ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDVvZBUnDvQeReySygp0EcwTgZm1vSgNGmEJQM8Dwx/mGV4W59nYugqrgkkkxJ9adfT25bJlllwSHhQ1GrpZBausLJtdGueL2A4F5sAtfI+LamcNx4W1rVJH8Cvm7XTMe3+/SY/XdfEqDxrJAR1cAJDdNTJPrkRPeYoVXTsjtVP6VSVv0PJL5pRHSUDfnjNtzR3+zlTA3bhOf5UqDBUtrizFc8qAv0hJdk51sMGGkRlZmSnO4m1ZMB3sF7HLsSk2SvZio+XR4hQ9rT/t1td9KUg0Xgs3zZOK0DPjL21RQdnZpGz7ENRCAVpAzF6oq7t3d8B76IqwS16D7wDnu7DYimKtKBhiJZ0ZKG4t4uiHKRqQ6xManmSTMZ1GKHOVgScalKrIm3ws5SE+ITtA7XUKHMuanTpPjyOce16aIPpMsn5i4XTK2/KQEq/dEa/jcbo7Gcp4lb99/zLFRvLEX+w4jHDWxvTaJ/0E0y/UEMziMOf6f5cgNefO0V9mpQ0yWXWNdFPII+DU+vWZNttor4NKcj+/Y9FNdJ2QakTG4N4GDqu64TzkM6ESt6FJJuKtUOaIY6W4NkBLnHCY1p9r/pfF859+rQslLenZ77NDPp5s3HdA2uY2DffQjvmrSJjVgtCjBtR3HQNO+kd2BHblVjilVcNw4NAM2a1AgJUYlkcgd4kqw== laurabarluzzi@Lauras-MBP.homenet.telecomitalia.it

Requested group membership: fr-tech-devs
Reason for access: new fundraising-tech developer
Name of approving party (manager for WMF/WMDE staff): @XenoRyet (manager)
Ensure you have signed the L3 Wikimedia Server Access Responsibilities document: signed on Wed, Jun 17, 7:04 AM
Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

- User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
- User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
- User has provided the following: developer account username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
- User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
- The provided SSH key has been confirmed out of band and is verified not being used in WMCS.
- access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
- access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

ticket was orignally filed as:

The username of your existing LDAP account on https://idm.wikimedia.org or https://gerrit.wikimedia.org: laurabarluzzi

Do you currently have shell access (Yes/No)? Yes

Purpose (Specify which service you need to get access to, e.g. Icinga, Grafana, Superset etc): new fundraising-tech developer

The specific LDAP group that you want to be added to (optional): the groups that other fr-tech developers have access to (as reference, see @Damilare's groups)

@XenoRyet is laurabarluzzi's manager

Details

Related Changes in Gerrit:

	Subject	Author	Repo	Branch	Lines +/-
	admin: add lbarluzzi to fr-tech-devs	Fabfur	operations/puppet	production	+2 -1

Customize query in gerrit

Related Objects

Mentioned Here: T297383: Add damilare to icinga

Event Timeline

Laurabarluzzi created this task.Jul 6 2026, 7:02 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 6 2026, 7:02 PM

Hi,

This requests asks for membership in LDAP groups to match groups @Damilare is in.

Searching for existing tickets from the past where Damilare was added we can just see T297383 which was about adding them to the "wmf" group.

But that group is meanwhile a self-service workflow via the IDP and not handled in Phabricator tickets anymore.

Please see https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#WMF_Group

Please see the bottom of https://wikitech.wikimedia.org/wiki/SRE/LDAP/Groups/Request_access#Using_the_Wikimedia_Identity_Management_System on how to handle this in the IDP.

@Dzahn thanks, I already have wmf access from that flow granted. I was pointed here from my colleagues since at some point I tried to create a phab task clicking on Fundraising Access Request from the instructions page and then on create an access request and then I saw an error "Access Denied: restricted edit configuration"

@Dwisehaupt I tag you since you were in the email conversation about this.

It seems like you were trying to create a request for SSH access to fr-tech servers from a Phabricator template.

But for some reason you are not allowed to use that template. The template wants to add only the "fundraising-tech-ops" tag.

So that sounds to me like either that Phabricator template needs some work or you have not been added to the right Phabricator groups yet.

This ticket as-is is about LDAP groups, not shell access, and also the template you linked to seems to imply that fr-tech shell access requests are not handled in SRE.

I am not sure what the normal workflow is for onboarding in fr-tech but to avoid this I would recommend to have a general onboarding template that has checkboxes for all of it, Phabricator groups, shell access, LDAP groups and other things needed.

So to summarize:

seems like fr-tech shell access is handled internally by fr-tech, not by SRE (is this correct?)

LDAP group requests are a different thing and separate from shell requests, also when handled in SRE

seems like the immediate issue is a Phabricator permission issue with the template but that template is also unique to fr-tech

I can clear up some of the communication as I think there is some combination of things going on.

