Extension talk:OATHAuth/Flow

I have the same problem as Topic:Y9kjsgdks184jvrr , when I updated to 1.43.0.

When I run it from the WebGUI I get exactly the same error.

When I run it from the server itself I get the following error:

Wikimedia\Rdbms\DBQueryError from line 1198 of /directory/mediawiki-1.43.0/includes/libs/rdbms/database/Database.php: Error 1146: Table 'database.databaseoathauth_types' doesn't exist

Function: MediaWiki\Extension\OATHAuth\OATHAuthModuleRegistry::getModuleIdsFromDatabase

Query: SELECT  oat_id,oat_name  FROM `databaseoathauth_types`

The update was from 1.39.10 to 1.43.0.

I see you have found phab:T371849

Says MediaWiki version required is >= 1.43, but the latest is 1.42.1... so I'm confused.

That is probably for the current unreleased version. These tables are automatically constructed and it is difficult to reflect all information for each version of Mediawiki.

Okie dokie. Thank you.

I set in LocalSettings: $wgOATHRequiredForGroups = ['editor']; and no effect.

Looking for something similar, would like to know the correct syntax for $wgOATHRequiredForGroups

Any luck w/ this? I'm trying to enforce TFA for all users, and it's unclear how to do that:

$wgOATHRequiredForGroups[] = 'user';

does nothing different from

$wgGroupPermissions['*']['oathauth-enable'] = true;

I have the following config

##Users should be given access to the oathauth-enable user right so that they can enable it at Special:OATHAuth

$wgGroupPermissions['user']['oathauth-enable'] = true;

##Set MFA for all logged in users

#$wgOATHRequiredForGroups[] = ['user','WIKI-PSWiki-Admins'];

##Remove 'read' right until auth with MFA

$wgOATHExclusiveRights = ['read'];

But with this the users are being asked to do MFA but they don't have the rights to see the preferences page

As MediaWiki in general is architected for situations where users have read rights, you might run into unexpected problems when they don't, this being one of them. Manual:Preventing_access suggests Manual:$wgWhitelistRead. I'm not sure anyone has ever tested for a situation like the one you are describing, so unsure if that suggestion will work.

Is my syntax in configuration correct?

The user are not able to see the login page as well though I have

$wgWhitelistRead = array ("Special:Userlogin");

Say I remove $wgOATHExclusiveRights, will $wgOATHRequiredForGroups take care of enforcing the user to have MFA on login, like register to MFA if they don't have it set.

I had the same issue with my installation, so I edited the plugin.

In extensions/OATHAuth/src/Hook/HookHandler.php replace, from line 220 to 228:

$session = $user->getRequest()->getSession();

$WhitelistArray = $this->config->get( 'WhitelistRead' );
               if ( !is_array( $WhitelistArray ) ) {
                       $WhitelistArray = array();
               }

		if (
			!(bool)$session->get( OATHAuth::AUTHENTICATED_OVER_2FA, false ) &&
			in_array( $action, $this->config->get( 'OATHExclusiveRights' ) ) &&
			!in_array( $title, $WhitelistArray )
		) {
			$result = 'oathauth-action-exclusive-to-2fa';
			return false;
		}
		return true;

then, in LocalSettings.php:

$wgOATHExclusiveRights = ['read'];
$wgOATHRequiredForGroups = ['user'];
$wgWhitelistRead = [
   'Special:UserLogin',
   'Special:Preferences',
   'Special:Manage Two-factor authentication',
   'Special:OATHAuth',
   'MediaWiki:Common.css',
   'MediaWiki:Common.js'
]

Once 2FA is enabled, user must logout and login again

There's any way to prevent an user to disable the two factor authentication?

Not at the moment but probably soon. See T150562.

Anyone know what OATH stands for? Perhaps we can work this into the page somewhere, to help folks remember the extension name.

See the last link in See also:

• Initiative for Open Authentication (OATH)

When I use the latest version of OATHAuth on MediaWiki1.39.4，an error occurred.

2023/07/21 00:34:54 [error] 12943#0: *2494 FastCGI sent in stderr: ＂PHP message: PHP Fatal error:  Uncaught Exception: Unable to open file /www/wwwroot/wiki.youshouyan.org/extensions/OATHAuth/extension.json: filemtime(): stat failed for /www/wwwroot/wiki.youshouyan.org/extensions/OATHAuth/extension.json in /www/wwwroot/wiki.youshouyan.org/includes/registration/ExtensionRegistry.php:199
Stack trace:


# 0 /www/wwwroot/wiki.youshouyan.org/includes/GlobalFunctions.php(49): ExtensionRegistry-＞queue()
# 1 /www/wwwroot/wiki.youshouyan.org/LocalSettings.php(218): wfLoadExtension()
# 2 /www/wwwroot/wiki.youshouyan.org/includes/Setup.php(218): require_once(＇...＇)
# 3 /www/wwwroot/wiki.youshouyan.org/includes/WebStart.php(86): require_once(＇...＇)
# 4 /www/wwwroot/wiki.youshouyan.org/index.php(44): require(＇...＇)
# 5 {main}

 thrown in /www/wwwroot/wiki.youshouyan.org/includes/registration/ExtensionRegistry.php on line 199＂ while reading response header from upstream, client: 103.15.97.139, server: wiki.zorua.top, request: ＂GET /wiki/有兽档案馆:首页 HTTP/1.1＂, upstream: ＂fastcgi://unix:/tmp/php-cgi-81.sock:＂

Unable to open file /www/wwwroot/wiki.youshouyan.org/extensions/OATHAuth/extension.json

Make sure your php process is allowed to open this file.

I've changed the permission code of extension.js from 655 to 755, and PHP stopped throwing the error above. However, when I click the "enable" button on Special:OATHAuth page, the website still returns code 404, without any further explanation in the error log. Actually, this is the original bug that drove me to look into the error log yesterday.

I've performed an investigation into the source code, and I found that 404 is thrown when PHP is executing Line 121 of src/Module/TOTP.php, i.e., creating a TOTPEnableForm object. I hope this information is helpful for debugging, and I'm always glad to provide more information when needed.

As it is already possible to force users to login before reading pages, is it possible to have 2FA also mandatory for this?

1. $wgOATHExclusiveRights=['read'];

But try first.

After relogin . It works.

When I want to enable the TOTP.

I got this error - [c884f5c00ef4a4497ae26590] /index.php?title=Special:OATH%E9%AA%8C%E8%AF%81&action=enable&module=totp&warn=1 Error: Class 'Base32\Base32' not found

even I have check that the all required dependency has been installed like christian-riesen/base32 .

MW 1.39 . Did I missed out any setting ?

Any secondary effects from disabling this?