enabled/disabled
 In ProgressReedyT401771 Merge password and 2FA management into a single Special:AccountSecurity page when OATHAuth is installed
 ResolvedMstylesT401772 Allow TOTP auth methods to be named
 ResolvedMstylesT401773 Always redirect 2FA management special page to auth domain on SUL wikis, so that WebAuthn setup can be offered
 OpenNoneT376021 Migrate WebAuthn on Wikimedia wikis to central domain
 ResolvedpmiazgaT378402 Disallow setting up new WebAuthn passkeys on Wikimedia wikis
 ResolvedTgrT389064 Notify WebAuthn users about SUL3 changes
 ResolvedArielGlennT354701 Enable migration of WebAuthn credentials to central domain
 ResolvedNoneT248339 Decide how to deal with WebAuthn login/registration flow on Wikimedia wikis in future
 ResolvedReedyT248367 Update messages to notify WebAuthn users that they need to login on the same wiki they registered
 OpenNoneT405553 Email users to tell them to re-enable WebAuth on central domain (SUL3)
Restricted Task
 ResolvedCatropeT401774 Redesign UI for listing 2FA methods and adding new methods
 OpenNoneT401775 Allow 2FA methods to be renamed
 ResolvedsbassettT401776 Display recovery codes when setting up the user's first 2FA method, regardless of type
 ResolvedMstylesT401777 During login, allow multiple 2FA methods to be used, but prioritize WebAuthn if available
 ResolvedCatropeT402467 Allow users to enable multiple authenticator types
 ResolvedReedyT404363 Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices
 ResolvedsbassettT145915 OATHAuth OTP shouldn't be stored in cleartext in the DB
 ResolvedReedyT408297 Recovery codes aren't consumed when encryption is enabled
 ResolvedReedyT408305 Add/update maintenance script to encrypt existing recovery codes...
 ResolvedMstylesT404314 Redirect to Special:AccountSecurity once a new authentication method is added
 ResolvedReedyT404806 Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI
 ResolvedReedyT407057 Run MoveRecoveryCodesFromTOTP.php
 ResolvedReedyT405235 Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration
 ResolvedReedyT406953 Don't save scratch_tokens if empty array (like they are on new TOTP rows)
 ResolvedReedyT404807 Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI when no longer needed from CommonSettings-labs.php
 ResolvedMstylesT403666 Display creation timestamp of each key on Special:AccountSecurity
 OpenNoneT416159 Allow passkey to be named

Event Timeline

sbassett created this task.Jul 15 2025, 9:57 PM
Restricted Application added a subscriber: • Aklapper. · View Herald TranscriptJul 15 2025, 9:57 PM
sbassett edited projects, added: FY2025-26 WE4.6.2 Multiple Authenticators; removed: FY2025-26 WE 4.6 - Account Security.Jul 15 2025, 10:00 PM
Johannnes89 subscribed.Jul 15 2025, 10:34 PM
sbassett mentioned this in T172079: Allow OATHAuth users with 2FA already enabled to add / switch devices without disabling.Jul 22 2025, 5:23 PM
kostajh subscribed.Jul 27 2025, 7:30 PM
Tgr removed a subtask: T399651: Separate recovery codes into a separate module.Jul 31 2025, 4:49 PM
Tgr added a subtask: T232336: Separate recovery codes into a separate 2FA module.
sbassett closed subtask T399959: Assess and review existing tasks and patches related to supporting WE 4.6.2 2fa Multiple Authenticators work as Resolved.Aug 14 2025, 9:16 PM
Mstyles added a subtask: T353962: Add new notifications for additional 2FA being enabled/disabled.Aug 20 2025, 6:58 PM
Mstyles added a subtask: T401771: Merge password and 2FA management into a single Special:AccountSecurity page when OATHAuth is installed.
Mstyles added a subtask: T401772: Allow TOTP auth methods to be named.
Mstyles added a subtask: T401773: Always redirect 2FA management special page to auth domain on SUL wikis, so that WebAuthn setup can be offered.
Mstyles added a subtask: T401774: Redesign UI for listing 2FA methods and adding new methods.
Mstyles added a subtask: T401775: Allow 2FA methods to be renamed.Aug 20 2025, 7:00 PM
Mstyles added a subtask: T401776: Display recovery codes when setting up the user's first 2FA method, regardless of type.
Mstyles added a subtask: T401777: During login, allow multiple 2FA methods to be used, but prioritize WebAuthn if available.
sbassett changed the status of subtask T401771: Merge password and 2FA management into a single Special:AccountSecurity page when OATHAuth is installed from Open to In Progress.Aug 20 2025, 7:26 PM
Catrope closed subtask T402467: Allow users to enable multiple authenticator types as Resolved.Aug 26 2025, 7:23 PM
Catrope closed subtask T399654: Ensure Mobile Apps are supported with 2FA changes as Resolved.Sep 9 2025, 4:24 PM
sbassett added a subtask: T404363: Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices.Sep 11 2025, 2:33 PM
sbassett added a subtask: T404314: Redirect to Special:AccountSecurity once a new authentication method is added.
Catrope closed subtask T401774: Redesign UI for listing 2FA methods and adding new methods as Resolved.Sep 16 2025, 9:13 PM
gerritbot added a comment.Sep 16 2025, 11:31 PM

