This would practically be a subset of cn=wmf + cn=wmde + cn=nda, which I thought already had access to klaxon, per profile::klaxon. Am I missing some detail?

In T271587#6735019, @Joe wrote:

This would practically be a subset of cn=wmf + cn=wmde + cn=nda, which I thought already had access to klaxon, per profile::klaxon. Am I missing some detail?

I think the idea is to narrow down permissions to only those who actually have shell access and not the broad set of wmf/nda/wmde who only access some of our web services?

In T271587#6735366, @MoritzMuehlenhoff wrote:

In T271587#6735019, @Joe wrote:

This would practically be a subset of cn=wmf + cn=wmde + cn=nda, which I thought already had access to klaxon, per profile::klaxon. Am I missing some detail?

I think the idea is to narrow down permissions to only those who actually have shell access and not the broad set of wmf/nda/wmde who only access some of our web services?

I think the idea is to try and lower the bar for users that can use klaxon. There are some users in admin.yaml that do not exist in wmf, nda or wmde. The proposal is to create a new group which covers this class of user.

I have created a quick script to list the users that fall into this catagory. The following list esencially includes user with ensure => present in admin.yaml who are not in any of the ldap groups nda, wmf, wmde. The output indicates which ldap groups the users are in and which posix groups they are in as per admin.yaml

ran on mwmaint1002

$ sudo ./admin.py -a ./data.yaml
The following users are not in any of the privalaged ldap groups
west1:  ldap_groups(project-tools,project-bastion)      posix groups(analytics-privatedata-users)
leizi:  ldap_groups()   posix groups(analytics-privatedata-users)
pearley:        ldap_groups()   posix groups(restricted,analytics-privatedata-users)
springle:       ldap_groups(project-puppet,project-analytics,project-tools,project-bastion)     posix groups(snapshot-users)
mbinder:        ldap_groups(project-bastion)    posix groups(phabricator-bulk-manager)
agaduran:       ldap_groups()   posix groups(analytics-privatedata-users)
ktsouroupidou:  ldap_groups()   posix groups(restricted,analytics-privatedata-users)
reprepro:       ldap_groups()   posix groups()
ezachte:        ldap_groups(project-bastion)    posix groups(restricted,analytics-privatedata-users)
jdcc:   ldap_groups()   posix groups(analytics-privatedata-users)
karen:  ldap_groups()   posix groups(restricted,analytics-privatedata-users)
cohi:   ldap_groups()   posix groups(analytics-privatedata-users)

Sidenote: if this is straightforward to do, it would be nice if we could create an LDAP group of users in the admin deployment group, so we can replace the manually maintained Gerrit wmf-deployment group with the auto-populated LDAP one.

@SLyngshede-WMF, @MoritzMuehlenhoff this seems like something that fits with the IDM. I'm not sure it needs to be part of the bitu software. however perhaps a timer on that machine, thoughts?