This is due to gerrit using cn as the UI login (internally in gerrit this is the gerrit schema), while using uid as the ssh/api login (internally in gerrit this is the username schema).

web UI login

1. gerrit checks your provided username against usernames in the gerrit schema
2. if a user is found it searches LDAP cn entry that matches.

ssh/rest api login

1. gerrit checks your provided username against usernames in the username schema
2. if a user is found it searches LDAP cn entry that matches.

The trouble is that gerrit stores uid in the username schema and then uses that (in the case of ssh or http api auth) to search for cn which is not going to work unless your shell name and wikitech username are the same.

It seems like we should have used uid as the login name for the UI in the first place; however, switching our login query to point to uid seems like a really very Bad Idea™, so not sure how to fix this :\

@thcipriani: the fix is turning on http passwords.

Rather, if we set auth.gitBasicAuthPolicy = "HTTP_LDAP" then I could work around the problem by setting an http password like I did before that option got taken away.

• Code: /modules/gerrit/templates/gerrit.config.erb :7
• Documentation: config-gerrit.html#auth.gitBasicAuthPolicy

In T225308#5243509, @mmodell wrote:

@thcipriani: the fix is turning on http passwords.

Will be doing that once a few security patches applied (that is T218750: Re-enable use of Gerrit HTTP token to push patchsets).

Doesn't fix the problem that we can't use LDAP login for the http api if your cn is different than your uid. It does provide a workaround which I guess will have to be good enough.

cn !== uid for most of our Developer accounts as far as I know. We encourage cn to be a person's full name (or at least given name + family name) and uid's have other constraints including ASCII alphanumeric charset restrictions.

Change 518811 had a related patch set uploaded (by Thcipriani; owner: Thcipriani):
[operations/puppet@production] gerrit: Re-enable the use of HTTP auth tokens

https://gerrit.wikimedia.org/r/518811

Change 518811 merged by CDanis:
[operations/puppet@production] gerrit: Re-enable the use of HTTP auth tokens

https://gerrit.wikimedia.org/r/518811

Change 527596 had a related patch set uploaded (by Paladox; owner: Thcipriani):
[operations/puppet@production] gerrit: Re-enable the use of HTTP auth tokens

https://gerrit.wikimedia.org/r/527596

Change 527596 merged by CDanis:
[operations/puppet@production] gerrit: Re-enable the use of HTTP auth tokens

https://gerrit.wikimedia.org/r/527596