Page MenuHomePhabricator

Give me permissions in LDAP [Please don't use this anymore]
Closed, ResolvedPublic

Description

This is a parent task, and an ongoing process to add people to the wmf group so they can access analytics tools such as pivot, piwik, or other things that are only available internally behind LDAP authentication.

Process
Before requesting access here, please make sure you:

  • have a functioning wikitech login
  • are an employee or contractor with wmf OR have signed an NDA

Depending on the above, you can request to be added to the wmf group or the nda group (this may change as a result of T129786). You can do so by:

  • comment on this task, stating which group you think you should be in (wmf or nda) and that you'd like access
  • include your username on wikitech
  • one of us will create a subtask to grant you access
  • if we don't get back to you within a business day or so, ping us on IRC or email

Once you're added to the group, you'll be able to access pivot, piwik, etc, and we'll be maintaining documentation about that on https://wikitech.wikimedia.org/wiki/Analytics

Also please check https://wikitech.wikimedia.org/wiki/LDAP_Groups

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 15 2016, 7:02 PM
elukey updated the task description. (Show Details)Nov 15 2016, 7:05 PM
Milimetric updated the task description. (Show Details)Nov 15 2016, 7:08 PM
Abit added a subscriber: Abit.EditedNov 15 2016, 7:09 PM

Can you please add me to the WMF group? I need it to see some stuff on piwik. My wikitech username is wubwubwub. (It wouldn't let me create an account with spaces in it, iirc. I can switch to Abittaker (WMF) if that would be easier for y'all.)

May I be added to the WMF group? I tried to access https://pivot.wikimedia.org/ with my Wikitech credential but it did not work...My wikitech user name is Hjiang. Thanks a lot and I will really appreciate your help!

@HJiang-WMF I checked your username as part of T149187, you are in the wmf ldap group as far as I can see, so you should be able to login in Pivot. Have you tried recently to access pivot?

Anyhow, please follow up with me directly so we'll sort out the issue!

As per https://phabricator.wikimedia.org/T149187#2744709, I verified that wubwubwub is a valid account with email belonging to Amanda. I added the user to`wmf` as requested.

@Abit - You should be able to pass the first authentication barrier for Piwik now. Please note that you'll require another user for Piwik, but I haven't done it before so we'll need @Milimetric's assistance :)

elukey triaged this task as Normal priority.Nov 18 2016, 8:37 AM

@elukey I tried to access pivot with my Wikitech credential, and now it finally worked. Thanks for pointing me to the right direction! Much appreciated.

Abit removed a subscriber: Abit.Nov 22 2016, 6:22 PM
elukey moved this task from Backlog to Ops Backlog on the User-Elukey board.Dec 14 2016, 11:08 AM

Commenting on behalf of @Tnegrin. Toby needs access to Pivot, so please add him to wmf LDAP. His wikitech username is: tnegrin. Thank you!!

Just done! @Tnegrin, can you check that you can access https://pivot.wikimedia.org ?

spatton added a subscriber: spatton.EditedJan 19 2017, 8:43 PM

Howdy, can I be added to the wmf LDAP group? Wikitech username is Spatton. I'm a member of the online fundraising team. Thank you.

Editing this to also include the same access request for other members of the online fundraising (banner) team. Here are their usernames:

JRobell
Mhernandez
Pcoombe

attn @Pcoombe, @jrobell, @MeganHernandez_WMF

@spatton: could you also specify whether each user is a WMF employee or a contractor that has signed the NDA? This will help add them to the right LDAP group.

Absolutely @Milimetric - everyone listed above is an WMF employee. Thanks!

omg -- it works and it's wonderful. Thanks all!

@Pcoombe, @jrobell, @MeganHernandez_WMF and @spatton you should all now be able to log in https://pivot.wikimedia.org

Please read the following wiki page: https://wikitech.wikimedia.org/wiki/LDAP_Groups (section wmf grants access to)

In the above wiki page you'll see how many things other than pivot you can now access since you are know part of the wmf LDAP group. Don't want to scare you but please remember that with great power comes great responsibility :)
Please read the page and let me know if there is any doubt or follow up. It is always better to be aware of what your account is allowed to do in our infrastructure :)

Thanks!

Thanks @elukey, it's working for me. This is great!

Working for me as well @elukey. Thank you!!

Hello! I am a WMF employee and would like to request access to pivot. My Wikitech username is melodykramer

Please let me know if you have any questions! mkramer@wikimedia.org or here!

@MelodyKramer Hello! Just added you to the wmf group, you should be now able to access https://pivot.wikimedia.org.

