Page MenuHomePhabricator

User offboarding
Open, MediumPublic

Description

Implementation of an admin feature: Offboarding.

As users leave the foundation or any of our projects an offboarding process needs to ensure that any access to production environments or PII is removed.

The goal for this task is to implement:

  • Admin only area.
  • Define what constitutes an administrator.
  • Automatic removable of LDAP permissions which are normally restricted.

Related Objects

Event Timeline

SLyngshede-WMF triaged this task as Medium priority.

Change 919073 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/software/bitu-ldap@master] Search: add function for search users.

https://gerrit.wikimedia.org/r/919073

Change 920665 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/software/bitu@master] Offboarding: Allow managers to offboard users.

https://gerrit.wikimedia.org/r/920665

Employees being off-boarded from the WMF may wish to continue in some roles as a volunteer.

Will this support keeping some roles or switching from 'wmf' to 'nda' ldap groups?

As currently planned there will just be a list of roles/LDAP groups which is removed from users during off-boarding. Any other groups that user belongs to is not affected.
But I'm currently working on it, so any input or wishes are greatly appreciated.

Current functionality:

Skærmbillede 2023-05-18 kl. 13.40.02.png (1×2 px, 205 KB)

Skærmbillede 2023-05-18 kl. 13.39.48.png (758×2 px, 188 KB)

Change #920665 abandoned by Slyngshede:

[operations/software/bitu@master] Offboarding: Allow managers to offboard users.

https://gerrit.wikimedia.org/r/920665