ldap-lint should check staff groups about utils HOT 11 CLOSED

is the second statement actually true? ocfroot should have /root, but not all of ocfroot needs /admin right? i though /admin is only for ldap/kerberos admin.

from utils.

there is no case where a person should be in ocfroot and not have a /admin principal

from utils.

oh, interesting. are we giving all root staff super powers in kerberos and ldap now?

from utils.

yes. it doesn't make sense to provide root but not ldap admin; you'll constantly be blocked on silly things like changing puppet environments, adding new hosts or puppet classes, etc.

additionally, there's no technical justification since both privileges easily escalate into the other

from utils.

yes. it doesn't make sense to provide root but not ldap admin; you'll constantly be blocked on silly things like changing puppet environments, adding new hosts or puppet classes, etc.

ah, all the newness of ldap for all the things.

additionally, there's no technical justification since both privileges easily escalate into the other

good point

though, it would make sense for an ocfstaff member to have /root just to change passwords, right? (i.e. staff member is not in ocfroot group, but only ocfstaff) (yes, i know we basically don't need that anymore since you can change it on the website now.)

from utils.

yeah, lots of staff have a /root principal but not root (ocfroot aka sudo)

it's definitely confusingly named. to make it worse, the /root principal is used to authenticate (but not authorize) sudo access, except on staff VMs and desktops

from utils.

good to know that /root (and /admin) are still as confusing as 3+ years ago. 😛

from utils.

IMHO we should eventually rename /root to /staff and ocfroot to ocfadmin.

from utils.

IMHO we should eventually rename /root to /staff and ocfroot to ocfadmin.

didn't we decide to do that like 6 years ago, but never did it?

from utils.

I wonder if renaming /root to /staff will end up confusing new staff as to what privileges they have when they get added to the ocfstaff LDAP group, but would still need to ask for a /staff principal to do any root-requiring work

from utils.

Closed by ocf/puppet#835 🎉

from utils.