Please read this follow up to know exactly what new permissions you got. This access grants a lot of freedom to explore a lot of critical data for the WMF (not only pivot) so better to be aware of it :)

Let me know if it works!

Pcoombe removed a subscriber: Pcoombe.Jan 25 2017, 1:26 PM

Thanks @elukey - appreciate it! I'll let you know if I run into any trouble! Have a great day!

Tnegrin removed a subscriber: Tnegrin.Jan 25 2017, 2:24 PM

Hey! Could I request access to pivot for the following account:

Seddon (https://wikitech.wikimedia.org/wiki/User:Seddon)

Confirming I am a WMF employee.

@Jseddon done! Please review this to make sure that you are aware of what the new permissions grant to your account :)

Thanks much, @elukey and @Milimetric. I have two additional permissions requests for our fundraising analytics consultants. Could you please add them to the wmf LDAP group, and let me know if there's any additional verification of employment I should provide? You can find their contact details listed at the bottom of the Collab Fundraising Contact list (last names Pany and Samra).

Usernames:
Mpany
Jksamra

CC @jrobell

@spatton: The "wmf" LDAP group is limited to WMF staff. There's a separate "nda" LDAP group covering access to various web-based services. What in particular do you need to access?

Hi @elukey and @Milimetric - I'm still unable to sign in. I believe I am using the correct u and p. Would it be possible to screenshare or evaluate with one of you?

@MoritzMuehlenhoff, right now we're just looking to get these two users Pivot access, so the NDA group would be just fine.

That groups page describes: wmf - for WMF staff/contractors, which is why I specified WMF. Thanks much for the help.

@spatton: this is an example of a task that I opened for the WMDE folks that needed access - https://phabricator.wikimedia.org/T148832 - we'll probably need to do it again for your last access request.

Melody is able to access now, just followed up on Hangouts.

I followed up with Sam via chat, we are following up with Legal to verify NDA compatibility with this request before proceeding any further.

thank you @elukey. I started an email thread with you and James at legal
who has been handling the contracts with CPS for us.

Hello. I would like access access to pivot, so I need LDAP permissions. I should be in group wmf

I am a product manager at the WMF: https://meta.wikimedia.org/wiki/User:TBolliger_(WMF)

My wikitech username is: https://wikitech.wikimedia.org/wiki/User:Tbolliger

Thank you!

@TBolliger : I've added you to the wmf group.

Thank you @MoritzMuehlenhoff — I can confirm I now have the access I need.

elukey moved this task from Ops Backlog to Stalled on the User-Elukey board.Feb 10 2017, 4:32 PM

@Mpany and @Jksamra should be able to login to Pivot now (https://pivot.wikimedia.org).

As I written before, please check what the nda LDAP group grant you access to in https://wikitech.wikimedia.org/wiki/LDAP_Groups :)

Let me know if you have any issue!

As far as I can see nobody else has a pending access request, please let me know otherwise.

elukey closed this task as Resolved.Mar 3 2017, 12:57 PM

Further requests will need to be a clone of this task, please open one for each interested username. Feel free to ping me directly on IRC or hangouts if you have any doubts.

It was nice as a super easy to find quick link to send people when they needed access. What do you all prefer instead? A quick sub-page of Data_access?

@Milimetric : When new people should be added to the privileged LDAP groups ("wmf" for WMF staff or "nda" for volunteers/researchers/external contractors), please open a Phab ticket and add the Ops-Access-Requests project.This way it gets picked up by the Ops person on Ops Clinic Duty for quick processing.

Could we just change the phrasing of this task to say that? So the description would be:

To use Pivot, Piwik, and other Analytics tools that require an LDAP login, please do the following:

Process

  • have a functioning wikitech login
  • are an employee or contractor with wmf OR have signed an NDA
  • create a sub-task of this task, tag it Ops-Access-Requests
  • in that task, ask to be added to:
    • nda LDAP group if you're a volunteer/researcher/external contractor
    • wmf LDAP group if you're WMF staff

Hi - I am requesting access to pivot by being added to the wmf group (I am the product manager for the reading-web team - https://meta.wikimedia.org/wiki/User:OVasileva_(WMF))
My wikitech username is Ovasileva

elukey renamed this task from Ongoing: Give me permissions in LDAP to Give me permissions in LDAP [Please don't use this anymore].Mar 16 2017, 4:49 PM

Changed the Task title and the Analytics docs, from now on please open a task like https://phabricator.wikimedia.org/T160662, this task is not valid anymore :)