Change 242039 merged by Yuvipanda:
ldap: Rewrite ssh lookup script

https://gerrit.wikimedia.org/r/242039

Change 242044 merged by Yuvipanda:
tools: Remove ldapspportlib use from toolschecker

https://gerrit.wikimedia.org/r/242044

Change 301040 had a related patch set uploaded (by Yuvipanda):
ldap: Kill a bunch of unused scripts

https://gerrit.wikimedia.org/r/301040

Change 301036 had a related patch set uploaded (by Yuvipanda):
Get rid of the LDAP YAML ENC

https://gerrit.wikimedia.org/r/301036

Change 301036 merged by Yuvipanda:
Get rid of the LDAP YAML ENC

https://gerrit.wikimedia.org/r/301036

Change 301040 merged by Yuvipanda:
ldap: Kill a bunch of unused scripts

https://gerrit.wikimedia.org/r/301040

Change 301052 had a related patch set uploaded (by Yuvipanda):
ldap: Drastically simplify modify-ldap-user

https://gerrit.wikimedia.org/r/301052

Change 301048 had a related patch set uploaded (by Yuvipanda):
ldap: Replace change-ldap-password with reset-ldap-password

https://gerrit.wikimedia.org/r/301048

Change 301053 had a related patch set uploaded (by Yuvipanda):
ldap: Remove unused homedirectorymanager

https://gerrit.wikimedia.org/r/301053

Change 301059 had a related patch set uploaded (by Yuvipanda):
ldap: Vastly simplify modify-ldap-group

https://gerrit.wikimedia.org/r/301059

Change 301061 had a related patch set uploaded (by Yuvipanda):
ldap: Add warning to ldaplist

https://gerrit.wikimedia.org/r/301061

Change 301048 merged by Yuvipanda:
ldap: Replace change-ldap-password with reset-ldap-password

https://gerrit.wikimedia.org/r/301048

Change 301061 merged by Yuvipanda:
ldap: Add warning to ldaplist

https://gerrit.wikimedia.org/r/301061

Change 301059 merged by Yuvipanda:
ldap: Vastly simplify modify-ldap-group

https://gerrit.wikimedia.org/r/301059

Change 301053 merged by Yuvipanda:
ldap: Remove unused homedirectorymanager

https://gerrit.wikimedia.org/r/301053

Change 301052 merged by Yuvipanda:
ldap: Drastically simplify modify-ldap-user

https://gerrit.wikimedia.org/r/301052

I just used ldaplist on terbium and saw the warning:

If you are still relying on ldaplist and not using ldapsearch,
please comment on https://phabricator.wikimedia.org/T114063
before 30 August 2016. If nobody comments, ldaplist will be removed!

Maybe that message could contain an example how do use ldapsearch for the most common search, the equivalent of: ldaplist -l passwd someuser

currently i am getting:

SASL/DIGEST-MD5 authentication started
Please enter your password:

@Dzahn ah, can you tell me what you were trying to do with ldaplist?

ah, I see you included it, nvm.

@Krenair do you think you can help?

Yes, you need ldapsearch -x followed by your LDAP query. The -x is important, it specifies basic authentication instead of SASL.

Could you paste the entire command that replaces "ldaplist -l passwd?

ldapsearch -x objectClass=posixaccount should give you the same thing as ldaplist -l passwd
ldapsearch -x uid=krenair should give you the same thing as ldaplist -l passwd krenair

Thank you very much. That works. No concerns removing ldaplist then.

In T114063#2504069, @AlexMonk-WMF wrote:

ldapsearch -x objectClass=posixaccount should give you the same thing as ldaplist -l passwd
ldapsearch -x uid=krenair should give you the same thing as ldaplist -l passwd krenair

Can we replace ldaplist with a simple script that echos those? It might take a while before my muscles unlearn ldaplist -l passwd ;-)

Just found that ldaplist is scheduled for deletion. I am still relying on it because its syntax is quite trivial. If I want to lookup my LDAP informations I just:

ldaplist -l passwd hashar

Way easier than the very cumbersome ldapsearch command that requires you to remember the -x and the LDAP properties..

I arrived here by looking at outdated documentation found on wikitech. I found the new one, too. But please before killing it, make sure you redirect on all places to the right command (for casual users like me that do not want to think).

E.g: https://wikitech.wikimedia.org/wiki/Ops_Clinic_Duty#LDAP_group_changes

Apparently the admin tool in Toolforge uses ldaplist -l servicegroups to maintain a local to Toolforge(?!) git repo containing servicegroups.ldif which is a dump of the servicegroup tree.

I believe this was added at some point as a backup in case someone accidentally removes themselves from the service group. @coren may remember the background story :-)

I am back here because a comment on ldaplist on mwmaint1002:

If you are still relying on ldaplist and not using ldapsearch,
please comment on https://phabricator.wikimedia.org/T114063
before 30 August 2016. If nobody comments, ldaplist will be removed!

https://wikitech.wikimedia.org/wiki/SRE_Clinic_Duty#LDAP_group_changes still needs to be updated with the alternative commands, do not close before that.

I am here because of the same comment – https://wikitech.wikimedia.org/wiki/LDAP#Common_LDAP_administrative_actions also still recommends ldaplist (and mwmaint1001, which no longer exists).

@Lucas_Werkmeister_WMDE ldaplist still exists and works. Just the maintenance server has changed to mwmaint1002.

[mwmaint1002:~] $ which ldaplist
/usr/local/bin/ldaplist

[mwmaint1002:~] $ ldaplist -l passwd dzahn | grep cn:
	cn: Dzahn

@Dzahn I’m aware, the command told me to leave a comment here so I did :)

Fixed section to use ldapsearch and new admin hostname

Ok, let's just fix the docs regarding the host name. I can as soon as i got my phone to charge again so i can use 2fa, heh.

About this task in general: I don't think anyone is working on this since Yuvi started it but isn't with WMF anymore.

Edit: Thanks Krenair!

Hmm, who or what (task?) is this task is stalled on ("If a report is waiting for further input (e.g. from its reporter or a third party) and can currently not be acted on")?

And different question: What still needs to be done here?
Admin tool in Toolforge?
/operations/puppet/modules/ldap/files/scripts/add-ldap-group.py , /operations/puppet/modules/ldap/files/scripts/modify-mfa.py ?
Something else / more?
Thanks for clarifying.

@Aklapper It was stalled because the person who created it isn't active anymore and nobody else is working on it or expected to work on it anytime soon. Furthermore nobody else seems to have answers to the questions you are raising. So yes, "waiting for further input from reporter" seemed accurate.

I think that is for cloud-services-team

One of the last use I remember was for ldaplist a custom wrapper using ldapsupportlib.py to ease search. The wrapper was helpful but nowadays I just use getent or ldapsearch using https://wikitech.wikimedia.org/wiki/Ldapsearch as reference.

I don't know whether ldapsupportlib.py was used anywhere else beside ldaplist.

Change 691959 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] cloud-vps: don't install ldapsupportlib on Bullseye

https://gerrit.wikimedia.org/r/691959

Change 691959 merged by Andrew Bogott:

[operations/puppet@production] cloud-vps: don't install ldapsupportlib on Bullseye

https://gerrit.wikimedia.org/r/691959

Change 862833 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/puppet@production] ldap:client:utils remove outdated ldaplist util.

https://gerrit.wikimedia.org/r/862833

Change 862833 merged by Slyngshede:

[operations/puppet@production] ldap:client:utils remove outdated ldaplist util.

https://gerrit.wikimedia.org/r/862833

Change 877957 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Fix up package list after ldapsupportlib removal

https://gerrit.wikimedia.org/r/877957

Change 877957 merged by Muehlenhoff:

[operations/puppet@production] Fix up package list after ldapsupportlib removal

https://gerrit.wikimedia.org/r/877957