Related: T148048: Store Wikimedia unified account name (SUL) in LDAP directory

Attributes we will be needing:

• wikimediaGlobalAccountId (MediaWiki SUL account) (optional)
• wikimediaGlobalAccountName (MediaWiki SUL account name) (optional)
• First name (sn) (optional)
• Given name (givenName) (optional)
• password (userPassword) (required)
• shell name (loginShell) (optional)
• email address (required)
• wikimedia developer account username, stored as uid (required)
• phabricatorAccountID (optional)
• phabricatorAccountName (optiona)

The following fields are NOT user editable, but requires interaction with authentication flows. SRE involvement or other automation to up:

• wikimediaGlobalAccountId
• wikimediaGlobalAccountName
• phabricatorAccountID
• phabricatorAccountName
• email
• WDA username

Users should be free to edit the following attributes in their profile page:

• First name
• Given name
• Password
• Shell
• SSH keys

In T320794#8690975, @SLyngshede-WMF wrote:

Attributes we will be needing:

• wikimediaGlobalAccountName (MediaWiki SUL account name) (optional)

Be aware that this value can change over time via https://meta.wikimedia.org/wiki/Special:GlobalRenameRequest

• First name (sn) (optional)
• Given name (givenName) (optional)

What are these values expected to be used for in practical terms? First name and given name are synonyms in most contexts. Sometimes first name is treated as a self-selected moniker and given name is required to be a legally identified first name, but both terms always apply to the same Western naming concept.

Human names are very complex, especially when dealing with individuals who are part of an international movement with strong commitments to privacy. If this is an attempt to apply "western" naming semantics to Developer accounts that could be seen as both anti-privacy (real names vs pseudonyms) and noninclusive (cultures and individuals who do not fit the name template) if not messaged well.

Today both the sn and cn attributes are both used to store the "Wikitech username" of a given developer account. I think this is the attribute you are calling "WDA username" later in the list.

• WDA username (required)

I think this is the current cn and sn data.

• Phabricator username (optional)

Be aware that this value can change over time. Phabricator account renaming is semi-discouraged as it does not rewrite historical uses of the prior name in tasks, but it can be and is done at least a few times per year.

We actually have uid, cn and sn which are all by default set to the developer account username.

It might make sense to drop sn and givenName for displayName. The advantage of using the sn and givenName is that this is what is "expect" in many systems that consume LDAP data. Strictly speaking we don't need them.

I've update the Phabricator field to be two, as with the SUL account/global account id and one with the name. The name is simply intended to serve as a "cache", to avoid doing request to both MediaWiki and Phabricator everytime we need the username. The id is what must be used when doing any operations.

In T320794#8693751, @SLyngshede-WMF wrote:

We actually have uid, cn and sn which are all by default set to the developer account username.

Possibly pedantic, but uid is the Developer account's shell name. This name is subject to different restrictions than what most folks would consider the "account name" which is stored doubly in the cn and sn attributes.

It might make sense to drop sn and givenName for displayName. The advantage of using the sn and givenName is that this is what is "expect" in many systems that consume LDAP data. Strictly speaking we don't need them.

I haven't been here quite long enough to know the history behind the duplication of the Wikitech account name data in cn and sn. I think that most docs and config uses are for cn, but I would not rule out that some system is expecting sn to be the account name.

I've update the Phabricator field to be two, as with the SUL account/global account id and one with the name. The name is simply intended to serve as a "cache", to avoid doing request to both MediaWiki and Phabricator everytime we need the username. The id is what must be used when doing any operations.

nod. When interacting with Phabricator's API I think you always need to use the account's PHID value rather than the display name. For MediaWiki APIs generally you need the display name rather than the numeric id. I don't think anything I have built outside of MediaWiki actually handles MediaWiki account renames correctly, so I'm more trying to make sure you are aware of some of the traps than telling you what to do or how. :)

In T320794#8692786, @bd808 wrote:

• First name (sn) (optional)
• Given name (givenName) (optional)

What are these values expected to be used for in practical terms?

The name will be opt-in, people can continue to use the nickname and never disclose their "passport name". That said, there's a few practical uses around permission management which really benefit from the more expressive name. One practical use case is for things like permission management, if someone requests access to a given group it's useful to have the approver/manager show the full name instead of just the account name.

First name and given name are synonyms in most contexts. Sometimes first name is treated as a self-selected moniker and given name is required to be a legally identified first name, but both terms always apply to the same Western naming concept.
Human names are very complex, especially when dealing with individuals who are part of an international movement with strong commitments to privacy. If this is an attempt to apply "western" naming semantics to Developer accounts that could be seen as both anti-privacy (real names vs pseudonyms) and noninclusive (cultures and individuals who do not fit the name template) if not messaged well.

That's a good point. We should maybe simply create a custom attribute like wikimediaDisplayName which allows specifying the preferred name independent of any concepts of first/middle/last/family names.

Today both the sn and cn attributes are both used to store the "Wikitech username" of a given developer account. I think this is the attribute you are calling "WDA username" later in the list.

The use of "sn" always striked me as odd, and the reason seems to have been lost in history, my proposal would be to only use "cn" for newly created or modified accounts. If some interface breaks (which I doubt), the fix is a single character away :-)

Small note:
We store both cn, with username capitalized, to be in compliance with mediaWiki, otherwise users could not be authenticated on wikitech.
uid contains the actual username, for use by the servers during authentication.
sn is currently not require, and will only be implemented as an optional field in the future.

That's not really resolved? There'll be plenty of additional attributes needed when we actually get to add the core attributes?

Isn't that going to be a new task for each set of additional attributes? I think that makes it easier to track.

Ok, that works for me