Create Task
Maniphest T423119

FY25-26 Q4: Phase 2 of 2FA enforcement in Wikimedia production
Open, Needs TriagePublic
Actions

Description

Per the timeline published on Meta-Wiki, in May 2026, the following groups will have 2FA enforced:

  • arbcom
  • bureaucrat (only on private and fishbowl wikis)

Acceptance criteria

Pre-enforcement: (can be done well before)

  • WikimediaMessages contains relevant messages in form: userrights-restricted-group-<name> and userrights-restricted-group-<name>-private-conditions
  • $wgOATH2FARequiredGroupRemovalPages is properly configured to address the newly-enforced groups (only for groups that are revoked by someone else than stewards)

Enforcement:

  • The listed groups can be assigned only to users with 2FA enabled
  • The listed groups are automatically revoked from members who don't have 2FA

Details

Related Changes in Gerrit:
SubjectRepoBranchLines +/-
Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3operations/mediawiki-configmaster+11 -0
Enforce 2FA requirements for phase 2 groupsoperations/mediawiki-configmaster+16 -0
Add messages related to mandatory 2FA for more groupsmediawiki/extensions/WikimediaMessageswmf/1.47.0-wmf.1+25 -13
Add messages related to mandatory 2FA for more groupsmediawiki/extensions/WikimediaMessagesmaster+25 -13
Customize query in gerrit

Related Objects
Search...

Event Timeline

mszwarc created this task.Apr 13 2026, 11:34 AM
Restricted Application added a subscriber: ZhaoFJx. · View Herald TranscriptApr 13 2026, 11:34 AM
mszwarc moved this task from Inbox to Later sprints on the Product Safety and Integrity board.Apr 13 2026, 11:53 AM
mszwarc mentioned this in T391699: Add functionality to disallow bureaucrats who do not have 2fa enabled to grant certain privileged rights/groups.Apr 13 2026, 12:20 PM
ASanford-WMF subscribed.Mon, Apr 27, 7:23 PM

{P91692}

Johannnes89 subscribed.Mon, Apr 27, 7:49 PM
AntiCompositeNumber subscribed.Fri, May 1, 2:21 AM
HouseBlaster subscribed.Fri, May 1, 3:09 AM
gerritbot added a comment.Fri, May 1, 3:56 PM

Change #1281533 had a related patch set uploaded (by Alex.sanford; author: Alex.sanford):

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mndatory 2FA for more groups

https://gerrit.wikimedia.org/r/1281533

gerritbot added a project: Patch-For-Review.Fri, May 1, 3:56 PM
gerritbot added a comment.Mon, May 4, 7:06 PM

Change #1281533 abandoned by Alex.sanford:

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mandatory 2FA for more groups

Reason:

Prevent accidental merge

https://gerrit.wikimedia.org/r/1281533

gerritbot added a comment.Mon, May 4, 7:07 PM

Change #1281533 restored by Alex.sanford:

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1281533

gerritbot added a comment.Tue, May 5, 7:37 AM

Change #1281533 merged by jenkins-bot:

[mediawiki/extensions/WikimediaMessages@master] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1281533

ReleaseTaggerBot added a project: MW-1.47-notes (1.47.0-wmf.2; 2026-05-12).Tue, May 5, 8:01 AM
gerritbot added a comment.Tue, May 5, 3:22 PM

Change #1283028 had a related patch set uploaded (by Alex.sanford; author: Alex.sanford):

[mediawiki/extensions/WikimediaMessages@wmf/1.47.0-wmf.1] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1283028

gerritbot added a comment.Wed, May 6, 1:12 PM

Change #1283028 merged by jenkins-bot:

[mediawiki/extensions/WikimediaMessages@wmf/1.47.0-wmf.1] Add messages related to mandatory 2FA for more groups

https://gerrit.wikimedia.org/r/1283028

Stashbot added a comment.Wed, May 6, 1:13 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-06T13:13:20Z] <alexsanford@deploy1003> Started scap sync-world: Backport for [[gerrit:1283028|Add messages related to mandatory 2FA for more groups (T423119)]]

Stashbot added a comment.Wed, May 6, 1:31 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-06T13:31:07Z] <alexsanford@deploy1003> alexsanford: Backport for [[gerrit:1283028|Add messages related to mandatory 2FA for more groups (T423119)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Wed, May 6, 1:44 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-06T13:44:14Z] <alexsanford@deploy1003> Finished scap sync-world: Backport for [[gerrit:1283028|Add messages related to mandatory 2FA for more groups (T423119)]] (duration: 30m 53s)

ASanford-WMF updated the task description. (Show Details)Wed, May 6, 1:46 PM

i18n messages updated in https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaMessages/+/1281533

ReleaseTaggerBot edited projects, added MW-1.47-notes (1.47.0-wmf.1; 2026-05-05); removed MW-1.47-notes (1.47.0-wmf.2; 2026-05-12).Wed, May 6, 2:00 PM
gerritbot added a comment.Mon, May 11, 8:39 PM

Change #1285905 had a related patch set uploaded (by Alex.sanford; author: Alex.sanford):

[operations/mediawiki-config@master] Enforce 2FA requirements for phase 2 groups

https://gerrit.wikimedia.org/r/1285905

gerritbot added a comment.Tue, May 12, 7:25 PM

Change #1286469 had a related patch set uploaded (by Alex.sanford; author: Alex.sanford):

[operations/mediawiki-config@master] Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3

https://gerrit.wikimedia.org/r/1286469

gerritbot added a comment.Tue, May 12, 8:03 PM

Change #1285905 merged by jenkins-bot:

[operations/mediawiki-config@master] Enforce 2FA requirements for phase 2 groups

https://gerrit.wikimedia.org/r/1285905

gerritbot added a comment.Tue, May 12, 8:03 PM

Change #1286469 merged by jenkins-bot:

[operations/mediawiki-config@master] Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3

https://gerrit.wikimedia.org/r/1286469

Stashbot mentioned this in T423120: FY25-26 Q4: Phase 3 of 2FA enforcement in Wikimedia production.Tue, May 12, 8:03 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-12T20:03:35Z] <alexsanford@deploy1003> Started scap sync-world: Backport for [[gerrit:1285905|Enforce 2FA requirements for phase 2 groups (T423119)]], [[gerrit:1286469|Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3 (T423119 T423120)]]

Stashbot added a comment.Tue, May 12, 8:05 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-12T20:05:31Z] <alexsanford@deploy1003> alexsanford: Backport for [[gerrit:1285905|Enforce 2FA requirements for phase 2 groups (T423119)]], [[gerrit:1286469|Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3 (T423119 T423120)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Stashbot added a comment.Tue, May 12, 8:15 PM

Mentioned in SAL (#wikimedia-operations) [2026-05-12T20:15:22Z] <alexsanford@deploy1003> Finished scap sync-world: Backport for [[gerrit:1285905|Enforce 2FA requirements for phase 2 groups (T423119)]], [[gerrit:1286469|Prepare $wgOATH2FARequiredGroupRemovalPages for phases 2 and 3 (T423119 T423120)]] (duration: 11m 47s)

ASanford-WMF updated the task description. (Show Details)Tue, May 12, 8:16 PM
Izno subscribed.Tue, May 26, 1:13 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits