Page MenuHomePhabricator

All Wikimedia developer services should use single sign-on
Open, HighPublic

Description

Wikimedia developer services here refers to things like Phabricator, Gerrit, Kibana, Grafana, Wikitech/Horizon etc.

Most of these currently use LDAP to share credentials, but that's not true single sign-on, authentication still happens locally. That's bad for usability (people have to type in passwords all the time) and bad for security (if any one of these services gets compromised, the attacker can harvest the credentials for all the others). It also prevents the use of shared credentials in less secure environments (such as the beta cluster), resulting in awkward workarounds.

Instead, these services should use our CAS-SSO developer single sign-on.

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

One option would be to use Wikimedia SUL via mod_authnz_fcgi and a custom authentication client frontend (probably based on oauthclient-php). That would require T148048: Store Wikimedia unified account name (SUL) in LDAP directory, and the auth frontend doing an LDAP group lookup or providing it some way to fetch those groups via the OAuth identify request.

chasemp added a project: Security-Team.

@MoritzMuehlenhoff seems like maybe some merging of this stuff into T233921 and co would make sense?

taavi renamed this task from All Wikimedia developer services should use single sign-on to All Wikimedia developer services should use single sign-on.Feb 16 2022, 8:22 PM
joanna_borun subscribed.

After reviewing the task, it appears that no further action is required on our part. Therefore, I am removing the "Infrastructure Foundations" tag.

Oranoc.220 raised the priority of this task from High to Needs Triage.
taavi removed Oranoc.220 as the assignee of this task.
taavi triaged this task as High priority.
taavi removed Due Date which was set to Feb 16 2025, 12:00 AM.
taavi added a subscriber: Oranoc.220.

Do I understand correctly that currently only bitu (https://idm.wikimedia.org/) is using CAS-SSO (https://idp.wikimedia.org/), while Phabricator (https://phabricator.wikimedia.org/), Striker (https://toolsadmin.wikimedia.org/), and Gerrit (https://gerrit.wikimedia.org/) still need to be integrated, as far as I can tell from the subtasks?