Change 742759 had a related patch set uploaded (by Herron; author: Herron):

[operations/puppet@production] admin: create ldap_only entry for user jsn

https://gerrit.wikimedia.org/r/742759

Change 742759 merged by Herron:

[operations/puppet@production] admin: create ldap_only entry for user jsn

https://gerrit.wikimedia.org/r/742759

Thanks @herron!

@herron: As I've seen process steps skipped several times lately, what could be done to follow the docs? Could this be brought up in an SRE meeting, please?
It's human and understandable that folks stick to their procedural knowledge, but it also makes it hard to improve processes if they aren't looked up. Thanks.

In T296654#7539033, @Aklapper wrote:

It's human and understandable that folks stick to their procedural knowledge, but it also makes it hard to improve processes if they aren't looked up.

I'd suggest adding this step as a checklist item on the appropriate access request form(s). This way it will appear in the task description as a to-do, and would be reviewed/done before the task is resolved.

@herron: I've edited https://phabricator.wikimedia.org/project/profile/1564/ to state "Check and follow https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#LDAP_access ", is that what you had in mind? If not, what text exactly would you like to see in the form?

In T296654#7549793, @Aklapper wrote:

is that what you had in mind? If not, what text exactly would you like to see in the form?

I was thinking of appending the specifics as checklist items in the text populated by the "create a ticket" links from the details sections of LDAP-Access-Requests and SRE-Access-Requests (https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?title=Grant%20Access%20to%20%3CINSERT%20LDAP%20GROUP%3E%20for%20%3CINSERT%20USERNAME%3E&description=*%20The%20**username**%20of%20your%20existing%20account%20on%20wikitech.wikimedia.org%3A%20%0D%0A%0D%0A*%20Do%20you%20currently%20have%20**shell%20access**%20(Yes%2FNo)%3F%0D%0A%0D%0A*%20**Purpose**%20(Specify%20which%20service%20you%20need%20to%20get%20access%20to%2C%20e.g.%20Icinga%2C%20Grafana%2C%20Superset%20etc)%3A%0D%0A%0D%0A*%20The%20specific%20**LDAP%20group**%20that%20you%20want%20to%20be%20added%20to%20(optional)%3A%0D%0A%0D%0A%2F%2FFor%20contractors%20only%3A%2F%2F%0D%0A*%20Contract%20end%20date%3A%0D%0A*%20Contract%20contact%20person%3A&projects=LDAP-Access-Requests and https://phabricator.wikimedia.org/maniphest/task/edit/form/8/)

The first one should probably be moved to a template as well.

@herron: As I am not a member of acl*sre-team I cannot access https://phabricator.wikimedia.org/project/edit/956/ - feel free to do so (also for
https://phabricator.wikimedia.org/project/edit/1564/ ). Thanks!