This is a new access request for Noah Israel. They require the following access: (mark each box with an x)
[x] civicrm web access
[x] standard access
[ ] donor services access
[x] ssh access - if specific hosts: `list here`
[x] mysql - if specific hosts or databases: `list here`
[x] superset
[ ] other: `please explain`
---
=== Prerequisites ===
Before we can take any action to add a user, we need to verify that they are authorized to have such access. This requires confirmation from their manager and approval from the C level that access is approved.
==== [x] user_verification ====
Requires: user request
[x] access_rights: letter to C level (currently Lisa) verifying grant of access
[x] account name/contact info: verify on https://collab.wikimedia.org/wiki/Fundraising#Contact_List
=== Accounts and Services ===
==== [x] user account ====
Requires: user_verification
[x] Add the user to the users.yaml and group_members.yaml files as appropriate.
[x] Push out puppet changes.
==== [ ] client_ssl_cert ====
Requires: user_verification
[x] cert_setup: generate cert on frpm1001 using ssl_user_admin
[x] account_setup: sms the user the password for the key
[ ] follow_on: assist with certificate installation
==== [ ] yubikey ====
Requires: useraccount and OIT request to send out yubikey to user
[ ] physical: Make a request to OIT to have a key sent to the user
[ ] account_setup: Get public side and add to puppet-private/manifests/passwords/yubico.pp
[ ] follow_on: Make sure user can use yubikey for ssh access
==== [ ] ssh ====
Requires: useraccount and yubikey
[ ] key_setup: Send template/docs for generating keypair and ~/.ssh/config file
[ ] account_setup: Get public side and add to puppet-private/secrets/ssh/default/$username
[ ] follow_on: Verify user can ssh using correct creds and passphrases when needed.
==== [ ] mysql ====
Requires: useraccount, yubikey, ssh
[x] account_setup
[x] Create user block in ~/puppet-private/secrets/mysql_grants/fundraising_qa
[x] Ensure user is in correct blocks for select rights on dbs.
- Generally use another user in same group as a guide
[x] Run the grant script to get the grants.
[x] Copy/paste to execute the grants on appropriate dbs.
[x] Create the user a ~/.my.cnf file with the original password from account creation.
[ ] follow_on: Verify user can ssh to the required host and log in to mysql.
==== [ ] civicrm ====
Requires: client_ssl_cert
[x] account_setup: Create user account. This will notify the user via email to update their password.
[ ] follow_on: Verify user can log in to https://civicrm.wikimedia.org
==== [ ] superset ====
Requires: client_ssl_cert
[x] account_setup: Create user account. Notify the user of their account name and password.
[ ] follow_on: Verify user can log in to https://analytics.frdev.wikimedia.org