Re: Salsa as authentication provider for Debian

From	Sam Hartman <hartmans@debian.org>
Newsgroups	linux.debian.project
Subject	Re: Salsa as authentication provider for Debian
Date	2020-04-09 23:30 +0200
Message-ID	<zTMUh-72u-1@gated-at.bofh.it> (permalink)
References	<zSCkj-4An-3@gated-at.bofh.it> <zTg82-3Rv-7@gated-at.bofh.it> <zTooV-wA-3@gated-at.bofh.it> <zTzNn-7pE-7@gated-at.bofh.it> <zTJMJ-5b6-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

>>>>> "Tollef" == Tollef Fog Heen <tfheen@err.no> writes:

    Tollef> ]] Enrico Zini
    >> For guest accounts opened by DSA directly, it can be pretty much

First, at this point in time I would be very skepticle of someone
contributing to Debian enough to need porter box access but not having a
salsa account.
It's possible, but  that would be a yellow flag for me in evaluating
such a request.

There are two ways I might read the above statement.
First, subservient might mean that  you're worried about an attack on
salsa propagating into DSA's LDAP.
Clearly that would be bad.
So, taking an automated data feed from salsa and acting on it is
something we'd want to view with hesitation if not out right concern.

However, as I read the guest account process, it has a number of manual
steps where people are processing tickets.
I suspect that DSA actually has a script or set of scripts that go
create the guest account.

Having these scripts check to see if the name is registered at salsa and
requiring manual override to create an account if it conflicts with
salsa and appears to belong to a different user is not, in my mind,
making DSA's ldap subservient to the salsa LDAP.

It might be making one of the namespaces DSA controls interact with a
larger overlapping namespace.
It won't stop DSA from doing anything.
In fact, Enrico has demonstrated that even if DSA chooses to ignore this
project or to create conflicts everything will work out with annoyance
felt mostly be the people who are involved in a conflict.
But like the rest of us, members of DSA can register salsa accounts.
(And if DSA needed additional mechanisms to register salsa accounts, I
strongly suspect the salsa admins would cooperate in creating such a
mechanism.  If not, that sounds like something to escalate.)

I think this sort of namespace interaction--trying to have fewer
namespaces in the project and increase the chances that usernames in one
part of the project overlap with another--is a good thing.

And honestly, LDAP already is subservient to salsa in that game.
People interact with salsa far before they are going to interact with
DSA LDAP.
So much of what we do is based on salsa, and that's even more true for
many of the ways initial contributors can get involved with the project.

It is almost certain that your salsa account is the first Debian account
you will need.
Even if we have some SSO solution--even if we have some other account
lifecycle  process you go through to get your salsa account, you'll be
going through that process first because you want a salsa account.
Yes, it's Debian.
There will doubtless be exceptions: we have exceptions to everything.

But salsa accounts are the accounts people first run into in the vast
majority of cases.
And if you buy the argument that people's usernames should not change
as their role in the organization changes, the LDAP namespace is already
de facto subservient to the salsa namespace.
Any of the cases where that's not true are cases that frustrate and get
in the way of people trying to contribute to our community.

If you don't buy that argument--if you believe that -guest is a feature
rather than a bug, then things are more complicated.
However, assuming that the mechanisms for determining easily if someone
are a dd are adequate, I think there is a rough consensus in this
discussion that keeping the same username as your role changes is
desirable.

