Enhance account handling (meta bug)
Open, MediumPublic
Actions

Assigned To

None

Authored By

	MoritzMuehlenhoff
	Aug 12 2016, 9:26 AM

Description

This task tracks various enhancement tasks around account/group membership handling in the WMF systems.

Related Objects
Search...

Status	Subtype	Assigned	Task
Open		None	T142815 Enhance account handling (meta bug)
Resolved		MoritzMuehlenhoff	T142816 Optional expiry date for user accounts
Resolved		MoritzMuehlenhoff	T142817 Enhance group membership visibility using the memberof LDAP overlay
Declined		None	T142819 Update/add/remove LDAP entries based on changes to data.yaml
Resolved		jbond	T142821 Synchronise groups defined in data.yaml to LDAP
Resolved		hashar	T142822 Check status of under_NDA group
Resolved		MoritzMuehlenhoff	T142825 Offboarding script for account handling
Resolved		MoritzMuehlenhoff	T142826 Require/track email addresses
Declined		None	T142827 Enforce reference to Phabricator task for all commits to modules/admin/data/data.yaml
Declined		None	T142830 Require/track Phabricator username
Resolved		MoritzMuehlenhoff	T142836 Cross-validation of account data
Declined		None	T129786 Add wmf LDAP group members into nda group, delete wmf group
Resolved		MoritzMuehlenhoff	T129788 Review list of LDAP groups and document exactly what kind of access they can be allowed to provide
Resolved		• AlexMonk-WMF	T114161 Do not require people to be explicitly added to the bastiononly group
Declined		None	T146657 create notifications about user accounts that have not been used for a long time
Declined		None	T149222 Reconsider/check naming of 'privatedata' shell groups compared to their theoretically non-sensitive counterparts
Declined		None	T149225 Rethink/clarify/document use of 'analytics' vs. 'statistics' in group names
Open		None	T148048 Store Wikimedia unified account name (SUL) in LDAP directory
Open		taavi	T359428 Striker should use ID instead of username to identify SUL accounts
Resolved		MoritzMuehlenhoff	T157131 Harmonise "Directory Managers" group
Resolved		Dzahn	T157591 rename shell user 'volkere' to 'volker-e'
Declined		None	T160158 Make disabled accounts visible in the corp mirror LDAP replica
Declined		None	T161003 Cross-check disabled accounts from corp LDAP against data.yaml
Stalled		None	T161004 Remove disabled users from internal mailing lists
Open	Feature	None	T364516 Look for ways to consolidate "we trust this human" access lists

Event Timeline

MoritzMuehlenhoff created this task.Aug 12 2016, 9:26 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 12 2016, 9:26 AM

MoritzMuehlenhoff added a project: SRE.Aug 12 2016, 9:26 AM

Krenair subscribed.Aug 12 2016, 9:29 AM

MoritzMuehlenhoff added a subtask: T142816: Optional expiry date for user accounts.Aug 12 2016, 9:30 AM

MoritzMuehlenhoff created subtask T142817: Enhance group membership visibility using the memberof LDAP overlay.Aug 12 2016, 9:36 AM

MoritzMuehlenhoff created subtask T142819: Update/add/remove LDAP entries based on changes to data.yaml.Aug 12 2016, 9:53 AM

MoritzMuehlenhoff created subtask T142822: Check status of under_NDA group.Aug 12 2016, 10:36 AM

faidon subscribed.Aug 12 2016, 10:42 AM

Peachey88 subscribed.Aug 12 2016, 10:44 AM

MoritzMuehlenhoff created subtask T142825: Offboarding script for account handling.Aug 12 2016, 10:57 AM

MoritzMuehlenhoff created subtask T142826: Require/track email addresses.Aug 12 2016, 11:07 AM

MoritzMuehlenhoff created subtask T142827: Enforce reference to Phabricator task for all commits to modules/admin/data/data.yaml.Aug 12 2016, 11:10 AM

MoritzMuehlenhoff created subtask T142830: Require/track Phabricator username.Aug 12 2016, 11:55 AM

