@Vacio Could you please elaborate on what the problem is? Did you try signing up to wikitech and did you run into an error? If so what? You can create a wikitech account at https://wikitech.wikimedia.org/w/index.php?title=Special:CreateAccount

@Vacio Wikitech uses a separate user database from the normal Wikimedia wikis. You will need to create a new account for use on wikitech. You can do this in either of two ways:

• Go to https://wikitech.wikimedia.org/wiki/Special:CreateAccount and use the on-wiki account creation process
• Go to https://toolsadmin.wikimedia.org/register/ and use the registration wizard

Both methods will create an LDAP account for you that can be used to login to wikitech, Gerrit, toolsadmin, and other Wikimedia websites that use LDAP authentication.

@Vacio You are in the right place! If you can hop on to the #wikimedia-cloud IRC channel sometime, we can help you figure this out easier real time :)

I will right now, thanks a lot (:

Task description has been updated to reflect debugging done over irc.

We need to:

• Figure out how to attach this LDAP account to Wikitech so that @Vacio can reset their password
• Add password reset to Striker
• See if there is a good way to attach new LDAP accounts to Wikitech when they are created using Striker

@Vacio, your LDAP account has been attached on Wikitech, so you should now be able to go to https://wikitech.wikimedia.org/wiki/Special:PasswordReset and request a password reset.

For posterity, here's how to attach an LDAP account to Wikitech so that the database and logs look right:

$new_user = 'cn from the LDAP record';
$new_email = 'mail from the LDAP record';

$l = LdapAuthenticationPlugin::getInstance();
$l->LDAPUsername = $new_user;
$l->email = $new_email;
$l->setDomain( $l->getDomain() );
$_SESSION['wsDomain'] = $l->getDomain();
$u = User::newFromName( $l->LDAPUsername, 'creatable' );
$u->addToDatabase();
$u->saveSettings();
$l->initUser( $u, true );
$u->addWatch( $u->getUserPage(), User::IGNORE_USER_RIGHTS );
$le = new ManualLogEntry( 'newusers', 'create' );
$le->setPerformer( $u );
$le->setTarget( $u->getUserPage() );
$le->setComment( '' );
$le->setParameters( [ '4::userid' => $u->getId() ] );
$le->publish( $le->insert() );

These commands can be pasted into a mwscript eval.php --wiki=labswiki session started from silver.

\MediaWiki\Auth\AuthManager::getInstance()->autoCreateUser( User::newFromName( $username ), LdapPrimaryAuthenticationProvider::class, false )

is probably a less painful way to attach a user account (assuming the LDAP account exists already but the user account doesn't).

As discussed on IRC, one approach is to allow Special:PasswordReset to work for users who do not have a local account, then make sure clicking on the verification link autocreates the user.
One potential complication there is that password reset requires the editmyprivateinfo right so we'd have to somehow check whether the user would have this right after being autocreated. (Or maybe just make editmyprivateinfo for anons a requirement for password reset. If you squint hard enough, that makes semantic sense.)

In T174469#3593114, @Tgr wrote:

\MediaWiki\Auth\AuthManager::getInstance()->autoCreateUser( User::newFromName( $username ), LdapPrimaryAuthenticationProvider::class, false )

is probably a less painful way to attach a user account (assuming the LDAP account exists already but the user account doesn't).

That will blow up when AuthManager passes the User off to LdapPrimaryAuthenticationProvider to fill in the account details. It would probably work if you added the LDAP global state setup as a preamble:

$l = LdapAuthenticationPlugin::getInstance();
$l->LDAPUsername = $user_name;
$l->email = $user_email;
$l->setDomain( $l->getDomain() );
$_SESSION['wsDomain'] = $l->getDomain();

\MediaWiki\Auth\AuthManager::getInstance()->autoCreateUser(
    User::newFromName( $user_name ), LdapPrimaryAuthenticationProvider::class, false );

Change 394510 had a related patch set uploaded (by BryanDavis; owner: Bryan Davis):
[mediawiki/extensions/OpenStackManager@master] Add maintenance script for attaching existing LDAP accounts

https://gerrit.wikimedia.org/r/394510

Change 394510 merged by jenkins-bot:
[mediawiki/extensions/OpenStackManager@master] Add maintenance script for attaching existing LDAP accounts

https://gerrit.wikimedia.org/r/394510

A user has appeared in #wikimedia-dev asking about the account which turns out to be uid=siyam-_-,ou=people,dc=wikimedia,dc=org, cn: MD Abu Siyam. They've forgotten the password but can't reset because wikitech thinks it doesn't exist: https://wikitech.wikimedia.org/wiki/Special:Contributions/MD_Abu_Siyam
@bd808 please can you attach it?

In T174469#4718368, @Krenair wrote:

A user has appeared in #wikimedia-dev asking about the account which turns out to be uid=siyam-_-,ou=people,dc=wikimedia,dc=org, cn: MD Abu Siyam. They've forgotten the password but can't reset because wikitech thinks it doesn't exist: https://wikitech.wikimedia.org/wiki/Special:Contributions/MD_Abu_Siyam
@bd808 please can you attach it?

{{done}} https://wikitech.wikimedia.org/wiki/Special:Log/MD_Abu_Siyam

bd808 says:

the fix is `mwscript extensions/OpenStackManager/maintenance/attachLdapUser.php --wiki=labswiki --user=$LDAP_CN --email=$LDAP_MAIL` on a labweb host

Can I request a password reset? I made an account with a randomly generated password but my password manager failed to save it. I have not logged into it once and so I cannot use https://wikitech.wikimedia.org/ to reset it.

Is this still an issue as Bitu is now used for password resets?

In T174469#9605736, @taavi wrote:

Is this still an issue as Bitu is now used for password resets?

If the reset process is actually working in Bitu now then the main remaining issue would be discovery of that fact. We shouldn't assume that folks using Striker are familiar enough with the larger Wikimedia technical contributor ecosystem to know that they could switch to another *.wikimedia.org site manually to resolve their problem. I actually can't figure out the URL that would be needed myself off the top of my head. I think this means we still need a link from the login screen to somewhere labeled "Forgot password?".

Change 1009295 had a related patch set uploaded (by Majavah; author: Majavah):

[labs/striker@master] Link to idm.wm.o for password resets

https://gerrit.wikimedia.org/r/1009295

Change 1009295 merged by jenkins-bot:

[labs/striker@master] Link to idm.wm.o for password resets

https://gerrit.wikimedia.org/r/1009295