Extensão:OATHAuth

Not to be confused with Extension:OAuth.

This extension comes with MediaWiki 1.31 and later, so you do not need to download it. The remaining configuration instructions must still be followed.

Manual de extensões do MediaWiki

OATHAuth Estado de lançamento: estável
Implementação	Direitos do utilizador , Página espacial , Ação de página
Descrição	Fornece a autenticação de dois fatores para iniciar a sessão
Autor(es)	Ryan Lane
Última versão	Atualizações contínuas
Política de compatibilidade	Lançamentos de capturas de ecrã junto com o MediaWiki. Original não é compatível com versões anteriores.
Alterações à base de dados	Sim
Tabelas	oathauth_types oathauth_devices oathauth_users
Licença	GPL-2.0-or-later AND GPL-3.0-or-later
Transferência	Download extension Git [?]: Browse repository (Phabricator · GitHub) Gerrit code review Git commit log Download source tarball
Parâmetros $wgOATHAuthWindowRadius $wgOATHRequiredForGroups $wgOATHAuthAccountPrefix $wgOATHExclusiveRights
Permissões adicionadas oathauth-enable oathauth-api-all oathauth-disable-for-user oathauth-view-log oathauth-verify-user
Hooks utilizados AuthChangeFormFields GetPreferences LoadExtensionSchemaUpdates UnitTestsAfterDatabaseSetup UnitTestsBeforeDatabaseTeardown UserEffectiveGroups UserGetRights getUserPermissionsErrors
Quarterly downloads	37 (Ranked 27th)
Public wikis using	1,459 (Ranked 205th)
Traduza a extensão OATHAuth se ela estiver disponível em translatewiki.net
Problemas	Tarefas em aberto · Reportar um erro

The OATHAuth extension provides two-factor authentication support. By default, this includes a time-based one-time password (TOTP) implementation that allows users to generate 2FA codes from their phone or desktop app. Client support is available for most feature phones, smartphones, and desktops.

This extension has nothing to do with OAuth, which is a totally different protocol.

Utilização

The help page on Two-factor authentication provides information for end users on how to use this extension. However, the special page will also guide users.

Instalação

Aviso:

There is a bug with this extension where it does not update properly from the web (mw-config) updater and must instead use the update.php command line update script (phab:T371849)

• Exporte e coloque o ficheiro, ou ficheiros, num diretório chamado OATHAuth, na sua pasta extensions/.
  Developers and code contributors should install the extension from Git instead, using:

  cd extensions/
  git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth
  

• Only when installing from Git, run Composer to install PHP dependencies, by issuing composer install --no-dev in the extension directory. (See T173141 for potential complications.)
• Acrescente o seguinte código ao fundo do ficheiro $LocalSettings:

  wfLoadExtension( 'OATHAuth' );
  

• Execute o script de atualização que irá criar automaticamente as tabelas da base de dados necessárias para esta extensão.
• Configure conforme necessário.
• It is strongly recommended to setup caching when using OATHAuth. This will improve performance, but also the security of your wiki if you're using OATHAuth. If you are only running one application/web server and have php-apcu installed, and no specific cache configured, MediaWiki will likely fallback to using APCu. If you are using multiple application/web server it is advised to set up local cluster caching that all hosts can use. Examples include Memcached .
• Pronto – Na página especial Special:Version da sua wiki verifique se a extensão foi instalada.

Configuração

Parâmetros

Configuration Flag	Valor Predefinido	Descrição
$wgOATHAuthWindowRadius	4	The number of token windows in each direction that should be valid. This tells OATH to accept tokens for a range of effectively ((1 + 2 * $wgOATHAuthWindowRadius) * 30) seconds. This range of valid windows is centered around the current time. The purpose of this configuration variable is to account for differences between the user's and server's clock. However, keeping it as low as possible is recommended.
$wgOATHAuthDatabase	false	(deprecated) The database domain. Only used in a multi-database environment. After MediaWiki 1.42, you should use $wgVirtualDomainsMapping['virtual-oathauth'] instead of this option.
$wgOATHAuthSecret	false	The base OATHAuth secret for this wiki from which all encryption keys are derived. If false, the value of $wgSecretKey is used.
$wgOATHAuthAccountPrefix	false	The prefix used for the OATHAuth user account name and the issuer used for the account. If false, the value of $wgSitename is used.
$wgOATHExclusiveRights	[]	Set of permissions that are revoked from users who did not login using two-factor authentication.
$wgOATHRequiredForGroups	[]	Sets a list of user groups that are required to have two-factor authentication enabled. Use 'user' if you want all logged-in users required to enable two-factor authentication.

OATHAuth also adds a key to the $wgRateLimits array to define rate limits for authentication attempts:

		'badoath' => [
			'&can-bypass' => false,
			'user' => [ 10, 60 ],
			'user-global' => [ 10, 60 ],
		]

Note that the user-global key is available only since 1.35. Earlier version have to rely on user and perhaps ip-all. See the documentation of $wgRateLimits for details.

Permissão do utilizador

Granting access to enable OATHAuth

Users should be given access to the oathauth-enable user right so that they can enable it at Special:OATHAuth (a link to which appears at Special:Preferences).

$wgGroupPermissions['user']['oathauth-enable'] = true;

The above will grant all registered users access to enable OATHAuth.

Administração

Resetting a user token

If a user loses both their token generator and the recovery tokens, two-factor authentication may be removed from the user by running the disableOATHAuthForUser maintenance script:

Versão MediaWiki:

1.40

$ ./maintenance/run OATHAuth:disableOATHAuthForUser <user>

Versão MediaWiki:

≤ 1.39

$ php ./extensions/OATHAuth/maintenance/disableOATHAuthForUser.php <user>

Where ‎<user> is the name of the user to have 2FA disabled.

Shared database tables

Some Wikis may want to share the 2FA data amongst multiple Wikis. Shared database tables , the previous method for doing so is deprecated in MediaWiki 1.42 and later. For new wiki-farm installations where you want users to share their 2FA token amongst multiple wikis, please use $wgVirtualDomainsMapping and the extensions will automatically make its tables use the specified database name.

$wgVirtualDomainsMapping['virtual-oathauth'] = [ 'db' => 'sharedbname' ]

When using shared database tables, i.e., the same set of users for different wikis, add oathauth_devices and oathauth_types to $wgSharedTables.

$wgSharedTables[] = 'oathauth_devices';
$wgSharedTables[] = 'oathauth_types';

Ver também

• Wikimedia Security Team/Two-factor Authentication for CentralAuth wikis
• Two-factor authentication (TFA)
• Extension:WebAuthn
• Initiative for Open Authentication (OATH)

References