Grant Access to ldap/wmf for AAssaf
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	• AAssaf
	Apr 19 2022, 2:23 PM

Description

The username of your existing account on wikitech.wikimedia.org: AAssaf

Do you currently have shell access (Yes/No)? No

Purpose (Specify which service you need to get access to, e.g. Icinga, Grafana, Superset etc): Observability tools such as Logstash, as well as other monitoring and config viewing facilities (especially for Wikifunctions and connected architecture), plus general Gerrit +2 submit.

The specific LDAP group that you want to be added to (optional): ldap/wmf

For contractors only:

Contract end date: 2022-10-10
Contract contact person: dr0ptp4kt (Adam Baso)

Details

	Subject	Repo	Branch	Lines +/-
	admin: add LDAP only accounts: aassaf, maryyang	operations/puppet	production	+12 -0

Customize query in gerrit

Related Objects

Mentioned In: T307582: Grant Access to ldap/wmf for Ariel Gutman
T306225: Grant Access to ldap/wmf for "Mary Yang"

Event Timeline

• AAssaf created this task.Apr 19 2022, 2:23 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptApr 19 2022, 2:23 PM

@dr0ptp4kt could you please clarify if this access request (and the other related to the same project) is instead for the NDA group more than the WMF one? The NDA seems more approriate for non-staff and is the same used for example for research contractors.
As for accessing tools usually WMF and NDA are equivalent, so that shouldn't affect usability.

Volans mentioned this in T306225: Grant Access to ldap/wmf for "Mary Yang".Apr 20 2022, 8:45 AM

Volans moved this task from Backlog to Manager Approval Pending on the LDAP-Access-Requests board.Apr 20 2022, 1:54 PM

In T306437#7864599, @Volans wrote:

@dr0ptp4kt could you please clarify if this access request (and the other related to the same project) is instead for the NDA group more than the WMF one? The NDA seems more approriate for non-staff and is the same used for example for research contractors.
As for accessing tools usually WMF and NDA are equivalent, so that shouldn't affect usability.

That doesn't grant any of the gerrit access though, right? That's the main motivator.

@Jdforrester-WMF I can check what's the difference in Gerrit, it depends on the repositories I guess.
Do they have an @wikimedia.org email account? As per https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#WMF_group we usually grant the ldap/wmf group only to staff and contractors with an @wikimedia.org email account.

In T306437#7868290, @Volans wrote:

@Jdforrester-WMF I can check what's the difference in Gerrit, it depends on the repositories I guess.

The relevant group is https://gerrit.wikimedia.org/r/admin/groups/4cdcb3a1ef2e19d73bc9a97f1d0f109d2e0209cd,members which includes ldap/wmf but not ldap/nda.

Do they have an @wikimedia.org email account? As per https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#WMF_group we usually grant the ldap/wmf group only to staff and contractors with an @wikimedia.org email account.

They do.

In T306437#7868299, @Jdforrester-WMF wrote:

Do they have an @wikimedia.org email account? As per https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#WMF_group we usually grant the ldap/wmf group only to staff and contractors with an @wikimedia.org email account.

They do.

Perfect, then the developer account (LDAP) on wikitech should be associated with the @wikimedia.org account and then we can grant the ldap/wmf group on that account. I'll check if they are associated and those that are not will ping on the related task.
Thanks for the clarification.