1232400 - Make LDAP master updates optional when SSHing to hg.mozilla.org

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, defect)

Description

[Gregory Szorc [:gps]]

The LDAP master has been keeling over repeatedly for the past week or so. SSH sessions into hg.mozilla.org are failing due to inability to talk to the LDAP master.

We use a read-only LDAP server for processing logins and permissions. We use the writable LDAP master for recording last access date. We don't strictly need to record the last access date on every SSH session. So let's make this optional and reduce our failure points by 1.

Comment 1

[Gregory Szorc [:gps]]

Attachment: MozReview Request: hgserver: don't require LDAP attribute update (bug 1232400); r?fubar

hgserver: don't require LDAP attribute update (bug 1232400); r?fubar

The LDAP master has been failing periodically for the last several days.
This was causing people to fail to SSH into hg.mozilla.org.

Since the LDAP master is only used for updating the last access
attribute and it isn't critical for this to succeed 100% of the time,
let's loosen the requirements around updating the last access attribute.

With this commit, we now ignore failures connecting to the LDAP master
server. A test demonstrating the graceful failure has been added.

Comment 2

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8698138 [details]
MozReview Request: hgserver: don't require LDAP attribute update (bug 1232400); r?fubar

https://reviewboard.mozilla.org/r/27833/#review24983

::: hgserver/pash/ldap_helper.py:31
(Diff revision 1)
> -    if ldap_conn:
> +    if not ldap_conn:

get_ldap_attrib is where we check for hgAccountEnabled, which I think we DO want to be strict about. Setting the access time is in update_access_date().

Comment 3

[Gregory Szorc [:gps]]

Attachment: MozReview Request: hgserver: don't require LDAP attribute update (bug 1232400); r?fubar

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/27833/diff/1-2/

Comment 4

[Kendall Libby [:fubar] (he/him)]

Comment on attachment 8698612 [details]
MozReview Request: hgserver: don't require LDAP attribute update (bug 1232400); r?fubar

https://reviewboard.mozilla.org/r/27833/#review25121

awesome, that's much clearer for adled brains. ;-)

Comment 5

[Gregory Szorc [:gps]]

Thank you. Will deploy shortly.

Comment 6

[Justin Dow [:jabba]]

Just a note that the LDAP master issue has been fixed now, so we should have stability there again.

Comment 7

[Gregory Szorc [:gps]]

Thanks for the update, jabba!