You've filled out the wrong form for LDAP access

Please see https://phabricator.wikimedia.org/maniphest/task/edit/form/1/?title=Grant%20Access%20to%20%3CINSERT%20LDAP%20GROUP%3E%20for%20%3CINSERT%20USERNAME%3E&description=*%20The%20**username**%20of%20your%20existing%20account%20on%20wikitech.wikimedia.org%3A%20%0D%0A%0D%0A*%20Do%20you%20currently%20have%20**shell%20access**%20(Yes%2FNo)%3F%0D%0A%0D%0A*%20**Purpose**%20(Specify%20which%20service%20you%20need%20to%20get%20access%20to%2C%20e.g.%20Icinga%2C%20Grafana%2C%20Superset%20etc)%3A%0D%0A%0D%0A*%20The%20specific%20**LDAP%20group**%20that%20you%20want%20to%20be%20added%20to%20(optional)%3A%0D%0A%0D%0A%2F%2FFor%20contractors%20only%3A%2F%2F%0D%0A*%20Contract%20end%20date%3A%0D%0A*%20Contract%20contact%20person%3A&projects=LDAP-Access-Requests,SRE instead.

https://wikitech.wikimedia.org username: TomekSikora.Monsoon

@TomekSikora.Monsoon: Could you please answer all questions in the previous comment? Thanks.

Hello Andre. This request emanated from the project we are running with Monsoon. I'm the project lead, and would be the approving party. The request is primarily limited to access to Google Search Console only.

I'm not sure 'nda' lets you login to google search console.

@soworu: Apologies for the confusion- the procedure for requesting access to the Google Search Console has recently changed (2 weeks ago), as it is being now overseed by product (CC @SCherukuwada) and it is not as clear as it used to be (e.g. there is no specific form for this now). This can improve.

I think the best way to move forward is someone (e.g. @TomekSikora.Monsoon) gets in touch with @SCherukuwada, who has the service knowledge to understand the the specific needs (e.g. service, domains needed, email account, expiration time), and together we rework this ticket with all information needed. This is the existing documentation: https://wikitech.wikimedia.org/wiki/Search_Console_Data#Process

This will require Legal approval, through the file of an NDA (which may be already in place, but we SRE don't know about that at the moment). Our contact in Legal will clarify that once the request is clear. Also, we -SRE- will assist in deploy the access- but please coordinate with @SCherukuwada first to provide a clear request.

@SCherukuwada: we need to document https://wikitech.wikimedia.org/wiki/Search_Console_Data better to provide a clear form to request access. Could you please work once with Monsoon (@TomekSikora.Monsoon) to understand the request better and later with us (SREs) to improve the process to make it clearer (I can help)? We may even want to create a separate tag to avoid the confusion with LDAP and SSH requests. That way you will not be bothered in future requests 0:-).

The confusion came from the fact that NDA is an LDAP group, but it is independent from this request- even if an NDA signing is needed.

@jcrespo I've been involved in this discussion so I know what's going on here. I've updated the ticket to reflect what they need. I can take care of providing access; how do I put an entry in the maint-announce calendar to revoke access on the expiry date?

@soworu I need someone from legal to say "Yes, they've signed a full NDA."

Once that's done, I can provide access based on the process documented at https://wikitech.wikimedia.org/wiki/Search_Console_Data.

@KFrancis normally confirms NDAs

In T304502#7844616, @SCherukuwada wrote:

@jcrespo I've been involved in this discussion so I know what's going on here. I've updated the ticket to reflect what they need. I can take care of providing access; how do I put an entry in the maint-announce calendar to revoke access on the expiry date?

@soworu I need someone from legal to say "Yes, they've signed a full NDA."

Once that's done, I can provide access based on the process documented at https://wikitech.wikimedia.org/wiki/Search_Console_Data.

@SCherukuwada: sadly you won't be able to- I can take care for now, but this is something we need to iron out in the process. Regarding legal, usually @KFrancis helps us here:

@KFrancis can you confirm the right NDA is on file at WMF for Tomek (details on description) to access WMF's Google Console?

Hi @SCherukuwada. Charlene confirmed that there's an MSA on file. According to her feedback

"Monsoon signed out standard MSA for consulting work. It includes confidentiality terms and they are sufficient, unless PII is shared. It sounds like they are only looking at public information and de-identified data. That being the case it is okay to give them access to the Google Search Console to conduct the work detailed in their SOW."

I've given the above-mentioned e-mail address access to the two English
Wikipedia domains (en.wikipedia.org and en.m.wikpedia.org).

@Jaime Crespo <jcrespo@wikimedia.org> and myself will get together next
week to streamline this process somewhat.

Hi all, reconfirming as there is an MSA on file, we are covered. Thanks!

Thank you, waiting for Tomek Sikora to confirm access to resolve.

Access has now been revoked.

Should this be closed then?