Developer accounts that have been locked via a wikitech block should not be found by our "Project Access" Horizon dashboard
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	bd808
	Jun 20 2023, 9:48 PM

Project Tags

Referenced Files

None

Subscribers

Aklapper

bd808

Description

As noticed in T339968: Delete blocked spoofer uid=bawolffa Developer account, a blocked Wikitech account can still show up Horizon when folks are adjusting Cloud VPS project membership. The particular account that was removed there was blocked prior to our implementing LDAP account locking in response to a block (T168692: Blocking an account on wikitech should disable LDAP logins).

Tests using accounts that are known to have the pwdPolicySubentry=cn=disabled,ou=ppolicies,dc=wikimedia,dc=org lock indicator show that it is possible both to look them up via openstack user show SHELL_NAME and to add them to a project via the Horizon "Project Access" dashboard. An ideal solution would stop both from working, likely by finding the right place in our Keystone configuration to apply a (!(pwdPolicySubentry=cn=disabled,ou=ppolicies,dc=wikimedia,dc=org)) constraint on the LDAP lookup.

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	openstack: Hide locked Developer accounts from Keystone	BryanDavis	operations/puppet	production	+8 -0

Customize query in gerrit

Related Objects

Mentioned Here: T168692: Blocking an account on wikitech should disable LDAP logins
T339968: Delete blocked spoofer uid=bawolffa Developer account

Event Timeline

bd808 created this task.Jun 20 2023, 9:48 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 20 2023, 9:48 PM

I think the right magic might be to add a user_filter to our config that excludes blocked accounts:

[ldap]
user_filter = (!(pwdPolicySubentry=cn=disabled,ou=ppolicies,dc=wikimedia,dc=org))

That setting is documented at https://docs.openstack.org/keystone/zed/admin/configuration.html#integrate-identity-back-end-with-ldap in the "Filters" section.

bd808 added a project: cloud-services-team.Jun 20 2023, 10:00 PM

Change 932034 had a related patch set uploaded (by BryanDavis; author: Bryan Davis):

[operations/puppet@production] openstack: Hide locked Developer accounts from Keystone

https://gerrit.wikimedia.org/r/932034

gerritbot added a project: Patch-For-Review.Jun 21 2023, 11:54 PM

bd808 changed the task status from Open to In Progress.Jun 21 2023, 11:55 PM

bd808 claimed this task.

Restricted Application added a project: User-bd808. · View Herald TranscriptJun 21 2023, 11:55 PM

Change 932034 merged by Andrew Bogott: