Page MenuHomePhabricator

Qualtrics cannot send email to wikimedia.org addresses
Open, MediumPublic

Description

We use Qualtrics to run many important surveys, such as Community Engagement Insights.

In order to make Qualtrics's emails more legitimate, we set it up so that they are sent from a wikimedia.org addresss rather than a qualtrics.com one (T164424).

To do this, we set up a G Suite account with the address qualtrics@wikimedia.org and set Qualtrics to send through it using SMTP.

However, to limit security risks, we did not want that account to have access to other G Suite apps like Google Drive. It's not possible to turn off Google Drive access for an individual account, so we placed it in a special LDAP organizational unit (ou=qualtrics, ou=corp, ou=wikimedia, ou=org).

However, this OU is not replicated to the production LDAP. This means the account can't receive email (so we can't use Qualtrics's feature of counting bounce notices) and can't send email to wikimedia.org accounts (so password resets for staff users and staff surveys fail).

The fix for this is probably creating a special limited-access OU which will be replicated to production LDAP (T159750).

Event Timeline

Zppix renamed this task from Add to Qualtrics email-LDAP issue.Sep 25 2017, 8:10 PM
Zppix removed ops-monitoring-bot as the assignee of this task.
Zppix added a subscriber: ops-monitoring-bot.
Zppix removed a subscriber: ops-monitoring-bot.

[Please add corresponding projects to tasks, otherwise tasks will never appear on their workboards. Adding Mail + SRE as that's also the tags on T159750 ]

FWIW I do see messages from the qualtrics mail system being relayed through the wikimedia.org MX and onward to google. Are there any examples of errors/bounces relating to this issue available?

FWIW I do see messages from the qualtrics mail system being relayed through the wikimedia.org MX and onward to google. Are there any examples of errors/bounces relating to this issue available?

I believe that, because of the way it's set up, bounce emails don't propagate back to Qualtrics, so we don't have an example. However, I think we already know what we need to do here, which is create a new LDAP group that only has access to a limited set of WMF Google services and then propagate it to the mail relay. That's T159750.

nshahquinn-wmf renamed this task from Qualtrics email-LDAP issue to Qualtrics cannot send email to wikimedia.org addresses.Dec 22 2017, 4:00 PM
nshahquinn-wmf updated the task description. (Show Details)
nshahquinn-wmf raised the priority of this task from Medium to Needs Triage.Mar 5 2018, 8:30 AM
nshahquinn-wmf moved this task from Blocked to Radar on the Contributors-Analysis board.

@HMarcus, I just want to put this on your radar.

Qualitrics is one of the main tools we use to conduct surveys, and for legal and trust reasons, it's much better for us to use an @wikimedia.org email address to send survey invitations. However, we're currently not able to do that because of the way the email system is configured. This isn't urgent, but based on my understanding of this ticket and T159750, it would be pretty easy to fix and also have benefits in how we provide Google Apps access to contractors.

I don't work on Qualtrics much any more, so if you have questions @JAnstee_WMF is the person to ask 😁

Hi Neil & Jaime,

I was looking through previous Zendesk tickets and found that Byron marked this as complete on March 23, 2018, as the qualtrics user was "set up and it's working". However when I go through the Google admin console, there are only two references to qualtrics: qualtrics-list@ and qualtrics@. These are both set up as Groups, not individual users as was previously stated. There is also an LDAP OU labeled "qualtrics", which is empty.

What happened with the user account that Byron previously set up? Was it ever working? Am I correct in assuming we would be starting from scratch and ignoring the already existing Qualtrics groups?

Thanks,
Harry