Page MenuHomePhabricator
Create Task
Maniphest T367287

Update Wikitech's LDAP credentials to be read-only
Open, Stalled, MediumPublic
Actions

Description

Now that OSM is gone from Wikitech I think we can change the LDAP credentials it uses to a read-only account.

Details

SubjectRepoBranchLines +/-
openstack: wikitech: Stop setting writable LDAP credentialsoperations/puppetproduction+0 -16
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 OpenNoneT189531 All Wikimedia developer services should use single sign-on
 OpenNoneT363125 sustainability of wikitech.wikimedia.org
 OpenNoneT161859 Make Wikitech an SUL wiki
 StalledNoneT367287 Update Wikitech's LDAP credentials to be read-only
 Resolved• taaviT161553 Remove OpenStackManager from Wikitech
 ResolvedAndrewT150091 Support project creation without OpenStackManager
 ResolvedAndrewT159021 Wikitech error when adding users to projects
 ResolvedAndrewT162097 Create a Horizon panel for managing per-project sudo policies
 ResolvedAndrewT194191 Allow projectadmins to change project roles in Horizon
 ResolvedMarcoAurelioT194670 Copy maintenance/attachLdapUser.php to another extension
 ResolvedAndrewT194794 Add new users to Bastion group whenever they join a project
 Resolved• taaviT196171 Developer account creation without OpenStackManager
 DeclinedNoneT179463 Create a single application to provision and manage developer (LDAP) accounts
 DuplicateNoneT189639 Separate LDAP account creation bits from Striker to create a new identity management platform
 OpenNoneT319405 Create an IDM for Wikimedia developer accounts
 ResolvedSLyngshede-WMFT319407 IDM milestone 1 "Initial development work"
 ResolvedNoneT319409 Pick a name for the IDM
 ResolvedSLyngshede-WMFT319410 Initial Django project setup
 ResolvedSLyngshede-WMFT319415 Evaluate Striker codebase
 ResolvedMarosteguiT320426 Figure out where/how to store IDM internal data
 ResolvedSLyngshede-WMFT320427 Design and implement async LDAP operations
 ResolvedSLyngshede-WMFT320428 Initial IDM puppetisation
 ResolvedSLyngshede-WMFT320430 Create an initial IDM/LDAP image for tests and CI
 ResolvedSLyngshede-WMFT320431 IDM: Central logging on all changes
 ResolvedSLyngshede-WMFT320603 IDM milestone 2 "Initial limited deployment"
 ResolvedSLyngshede-WMFT320604 Decide on model for serving idm.wikimedia.org
 ResolvedNoneT320605 Figure out an HA setup for the IDM
 ResolvedSLyngshede-WMFT320794 Extend LDAP to allow storing all necessary attributes
 ResolvedSLyngshede-WMFT320795 Implement a staging setup for the IDM
 ResolvedSLyngshede-WMFT320797 Initial production deployment of the IDM
 ResolvedSLyngshede-WMFT320799 IDM integration into CAS SSO
 ResolvedSLyngshede-WMFT320807 Implement OAuth account validation for linking an account to a wiki account
 ResolvedSLyngshede-WMFT320808 Implement email address validation workflow
 OpenNoneT148048 Store Wikimedia unified account name (SUL) in LDAP directory
 OpenNoneT359428 Striker should use ID instead of username to identify SUL accounts
 ResolvedSLyngshede-WMFT335091 Determine which sender address to use for email notification
 ResolvedSLyngshede-WMFT340721 Build Debian packages for Bookworm
 ResolvedSLyngshede-WMFT340722 Update IDM servers to Bookworm
 OpenSLyngshede-WMFT320801 Build-out for self service
 ResolvedSLyngshede-WMFT320802 Create a mockup and involve designers
 ResolvedBUG REPORTSLyngshede-WMFT338824 Bitu is not responsive
 InvalidNoneT320805 Define the core attribute list managed in the IDM with all stakeholders
 ResolvedSLyngshede-WMFT320806 Consider reusing some wiki data sources for signup/restrictions
 ResolvedSLyngshede-WMFT320809 Figure out a captcha option for IDM
 OpenNoneT335478 Automatic detection of inactive LDAP account
 OpenNoneT335485 Automatically deploy documentation to docs.wikimedia.org
 ResolvedSLyngshede-WMFT340636 Implement "Forgot my username" feature
 ResolvedSLyngshede-WMFT340637 Implement "update email" functionality
 OpenSLyngshede-WMFT340717 Implement "source" field on user objects
 OpenSLyngshede-WMFT345168 Live validation of usernames
 ResolvedSLyngshede-WMFT345226 Switch developer account creation to Bitu
 OpenSLyngshede-WMFT347572 SSH Key type expiry
 Resolved• taaviT338477 `Nova Resource:` namespace should be declared in wmf-config, not in Extension:OpenStackManager
 Resolved• taaviT359544 Disable SSH key management on Wikitech
 ResolvedFeatureSLyngshede-WMFT359543 Allow enabling a key directly when adding it
 ResolvedBUG REPORTSLyngshede-WMFT360634 Bitu not importing key changes directly in LDAP
 OpenSLyngshede-WMFT359820 Add developer account (un)blocking support to Bitu

Event Timeline

• taavi created this task.Wed, Jun 12, 11:30 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptWed, Jun 12, 11:30 AM
• taavi added a subtask: T161553: Remove OpenStackManager from Wikitech.Wed, Jun 12, 11:30 AM
• taavi added projects: cloud-services-team, Infrastructure-Foundations.
• taavi updated the task description. (Show Details)
• MoritzMuehlenhoff subscribed.Wed, Jun 12, 1:02 PM
gerritbot added a comment.Wed, Jun 12, 2:10 PM

Change #1042267 had a related patch set uploaded (by Majavah; author: Majavah):

[operations/puppet@production] openstack: wikitech: Stop setting writable LDAP credentials

https://gerrit.wikimedia.org/r/1042267

gerritbot added a project: Patch-For-Review.Wed, Jun 12, 2:10 PM
• taavi claimed this task.Wed, Jun 12, 2:11 PM
bd808 subscribed.Wed, Jun 12, 3:45 PM

Please do not do this until Bitu takes over Developer account blocking.

• taavi added a comment.Wed, Jun 12, 3:52 PM

Oh. Right. Good point, I forgot about that.

• taavi changed the task status from Open to Stalled.Wed, Jun 12, 3:52 PM
• taavi added a subtask: T359820: Add developer account (un)blocking support to Bitu.
• MoritzMuehlenhoff triaged this task as Medium priority.Mon, Jun 17, 2:06 PM
• taavi closed subtask T161553: Remove OpenStackManager from Wikitech as Resolved.Wed, Jun 19, 5:54 AM
• taavi removed • taavi as the assignee of this task.Tue, Jun 25, 3:37 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits