Rename specific account in LDAP, Wikitech, Gerrit and Phabricator
Closed, ResolvedPublic

Description

My legal name changed from Adrian Lang to Adrian Heine. I'd love to have my accounts in LDAP, Wikitech, Gerrit and Phabricator changed accordingly:

adrianheine updated the task description. (Show Details)
adrianheine raised the priority of this task from to Normal.
adrianheine added subscribers: adrianheine, yuvipanda.
adrianheine updated the task description. (Show Details)Jan 6 2015, 10:31 AM
adrianheine set Security to None.
Aklapper renamed this task from Rename accounts to Rename specific account in LDAP, Wikitech, Gerrit and Phabricator.Jan 6 2015, 11:20 AM

@chad ....do we rename ldap accounts and it works magically in gerrit?

jeremyb added a subscriber: jeremyb.Jan 6 2015, 8:35 PM

Is this hard in phab?

Changing name for wikitech/gerrit/ldap may be hard. but email address should be trivial. and Adrian can do it without help from anyone else. right?

Krenair added a subscriber: Krenair.Jan 6 2015, 8:37 PM

Admins can in fact change a username in Phab but it comes with a lot of caveats like orphaned references. It doesn't seem like there is too much activity to worry about but it's a note.

I went ahead and renamed in Phab per request.

Thanks folks. Unfortunately, the user name is quite visible in gerrit (where I spend most of my time), and I can't change it (since it's from LDAP afaik). Just to be clear, this is about the ›Full Name‹, not the ›Username‹, which is ›adrian‹ in gerrit. In LDAP, that's cn and sn (and mail), not uid.

Thanks folks. Unfortunately, the user name is quite visible in gerrit (where I spend most of my time), and I can't change it (since it's from LDAP afaik). Just to be clear, this is about the ›Full Name‹, not the ›Username‹, which is ›adrian‹ in gerrit. In LDAP, that's cn and sn (and mail), not uid.

Hey #labs-team folks, do you guys ever rename people for wikitech? Seems like maybe your domain?

Sorry for being a pain, but I'd really like to know if this is going to happen or not. In case it isn't I'm just going to create a new account for me.

Sorry for the delayed response.

I don't know if we have done this before (@Andrew?), but it's trivial to do. However, because we have never done this before, I do not know what will / will not break. Also it isn't just labs admins, but anyone with root + Reedy / Chad / Robla who can do LDAP changes.

demon added a comment.Feb 5 2015, 3:43 PM

We have done it before, we have docs for it (see my previous comment).

You need 3 separate accesses to make this change (meaning only a root can do all of it):

  • LDAP
  • Wikitech
  • Gerrit
scfc added a subscriber: scfc.Feb 5 2015, 7:19 PM
coren moved this task from Triage to Backlog on the Cloud-Services board.Feb 10 2015, 9:20 PM

@Chad @yuvipanda @coren so, nothing seemed to has happened here for almost a month now. can you tell us what people might be relevant for getting this done. this should be a minute of work for someone who has the appropriate rights but we don't have them and thus are dependent on others.

Any update from ops here?

We have done it before, we have docs for it (see my previous comment).

You need 3 separate accesses to make this change (meaning only a root can do all of it):

  • LDAP
  • Wikitech
  • Gerrit

Actually... You're a deployer, an ldap-admin, and a gerrit-root. Why can't you do it?

Despite repeated assertions to the contrary, renaming someone's base ldap record is non-trivial, generally breaks things, and will involve an hour or so of interactive support between the requester and the implementer.

If it's worth it, please contact me on IRC this week and I'll see about making this happen.

Adrian is paternity leave until the end of August. It'd be great if this could be done before he returns.

We have done it before, we have docs for it (see my previous comment).

You need 3 separate accesses to make this change (meaning only a root can do all of it):

  • LDAP
  • Wikitech
  • Gerrit

Actually... You're a deployer, an ldap-admin, and a gerrit-root. Why can't you do it?

I lack rename abilities on Wikitech. Or the knowledge of how to rename an LDAP account.

We have done it before, we have docs for it (see my previous comment).

You need 3 separate accesses to make this change (meaning only a root can do all of it):

  • LDAP
  • Wikitech
  • Gerrit

Actually... You're a deployer, an ldap-admin, and a gerrit-root. Why can't you do it?

