Maniphest T233921

Further steps for CAS/web SSO
Open, MediumPublic
Actions

Assigned To

None

Authored By

	MoritzMuehlenhoff
	Sep 26 2019, 10:40 AM

Tags

Referenced Files

None

Subscribers

MoritzMuehlenhoff

Description

We have a prototype installation of CAS running with an initial service (https://cas-icinga.wikimedia.org) integrated. This task tracks further steps to build out the setup.

Related Objects
Search...

		Status	Subtype	Assigned	Task
		Open		None	T233921 Further steps for CAS/web SSO
		Resolved		MoritzMuehlenhoff	T233930 Create a staging environment for CAS
		Resolved		MoritzMuehlenhoff	T233931 Cross data center setup for CAS
		Resolved		jbond	T233933 Replicated ticket registry
		Resolved		jbond	T256113 CAS Store U2f tokens in a database
		Resolved		jbond	T256120 Request new database for idp-test.wikimedia.org
		Resolved		jbond	T233934 Collects metrics for CAS
		Resolved		jbond	T233935 Icinga Monitoring for CAS
		Resolved		MoritzMuehlenhoff	T233936 Integrate CAS into backup infrastructure
		Resolved		jbond	T233937 Add U2F/FIDO as second factor for CAS
		Open		None	T233938 SSO kill switch for crucial services
		Resolved		jbond	T233939 Wikimedia theme for SSO login page
		Open		None	T233940 CLI tools for CAS administration
		Open		None	T233941 CAS Single Logout Flow
		Open		None	T233942 Maintain session history / audit log
		Open		None	T233944 Log / alert on too many failing logins / Throttling login attempts
					Restricted Task
		Resolved		MoritzMuehlenhoff	T233946 Validate user lockout
		Resolved		MoritzMuehlenhoff	T233947 CAS build as a deb
		Resolved		jbond	T233948 Review ticket policies
		Resolved		MoritzMuehlenhoff	T233949 Fine-tune CAS logging
		Resolved		jbond	T233950 Revisit Tomcat deployment of CAS
		Resolved		jbond	T233951 Systemd hardening of CAS service unit
		Resolved		MoritzMuehlenhoff	T236815 Upgrade CAS to 6.1.0
		Resolved		jbond	T238924 Add cas authentication to puppetboard
		Resolved		jbond	T239323 Investigate how automated tasks can authenticate against CAS
		Resolved		jbond	T245743 Icinga check for CAS-protected web services
		Resolved		jbond	T246010 Investigate CAS performance

Event Timeline

MoritzMuehlenhoff created this task.Sep 26 2019, 10:40 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 26 2019, 10:40 AM

herron triaged this task as Medium priority.Sep 26 2019, 5:19 PM

jbond added a project: User-jbond.Oct 30 2019, 5:57 PM

jbond moved this task from Unsorted 💣 to Back Burner 🏛️ on the User-jbond board.Oct 30 2019, 6:07 PM

• chasemp subscribed.Nov 4 2019, 9:19 PM

MoritzMuehlenhoff mentioned this in T237630: Production logstash should be protected by two-factor auth, at the least.Nov 11 2019, 8:26 AM

• chasemp mentioned this in T189531: All Wikimedia developer services should use single sign-on.Dec 9 2019, 5:08 PM

jbond closed subtask T233934: Collects metrics for CAS as Resolved.Dec 18 2019, 11:09 AM

• chasemp added a project: Security-Team.Jan 2 2020, 9:14 PM

• chasemp moved this task from Incoming to Watching on the Security-Team board.

jbond closed subtask T238924: Add cas authentication to puppetboard as Resolved.Jan 20 2020, 1:24 PM

jbond closed subtask T233951: Systemd hardening of CAS service unit as Resolved.Feb 14 2020, 2:31 PM

MoritzMuehlenhoff closed subtask T236815: Upgrade CAS to 6.1.0 as Resolved.Mar 9 2020, 12:54 PM

MoritzMuehlenhoff closed subtask T233936: Integrate CAS into backup infrastructure as Resolved.Mar 9 2020, 12:57 PM

MoritzMuehlenhoff added a subtask: T246010: Investigate CAS performance.Mar 9 2020, 4:39 PM

MoritzMuehlenhoff added a project: CAS-SSO.May 6 2020, 11:17 AM

MoritzMuehlenhoff closed subtask T233930: Create a staging environment for CAS as Resolved.

Jgreen mentioned this in T252049: Investigate pulling in page view data to the fr-tech version of superset.May 8 2020, 4:42 PM

hashar mentioned this in T207762: Make the new Jenkins login page match the fancy gerrit login page.May 19 2020, 1:28 PM

hashar mentioned this in T198814: Enable MFA on Jenkins.May 19 2020, 1:34 PM

jbond closed subtask T246010: Investigate CAS performance as Resolved.May 26 2020, 9:27 AM

jbond closed subtask T245743: Icinga check for CAS-protected web services as Resolved.

jbond closed subtask T233950: Revisit Tomcat deployment of CAS as Resolved.

jbond closed subtask T233948: Review ticket policies as Resolved.May 26 2020, 9:33 AM

jbond closed subtask T233939: Wikimedia theme for SSO login page as Resolved.

jbond closed subtask Restricted Task as Resolved.May 26 2020, 1:54 PM

jbond closed subtask T233947: CAS build as a deb as Resolved.May 29 2020, 8:39 AM

MoritzMuehlenhoff closed subtask T233931: Cross data center setup for CAS as Resolved.Sep 23 2020, 11:36 AM

jbond closed subtask T233933: Replicated ticket registry as Resolved.May 27 2021, 4:26 PM

jbond closed subtask T233937: Add U2F/FIDO as second factor for CAS as Resolved.

Aklapper added a project: Infrastructure-Foundations.Jun 21 2021, 8:59 PM

jbond moved this task from Back Burner 🏛️ to planned on the User-jbond board.Jun 29 2021, 6:34 PM

joanna_borun changed the status of subtask T233935: Icinga Monitoring for CAS from Open to In Progress.Sep 21 2021, 4:04 PM

jbond closed subtask T239323: Investigate how automated tasks can authenticate against CAS as Resolved.Nov 25 2021, 2:52 PM

jbond closed subtask T233935: Icinga Monitoring for CAS as Resolved.Dec 7 2021, 9:46 AM

MoritzMuehlenhoff closed subtask T233946: Validate user lockout as Resolved.Jun 26 2023, 3:19 PM

MoritzMuehlenhoff closed subtask T233949: Fine-tune CAS logging as Resolved.Apr 9 2024, 7:53 AM