LDAP/Renaming users

From Wikitech
< LDAP(Redirected from Renaming users)
Jump to navigation Jump to search

It is possible, but not trivial, to rename a Wikitech/LDAP/Gerrit user account. The complication occurs mostly because multiple "primary" data stores all reference each other in interdependent ways.


Open 3 tabs and stay logged in on Wikitech, Gerrit and Phabricator. On Phabricator, make sure the user to be renamed has enabled both Wikitech and MediaWiki auth methods so that they do not lose access to Phabricator entirely during the rename.

Rename the user in LDAP

  1. Find the user's current information
    • ldaplist -l passwd <shell-account-name>
  2. Ensure the new CN doesn't conflict with another user's CN
    • ldapsearch -xLLL -P 3 -E pr=40000/noprompt -b"dc=wikimedia,dc=org" 'cn=<new-cn>'
  3. Change the user's CN using ldapmodify
    • $ ldapmodify -v -D 'uid=novaadmin,ou=people,dc=wikimedia,dc=org' -W -
      Enter bind password:
      dn: uid=<shell-account-name>,ou=people,dc=wikimedia,dc=org
      changetype: modify 
      replace: cn 
      cn: <new-cn>
      replace: sn 
      sn: <new-cn>

Rename the user in Wikitech

Have someone with super special permissions change your Wikitech username. Use Special:RenameUser. Login to Wikitech using your new username to make sure it works.


Login to Icinga with your new creds. It should work for lowercase as well.


  • Flush Gerrit's caches (with caution): ssh -p 29418 gerrit.wikimedia.org gerrit flush-caches --all
  • Go to https://gerrit.wikimedia.org/r/#/settings/contact and click on "Reload". You will be asked to login again, use your new Wikitech username
  • You should be able to see your history, make sure you see your new username as "Owner".
  • Git pull some random repo using ssh, it should work


  • Got to your profile and click on Manage->Edit Settings->External Accounts
  • Unlink the Wikitech auth and relink it with your new wikitech username.
  • If you want a new phabricator username, you could create a new account (not tested)

Wikimedia Cloud Services (Horizon)

  • You should be able to login using your new username.
  • You should have access to all projects you were before.

Hope for the best.