Password reset

From Wikitech
Jump to: navigation, search

Sometimes an MW user loses access to their account and cannot login. They have a blank or incorrect email address and have forgotten their password.

The usual response to this situation is to ignore them or to allow some on-wiki user to claim that a password reset is impossible. We do this because changing a user's email address requires shell access, and the workload would quickly escalate beyond reasonable amounts if the service was advertised as something that can be completed via a phabricator shell request. The main portion of the work is in avoiding social engineering -- it's necessary to ensure that the email address requested has a legitimate claim to the user account in question.

Occasionally, the requester is someone who, due to long service with the project, has earned the right to ask for 5 minutes of sysadmin time in service of a personal request. The procedure is then as follows:

  • Make sure the request is legit
  • mwscript eval.php --wiki=<user's main wiki>
  • $user = User::newFromName('<name>');
  • $user->setEmail('<email>');
  • $user->setEmailAuthenticationTimestamp( wfTimestampNow() );
  • $user->saveSettings();
  • In your browser, go to Special:PasswordReset on the user's main wiki.
  • Type in the user's name and click "email new password".
  • Ask requester to check their inbox to ensure that the password reset email was received.

On CentralAuth wikis, the eval.php script has the effect of updating the globaluser table (gu_email and gu_email_authenticated) and then clearing the relevant memcached key.

Reset two factor authentication

Be careful! This is process is highly vulnerable to social-engineering attacks. Don't reset things just because a user asked you on IRC or via email. Before resetting someone's login, be sure to confirm their identity, ideally by conferring with them face-to-face or in a video chat.

In the case where a user has lost access to their soft token generator, and does not have their backup codes, two factor authentication can be removed from the account by running the following on the wikitech host:

$ sql labswiki
$ mysql:root@localhost [labswiki]> select user_id from user where user_name='<username>';
$ delete from oathauth_users where id=<user_id>;

The user can then log in using just their LDAP password and re-add two factor authentication.