We chatted a bit about this and it now seems like this is a bug or outdated docs, because she can login but not see any objects despite being in the wmf group.

Hi Selena, could you link me to the tutorial you are following?

Thanks! I can definitely login to netbox, but all of the objects are locked. I'm following the SRE tutorials, so if there's maybe something I missed earlier, let me know!

resolving! But if there is any issue or more is needed feel free to just reopen it, or we can.

@SDeckelmann-WMF Hey, so.. I checked and you already have membership in the "wmf" LDAP group. So that means you should be able to login on https://netbox.wikimedia.org Let us know if that works for you. Cheers!

"netbox access" can still mean some different things.

@wiki_willy mentioned to me that @SDeckelmann-WMF needed to access netbox as well, I'm handing this over to @Dzahn if this is time sensitive as I'm out right now

In T394749#10850867, @Dzahn wrote:

@hashar So it requires 2 things, membership in LDAP group ciadmin and also shell access with contint-admins?

T395094: Grant Access to ops-limited for sdeckelmann-wmf and T395110: Grant Access to ops-limited for lsobanski done

T395094: Grant Access to ops-limited for sdeckelmann-wmf and T395110: Grant Access to ops-limited for lsobanski done

Done. Peter has a shell user on contint* machines now and is the LDAP ciadmin group.

Change #1148264 merged by Dzahn:

[operations/puppet@production] admin: Add phedenskog to contint-admins

https://gerrit.wikimedia.org/r/1148264

I already did the LDAP group membership just now after Tyler's approval.

@hashar So it requires 2 things, membership in LDAP group ciadmin and also shell access with contint-admins?

Approved as keeper of contint-admins.

I was able to login now, thanks! I think we can proceed with keeping "mbinder" and cleaning up "maxbinderWMF". I appreciate your patience. :)

It might be an issue with your email already being in the system using the new "maxbinderwmf" user. I've invalided that email address, let's see if that will allow the authentication to link the users correctly.

@MBinder_WMF Can you sign in at https://idp.wikimedia.org ?

+ @thcipriani as the manager approving shell access / contint-admins ( 1148264 - admin: Add phedenskog to contint-admins ).

Change #1148264 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/puppet@production] admin: Add phedenskog to contint-admins

https://gerrit.wikimedia.org/r/1148264

Thanks for the help. So I reset via email, and still can't log in with mbinder. I double checked the password I created is what's entered. I also tried to log in first with what I think the password would be (because I would use that to do the Phab batch edit work). After waiting a few minutes and trying again, I saw this:

In T394523#10831292, @MBinder_WMF wrote:

hmm, well, I do use the other one for Phabricator batch edit silencing, though I don't know that that would always have to be done under an official account. I'd probably prefer to keep one account for now. In that case, is there a way to delete the one for this request, and I can try to recover login info for the other?

I'm unfortunately not the right person to ask for that! I'd get in touch with your manager and see what the bigger wigs say.

hmm, well, I do use the other one for Phabricator batch edit silencing, though I don't know that that would always have to be done under an official account. I'd probably prefer to keep one account for now. In that case, is there a way to delete the one for this request, and I can try to recover login info for the other?

My guess is that your old one would remain as a personal account and that MaxBinderWMF would be for official representation (given that the WMF suffix is reserved).

I am not! That other account was set up on my behalf, I think, as part of another small issue wherein I needed SSH to a specific thing but not much else, so I wasn't sure if I should or how to use it in this context. Should I instead do a password reset of that existing username? I'm not attached to the new one, and would be more concerned about breaking anything with the old one.

Hmm, are you intentionally using a new developer account for this instead of the existing 'mbinder' one that your Phabricator shell access is already associated with?

Thank you @BCornwall for the help!
I have all needed SSH access now, however I'm not sure about Kerberos - I did not receive any email with temporary password yet. Is there anything else I need to request besides the Kerberos identity?

This access has been granted. It'll be up to an hour before it will be in effect. If there's anything else you need don't hesitate to ask!

Change #1146027 merged by BCornwall:

[operations/puppet@production] admin: Add jtweed to analytics-privatedata-users

https://gerrit.wikimedia.org/r/1146027

Approved, thanks!