--Sam

Thread

Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-06 18:00 +0200
  Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-06 18:20 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-06 20:50 +0200
      Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-06 21:20 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 10:40 +0200
          Re: Salsa as authentication provider for Debian Geert Stappers <stappers@debian.org> - 2020-04-07 11:30 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 17:40 +0200
              Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:00 +0200
                Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 09:50 +0200
                Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-09 12:20 +0200
                Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 09:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 14:50 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 18:00 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 18:30 +0200
                Re: Salsa as authentication provider for Debian Russ Allbery <rra@debian.org> - 2020-04-10 19:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-10 20:20 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 22:10 +0200
                Re: Salsa as authentication provider for Debian Russ Allbery <rra@debian.org> - 2020-04-10 22:30 +0200
      Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-06 21:50 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 09:50 +0200
          Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 10:30 +0200
          Re: Salsa as authentication provider for Debian Felix Lechner <felix.lechner@lease-up.com> - 2020-04-10 21:50 +0200
            Re: Salsa as authentication provider for Debian kuLa <kula@kulisz.net> - 2020-04-11 08:30 +0200
            Re: Salsa as authentication provider for Debian Jonathan Carter <jcc@debian.org> - 2020-04-11 12:10 +0200
              Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-11 19:30 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <leader@debian.org> - 2020-04-11 20:20 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-07 10:40 +0200
      Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:30 +0200
        Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-10 12:20 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-10 19:10 +0200
  Re: Salsa as authentication provider for Debian Holger Levsen <holger@layer-acht.org> - 2020-04-06 21:00 +0200
  Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 12:40 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 14:10 +0200
      Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 14:40 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 15:30 +0200
          Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 15:40 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 16:10 +0200
              Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 16:30 +0200
                Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:50 +0200
      Re: Salsa as authentication provider for Debian Michael Lustfield <michael@lustfield.net> - 2020-04-07 16:30 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 17:00 +0200
    Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 17:40 +0200
      Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-08 22:30 +0200
  Re: Salsa as authentication provider for Debian Paul Wise <pabs@debian.org> - 2020-04-07 17:30 +0200
    Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-07 17:40 +0200
      Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-07 19:00 +0200
        Re: Salsa as authentication provider for Debian Xavier <yadd@debian.org> - 2020-04-10 21:50 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-07 19:00 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-07 20:30 +0200
      Re: Salsa as authentication provider for Debian Paul Wise <pabs@debian.org> - 2020-04-08 08:00 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 11:40 +0200
  Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 12:30 +0200
    Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:00 +0200
    Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-08 21:20 +0200
      Re: Salsa as authentication provider for Debian Steve McIntyre <93sam@debian.org> - 2020-04-08 21:40 +0200
      Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 09:30 +0200
        Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-09 20:10 +0200
          Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 20:30 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-09 23:30 +0200
            Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-12 10:40 +0200
              Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-12 18:50 +0200
                Re: Salsa as authentication provider for Debian Tollef Fog Heen <tfheen@err.no> - 2020-04-13 18:50 +0200
                Re: Salsa as authentication provider for Debian Pirate Praveen <praveen@onenetbeyond.org> - 2020-04-13 19:50 +0200
  Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:00 +0200
    Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:20 +0200
      Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:00 +0200
    Re: Salsa as authentication provider for Debian Ulrike Uhlig <ulrike@debian.org> - 2020-04-08 14:20 +0200
      Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:30 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:30 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 16:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 16:30 +0200
          Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-08 18:10 +0200
            Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-09 10:10 +0200
      Re: Salsa as authentication provider for Debian Ole Streicher <olebole@debian.org> - 2020-04-08 14:40 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-10 21:50 +0200
    Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 14:20 +0200
    Re: Salsa as authentication provider for Debian Bastian Blank <waldi@debian.org> - 2020-04-08 14:40 +0200
      Re: Salsa as authentication provider for Debian Shengjing Zhu <zhsj@debian.org> - 2020-04-08 14:50 +0200
        Re: Salsa as authentication provider for Debian Enrico Zini <enrico@enricozini.org> - 2020-04-08 15:00 +0200
          Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-08 15:20 +0200
      Re: Salsa as authentication provider for Debian Julien Cristau <jcristau@debian.org> - 2020-04-10 21:50 +0200
        Re: Salsa as authentication provider for Debian Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-11 09:30 +0200
          Re: Salsa as authentication provider for Debian Julien Cristau <jcristau@debian.org> - 2020-04-11 19:30 +0200
            Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-11 20:10 +0200
            Re: Salsa as authentication provider for Debian Andrei POPESCU <andreimpopescu@gmail.com> - 2020-04-12 07:30 +0200
              Re: Salsa as authentication provider for Debian Luca Filipozzi <lfilipoz@debian.org> - 2020-04-12 17:00 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-13 16:00 +0200
                Re: Salsa as authentication provider for Debian Peter Palfrader <weasel@debian.org> - 2020-04-13 21:00 +0200
                Re: Salsa as authentication provider for Debian Sam Hartman <hartmans@debian.org> - 2020-04-13 21:30 +0200

csiph-web