I lack rename abilities on Wikitech. Or the knowledge of how to rename an LDAP account.

https://wikitech.wikimedia.org/wiki/Renaming_users covers changing the LDAP CN. @bd808, @greg, and various ops can give you the ability to rename wiki accounts - deployers and ops can do it by logging into silver.

Restricted Application added a subscriber: Matanya. · View Herald TranscriptSep 6 2015, 6:46 PM

I'm back, and I'm happy to walk through the process with someone on IRC if that's necessary :)

Lydia_Pintscher raised the priority of this task from Normal to High.Dec 1 2015, 11:46 AM

Folks, Can we please get this moving? It is nearly a year since the ticket was opened.

Aklapper added a comment.EditedJan 5 2016, 10:22 PM

Operations: If nobody feels comfortable going ahead and rename because nobody understands all the potential negative side effects, would creating a new account with the updated user name be an option?

If this won't get fixed, could someone from ops please once provide info which problems we are afraid of in the current setup?

Update: I guess my last question is mostly answered by https://wikitech.wikimedia.org/wiki/Renaming_users as pointed out by demon

demon added a comment.Jan 6 2016, 8:15 AM

If somebody can give me the rename user rights on wikitech I can do this. As I've said before, that's the piece I lack.

bd808 added a comment.Jan 6 2016, 4:21 PM

If somebody can give me the rename user rights on wikitech I can do this. As I've said before, that's the piece I lack.

I just gave @demon admin and crat membership on wikitech.

scfc assigned this task to demon.Jan 24 2016, 11:35 PM

If somebody can give me the rename user rights on wikitech I can do this. As I've said before, that's the piece I lack.

If somebody can give me the rename user rights on wikitech I can do this. As I've said before, that's the piece I lack.

I just gave @demon admin and crat membership on wikitech.

demon added a comment.Feb 9 2016, 5:13 PM

@adrianheine find me on IRC (ostriches or ^d), prefer to do it synchronously so we can troubleshoot if it goes wrong.

demon updated the task description. (Show Details)Feb 10 2016, 3:37 PM
demon updated the task description. (Show Details)Feb 10 2016, 3:43 PM

I think I got this right. It's been awhile, so please let me know immediately if it's not.

demon added a comment.EditedFeb 10 2016, 5:40 PM

Only thing left is to deattach the LDAP account from Phabricator and attach the new one. Should setup OAuth first though so you have an alternative way to login.

Dzahn awarded a token.Feb 10 2016, 5:48 PM
adrianheine closed this task as Resolved.Feb 11 2016, 7:56 AM

Thank you very much, @demon. I've yet to find any issue :)

@demon, are all the steps you took documented?

Sophivorus added a subscriber: Sophivorus.EditedApr 29 2016, 1:10 AM

Hi! I'd like to request a rename too. My global username has recently changed from "Luis Felipe Schenone" to "Felipe Schenone" so I'd like to request the same for WikiTech, LDAP, Phabricator and Gerrit. Also, my username at Gerrit is currently lfs, I would really appreciate it if someone could change it to lfschenone, as I'm unifying my username throughout the Internet and this is the very LAST service left! Is anyone able to do this for me? Thanks, in return I promise to do lots of code review!

In T85913#2250474, @lfschenone wrote:

Hi! I'd like to request a rename too. My global username has recently changed from "Luis Felipe Schenone" to "Felipe Schenone" so I'd like to request the same for WikiTech, LDAP, Phabricator and Gerrit. Also, my username at Gerrit is currently lfs, I would really appreciate it if someone could change it to lfschenone, as I'm unifying my username throughout the Internet and this is the very LAST service left! Is anyone able to do this for me? Thanks, in return I promise to do lots of code review!

please open a new ticket for this

Change 304740 had a related patch set uploaded (by Hashar):
Update Adrian Heine email

https://gerrit.wikimedia.org/r/304740

@hashar: Since I left WMDE, both addresses will be bouncing. Just remove me from the list.

@hashar: Since I left WMDE, both addresses will be bouncing. Just remove me from the list.

Done.

Change 304740 merged by jenkins-bot:
Remove Adrian Heine as owner of Wikibase and Wikidata Selenium tests.

https://gerrit.wikimedia.org/r/304740