Mentioned in SAL (#wikimedia-releng) [2023-09-25T23:24:58Z] <brennen> gitlab: disabling separate 2fa policies for groups under /repos (T347295)

Two factor authentication was enabled for groups with elevated privileges (like sre). Users outside of this group may also have elevated permissions through maintainer permissions in certain projects. This allows users to merge changes or schedule CI jobs in the trusted environment.

Noting that 2fa is currently mandated for all members of /repos. (Not, however, /toolforge-repos and /cloudvps-repos.) In general, we also check the 2fa box for project groups under /repos when creating them.

The intent on that one was always that contributors to officially hosted projects would have mandated 2fa, but re-reading the docs here, I noticed the "Allow subgroups to set up their own two-factor authentication rule" setting for groups, which was turned on for /repos:

I've unchecked that box.

I'm less sure than I would like to be how these settings behave in practice.

cc: @thcipriani

Things to confirm:

• Every individual under any project in /repos should already be required to have 2fa (it would be terrible if didn't work that way: let's confirm)
• What about groups added to groups under /repos—although we should discourage this pattern (don't think it's in use currently)

Open questions:

• Should this be enforced for other top-level groups—maybe cloud-services-team could chime-in on that one? (tagging for this question)

Once we've confirmed and resolved the above, I think we can call this resolved.