Change #1188904 had a related patch set uploaded (by Reedy; author: Reedy):

[operations/mediawiki-config@master] CommonSettings-labs.php: Enable OATHAuth new UI and multiple module testing

https://gerrit.wikimedia.org/r/1188904

gerritbot added a project: Patch-For-Review.Sep 16 2025, 11:31 PM
gerritbot added a comment.Sep 16 2025, 11:36 PM

Change #1188904 merged by jenkins-bot:

[operations/mediawiki-config@master] CommonSettings-labs.php: Enable OATHAuth new UI and multiple module testing

https://gerrit.wikimedia.org/r/1188904

Reedy added a subtask: T403666: Display creation timestamp of each key on Special:AccountSecurity.Sep 16 2025, 11:44 PM
Maintenance_bot removed a project: Patch-For-Review.Sep 17 2025, 12:30 AM
Mstyles closed subtask T401777: During login, allow multiple 2FA methods to be used, but prioritize WebAuthn if available as Resolved.Sep 19 2025, 5:48 PM
Mstyles closed subtask T399648: Default to WebAuthn when available during login 2FA check as Resolved.
sbassett changed the status of subtask T401776: Display recovery codes when setting up the user's first 2FA method, regardless of type from Open to In Progress.Sep 19 2025, 10:00 PM
sbassett changed the status of subtask T399647: Redesign 2FA login UX for multiple authenticator support from Open to In Progress.Sep 19 2025, 10:09 PM
sbassett closed subtask T399647: Redesign 2FA login UX for multiple authenticator support as Resolved.
sbassett changed the status of subtask T399649: Show enabled 2FA details on Special:AccountSecurity from Open to In Progress.Sep 19 2025, 10:12 PM
sbassett changed the status of subtask T399652: Allow Auth factors to be deleted easily from Open to In Progress.
sbassett changed the status of subtask T399653: Inform users about recovery codes from Open to In Progress.Sep 19 2025, 10:16 PM
sbassett changed the status of subtask T405235: Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration from Open to In Progress.Sep 28 2025, 2:12 PM
Mstyles closed subtask T404314: Redirect to Special:AccountSecurity once a new authentication method is added as Resolved.Sep 29 2025, 5:49 PM
sbassett closed subtask T232336: Separate recovery codes into a separate 2FA module as Resolved.Oct 3 2025, 8:38 PM
sbassett closed subtask T401776: Display recovery codes when setting up the user's first 2FA method, regardless of type as Resolved.Oct 3 2025, 8:50 PM
sbassett closed subtask T399653: Inform users about recovery codes as Resolved.Oct 3 2025, 8:53 PM
sbassett closed subtask T399652: Allow Auth factors to be deleted easily as Resolved.
sbassett closed subtask T399649: Show enabled 2FA details on Special:AccountSecurity as Resolved.
gerritbot added a comment.Oct 6 2025, 7:25 PM

Change #1193928 had a related patch set uploaded (by SBassett; author: SBassett):

[operations/mediawiki-config@master] Enable New UI and Multiple Module support for OATHAuth in Wikimedia production

https://gerrit.wikimedia.org/r/1193928

gerritbot added a project: Patch-For-Review.Oct 6 2025, 7:25 PM
gerritbot added a comment.Oct 9 2025, 8:35 PM

Change #1193928 merged by jenkins-bot:

