Page MenuHomePhabricator

Add dhorn to analytics-privatedata-users
Closed, ResolvedPublic

Description

I'd like to be added to analytics-privatedata-users, to be able to access private data sets in Superset and Turnilo, after HDFS permission updates.


Requestor provided information and prerequisites

This section is to be completed by the individual requesting access.

  • Shell username: dannyh
  • Ssh public key (must be dedicated key for wmf production): n/a
  • Requested group membership: analytics-privatedata-users
  • Reason for access: see above
  • Name of approving party (hiring manager for WMF staff): Carol Dunn
  • Requestor -- Please Acknowledge that you have read and signed the L3 Wikimedia Server Access Responsibilities document:
  • Requestor -- Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
  • - User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponser for volunteers, manager for wmf staff)
  • - Patchset for access request

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Event Timeline

I hope that I've done this correctly; please let me know if I've made a mistake. Thanks!

Adding Andrew & Olja as they normally approve for this group.

@DannyH: it looks good. @Ladsgroup is on clinic duty this week and will pick it up for you! Please get your manager to comment on the task ready with their approval.

Looks like Danny will not need shell access, just ssh-keyless group membership.

Change 758603 had a related patch set uploaded (by Ladsgroup; author: Amir Sarabadani):

[operations/puppet@production] admin: Add dannyh to analytics-privatedata-users

https://gerrit.wikimedia.org/r/758603

I made the patch for it, please confirm that the correct LDAP username is dannyh and I will merge it. Keep it in mind this is wikimedia production/cloud ldap account which is different from WMF ITS LDAP account. It is basically your wikitech.wikimedia.org username and password.

I'm not sure how to check this. On Superset, my profile is https://superset.wikimedia.org/superset/profile/dannyh/

To log in, I use DannyH (WMF)

I'm not sure which of those is the LDAP username.

I talked to @jbond and it seems you can login with your CN in CAS, that's why "DannyH (WMF)" works but your ldap entry says your usename is "dannyh" and "dhorn" (I think) is your user name in wmf ITS LDAP.

All of this jargon means I just can merge the patch and you will have access in half an hour.

Change 758603 merged by Ladsgroup:

[operations/puppet@production] admin: Add dannyh to analytics-privatedata-users

https://gerrit.wikimedia.org/r/758603

Ladsgroup updated the task description. (Show Details)

You should be able to access it in half an hour, reopen if that's not the case.

I talked to @jbond and it seems you can login with your CN in CAS, that's why "DannyH (WMF)" works but your ldap entry says your usename is "dannyh" and "dhorn" (I think) is your user name in wmf ITS LDAP.

To expand a bit on the username cn, uid confusions please see https://wikitech.wikimedia.org/wiki/CAS-SSO#What_username_do_services_use and let me know if that needs additional clarification