WebAuthn is kinda broken on Wikimedia wikis (T376021: Migrate WebAuthn on Wikimedia wikis to central domain), and during the SUL3 rollout people's login domain will change as they get opted into the experiment, breaking WebAuthn fully. We'll follow up with the few existing users and explain they'll need to switch to OATH for now, but first, let's disallow enabling WebAuthn for more users (using the mechanism created in T354701: Enable migration of WebAuthn credentials to central domain).
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
Event Timeline
Comment Actions
We should probably mention this in Tech News, and only deploy the config change once that mention is out.
Comment Actions
Hello @Tgr,
Tech News - What wording would you suggest as the content, and When should it be included? Thanks!
Comment Actions
I guess I really should write a wiki page for SUL3 first so there's some context on why we do this that does not require reading Phabricator tickets.
Comment Actions
We could do a trick and use the maxKeysPerUser config variable - set it to 0.
This would hide the add button and disallow submitting the form. However, if someone knows the URL and visits the new key page manually - the error message would be:
Maximum of 0 keys can be registered
As this is a temporary measure I think it's more than enough and we do not need to create a special message.
Comment Actions
Change #1113141 had a related patch set uploaded (by Pmiazga; author: Pmiazga):
[operations/mediawiki-config@master] Disable new WebAuthn credentials creation
Comment Actions
@Tgr Thanks! I've added it using this wording. If it needs correcting or any additions, please do so within the next ~18 hours, after which it will be frozen for translation. (Changes from your draft are bolded)
For developers considering using WebAuthn: Wikimedia wikis allow WebAuthn checks (such as hardware tokens) during login, but the feature is fragile and has very few users. The MediaWiki Platform team is temporarily disabling adding new WebAuthn keys, to avoid interfering with the rollout of SUL3 (single user login version 3). Existing keys are unaffected. [2]
Comment Actions
Change #1113141 merged by jenkins-bot:
[operations/mediawiki-config@master] Disable new WebAuthn credentials creation
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-02-06T14:08:54Z] <urbanecm@deploy2002> Started scap sync-world: Backport for [[gerrit:1113141|Disable new WebAuthn credentials creation (T378402 T354701)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-02-06T14:11:33Z] <urbanecm@deploy2002> pmiazga, urbanecm: Backport for [[gerrit:1113141|Disable new WebAuthn credentials creation (T378402 T354701)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-02-06T14:22:55Z] <urbanecm@deploy2002> Finished scap sync-world: Backport for [[gerrit:1113141|Disable new WebAuthn credentials creation (T378402 T354701)]] (duration: 14m 00s)
Comment Actions
Landed on production. Tested scenarios:
✅ Check logging-in and logging out when using existing 2FA Webauthn key
✅ After removing the 2FA key there shouldn't be an option to register new one.
✅ After removing the 2FA key login/logout works
✅ Enable TOTP and try to log-in logout
Comment Actions
Change #1128403 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Revert "Disable new WebAuthn credentials creation"
Comment Actions
Change #1128403 merged by jenkins-bot:
[operations/mediawiki-config@master] Revert "Disable new WebAuthn credentials creation"
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-17T13:06:22Z] <tgr@deploy2002> Started scap sync-world: Backport for [[gerrit:1128403|Revert "Disable new WebAuthn credentials creation" (T378402 T389064)]], [[gerrit:1128032|sqwiktionary: update logo, wordmark, tagline and icon (T342172)]], [[gerrit:1126533|Growth: eswiki+cswiki - enable new way of refreshing LinkRecommendations (T386250)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-17T13:10:17Z] <tgr@deploy2002> tgr, migr, anzx: Backport for [[gerrit:1128403|Revert "Disable new WebAuthn credentials creation" (T378402 T389064)]], [[gerrit:1128032|sqwiktionary: update logo, wordmark, tagline and icon (T342172)]], [[gerrit:1126533|Growth: eswiki+cswiki - enable new way of refreshing LinkRecommendations (T386250)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-17T13:19:49Z] <tgr@deploy2002> Finished scap sync-world: Backport for [[gerrit:1128403|Revert "Disable new WebAuthn credentials creation" (T378402 T389064)]], [[gerrit:1128032|sqwiktionary: update logo, wordmark, tagline and icon (T342172)]], [[gerrit:1126533|Growth: eswiki+cswiki - enable new way of refreshing LinkRecommendations (T386250)]] (duration: 13m 27s)
Comment Actions
This is done, it's just not being used anymore. The plan was to notify WebAuthn users this week to migrate their keys to the shared domain; due to various complications that didn't happen yet, but will soon. At that point they will need to be able to create new passkeys.
