LDAP/Renaming users

From Wikitech
< LDAP(Redirected from Renaming users)
Jump to navigation Jump to search

It is possible, but not trivial, to rename a Wikitech/LDAP/Gerrit user account. The complication occurs mostly because multiple "primary" data stores all reference each other in interdependent ways.

Rename the user in LDAP

  1. Find the user's current information
    • ldaplist -l passwd <shell-account-name>
  2. Ensure the new CN doesn't conflict with another user's CN
    • ldapsearch -xLLL -P 3 -E pr=40000/noprompt -b"dc=wikimedia,dc=org" 'cn=<new-cn>'
  3. Change the user's CN using ldapmodify
    • $ ldapmodify -v -D 'uid=novaadmin,ou=people,dc=wikimedia,dc=org' -W -
      Enter bind password:
      dn: uid=<shell-account-name>,ou=people,dc=wikimedia,dc=org
      changetype: modify 
      replace: cn 
      cn: <new-cn>
      replace: sn 
      sn: <new-cn>

Rename the user in Wikitech

Use Special:RenameUser

Rename the user in Gerrit

  1. Connect to Gerrit's database
    • ssh -p 29418 gerrit.wikimedia.org gerrit gsql
  2. Find the user's current information
    • select * from account_external_ids where external_id like 'gerrit:<old cn>'
      (this sometimes might not be the casing you expect, hence the like)
  3. Update gerrit: entry
    • update account_external_ids set external_id = 'gerrit:<new cn>' where external_id = 'gerrit:<old cn>'
  4. Wait for caches to clear, or alternatively force clear them
    • ssh -p 29418 gerrit.wikimedia.org gerrit flush-caches --all