At present, users must be a member of either wmf or nda in order to be permitted access to Superset.
Once authenticated, users are then automatically assigned the Alpha and sql_lab roles, which give them the level of access agreed in: T328457: Grant all authenticated users access to SQL Lab in Superset

We are currently mapping the ops group in LDAP to the Admin role in Superset, but this is not an ideal configuration since...

Not all SREs need administrative access to Superset
Some members of the Data-Engineering team should have Admin rights.

Therefore, we would like to create an LDAP group called superset-admins and use this to grant these rights programmatically.

We have the option AUTH_ROLES_SYNC_AT_LOGIN enabled, which means that roles cannot be assigned outside of the OIDC=>Superset mapping.

We will need to update this page with information about the new group:

https://wikitech.wikimedia.org/wiki/SRE/LDAP/Groups

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	Use the superset-admins LDAP group to map to Admin rights	Btullis	operations/deployment-charts	master	+2 -2
	Add superset-admins to sensitive groups for offboarding	Muehlenhoff	operations/puppet	production	+1 -0

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	brouberol	T353782 Decommission an-tool1010
Resolved	brouberol	T347710 Migrate the Analytics Superset instances to our DSE Kubernetes cluster
Resolved	BTullis	T358650 Create superset-admins LDAP group and populate with the current list of Admins from the production instance.

Event Timeline

BTullis created this task.Feb 28 2024, 10:42 AM

BTullis triaged this task as High priority.

BTullis moved this task from Backlog to In Progress on the Data-Platform-SRE (2024.02.12 - 2024.03.03) board.

BTullis renamed this task from Create superset-admin LDAP group and populate with the current list of Admins from the production instance. to Create superset-admins LDAP group and populate with the current list of Admins from the production instance..Feb 28 2024, 10:57 AM

BTullis updated the task description. (Show Details)

Looks good!

Change 1007305 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Add superset-admins to sensitive groups for offboarding

https://gerrit.wikimedia.org/r/1007305

gerritbot added a project: Patch-For-Review.Feb 28 2024, 11:19 AM

BTullis updated the task description. (Show Details)Feb 28 2024, 11:42 AM

I have created the group with the following LDIF file.

btullis@mwmaint1002:~$ cat superset-admins.ldif 
dn: cn=superset-admins,ou=groups,dc=wikimedia,dc=org
cn: superset-admins
objectClass: groupOfNames
member: uid=btullis,ou=people,dc=wikimedia,dc=org
member: uid=brouberol,ou=people,dc=wikimedia,dc=org
member: uid=stevemunene,ou=people,dc=wikimedia,dc=org
member: uid=bking,ou=people,dc=wikimedia,dc=org
member: uid=rkemper,ou=people,dc=wikimedia,dc=org
member: uid=otto,ou=people,dc=wikimedia,dc=org
member: uid=joal,ou=people,dc=wikimedia,dc=org
member: uid=milimetric,ou=people,dc=wikimedia,dc=org
member: uid=mforns,ou=people,dc=wikimedia,dc=org
member: uid=elukey,ou=people,dc=wikimedia,dc=org
member: uid=aqu,ou=people,dc=wikimedia,dc=org
member: uid=jebe,ou=people,dc=wikimedia,dc=org

...then the following command:

btullis@mwmaint1002:~$ ldapadd -f superset-admins.ldif -D "cn=admin,dc=wikimedia,dc=org" -x -W -H "ldap://ldap-rw.eqiad.wikimedia.org:389"
adding new entry "cn=superset-admins,ou=groups,dc=wikimedia,dc=org

Confirmed that it worked with a search.

btullis@mwmaint1002:~$ ldapsearch -x cn=superset-admins
# extended LDIF
#
# LDAPv3
# base <dc=wikimedia,dc=org> (default) with scope subtree
# filter: cn=superset-admins
# requesting: ALL
#

# superset-admins, groups, wikimedia.org
dn: cn=superset-admins,ou=groups,dc=wikimedia,dc=org
cn: superset-admins
objectClass: groupOfNames
member: uid=btullis,ou=people,dc=wikimedia,dc=org
member: uid=brouberol,ou=people,dc=wikimedia,dc=org
member: uid=stevemunene,ou=people,dc=wikimedia,dc=org
member: uid=bking,ou=people,dc=wikimedia,dc=org
member: uid=rkemper,ou=people,dc=wikimedia,dc=org
member: uid=otto,ou=people,dc=wikimedia,dc=org
member: uid=joal,ou=people,dc=wikimedia,dc=org
member: uid=milimetric,ou=people,dc=wikimedia,dc=org
member: uid=mforns,ou=people,dc=wikimedia,dc=org
member: uid=elukey,ou=people,dc=wikimedia,dc=org
member: uid=aqu,ou=people,dc=wikimedia,dc=org
member: uid=jebe,ou=people,dc=wikimedia,dc=org

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

BTullis closed this task as Resolved.Feb 28 2024, 12:08 PM

BTullis moved this task from In Progress to Done on the Data-Platform-SRE (2024.02.12 - 2024.03.03) board.

Change 1006871 had a related patch set uploaded (by Btullis; author: Btullis):

[operations/deployment-charts@master] Use the superset-admins LDAP group to map to Admin rights

https://gerrit.wikimedia.org/r/1006871

Change 1007305 merged by Muehlenhoff:

[operations/puppet@production] Add superset-admins to sensitive groups for offboarding

https://gerrit.wikimedia.org/r/1007305

Change 1006871 merged by jenkins-bot:

[operations/deployment-charts@master] Use the superset-admins LDAP group to map to Admin rights

https://gerrit.wikimedia.org/r/1006871

Maintenance_bot removed a project: Patch-For-Review.Feb 28 2024, 1:31 PM

Sfaci mentioned this in T362642: Implement the authentication and authorization mechanism for MPIC.Apr 19 2024, 4:00 PM

Sfaci mentioned this in T365185: MPIC - Frontend state management according to the user role.May 16 2024, 6:27 PM

Create superset-admins LDAP group and populate with the current list of Admins from the production instance.Closed, ResolvedPublicActions

Description

Details

Related ObjectsSearch...

Event Timeline

Create superset-admins LDAP group and populate with the current list of Admins from the production instance.
Closed, ResolvedPublic
Actions

Related Objects
Search...