@bd808, thanks for the adjustment on the ticket.

The "d3r1ck" shell name (LDAP uid) currently belongs to the LDAP user "D3r1ck" which was also created by @D3r1ck01. We had this discussion on irc in the #wikimedia-cloud channel (intervening messages not relevant have been removed):

[23:37]  <   d3r1ck>	bd808: Is it possible to change the shell name too? from "d3r1ck01" to "d3r1ck"?
[23:39]  <    bd808>	d3r1ck: not easily. you already have a "D3r1ck" account that holds that uid
[23:39]  <    bd808>	It would require us disabling that other account
[23:40]  <    bd808>	if that account has been used in Cloud VPS projects then it gets trickier
[23:41]  <   d3r1ck>	bd808: you know when I was just starting, I didn't really know much so I was messing up. But now that I know some stuffs I am doing, I am beginning to see the mess up I did :(
[23:41]  <   d3r1ck>	bd808: If it's possible, I would really love the "d3r1ck" deleted completely (if possible) and udpate the "d3r1ck01" to "d3r1ck"
[23:42]  <    bd808>	d3r1ck: write it up on the task :)
[23:42]  <   d3r1ck>	But history of d3r1ck01 should not be lost :)
[23:42]  <    bd808>	Chad and I can look

This may be similar to the work that we did for T165624: Request to rename LegoFan4000 to MacFan4000 on WikiTech (T165624#3342899).

@demon, @bd808, any updates on this please? :)

Further digging reveals that @D3r1ck01 actually has three Developer accounts:

• D3r1ck / d3r1ck
• D3r1ck01 / d3r1ck01
• Alangi derick / derick

D3r1ck / d3r1ck

D3r1ck has no edits on wikitech, no project memberships in OpenStack, and no patch history in Gerrit. I think this means we can just block the Wikitech account and rm the backing LDAP record to clean up.

D3r1ck01 / d3r1ck01

D3r1ck01 has no edits on wikitech. The account is a member of bastion and massmessage projects, but does not appear to have ever logged in at the shell level to either. There are a large number of Gerrit commits owned by this developer account.

Alangi derick / derick

Alangi derick has edit history on wikitech. The account is a member of bastion and tools projects with a home directory on the tools NFS shares. The account is also the maintainer of 9 Toolforge tools. The account does not seem to have ever been attached to Gerrit.

Now what?

The request as written is for Alangi derick / derick to be renamed to Alangi Derick / d3r1ck which would involve:

• Blocking D3r1ck on wikitech
• Deleting the D3r1ck / d3r1ck LDAP record
• Blocking D3r1ck01 on wikitech
• Deleting the D3r1ck01 / d3r1ck01 LDAP record
• Renaming the Alangi derick Wikitech account
• Changing the uid of the uid=derick,ou=people,dc=wikimedia,dc=org LDAP record to d3r1ck
• Updating all of the Toolforge tool membership lists from uid=derick,ou=people,dc=wikimedia,dc=org to uid=d3r1ck,ou=people,dc=wikimedia,dc=org
• Renaming the homedir on Toolforge from /home/derick to /home/d3r1ck and updating the homeDirectory attribute in LDAP
• Updating Gerrit to associate the owner:"D3r1ck01 <alangiderick@gmail.com>" commits with the newly renamed Alangi derick / d3r1ck LDAP account.

I removed D3r1ck01 / d3r1ck01 from bastion and massmessage and added Alangi derick / derick as a replacement.

Blocked D3r1ck on wikitech.

Blocked D3r1ck01 on wikitech.

More "fun": LDAPAuth is case insensitive for the cn lookups against the backing directory, so when I try to rename Alangi derick to Alangi Derick via Special:RenameUser it claims the user already exists. The cn and sn in LDAP and the record in Wikitech will need to be updated manually.

You are very correct @bd808. When I just started my Wikimedia contributions, I didn't know that Wikitech is a seperate wiki that has it's own account not tied to the unified public wiki accounts. So all in all, I would want my Wikitech Username to match that of other Wikis "Alangi Derick" and also my gerrit & LDAP username should be d3r1ck (that match my IRC handle).

The plan is okay! So in the end, I would want my Wikitech username from "Alangi derick" to "Alangi Derick" and gerrit from "d3r1ck01" to "d3r1ck". Which means my phab handle too will change to "d3r1ck" right? Thanks.

So to summarise, see below;

• Wikitech Wiki -> "Alangi Derick"
• LDAP & Gerrit -> "d3r1ck" (this will also reflect on phab since I login to phabricator using my LDAP account).

