Page MenuHomePhabricator

Harmonise "Directory Managers" group
Closed, ResolvedPublic

Description

The "Directory Managers" group in LDAP was inherited from OpenDJ. It grants full write access to OpenLDAP via ACLs (in addition to the cn=admin user).

It's however a different group type compared to all other groups in LDAP (groupOfUniqueNames as compared to the default groupOfNames). Thus the membership attribute is also different. For consistency it would be nice to only deal with one group type.

The group currently contains two members from Ops and two system users: uid=novaadmin and cn=scriptuser. It needs to be checked which of those actually still use the group, if only cn=scriptuser remains we could just as well drop the group and add this to the ACLs directly.

If cn=admin is insufficient, OpenLDAP could also be configured to accept a root-accessible ldapi socket for simple Ops access.

Event Timeline

@faidon and @Andrew ; you are currently the only two non-role members in that group; are you using the group member ship to make LDAP changes or do you typically use cn=admin or tool frontend ends using cn=scriptuser?

I typically use my own account rather than cn=admin (as to not share a password and provide accountability of who made the changes) but I'm happy to change my ways.

Same here -- I use my own account but it won't kill me to look up the manager password instead.

Change 342008 had a related patch set uploaded (by Muehlenhoff):
[operations/puppet] Harmomise group type for LDAP admin access

https://gerrit.wikimedia.org/r/342008

Change 342008 merged by Muehlenhoff:
[operations/puppet] Harmomise group type for LDAP admin access

https://gerrit.wikimedia.org/r/342008

Change 343884 had a related patch set uploaded (by Muehlenhoff):
[operations/puppet] Harmonise group type for LDAP admin access

https://gerrit.wikimedia.org/r/343884

Change 343884 merged by Muehlenhoff:
[operations/puppet] Harmonise group type for LDAP admin access

https://gerrit.wikimedia.org/r/343884

Mentioned in SAL (#wikimedia-operations) [2017-03-21T15:27:42Z] <moritzm> removed "Directory Managers" group from LDAP (Bug T157131)

MoritzMuehlenhoff claimed this task.

LDAP ACLs have been converted to use "cn=ldap_ops" (which is a standard group) and "cn=Directory Managers" has eventually been removed.