1703758 - Add Acasandrei Beatrice to Treeherder sheriff group

Status: RESOLVED FIXED

(Tree Management :: Treeherder: Infrastructure, task)

Description

[Acasandrei Beatrice (needinfo me)]

I will work on tasks that require me to have perf sheriff rights.

Comment 1

[Sarah Clements [:sclements]]

It looks like you do have some permissions for use with the taskcluster notify service per here.

If you need full sheriff privileges for taskcluster there needs to be a change to your LDAP role to "sheriff", so you'll need to file this bug in Infrastructure & Operations::Infrastructure: LDAP and include approval from :dhunt and/or :aryx (or whomever IT needs approval from).

Comment 2

[Acasandrei Beatrice (needinfo me)]

Thanks for letting me know. I filled a bug for that. I also need my user's is_staff field set to true (1). Can you help me with that?

Comment 3

[Sarah Clements [:sclements]]

hrm, I think Treeherder gets that info from when you log in to auth0, so that will need to be an IAM/LDAP change. Do you have a mozilla email that you log in with?

Comment 4

[Ionuț Goldan [:igoldan]]

Unless Auth0' s integration also updates our auth-related data from the database (which doesn't immediately seem to be the case), Beatrice' s auth_user.is_staff flag should still be set to 1.
That flag guards write operations on essential Perfherder endpoints & blocks Beatrice from doing any real perf sheriffing.

Comment 5

[Acasandrei Beatrice (needinfo me)]

(In reply to Sarah Clements [:sclements] from comment #3)

hrm, I think Treeherder gets that info from when you log in to auth0, so that will need to be an IAM/LDAP change. Do you have a mozilla email that you log in with?

My Mozilla email is [e-mail] .

Comment 6

[Sarah Clements [:sclements]]

(In reply to Ionuț Goldan [:igoldan] from comment #4)

Unless Auth0' s integration also updates our auth-related data from the database (which doesn't immediately seem to be the case), Beatrice' s auth_user.is_staff flag should still be set to 1.

That flag guards write operations on essential Perfherder endpoints & blocks Beatrice from doing any real perf sheriffing.

I understand the reasons for wanting it set, that wasn't the issue - I want to make sure access is kept in sync with credentials. However, I checked the code and you are indeed correct that we only verify a user already exists (and if not, create it) when we get an auth0 token on login - we don't update that user in our table if LDAP details have changed. That piece of code should be changed.

I've manually set is_staff to 1 for Beatrice on production. It doesn't look like she has logged in to prototype and stage, so a user entry will be added the first time she logs in based on her LDAP credentials at the time.

Comment 7

[Acasandrei Beatrice (needinfo me)]

Thank you. I have access now to everything I needed.