Thank you very much for the work done so far @bd808. Much appreciated.

In T171417#3805293, @D3r1ck01 wrote:

Which means my phab handle too will change to "d3r1ck" right?

The Phabricator account name is separate from the developer account names, so changing your Phabricator account name will require a separate set of work. That change is technically unrelated to these changes, so you should probably open another ticket to ask for that change to be made.

Ohh wow, thanks for letting me know this @bd808. I didn't know at all but for now, let's focus on this and once we are done, I'll create another ticket for changing the phab handle. I thought that once my LDAP account is changed, I can use it to login to phabricator since that's what I use to login to phab?

So this means Phabricator Handle != LDAP Account? I use my LDAP account to login to phab.

In T171417#3806686, @D3r1ck01 wrote:

So this means Phabricator Handle != LDAP Account? I use my LDAP account to login to phab.

There is a relation ship between your LDAP credentials and your Phabricator account, but your Phabricator account name and your LDAP account name(s) do not need to match. If you look at https://phabricator.wikimedia.org/settings/user/D3r1ck01/page/external/ you will see the external accounts that are linked to your Phabricator account as authentication sources. On the Wikimedia deployment this could be a LDAP/Wikitech/Developer account and/or a Wikimedia SUL account. Once linked any of the external auth methods can be used to access the linked Phabricator account. The Phabricator account's name is set at the time that you initially create the account. I think in our setup it defaults to being populated by either your LDAP account's cn attribute (your Wikitech account name) or your Wikimedia SUL account name depending on which auth method you use to create the initial account. This default name can be changed at account creation time to any string that is a) not in use already and b) meets the Phabricator account naming criteria.

Based on this question and answer on mediawiki.org it seems that renaming an existing Phabricator account is discouraged. This appears to be because of a lack of means to rewrite @username mentions in existing Phabricator content. I know that this is something that MediaWiki's renaming process has to work very hard to support itself and I understand why the Phabricator authors have not invested in the needed tooling.

Okay @bd808, thanks so much for the clarification.

@chasemp, could some progress be made on this ticket please? @bd808 had already started working on this but I think he is waiting for an ideal case for you & him to do some magical stuff :D

For gerrit updates the previous methods of using gerrit sql are no longer valid since gerrit now uses NoteDB https://gerrit-review.googlesource.com/Documentation/note-db.html

Renaming users has always discouraged/hard/manual in gerrit. The added complications of NoteDB mean that all of our documentation around renaming users is no longer valid. @mmodell and I have pondered this a bit. We might have a method, but I'd like to check my thinking with upstream.

In T171417#4507006, @thcipriani wrote:

For gerrit updates the previous methods of using gerrit sql are no longer valid since gerrit now uses NoteDB https://gerrit-review.googlesource.com/Documentation/note-db.html

Renaming users has always discouraged/hard/manual in gerrit. The added complications of NoteDB mean that all of our documentation around renaming users is no longer valid. @mmodell and I have pondered this a bit. We might have a method, but I'd like to check my thinking with upstream.

Okay @thcipriani, thanks a lot for the update. Will be looking forward to next steps. I really do hope this can be done since I'll not want to loose all my previous data :). Thanks!

@thcipriani, can this be done -- Delete user "d3r1ck" on Gerrit owner:"D3r1ck <alangiderick@gmail.com>" since user "d3r1ck01" points to the same email and the latter is what I see actively and have never used the former.

I've added it in the task description as another milestone, thanks!

This toolforge access request is perhaps stalled on this ticket? https://toolsadmin.wikimedia.org/tools/membership/status/406
@bd808 might have better context?

@Bstorm, I'm looking forward to this request to be completed honestly :) Also, @bd808, I wish to rename "Alangi Derick" now to "xSavitar". Global rename on public wiki has been done ready. Should I update the ticket to remove "d3r1ck" and replace with "xSavitar"?

Hi, poking again once more for reactivation of this process.

Currently, I've forgotten my Gerrit password and there is no way to reset it. If this task is completed, that could help with my Gerrit password reset. Please!

If this is "Watching" for WMCS, any idea who could actually act on this request?
Or is this request technically blocked (because Gerrit and NoteDB) and stalled? Thanks.

In T171417#7325005, @Aklapper wrote:

If this is "Watching" for WMCS, any idea who could actually act on this request?
Or is this request technically blocked (because Gerrit and NoteDB) and stalled? Thanks.

Gerrit probably means blocked on me