I think this feature may just be poorly exposed in the UI. There is a link labeled "Update" underneath the "e-mail" field on the https://idm.wikimedia.org/ldapbackend/properties/ screen. That link leads to the https://idm.wikimedia.org/accounts/email/ screen where a new email address can be entered.

Bitu doesn't actually keep a copy of the email address and therefor can't write the old email back to LDAP. I've seen other attributes, CN and SN be updated by something that appears to be neither Bitu, nor Wikitech. I'll try to do a bit more digging to figure out what that might be.

In T346601#9524050, @SLyngshede-WMF wrote:

Bitu doesn't actually keep a copy of the email address and therefor can't write the old email back to LDAP. I've seen other attributes, CN and SN be updated by something that appears to be neither Bitu, nor Wikitech. I'll try to do a bit more digging to figure out what that might be.

The two other things that I know that can touch the Developer account records are Striker (ssh keys and Toolforge related groups) and manual LDIF changes that I sometimes make in response to various Phabricator tasks or other prompts to fix things.

For @taavi's question about things resetting changes done via Special:Email back to a prior value, the first thing that comes to mind for me is the T339917: wikitech logins set the email address every time bug that a workaround was found for a couple of months before this bug was opened. I wonder if there are still some state sync races lurking somewhere in the LdapAuthentication extension that could undo email changes via MediaWiki?

Seems like Bitu actually saves the new email somewhere, but doesn't actually change it for wikitech. I changed from sportzpikachu@gmail.com to wiki@sportshead.dev on 2024-05-09, and I thought it had worked but just now I noticed that wikitech still had my old email, and I clicked the link to https://idm.wikimedia.org/accounts/email/ (which should probably show the current email) from the wikitech preferences page. Changing the email again causes Bitu to send a new email Someone, hopefully you, has requested that your email address for your Wikimedia Developer Account (sportz) be updated from wiki@sportshead.dev to wiki@sportshead.dev. To confirm this change please click here: <link>, clicking the link changes it in the Bitu dashboard but not in wikitech. I'll keep checking the Bitu dashboard to see if it reverts at any point

https://idm.wikimedia.org/ldapbackend/properties/ should show you the email address as stored in LDAP. I do wonder if the issue is that Wikitech doesn't pull the email address directly from LDAP, but stores a copy/cached version. I looked up your account in LDAP, and it correctly showed your new email address.

Showing the current email address on https://idm.wikimedia.org/accounts/email/ is a good idea. We'll add that.

Wikitech should update the email address from the developer account LDAP tree when logging in, but it's indeed otherwise cached in the MediaWiki daatabase.

@taavi: logged out and logged back in but MediaWiki doesn't seem to have updated the email. Special:Preferences is still showing the old one.

I think Wikitech just synchronized the old email address back, because it has now been updated in LDAP again, and it is set to the old Gmail account.

Bitu is showing the old email again, and triggering an email change caused Bitu to send an email Someone, hopefully you, has requested that your email address for your Wikimedia Developer Account (sportz) be updated from wiki@sportshead.dev to wiki@sportshead.dev. To confirm this change please click here:. The new email is definitely being stored somewhere, just not in the right place

You are correct, just looked at the code again. When generating the email template, Bitu will get the email from the user object, which is database backed, and it has a copy of the email address.

Caching is hard. :-(

This is still a problem. It seems like logging in to Bitu will set your email in LDAP to whatever your email was when you last logged in to that Bitu instance. Combine that with only logging in to idm-test very infrequently, and you'll have a very old email get activated again.

Ping. The exact mechanics of how this functions are still unknown to me, but Bitu (or more likely the staging instance) randomly flips my email in LDAP to my old @wikimedia.org address that I don't read anymore every so often which results in me missing those emails. It would be nice to not randomly lose emails sent to me.

Thanks, I think I worked it out. The email update to LDAP will trigger on ANY save to the user model in Django, which as you point out, can/will result in the staging instance pushing an incorrect email address to LDAP.