OATHAuth install (2FA, TOTP—Passkeys after MW 1.43)

[mcint]

I want to provide better, cleaner login on the wiki, than passwords. Mainly passkeys (though these will only come once we update to or past MW 1.43.

As of June 9, 2023 (the last mention of 1.39),

The OathAuth extension provides two-factor authentication support. By default, this includes a time-based one-time password (TOTP) implementation that allows users to generate 2FA codes from their phone or desktop app. Client support is available for most feature phones, smartphones and desktops.

https://www.mediawiki.org/wiki/Extension:OATHAuth

[mcint]

The use of 2FA can be required for certain pages, individually, or for certain groups/roles (would be new ones), for pages or actions relying on them.

I'm endeavoring to point to, and call out, just the most relevant sections, and what I'd want to include in a PR or update.

Installation

Before you install OATHAuth, first install either the GMP php or BCMath php extension. WebAuthn functionality requires one of those two extensions.

• php8.2-bcmath (php8.2-gmp has extra libgmp0 dep 🤷‍♂️)

Download and move the extracted OATHAuth folder to your extensions/ directory.
Developers and code contributors should install the extension from Git instead, using:
cd extensions/
git clone https://gerrit.wikimedia.org/r/mediawiki/extensions/OATHAuth
Only when installing from Git, run Composer to install PHP dependencies, by issuing composer install --no-dev in the extension directory. (See T173141 for potential complications.)

• [wiki-root]/extensions $ sudo -u wiki
git clone -b REL1_39 https://github.com/wikimedia/mediawiki-extensions-OATHAuth OATHAuth

• Add the following code at the bottom of your LocalSettings.php file:
  wfLoadExtension( 'OATHAuth' );
• Run the update script which will automatically create the necessary database tables that this extension needs.
• Configure as required.
  • It is strongly recommended to setup caching when using OATHAuth. This will improve performance, but also the security of your wiki if you're using OATHAuth. If you are only running one application/web server and have php-apcu installed, and no specific cache configured, MediaWiki will likely fallback to using APCu. If you are using multiple application/web server it is advised to set up local cluster caching that all hosts can use. Examples include Memcached.
• ✔️ Done – Navigate to Special:Version on your wiki to verify that the extension is successfully installed.

Configuration

Parameter	Default	My recommendation	Note
$wgOATHAuthWindowRadius	4	1 (not 0)	This tells OATH to accept tokens for a range of effectively ((1 + 2 * $wgOATHAuthWindowRadius) * 30)
$wgOATHSecretKey	false/none	(set)	Suggests $ hexdump -vn32 -e'8/8 "%08X" "\n"' /dev/urandom

Rate limits

OATHAuth also adds a key to the $wgRateLimits array to define rate limits for authentication attempts:

	'badoath' => [
		'&can-bypass' => false,
		'user' => [ 10, 60 ],
		'user-global' => [ 10, 60 ],
	]

Note that the user-global key is available only since 1.35. Earlier versions have to rely on user and perhaps ip-all. See the documentation of $wgRateLimits for details.