FY25-26 Q4: Phase 1 of 2FA enforcement in Wikimedia production
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	mszwarc
	Apr 13 2026, 11:34 AM

Description

Per the timeline published on Meta-Wiki, in April 2026, the following groups will have 2FA enforced:

editor (only on foundationwiki)
oauthadmin
steward (initially local group, the global group will be affected gradually as work on T410076 progresses; there's no separate schedule for global stewards)
translationadmin (only on foundationwiki)

Acceptance criteria

Pre-enforcement: (can be done well before)

WikimediaMessages contains relevant messages in form: userrights-restricted-group-<name> and userrights-restricted-group-<name>-private-conditions
$wgOATH2FARequiredGroupRemovalPages is properly configured to address the newly-enforced groups (only for groups that are revoked by someone else than stewards)

Enforcement:

The listed groups can be assigned only to users with 2FA enabled
The listed groups are automatically revoked from members who don't have 2FA

(the criteria don't apply to global steward group)

Details

Related Changes in Gerrit:

Subject	Repo	Branch	Lines +/-
Enforce 2FA requirements for phase 1 groups	operations/mediawiki-config	master	+15 -0
Prepare $wgOATH2FARequiredGroupRemovalPages for next groups	operations/mediawiki-config	master	+3 -1
Add messages related to mandatory 2FA for more groups	mediawiki/extensions/WikimediaMessages	master	+25 -1

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Open	None	T150898 Force OATHAuth (2FA) for certain user groups in Wikimedia production and Beta wikis
Open	None	T423116 FY25-26 Q4: 2FA enforcement for local and global groups in Wikimedia production
Resolved	ASanford-WMF	T423118 FY25-26 Q4: Phase 1 of 2FA enforcement in Wikimedia production

Event Timeline

mszwarc created this task.Apr 13 2026, 11:34 AM

mszwarc updated the task description. (Show Details)Apr 13 2026, 11:39 AM

Change #1270411 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1270411

gerritbot added a project: Patch-For-Review.Apr 13 2026, 11:52 AM

The list of users at risk of demotion in Phase 1 is here (already shared with stewards before):
{P90318}

Change #1270411 merged by jenkins-bot:

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1270411

Maintenance_bot removed a project: Patch-For-Review.Apr 13 2026, 8:30 PM

ReleaseTaggerBot added a project: MW-1.46-notes (1.46.0-wmf.24; 2026-04-14).Apr 13 2026, 9:00 PM

Change #1270772 had a related patch set uploaded (by Mszwarc; author: Mszwarc):

[operations/mediawiki-config@master] Prepare $wgOATH2FARequiredGroupRemovalPages for next groups

https://gerrit.wikimedia.org/r/1270772

gerritbot added a project: Patch-For-Review.Apr 14 2026, 7:05 AM

Change #1270772 merged by jenkins-bot:

[operations/mediawiki-config@master] Prepare $wgOATH2FARequiredGroupRemovalPages for next groups

https://gerrit.wikimedia.org/r/1270772

Mentioned in SAL (#wikimedia-operations) [2026-04-14T07:10:01Z] <mszwarc@deploy1003> Started scap sync-world: Backport for [[gerrit:1270772|Prepare $wgOATH2FARequiredGroupRemovalPages for next groups (T423118)]]

Mentioned in SAL (#wikimedia-operations) [2026-04-14T07:15:40Z] <mszwarc@deploy1003> mszwarc: Backport for [[gerrit:1270772|Prepare $wgOATH2FARequiredGroupRemovalPages for next groups (T423118)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-04-14T07:22:38Z] <mszwarc@deploy1003> Finished scap sync-world: Backport for [[gerrit:1270772|Prepare $wgOATH2FARequiredGroupRemovalPages for next groups (T423118)]] (duration: 12m 36s)

mszwarc updated the task description. (Show Details)Apr 14 2026, 7:23 AM

Maintenance_bot removed a project: Patch-For-Review.Apr 14 2026, 7:31 AM

Change #1271001 had a related patch set uploaded (by Catrope; author: Catrope):

[operations/mediawiki-config@master] Enforce 2FA requirements for phase 1 groups

https://gerrit.wikimedia.org/r/1271001

gerritbot added a project: Patch-For-Review.Apr 14 2026, 4:58 PM

Change #1271001 merged by jenkins-bot:

[operations/mediawiki-config@master] Enforce 2FA requirements for phase 1 groups

https://gerrit.wikimedia.org/r/1271001

Mentioned in SAL (#wikimedia-operations) [2026-04-14T20:49:30Z] <catrope@deploy1003> Started scap sync-world: Backport for [[gerrit:1270933|Update wikimaniawiki namespace search (T423278)]], [[gerrit:1271001|Enforce 2FA requirements for phase 1 groups (T423118)]]

Mentioned in SAL (#wikimedia-operations) [2026-04-14T20:51:22Z] <catrope@deploy1003> catrope, robertsky: Backport for [[gerrit:1270933|Update wikimaniawiki namespace search (T423278)]], [[gerrit:1271001|Enforce 2FA requirements for phase 1 groups (T423118)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2026-04-14T20:56:58Z] <catrope@deploy1003> Finished scap sync-world: Backport for [[gerrit:1270933|Update wikimaniawiki namespace search (T423278)]], [[gerrit:1271001|Enforce 2FA requirements for phase 1 groups (T423118)]] (duration: 07m 28s)