ecdsa-sha2-nistp256 are now accepted.

Turnilo is now also limited in the number of LDAP groups returned in the CAS token.

@bd808 we'll add the same filter to Turnilo, that also doesn't need to be concerned with Toolforge groups. I'll let you know when the filter is in place.

@Dzahn Sorry, Hal was allowed to keep many of his permissions as he'll still be working with the security team. Permissions and access requests was cleared with @acooper via email. I did update the email address in data.yaml to reflect the new email specified in LDAP.

We have this patch, which could be used here as well: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1003442

We have rolled out an update to the service configuration for Debmonitor in CAS. This will limit the groups pushed from CAS to Debmonitor, which should reduce the size of the CAS token.

Netbox is configured to

Netbox is limited to the groups "ops" and "wmf", seems a little weird that CAS would error out like that though.

My attempt at simply not shipping groups failed, the group membership test is done on the "client" and not on the IDP host. We need to filter the groups.

@Andrew Sorry, this is still pending. I need to figure out what to do about the Redis dependency. The correct solution would be to build a Redis container, but that's yet another thing to maintain, so I'll see if I can make it work without it.

It's probably enough to bump the default timeout as a quick fix. I'll take a look.

Thank you for reporting. I think I have some idea as to why the key updated failed, so I'll try to add a test case and see if we can replicate the problem and get it fixed.

@Meno25 I manually updated your SSH key to the eddsa-key-20240812, the old key has been removed. I've also deleted the cached copies found in Bitu (idm.wikimedia.org). The new key "should" import correctly next time you access the SSH key section there.

Hi, could you do a quick test for me? We had another user with a similar issue, but have yet to receive feedback regarding the fix.

Thank you for a very good bug report, it's appreciated

Yes, the tickets are short lived, so you need to run the kinit regularly. See: https://wikitech.wikimedia.org/wiki/Data_Platform/Systems/Kerberos

Hi @XiaoXiao-WMF, when logging in, please try to run the command "kinit" that should prompt you for your password, and will give you a valid Kerberos ticket.

The WMF group is for staff and contractor, so I suspect there's another one.

You shouldn't need access to the WMF group to access or contribute to repos/mediawiki.

We've tested modifying the basedn on test and @hashar confirms that login is now working.

While I don't have the password, I've tested authenticating as jenkin-deploy on idp-test2004, and CAS now sees the user and rejects due to invalid password.

CAS uses the following to lookup the user:

@Reedy Given that @Htriedman won't be needing access to security and privacy related tickets in Phabricator, could you remove the access to the acl*security_team policy in Phabricator. That isn't something I have access to.

@Htriedman I'm responsible for offboarding you from any systems you no longer require access to and I was informed that there where "special consideration", meaning that you would require continued access to certain systems.

@KFrancis Do we have an NDA for @JoelyRooke-WMDE

@Ottomata I'm just removing the SRE-Access-Requests tag to remove this from the Clinic Duty dashboard.

@KFrancis would you confirm that we have an NDA for @seanleong-WMDE

Just checked, you Wikitech account (Nintendofan885) is linked to a SUL account with the same name.

Closing this task, I've created https://phabricator.wikimedia.org/T371270 for the issues regarding the offboard-user script.

I'll set this to low, as it is easy to work-around, though medium is tempting, as the error message is ugly, confusing and scary.

@bd808 Sorry I haven't booked a time slot for debugging, but time hasn't been on my side.

This isn't all of it, but maybe we can design a patch for the pyproject.toml in Netbox, which would allow it to be installed using pip.

I just tested installing Netbox using pip from Git and the repo/project setup isn't really designed for it. Maybe we could get a patch in that fixes pyproject/setuptools. That would also be required to build a Debian package, otherwise I doubt that the dh_tools can actually build the package.

@MisterSynergy We deployed an update to https://idm-test.wikimedia.org

@bd808 I think we need to find 20 minutes where we can enable CAS Debugging on Debmonitor and see what is going on. Only guess is that due to you being a member of quite a few groups, your tokens do grow a bit larger than normal, 4x in fact. I'm not sure that's actually the issue, so let's try with debugging on and see.

It's not something know. We did have an issue on people.wikimedia.org where tokens would get mixed up between applications and users where sent into a loop. That was due to having multiple CAS settings on the same domain, so that's not the case here, also Bryan isn't in a loop.

@taavi Correct :-(

One way we could do this is by adding Github to Bitu in the same way we've added the SUL accounts.

@Dzahn It's already on my todo :-)

From the log file we do see:

sudo cookbook sre.hosts.reimage --os bookworm -t T368503 idp-test1002

@odimitrijevic / @Ottomata / @WDoranWMF Would either of you approve?

I did find the username in data.yaml, see https://gerrit.wikimedia.org/r/c/operations/puppet/+/1049019

@MisterSynergy Thank you for testing. Based on the error logs I believe that we where able to reproduce the bug you found.