Comment Actions
Not being used anymore?
T389379: Cannot enable WebAuthn seems to suggest people are being allowed to try and move...
Comment Actions
I mean, the disabling functionality is not being used anymore. I turned it off on Monday, a bit prematurely as it turns out because the SUL3 login rollout got sidetracked on other problems, but once it resumes, WebAuthn users will need to be able to replace the old passkey with a new one for auth.wikimedia.org. Do you see a problem with that? We can re-disable it and ask people to switch to TOTP if necessary, but it seemed easier to just let them create a new passkey. Granted, I didn't test that functionality yet.
Comment Actions
Change #1131482 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Disable new WebAuthn credentials creation on local domains
Comment Actions
Change #1131482 merged by jenkins-bot:
[operations/mediawiki-config@master] Disable new WebAuthn credentials creation on local domains
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-27T22:23:39Z] <thcipriani@deploy1003> Started scap sync-world: Backport for [[gerrit:1131482|Disable new WebAuthn credentials creation on local domains (T378402 T354701)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-27T22:28:03Z] <thcipriani@deploy1003> tgr, thcipriani: Backport for [[gerrit:1131482|Disable new WebAuthn credentials creation on local domains (T378402 T354701)]] synced to the testservers (https://wikitech.wikimedia.org/wiki/Mwdebug)
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-03-27T22:40:42Z] <thcipriani@deploy1003> Finished scap sync-world: Backport for [[gerrit:1131482|Disable new WebAuthn credentials creation on local domains (T378402 T354701)]] (duration: 17m 03s)
Comment Actions
Change #1187476 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):
[operations/mediawiki-config@master] Allow creating new WebAuthn passkeys on private wikis
Comment Actions
Change #1187476 merged by jenkins-bot:
[operations/mediawiki-config@master] Allow creating new WebAuthn passkeys on private wikis
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-15T20:49:56Z] <tgr@deploy1003> Started scap sync-world: Backport for [[gerrit:1187476|Allow creating new WebAuthn passkeys on private wikis (T378402 T354701)]], [[gerrit:1187980|Allow ClosedWikiProvider on the local domain on SUL wikis (T393473 T401640)]], [[gerrit:1188420|session: Cache JWT JTI in CookieSessionProvider (T399200)]]
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-15T20:56:19Z] <tgr@deploy1003> tgr: Backport for [[gerrit:1187476|Allow creating new WebAuthn passkeys on private wikis (T378402 T354701)]], [[gerrit:1187980|Allow ClosedWikiProvider on the local domain on SUL wikis (T393473 T401640)]], [[gerrit:1188420|session: Cache JWT JTI in CookieSessionProvider (T399200)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.
Comment Actions
Mentioned in SAL (#wikimedia-operations) [2025-09-15T21:07:19Z] <tgr@deploy1003> Finished scap sync-world: Backport for [[gerrit:1187476|Allow creating new WebAuthn passkeys on private wikis (T378402 T354701)]], [[gerrit:1187980|Allow ClosedWikiProvider on the local domain on SUL wikis (T393473 T401640)]], [[gerrit:1188420|session: Cache JWT JTI in CookieSessionProvider (T399200)]] (duration: 17m 23s)