MoritzMuehlenhoff created subtask T142836: Cross-validation of account data.Aug 12 2016, 12:34 PM

• AlexMonk-WMF added subtasks: T129786: Add wmf LDAP group members into nda group, delete wmf group, T129788: Review list of LDAP groups and document exactly what kind of access they can be allowed to provide.Aug 12 2016, 1:23 PM

• AlexMonk-WMF added a subtask: T114161: Do not require people to be explicitly added to the bastiononly group.Aug 12 2016, 1:59 PM

• AlexMonk-WMF closed subtask T114161: Do not require people to be explicitly added to the bastiononly group as Resolved.Aug 20 2016, 8:02 AM

greg subscribed.Aug 20 2016, 8:05 AM

MoritzMuehlenhoff triaged this task as Medium priority.Sep 6 2016, 12:58 PM

hashar closed subtask T142822: Check status of under_NDA group as Resolved.Sep 26 2016, 10:20 AM

Dzahn created subtask T146657: create notifications about user accounts that have not been used for a long time.Sep 26 2016, 4:03 PM

• AlexMonk-WMF created subtask T149222: Reconsider/check naming of 'privatedata' shell groups compared to their theoretically non-sensitive counterparts.Oct 26 2016, 6:01 PM

• AlexMonk-WMF created subtask T149225: Rethink/clarify/document use of 'analytics' vs. 'statistics' in group names.Oct 26 2016, 6:07 PM

• AlexMonk-WMF mentioned this in T108078: audit labs versus production ssh keys.Dec 10 2016, 2:24 PM

• AlexMonk-WMF added a subtask: T148048: Store Wikimedia unified account name (SUL) in LDAP directory.

MoritzMuehlenhoff closed subtask T142826: Require/track email addresses as Resolved.Feb 3 2017, 11:12 AM

MoritzMuehlenhoff created subtask T157131: Harmonise "Directory Managers" group.Feb 3 2017, 3:04 PM

Is there a way to disable an account in LDAP that would then fail for authentication for all ancillary services that check LDAP? We have run into wanting this a few times with spammers who hit Phab and then wikitech or gerrit. The common point of authentication is there but we end up playing whackamole in every venue individually. We have also wanted this for a Tool account or service user that is suspected as compromised and the workarounds are very specific and hacky.

Dzahn added a subtask: T157591: rename shell user 'volkere' to 'volker-e'.Feb 8 2017, 6:28 PM

Dzahn closed subtask T157591: rename shell user 'volkere' to 'volker-e' as Resolved.Feb 8 2017, 7:13 PM

MoritzMuehlenhoff closed subtask T129786: Add wmf LDAP group members into nda group, delete wmf group as Declined.Feb 17 2017, 10:12 AM

MoritzMuehlenhoff closed subtask T142816: Optional expiry date for user accounts as Resolved.Feb 17 2017, 12:55 PM

Ottomata closed subtask T149225: Rethink/clarify/document use of 'analytics' vs. 'statistics' in group names as Declined.Mar 9 2017, 3:57 PM

Ottomata closed subtask T149222: Reconsider/check naming of 'privatedata' shell groups compared to their theoretically non-sensitive counterparts as Declined.Mar 9 2017, 4:05 PM

MoritzMuehlenhoff closed subtask T142836: Cross-validation of account data as Resolved.Mar 10 2017, 9:44 AM

MoritzMuehlenhoff closed subtask T142830: Require/track Phabricator username as Declined.Mar 10 2017, 9:59 AM

MoritzMuehlenhoff closed subtask T142819: Update/add/remove LDAP entries based on changes to data.yaml as Declined.Mar 13 2017, 10:16 AM

MoritzMuehlenhoff closed subtask T129788: Review list of LDAP groups and document exactly what kind of access they can be allowed to provide as Resolved.Mar 15 2017, 12:07 PM

MoritzMuehlenhoff closed subtask T142825: Offboarding script for account handling as Resolved.Mar 17 2017, 10:01 AM

MoritzMuehlenhoff closed subtask T157131: Harmonise "Directory Managers" group as Resolved.Mar 21 2017, 3:29 PM