It is highly recommended that you avoid renaming users. It can (and has) lead to various problems and errors all over the various systems as their local databases and authentication methods will get out of sync
This has only been tested changing the cn, sn LDAP attributes. It has not been tested with change of the uid ldap attribute and would almost certainly not work
It is possible, but not trivial, to rename a Wikitech/LDAP/Gerrit user account. The complication occurs mostly because multiple "primary" data stores all reference each other in interdependent ways.
Open 3 tabs and stay logged in on Wikitech, Gerrit and Phabricator. On Phabricator, make sure the user to be renamed has enabled both Wikitech and MediaWiki auth methods so that they do not lose access to Phabricator entirely during the rename.
Rename the user in LDAP
- Find the user's current information
ldaplist -l passwd <shell-account-name>
- Ensure the new CN doesn't conflict with another user's CN
ldapsearch -xLLL -P 3 -E pr=40000/noprompt -b"dc=wikimedia,dc=org" 'cn=<new-cn>'
- Change the user's CN using
$ ldapmodify -v -D 'uid=novaadmin,ou=people,dc=wikimedia,dc=org' -W - Enter bind password: dn: uid=<shell-account-name>,ou=people,dc=wikimedia,dc=org changetype: modify replace: cn cn: <new-cn> - replace: sn sn: <new-cn> -
Rename the user in Wikitech
Have someone with super special permissions change your Wikitech username. Use Special:RenameUser. Login to Wikitech using your new username to make sure it works.
Login to Icinga with your new creds. It should work for lowercase as well.
- Flush Gerrit's caches (with caution): ssh -p 29418 gerrit.wikimedia.org gerrit flush-caches --all
- Go to https://gerrit.wikimedia.org/r/#/settings/contact and click on "Reload". You will be asked to login again, use your new Wikitech username
- You should be able to see your history, make sure you see your new username as "Owner".
- Git pull some random repo using ssh, it should work
- Got to your profile and click on Manage->Edit Settings->External Accounts
- Unlink the Wikitech auth and relink it with your new wikitech username.
- If you want a new phabricator username, you could create a new account (not tested)
Wikimedia Cloud Services (Horizon)
- You should be able to login using your new username.
- You should have access to all projects you were before.
Hope for the best.