1213757 - delegate password and 2fa resets to servicedesk

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, defect)

Description

[:glob ✱]

in order to centralise identity verification we're going to delegate security-group password and 2fa resets to servicedesk.

we need to:
- change the email address in the "you need to contact us to reset your password" from bmo-admin to servicedesk
- change the "can disable 2fa" group from admin to a new group
- create a new "servicedesk" group, owned by mpoessy

Comment 1

[Reed Loden [:reed]]

And how do you deal with non-MoCo employees who don't have access to servicedesk?

Comment 2

[:glob ✱]

Attachment: 1213757_1.patch

- add bz_can_disable_mfa group
- move mfa checks and auditing from editusers to Bugzilla::User
- update contact email address in SecureMail

Comment 3

[:glob ✱]

(In reply to Reed Loden [:reed] (use needinfo?) from comment #1)
> And how do you deal with non-MoCo employees who don't have access to
> servicedesk?

servicedesk will forward the request to the bmo admins to take action.

Comment 4

[:glob ✱]

i've created and populated the 'servicedesk' group.

Comment 5

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8672497 [details] [diff] [review]
1213757_1.patch

Review of attachment 8672497 [details] [diff] [review]:
-----------------------------------------------------------------

This one also conflicted with the duo patch as well. After working around that it seems mostly sane though.

Comment 6

[:glob ✱]

Attachment: 1213757_2.patch

Comment 7

[Dylan Hardison [:dylan] (he/him)]

Comment on attachment 8673484 [details] [diff] [review]
1213757_2.patch

Review of attachment 8673484 [details] [diff] [review]:
-----------------------------------------------------------------

r=dylan

::: editusers.cgi
@@ -274,2 @@
>              $otherUser->set_mfa('');
> -            Bugzilla->audit(sprintf('%s disabled 2FA for %s', $user->login, $otherUser->login));

What's the reasoning behind removing the audit log entry?

Comment 8

[:glob ✱]

(In reply to Dylan William Hardison [:dylan] from comment #7)
> What's the reasoning behind removing the audit log entry?

i moved it to Bugzilla::User->update()

Comment 9

[:glob ✱]

i'm holding off committing this patch for now - we want to do a quick training session of the servicedesk staff first.

Comment 10

[:glob ✱]

we're good to go here now.

To ssh://[e-mail]/webtools/bmo/bugzilla.git
   175f9c1..b6d9211  master -> master