Google Search Console access

Google search console access is extremely limited compared to access to other services. This is due to the limitations of the service.

When a user, other than the root user, is created, they have to be individually granted access to each sub-domain and project on a case by case basis. This is done via single permission grants in google search console. As such, access to the search console is restricted to those who need it, and is not given out freely.

There are two potential credentials/ways to access the Google Search console.

• Work for Wikimedia, and be granted access to the google search console admin user/password.
  • We don't like doing this, as it then gives whoever has access all the same rights as everyone else, with a single shared user.

• Work for Wikimedia or be a volunteer/contractor/hired to do the work, and get their own user.
  • This will be limited to a small sub-set of the 100 subdomains.

To gain access to this console in either form, the following steps must be taken.

• File an [[ https://phabricator.wikimedia.org/project/profile/956/ | #SRE-access-request ]] task in Phabricator.
• User must have a valid NDA on file with WMF legal. Not a phabricator NDA electronically signed, but a full NDA with our legal department.
  • WMF staff automatically sign this as part of their hiring process, all non-staff must have the NDA confirmed before access.
• User must ahve a valid reason for accessing the google search console.
  • Please document what you'll be doing, and why.
• User should have an end date in mind, or setup an expiry time to check access, typically within a year of access (or less.)
• All user requests for non staff must have the sponsorship of a WMF staff person.

SRE Notes / HowTo

ASSUMPTIONS: Do we only need to add users to the HTTPS version of the domain, or do they need to be on both? --RobH (talk) 19:02, 10 May 2018 (UTC)

• Please note the admin password for [[ https://www.google.com/webmasters/tools | google search console ]] is in the pwstore.
• There is no scripted check for expiry at this time. Add user to the maint-announce calendar for their expiry until we have a better system.

Adding Users to Domains

This is a tedious process. Once you login to the [[ https://www.google.com/webmasters/tools | google search console ]] you will see a list of every single sub-domain for every single language and project in both HTTP and HTTPS.

• Login to [[ https://www.google.com/webmasters/tools | google search console ]]. The Home page is the listing off the hundreds of domains we have in the search console.
• Click on Manage Domain, Add or Manage Users for the single domain you want to edit. This pulls up a sub-page.
• Determine if the user will need [[ https://support.google.com/webmasters/answer/2453966 | Restricted or Full access ]] to the Domain.
• Click add user, and then enter the user's email address and click add user.
• User has now been added to that project/subdomain. Repeat as needed for other projects/subdomains.

IMPORTANT NOTE FOR NON-WMF ADDITIONS: These all have expiration dates. An entry should be added to the maint-announce calendar, set to email out to the root list and the person who approved the access to the search console for the entry to alert them of expiry. Then whoever is on clinic duty for that week needs to login and remove the user from each of the domains.

Removing Users from Domains

• Login to [[ https://www.google.com/webmasters/tools | google search console ]]. The Home page is the listing off the hundreds of domains we have in the search console.
• Click on Manage Domain, Add or Manage Users for the single domain you want to edit. This pulls up a sub-page.
• Click the user in question in the list presented on page, this highlights the user.
• Click the delete user button on the highlighted line.