User Details
- User Since
- May 2 2022, 11:51 AM (123 w, 22 h)
- Availability
- Available
- LDAP User
- Slyngshede
- MediaWiki User
- SLyngshede-WMF [ Global Accounts ]
Today
Yesterday
ecdsa-sha2-nistp256 are now accepted.
Turnilo is now also limited in the number of LDAP groups returned in the CAS token.
@bd808 we'll add the same filter to Turnilo, that also doesn't need to be concerned with Toolforge groups. I'll let you know when the filter is in place.
Fri, Sep 6
We have this patch, which could be used here as well: https://gerrit.wikimedia.org/r/c/operations/puppet/+/1003442
We have rolled out an update to the service configuration for Debmonitor in CAS. This will limit the groups pushed from CAS to Debmonitor, which should reduce the size of the CAS token.
Wed, Sep 4
Netbox is configured to
Mon, Sep 2
Netbox is limited to the groups "ops" and "wmf", seems a little weird that CAS would error out like that though.
Thu, Aug 29
Mon, Aug 26
Thu, Aug 22
My attempt at simply not shipping groups failed, the group membership test is done on the "client" and not on the IDP host. We need to filter the groups.
@Andrew Sorry, this is still pending. I need to figure out what to do about the Redis dependency. The correct solution would be to build a Redis container, but that's yet another thing to maintain, so I'll see if I can make it work without it.
Wed, Aug 21
Mon, Aug 19
It's probably enough to bump the default timeout as a quick fix. I'll take a look.
Thank you for reporting. I think I have some idea as to why the key updated failed, so I'll try to add a test case and see if we can replicate the problem and get it fixed.
@Meno25 I manually updated your SSH key to the eddsa-key-20240812, the old key has been removed. I've also deleted the cached copies found in Bitu (idm.wikimedia.org). The new key "should" import correctly next time you access the SSH key section there.
Hi, could you do a quick test for me? We had another user with a similar issue, but have yet to receive feedback regarding the fix.
Thank you for a very good bug report, it's appreciated
Aug 8 2024
Yes, the tickets are short lived, so you need to run the kinit regularly. See: https://wikitech.wikimedia.org/wiki/Data_Platform/Systems/Kerberos
Hi @XiaoXiao-WMF, when logging in, please try to run the command "kinit" that should prompt you for your password, and will give you a valid Kerberos ticket.
Aug 7 2024
The WMF group is for staff and contractor, so I suspect there's another one.
You shouldn't need access to the WMF group to access or contribute to repos/mediawiki.
We've tested modifying the basedn on test and @hashar confirms that login is now working.
While I don't have the password, I've tested authenticating as jenkin-deploy on idp-test2004, and CAS now sees the user and rejects due to invalid password.
CAS uses the following to lookup the user:
2024-08-06 20:10:04,149 WARN [org.apereo.cas.util.function.FunctionUtils] - <Found 2 DNs for [org.ldaptive.auth.User@975024821::identifier=jenkins-deploy, context=null] : [uid=jenkins-deploy,ou=people,dc=wikimedia,dc=org, cn=jenkins-deploy,ou=sudoers,cn=integration,ou=projects,dc=wikimedia,dc=org] 2024-08-06 20:10:04,151 WARN [org.apereo.cas.util.LdapUtils] - <Found 2 DNs for [org.ldaptive.auth.User@975024821::identifier=jenkins-deploy, context=null] : [uid=jenkins-deploy,ou=people,dc=wikimedia,dc=org, cn=jenkins-deploy,ou=sudoers,cn=integration,ou=projects,dc=wikimedia,dc=org] 2024-08-06 20:10:04,151 ERROR [org.apereo.cas.authentication.DefaultAuthenticationManager] - <Authentication has failed. Credentials may be incorrect or CAS cannot find authentication handler that supports [RememberMeUsernamePasswordCredential(super=UsernamePasswordCredential(username=jenkins-deploy, source=null, customFields={}), rememberMe=false)] of type [RememberMeUsernamePasswordCredential]. Examine the configuration to ensure a method of authentication is defined and analyze CAS logs at DEBUG level to trace the authentication event.>
Aug 6 2024
@Reedy Given that @Htriedman won't be needing access to security and privacy related tickets in Phabricator, could you remove the access to the acl*security_team policy in Phabricator. That isn't something I have access to.
@Htriedman I'm responsible for offboarding you from any systems you no longer require access to and I was informed that there where "special consideration", meaning that you would require continued access to certain systems.
Aug 5 2024
@KFrancis Do we have an NDA for @JoelyRooke-WMDE
@Ottomata I'm just removing the SRE-Access-Requests tag to remove this from the Clinic Duty dashboard.
@KFrancis would you confirm that we have an NDA for @seanleong-WMDE
Aug 2 2024
Just checked, you Wikitech account (Nintendofan885) is linked to a SUL account with the same name.
Jul 29 2024
Closing this task, I've created https://phabricator.wikimedia.org/T371270 for the issues regarding the offboard-user script.
I'll set this to low, as it is easy to work-around, though medium is tempting, as the error message is ugly, confusing and scary.
Jul 15 2024
Jul 11 2024
@bd808 Sorry I haven't booked a time slot for debugging, but time hasn't been on my side.
Jul 10 2024
This isn't all of it, but maybe we can design a patch for the pyproject.toml in Netbox, which would allow it to be installed using pip.
I just tested installing Netbox using pip from Git and the repo/project setup isn't really designed for it. Maybe we could get a patch in that fixes pyproject/setuptools. That would also be required to build a Debian package, otherwise I doubt that the dh_tools can actually build the package.
Jul 4 2024
@MisterSynergy We deployed an update to https://idm-test.wikimedia.org
@bd808 I think we need to find 20 minutes where we can enable CAS Debugging on Debmonitor and see what is going on. Only guess is that due to you being a member of quite a few groups, your tokens do grow a bit larger than normal, 4x in fact. I'm not sure that's actually the issue, so let's try with debugging on and see.
It's not something know. We did have an issue on people.wikimedia.org where tokens would get mixed up between applications and users where sent into a loop. That was due to having multiple CAS settings on the same domain, so that's not the case here, also Bryan isn't in a loop.
Jun 28 2024
@taavi Correct :-(
One way we could do this is by adding Github to Bitu in the same way we've added the SUL accounts.
@Dzahn It's already on my todo :-)
Jun 26 2024
From the log file we do see:
sudo cookbook sre.hosts.reimage --os bookworm -t T368503 idp-test1002
Jun 25 2024
@odimitrijevic / @Ottomata / @WDoranWMF Would either of you approve?
Jun 24 2024
I did find the username in data.yaml, see https://gerrit.wikimedia.org/r/c/operations/puppet/+/1049019
Jun 18 2024
@MisterSynergy Thank you for testing. Based on the error logs I believe that we where able to reproduce the bug you found.