[operations/mediawiki-config@master] Enable New UI and Multiple Module support for OATHAuth in Wikimedia production

https://gerrit.wikimedia.org/r/1193928

Stashbot added a comment.Oct 9 2025, 8:37 PM

Mentioned in SAL (#wikimedia-operations) [2025-10-09T20:37:58Z] <reedy@deploy2002> Started scap sync-world: Backport for [[gerrit:1193928|Enable New UI and Multiple Module support for OATHAuth in Wikimedia production (T399644)]]

Stashbot added a comment.Oct 9 2025, 8:42 PM

Mentioned in SAL (#wikimedia-operations) [2025-10-09T20:42:04Z] <reedy@deploy2002> reedy, sbassett: Backport for [[gerrit:1193928|Enable New UI and Multiple Module support for OATHAuth in Wikimedia production (T399644)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Oct 9 2025, 8:58 PM

Mentioned in SAL (#wikimedia-operations) [2025-10-09T20:57:59Z] <reedy@deploy2002> Finished scap sync-world: Backport for [[gerrit:1193928|Enable New UI and Multiple Module support for OATHAuth in Wikimedia production (T399644)]] (duration: 20m 04s)

Maintenance_bot removed a project: Patch-For-Review.Oct 9 2025, 9:31 PM
A_smart_kitten mentioned this in T404029: Enable multiple 2FA modules in production.Oct 11 2025, 11:53 AM
Reedy closed subtask T401773: Always redirect 2FA management special page to auth domain on SUL wikis, so that WebAuthn setup can be offered as Resolved.Oct 11 2025, 3:46 PM
Reedy changed the status of subtask T404807: Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI when no longer needed from CommonSettings-labs.php from Open to In Progress.Oct 14 2025, 7:18 PM
TBurmeister changed the status of subtask T399657: Update existing 2FA documentation from Open to In Progress.Oct 21 2025, 7:01 PM
TBurmeister removed a subtask: T399656: Clearly document 2FA reset process.
Catrope closed subtask T399655: Ensure testability of Multiple Authentication as Resolved.Oct 22 2025, 4:56 AM
Reedy closed subtask T405235: Create MediaWiki maintenance script to migrate older TOTP devices to modern TOTP + Recovery Codes configuration as Resolved.Oct 22 2025, 10:25 PM
Reedy changed the status of subtask T404806: Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI from Open to In Progress.Oct 22 2025, 10:54 PM
Reedy closed subtask T404807: Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI when no longer needed from CommonSettings-labs.php as Resolved.Oct 22 2025, 11:17 PM
Catrope closed subtask T403666: Display creation timestamp of each key on Special:AccountSecurity as Resolved.Oct 27 2025, 11:22 PM
Catrope closed subtask T401772: Allow TOTP auth methods to be named as Resolved.Oct 29 2025, 5:43 PM
Reedy closed subtask T404806: Remove $wgOATHAllowMultipleModules and $wgOATHAuthNewUI as Resolved.Nov 3 2025, 4:27 PM
TBurmeister closed subtask T399657: Update existing 2FA documentation as Resolved.Dec 5 2025, 5:28 PM
• Aklapper added a subtask: T416159: Allow passkey to be named.Feb 2 2026, 2:25 PM
andritolion subscribed.Mar 12 2026, 3:11 PM

As far as I can tell, I can't find an issue mentioning this. The default name of passkeys is just Passkey -> Passkey #2 -> Passkey #2 #3 -> Passkey #2 #3 #4 and so on. I have *many* authenticators and the default name is starting to get quite long.

EMill-WMF subscribed.Mar 12 2026, 3:12 PM

@andritolion What kind of authenticators are you using?

andritolion added a comment.EditedMar 12 2026, 3:14 PM

@EMill-WMF, I have many YubiKeys, a Cryptnox Fido smartcard, and multiple other physical Fido authenticators all registered as passkeys. (Fido2 resident key)

EMill-WMF added a comment.Mar 13 2026, 7:08 PM

@andritolion Thanks - we do have https://phabricator.wikimedia.org/T416159 for this, as a subtask here. It is planned at some point, we plan to lean more heavily on passkeys over the next few months.

Reedy closed subtask T404363: Set OATHSecretKey value within Wikimedia production and migrate older 2fa data within oathauth_devices as Resolved.Mar 18 2026, 7:56 PM
Chlod mentioned this in T429278: beta: /enwiki/wiki/Special:AccountSecurity UnexpectedValueException: More than one recovery codes instance was found in the database for this user..Jun 16 2026, 4:19 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits