@bd808 Sorry I haven't booked a time slot for debugging, but time hasn't been on my side.

This isn't all of it, but maybe we can design a patch for the pyproject.toml in Netbox, which would allow it to be installed using pip.

I just tested installing Netbox using pip from Git and the repo/project setup isn't really designed for it. Maybe we could get a patch in that fixes pyproject/setuptools. That would also be required to build a Debian package, otherwise I doubt that the dh_tools can actually build the package.

@MisterSynergy We deployed an update to https://idm-test.wikimedia.org

@bd808 I think we need to find 20 minutes where we can enable CAS Debugging on Debmonitor and see what is going on. Only guess is that due to you being a member of quite a few groups, your tokens do grow a bit larger than normal, 4x in fact. I'm not sure that's actually the issue, so let's try with debugging on and see.

It's not something know. We did have an issue on people.wikimedia.org where tokens would get mixed up between applications and users where sent into a loop. That was due to having multiple CAS settings on the same domain, so that's not the case here, also Bryan isn't in a loop.

@taavi Correct :-(

One way we could do this is by adding Github to Bitu in the same way we've added the SUL accounts.

@Dzahn It's already on my todo :-)

From the log file we do see:

sudo cookbook sre.hosts.reimage --os bookworm -t T368503 idp-test1002

@odimitrijevic / @Ottomata / @WDoranWMF Would either of you approve?

I did find the username in data.yaml, see https://gerrit.wikimedia.org/r/c/operations/puppet/+/1049019

@MisterSynergy Thank you for testing. Based on the error logs I believe that we where able to reproduce the bug you found.

I've run a test build, Java 21 is a hard requirement, it cannot be older or newer.
Otherwise the overlay upgrade contains only minor changes. I have not tested the functionality.

@MisterSynergy We have deployed a potential bug fix to https://idm-test.wikimedia.org. This installation do use the production LDAP server, but a separate database. This mean that you should be able to test SSH key upload, activation and deactivation, but inactive keys may be different from those shown in production, as these only exist in the database for each of the two installation.

You are correct, just looked at the code again. When generating the email template, Bitu will get the email from the user object, which is database backed, and it has a copy of the email address.

I think Wikitech just synchronized the old email address back, because it has now been updated in LDAP again, and it is set to the old Gmail account.

https://idm.wikimedia.org/ldapbackend/properties/ should show you the email address as stored in LDAP. I do wonder if the issue is that Wikitech doesn't pull the email address directly from LDAP, but stores a copy/cached version. I looked up your account in LDAP, and it correctly showed your new email address.

@MisterSynergy I'm still trying to replicate the exact issue, but I believe we've found at least part of the issue.

First look indicates that the issue might be a missing comment in the comment field. I'm currently trying to reproduce how that may happen.
Second issue is how messaging is handled, we're missing a check for a "form valid"before displaying the "success" message.

The updated template will be rolled out with the next version bump of CAS.

This is a translation automatically provided by the framework used by Bitu.

Docker image is now available: https://docker-registry.wikimedia.org/wikimedia/operations-software-bitu/tags/

I'll assume that I need to at least build the Bitu container image. Then we'll figure out who adds it to the Striker developer environment.

@ABran-WMF Yes, I have no strong feeling about the database name, so what ever fits policy and naming conventions is absolutely fine.