LDAP-Access-RequestsComponent
ActivePublic
Watch Project

Members (7)

Nehalomi146319 (Omi)
User
Micromadmonkey (Micromadmonkey)
User
Dzahn (Daniel Zahn)
SRE in team collaboration services
greg (Greg Grossmeier)
Director of Engineering
Reedy (Sam Reed)
Breaker of Wikis
Krenair (Alex Monk)
Wikimedia volunteer
Jdforrester-WMF (James D. Forrester)
Software Engineer
View All

Watchers (12)

Nehalomi146319 (Omi)
User
khunRyPak (KhunPhanDuae)
User
AaR888 (Ariandi Lie)
Spy
mmartorana (manfredi martorana)
Application Security Engineer
Micromadmonkey (Micromadmonkey)
User
xSavitar
User
Jony (ZI Jony)
Volunteer Support
Tommy_Kronkvist (Tommy Kronkvist)
User
Jay8g
User
Jdforrester-WMF (James D. Forrester)
Software Engineer
View All

Details

Description

For Access requests for LDAP groups.

Note that some LDAP group membership (e.g. wmf, logstash-access, etc) is not requested via Phabricator but instead via Wikimedia IDM at https://idm.wikimedia.org. See the full list of LDAP groups managed in Wikimedia IDM.

Create your LDAP membership request in Phabricator

Please include:

Username: (The username of your existing LDAP account on https://idm.wikimedia.org or https://gerrit.wikimedia.org .)
Shell access: Yes/No (Whether you currently have shell access).
Purpose: (Specify which service you need to get access to, e.g. Icinga, Grafana, Superset etc).
Group: (The specific group you want to be added to - optional).
Contract end date: End date of contract (Contractors only)
Contract contact: Contact person for the contractor (Contractors only)

Refer to https://wikitech.wikimedia.org/wiki/LDAP/Groups for documentation on what each LDAP group is for.

How to create a LDAP account?

Make sure you have an LDAP account (aka "Wikimedia Developer" account). If you can login at https://idm.wikimedia.org or https://gerrit.wikimedia.org, then you have an LDAP account. If not, then create your LDAP account via idm.wikimedia.org.

For LDAP admins only, how to process a request?

Check and follow https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#LDAP_access
Note that LDAP flags can only be added to users who are listed in the admin/data.yaml file in Puppet. This is for auditing purposes. This basically means that for a user to gain access to one or more restricted LDAP groups, there is a paper trail managed by SRE with a Git commit recording that the user has signed the relevant NDAs or other documents.

Recent Activity
View All

Tue, May 12

Maintenance_bot removed a project from T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey: Patch-For-Review.

Tue, May 12, 8:31 AM · SRE, LDAP-Access-Requests

Marostegui closed T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey as Resolved.

Done

root@ldap-maint1001:~# ldapsearch -x cn=nda | grep -i cath
member: uid=catherinekelsey,ou=people,dc=wikimedia,dc=org
root@ldap-maint1001:~# ldapsearch -x cn=wmde | grep -i cath
member: uid=catherinekelsey,ou=people,dc=wikimedia,dc=org

Tue, May 12, 8:10 AM · SRE, LDAP-Access-Requests

gerritbot added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Change #1285890 merged by Marostegui:

[operations/puppet@production] admin: add Catherine Kelsey of WMDE as ldap_only user

https://gerrit.wikimedia.org/r/1285890

Tue, May 12, 8:03 AM · SRE, LDAP-Access-Requests

Lena_WMDE added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Hi everyone, I can confirm that @catherine.kelsey.wmde is working at WMDE as a data analyst and I approve this request. Thanks!

Tue, May 12, 7:50 AM · SRE, LDAP-Access-Requests

Mon, May 11

Dzahn reassigned T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey from Dzahn to catherine.kelsey.wmde.

Mon, May 11, 7:34 PM · SRE, LDAP-Access-Requests

gerritbot added a project to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey: Patch-For-Review.

Mon, May 11, 7:26 PM · SRE, LDAP-Access-Requests

gerritbot added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Change #1285890 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] admin: add Catherine Kelsey of WMDE as ldap_only user

https://gerrit.wikimedia.org/r/1285890

Mon, May 11, 7:26 PM · SRE, LDAP-Access-Requests

Dzahn added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Thanks Katie!

Mon, May 11, 7:26 PM · SRE, LDAP-Access-Requests

Dzahn claimed T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Mon, May 11, 7:21 PM · SRE, LDAP-Access-Requests

Dzahn placed T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey up for grabs.

Mon, May 11, 7:21 PM · SRE, LDAP-Access-Requests

KFrancis added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Hi all, the NDA is complete! Thanks!

Mon, May 11, 5:17 PM · SRE, LDAP-Access-Requests

Dzahn assigned T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey to KFrancis.

Mon, May 11, 4:26 PM · SRE, LDAP-Access-Requests

catherine.kelsey.wmde added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Thank you both! I've now signed the NDA :)

Mon, May 11, 9:15 AM · SRE, LDAP-Access-Requests

Fri, May 8

Dzahn placed T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey up for grabs.

Fri, May 8, 10:24 PM · SRE, LDAP-Access-Requests

KFrancis added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Hi all, the NDA has been sent out for signatures. I'll confirm when it's complete. Thanks!

Fri, May 8, 6:41 PM · SRE, LDAP-Access-Requests

catherine.kelsey.wmde added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Thanks @Dzahn - I've reached out to @KFrancis via email to start the process!

Fri, May 8, 7:49 AM · SRE, LDAP-Access-Requests

Thu, May 7

Dzahn changed the status of T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey from Open to In Progress.

Thu, May 7, 6:31 PM · SRE, LDAP-Access-Requests

Dzahn moved T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey from Backlog to NDA Pending on the LDAP-Access-Requests board.

Thu, May 7, 5:51 PM · SRE, LDAP-Access-Requests

Dzahn updated subscribers of T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

Thu, May 7, 3:21 PM · SRE, LDAP-Access-Requests

Dzahn added a comment to T425566: Grant Access to ldap/wmde & ldap/nda. for catherinekelsey.

@catherine.kelsey.wmde Hi, could you please send an email to Katie Francis of the legal team that you would like to start the NDA process? She needs your address and will follow-up and once that is done we can add you to the groups and resolve this ticket. Thanks!

Thu, May 7, 3:20 PM · SRE, LDAP-Access-Requests