Add a configuration setting that makes 2FA available to a configurable percentage of users. Users who already have the oathauth-enable right through their membership in a group should continue to have access to 2FA regardless.
Description
Description
Details
Details
Related Changes in Gerrit:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T411737 Remove oathauth-tester messages | |||
| Open | None | T411360 cleanup - depopuplate global oathauth-tester group | |||
| Open | None | T166622 Allow all users on all wikis to use OATHAuth | |||
| Open | Mstyles | T399664 Expand 2FA Opt-In Privileges | |||
| Resolved | Mstyles | T400579 Add ability to make 2FA available to N% of users |
Event Timeline
Comment Actions
As discussed in the parent task (T399664), I think the best way to do this would be a UserGetRights hook listener that adds the oathauth-enable right based on the last two digits of the user's central user ID.
Comment Actions
@Bugreporter notifying users that they have access to 2FA is a part of later work once we ensure that increasing access is not too much load on support or anything else.
Comment Actions
Change #1174049 had a related patch set uploaded (by Mstyles; author: Mstyles):
[operations/mediawiki-config@master] OATHAuth: Add Config Variable
Comment Actions
Change #1174062 had a related patch set uploaded (by Mstyles; author: Mstyles):
[mediawiki/extensions/OATHAuth@master] incremental 2FA rollout
Comment Actions
Change #1174062 merged by jenkins-bot:
[mediawiki/extensions/OATHAuth@master] Support incremental 2FA rollout
Comment Actions
Change #1174049 merged by jenkins-bot:
[operations/mediawiki-config@master] OATHAuth: Enable 2FA opt-in for 10% of users
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-08T20:19:51Z] <mstyles@deploy1003> Started scap sync-world: Backport for [[gerrit:1174049|OATHAuth: Enable 2FA opt-in for 10% of users (T400579)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-08T20:26:12Z] <mstyles@deploy1003> mstyles: Backport for [[gerrit:1174049|OATHAuth: Enable 2FA opt-in for 10% of users (T400579)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-08T20:33:22Z] <mstyles@deploy1003> Finished scap sync-world: Backport for [[gerrit:1174049|OATHAuth: Enable 2FA opt-in for 10% of users (T400579)]] (duration: 13m 28s)