1133792 - Change [e-mail] from an alias to an account

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: Account Requests, task)

Description

[Daniel Thorn [:relud]]

Right now [e-mail] is an alias for [e-mail]. I need to make [e-mail] the owner for two projects in the google developer console ( https://console.developers.google.com/project ), but because google can tell [e-mail] is an alias for a group, it will only add members of the group to a project, and not the group email itself. By changing [e-mail] to an account, I hope to be able to make it the owner of persona projects, so that those projects are not bound to an individual employee.

The developer console is being used to get OAuth 2.0 api keys for use with the persona gmail bridge. Having an actual user as the owner (ie [e-mail]) isn't acceptable, because the api key owner email is shown to end users in production.

Comment 1

[Ludovic Hirlimann [:Usul]]

:jabba what's the best way to do this ? Create a new account in LDAP ?

Comment 2

[Justin Dow [:jabba]]

Will anyone need to log into this account? Also, I want to make sure we are talking about @mozilla.com, since the bug summary says mozilla.org.

If anyone needs to log into the account, I'll have to create it in LDAP under the shared_accounts OU. If it just needs to exist, but no login, then we can create it in the gads_exceptions OU in google directory. Also CC'ing jen, as the owner of google apps.

Comment 3

[Daniel Thorn [:relud]]

yes it's @mozilla.com, my bad, fixed summary.

if emails are forwarded to [e-mail], then no login is required.

Comment 4

[Justin Dow [:jabba]]

jen - can you create an account in google apps in the gads_exceptions OU and set up the forwarding and remove the DL?

Comment 5

[Jennifer Hayashi [:jen]]

Yup. Let me create that now.  I may need the LDAP to get the forwarding working, but let me see how far I can get.

Comment 6

[Jennifer Hayashi [:jen]]

Removed the alias and created the account in gads_exception.  It took awhile for it to show up correctly in the directory.  Sent a test message with the forward on the account. Can someone confirm that they received it at infra-services?

Comment 7

[Daniel Thorn [:relud]]

It worked, thanks!

Comment 8

[Daniel Thorn [:relud]]

Apparently it needs a login to do what I need in the developer console. I didn't think it would. My bad. Can this account get a login?

Comment 9

[Jennifer Hayashi [:jen]]

Daniel - will you need permanent access? Or is this a one time thing?

Comment 10

[Daniel Thorn [:relud]]

Permanent access, I suspect.

Comment 11

[Jennifer Hayashi [:jen]]

Ok - jabba will need to created a shared ldap account so you can log in.  With SSO - you'll need to open a different browser or profile to log into the shared ldap successfully since you are already logged into Google with your account.

Since it is a shared account - please open a bug to have the password changed anytime a team member changes.  I don't think we currently have the ability to reset the passwords on shared accounts through the normal password reset tool.

Comment 12

[Jennifer Hayashi [:jen]]

Gave password to daniel.