As the WMF-Legal project tag was added to this task, some general information to avoid wrong expectations:
Please note that public tasks in Wikimedia Phabricator are in general not a place where to expect feedback from the Legal Team of the Wikimedia Foundation due to the scope of the team and/or nature of legal topics. See the project tag description.
Please see https://meta.wikimedia.org/wiki/Legal for when and how to contact the Legal Team. Thanks!

I have created a Wikitech account to be used for this purpose.
Change in approach, this shared account will no longer be used.

Wikitech username: Bishopfox
Shell username: bishopfox

WMF Legal reviewed the contract on file for Bishop Fox and their employees should be covered under their contract with the WMF, since they have already signed an NDA as a vendor.

Change 918519 had a related patch set uploaded (by Btullis; author: Btullis):

[operations/puppet@production] Add an ldap_only user for bishopfox

https://gerrit.wikimedia.org/r/918519

Change 918519 abandoned by Btullis:

[operations/puppet@production] Add an ldap_only user for bishopfox

Reason:

As per guidance I will let the third-party organisation create their own accounts for each individual who needs access.

https://gerrit.wikimedia.org/r/918519

I have discussed this with @jbond and @MoritzMuehlenhoff and I can appreciate now that it would be better to request that each analyst on the Bishop Fox team who requires access should create their own Wikitech account.
This would avoid the unnecessary sharing of credentials, which would go against our own security standards.

Therefore, I have requested by email that each analyst creates their own wikitech user and someone sends me the list of names.
The Bishopfox wikitech account I created yesterday will just be dormant, since we don't have any readily available process for deleting or renaming it.

I have now been provided with the following two Wikitech accounts for the two users:

• Thomas Wilson: TwilsonBF
• Ryan Basden: Bfrb

I'll add tracking references to these under the ldap_only section in data.yaml and then add them to the nda group in LDAP, once that is done.

Change 919822 had a related patch set uploaded (by Btullis; author: Btullis):

[operations/puppet@production] Add two ldap_only users from bishopfox

https://gerrit.wikimedia.org/r/919822

Change 919822 merged by Btullis:

[operations/puppet@production] Add two ldap_only users from bishopfox

https://gerrit.wikimedia.org/r/919822

I have now added uid=twilsonbf and uid=ryan-bf to the nda group in LDAP.

btullis@mwmaint1002:~$ ldapsearch -x member=uid=ryan-bf,ou=people,dc=wikimedia,dc=org dn
# extended LDIF
#
# LDAPv3
# base <dc=wikimedia,dc=org> (default) with scope subtree
# filter: member=uid=ryan-bf,ou=people,dc=wikimedia,dc=org
# requesting: dn 
#

# nda, groups, wikimedia.org
dn: cn=nda,ou=groups,dc=wikimedia,dc=org

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1
btullis@mwmaint1002:~$ ldapsearch -x member=uid=twilsonbf,ou=people,dc=wikimedia,dc=org dn
# extended LDIF
#
# LDAPv3
# base <dc=wikimedia,dc=org> (default) with scope subtree
# filter: member=uid=twilsonbf,ou=people,dc=wikimedia,dc=org
# requesting: dn 
#

# nda, groups, wikimedia.org
dn: cn=nda,ou=groups,dc=wikimedia,dc=org

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Here is the list of things that the nda LDAP group provides (unless the list is outdated):

https://wikitech.wikimedia.org/wiki/SRE/LDAP/Groups#NDA_group

Thanks @Dzahn - That's a useful reference.
I've created two user accounts in Matomo for twilsonbf and ryan-bf and supplied the credentials to the users.

Now that each user has been supplied with the credentials, I will mark this ticket as done while awaiting user confirmation of access.
I've put a reference to the contract expiry date into data.yaml and I will make a note to double-check that the access has been revoked on/by the 12th of June.

Yep, that's great thanks @jbond. I've just had confirmation by email that both analysts now have the access that they require.

Change 929645 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove LDAP access for Bishop Fox contractors

https://gerrit.wikimedia.org/r/929645

Change 929645 merged by Muehlenhoff:

[operations/puppet@production] Remove LDAP access for Bishop Fox contractors

https://gerrit.wikimedia.org/r/929645

@BTullis do the permissions need to be removed before closing the task?

In T336357#9007132, @odimitrijevic wrote:

@BTullis do the permissions need to be removed before closing the task?

Thanks for checking @odimitrijevic. Their access has already been revoked through this commit:
https://gerrit.wikimedia.org/r/c/operations/puppet/+/929645/

However, now you mention it there may be some accounts to remove in Matomo. I'll double check.

In T336357#8844321, @BTullis wrote:

The Bishopfox wikitech account I created yesterday will just be dormant, since we don't have any readily available process for deleting or renaming it.

If it hasn't already been actioned, That account should be blocked on wikitech wiki.

In T336357#9007388, @BTullis wrote:

In T336357#9007132, @odimitrijevic wrote:

@BTullis do the permissions need to be removed before closing the task?

Thanks for checking @odimitrijevic. Their access has already been revoked through this commit:
https://gerrit.wikimedia.org/r/c/operations/puppet/+/929645/

However, now you mention it there may be some accounts to remove in Matomo. I'll double check.

Access to Matomo was granted via their cn=nda LDAP membership (since Matomo is integration into the SSO provided by idp.wikimedia.org), their group memberships have been removed when I offboarded them along with https://gerrit.wikimedia.org/r/c/operations/puppet/+/929645/

In T336357#9007689, @MoritzMuehlenhoff wrote:

In T336357#9007388, @BTullis wrote:

In T336357#9007132, @odimitrijevic wrote:

@BTullis do the permissions need to be removed before closing the task?

Thanks for checking @odimitrijevic. Their access has already been revoked through this commit:
https://gerrit.wikimedia.org/r/c/operations/puppet/+/929645/

However, now you mention it there may be some accounts to remove in Matomo. I'll double check.

Access to Matomo was granted via their cn=nda LDAP membership (since Matomo is integration into the SSO provided by idp.wikimedia.org), their group memberships have been removed when I offboarded them along with https://gerrit.wikimedia.org/r/c/operations/puppet/+/929645/

Apologies, this was a clumsy explanation on my part. I didn't mean to infer that they still had access to Matomo. As @MoritzMuehlenhoff mentioned, their ability to access it was definitely revoked by the LDAP modification.
I was only talking about removing the MariaDB user records within Matomo, which would only be a matter of aesthetic to remove unnecessary accounts, not access control at this point.

I'll look into blocking the Wikitech account.

In T336357#9007551, @Peachey88 wrote:

In T336357#8844321, @BTullis wrote:

The Bishopfox wikitech account I created yesterday will just be dormant, since we don't have any readily available process for deleting or renaming it.

If it hasn't already been actioned, That account should be blocked on wikitech wiki.

I have now blocked the Bishopfox account on wikitech.

I've also removed the two user records that I created manually in Matomo and the two auto-provisioned user records that were created in Superset.