Laura does have fr-tech ssh access and that has already been set up. What Laura doesn't have yet is production SSH access. We would be requesting her to get an account with access in the fr_tech_devs group so that she would have access to the community crm host in the same manner as other fr-tech devs.

What we noticed with Laura's phabricator account is that she is missing inclusion in a set of groups like WMF-NDA, Trusted-Contributors, acl*security, etc. I figured those omissions may be hindering her ability to do regular phabricator actions such as creating a task from the link.

As far as the fr-tech phabricator template, it is just a link that prepopulates some fields, not an actual template.

Please let me know if you have any other questions.

Gotcha! Thanks for the clarifications.

Since this is an SSH access request for SRE then let's please use the template and tags for that.

The correct template is:

https://phabricator.wikimedia.org/maniphest/task/edit/form/8/

You can make a new ticket or edit this existing one and paste the contents from the template. Whatever seems easier to you.

I am editing the tags accordingly already. Cheers

missing inclusion in a set of groups like WMF-NDA, Trusted-Contributors, acl*security, etc.

Is there a general onboarding ticket for making these things happen? There are most likely more that have no direct relation to shell access.

Re: Access to that Phabricator form:
Sorry for that confusion (the error message is not great). This can be solved in two ways:

Either linking to form 1 which is sufficient and which anyone can access, instead of form 3. I've edited the documentation accordingly to use form 1 instead.
Or first adding to @Laurabarluzzi as a member to the Phabr project WMF-NDA (via a ticket in WMF-NDA-Requests), as that will allow accessing Form 3.

Dzahn updated the task description. (Show Details)Jul 7 2026, 12:36 AM

Dzahn updated the task description. (Show Details)

Thanks so much for these clarifying additions, Aklapper.

@Laurabarluzzi @Dwisehaupt

Alright, now that it's clear that this is a shell access request, (as opposed to LDAP group), let me edit the ticket so that it has the parts that would come from the form for shell access requests.

I am filling out the parts I can already tell from the context you have given.

Dzahn updated the task description. (Show Details)Jul 7 2026, 12:42 AM

@Laurabarluzzi Hi there, please take a look at the ticket now. I pre-filled your user name, email, approving party and reason.

What we will need next are the remaining lines to be filled out. What you can do personally:

SSH public key, if you could create one and paste it please.

L3 - please read this and sign that you have taken notice of it

Feel free to directly edit the ticket to add the key and check off boxes, or we can do it.

@Dwisehaupt @Damilare Hi, can we clarify the requested groups please? If I look strictly at "what Damilare has" as it was stated in the ticket then this means fr-tech-dev but also full deployment rights and analytics-privatedata (for some level of it).

With the reason being "new fundraising-tech developer" of course fr-tech-dev seems to be the perfect match.

From your comment above I take that as "just fr-tech-dev for now". It seems to make sense to wait with deployment and analytics data until it's actually a blocker for something, is that right?

Dzahn updated the task description. (Show Details)Jul 7 2026, 12:54 AM

Ok, we should be good to go here now. Rotating SRE clinic duty may continue on this ticket as well.

One more thing: Please get a manager from fr-tech to formally approve this by commenting here on the ticket. (cc: @XenoRyet )

Dzahn renamed this task from Grant Access to fr-tech groups for laurabarluzzi to Grant shell access (fr-tech-devs) for laurabarluzzi.Jul 7 2026, 12:58 AM

Dzahn moved this task from Untriaged to Awaiting User Input on the SRE-Access-Requests board.Jul 7 2026, 1:03 AM

Laurabarluzzi updated the task description. (Show Details)Jul 7 2026, 8:20 AM

cmooney updated the task description. (Show Details)Jul 7 2026, 5:02 PM

I've asked Laura to confirm her ssh key on Slack, if we can get that and a thumbs up from @XenoRyet I should be able to add this in the morning.

@greg can I get a thumbs up from you to add Laura to the fr-tech-devs group? Thanks.

cmooney updated the task description. (Show Details)Jul 9 2026, 8:54 AM

Taking over access request, summary before this can be deployed: the blockers on this ticket to move forward:

Formal ok from direct manager to aprove production access request, @XenoRyet
Formal approval from group approver @greg

jcrespo removed a project: SRE.Jul 9 2026, 10:24 AM

To record here Laura confirmed her ssh key to me over Slack and it matches the one in the task description. So this should be good to go once the approvers respond.

Dzahn moved this task from Awaiting User Input to Manager/NDA Approval/Confirmation on the SRE-Access-Requests board.Jul 15 2026, 11:37 PM

Fabfur subscribed.Jul 16 2026, 1:33 PM

stalled on manager approval

In T431338#12098763, @cmooney wrote:

@greg can I get a thumbs up from you to add Laura to the fr-tech-devs group? Thanks.

Yes, approved!

In T431338#12104034, @jcrespo wrote:

Taking over access request, summary before this can be deployed: the blockers on this ticket to move forward:

Formal ok from direct manager to aprove production access request, @XenoRyet

Formal approval from group approver @greg

I hope my approval for both is sufficient (dylan is out sick today).