@Andrew err can i wait for the fix? i dont urgently need toolsadmin account. was wanting to try starting a bot, but my coding is rudimentary. :)

Authentication has been disabled on idm-test.wikimedia.org. If everything works we can deploy the change to production.

Thank you for the complete explanation @bd808!

Change #1093822 merged by jenkins-bot:

[operations/software/bitu@master] API: Disable authentication for username API

https://gerrit.wikimedia.org/r/1093822

Is there a particular reason that this data validation API requires authentication?

Change #1093822 had a related patch set uploaded (by Slyngshede; author: Slyngshede):

[operations/software/bitu@master] API: Disable authentication for username API

https://gerrit.wikimedia.org/r/1093822

Tokens can be requests via https://idm-test.wikimedia.org once the attached patch has been merged.

This is an unfortunate side effect of T161859: Make Wikitech an SUL wiki having started and T364605: Move Striker to Bitu username validation API not yet having been implemented.

This was merged, but then the entire 2FA integration was removed for T376190: toolsadmin.wikimedia.org login fails because of missing OAuth grant at Wikitech as a side effect of the wikitech.wikimedia.org SUL migration.

It's definitely the case that we enforce unique project names in eqiad1. So the only situation I can think of where names would be ambiguous (and IDs unambiguous) is if we ever build our long-awaited second region.

I think my opinion is that I'm happy if openstack internally has uuids for projects ids, which is what upstream does.
Then, everything outside openstack, including our tooling, we can keep using project names. LDAP, stashbot, SAL, DNS, etc they all qualify in this category of being "our tooling".

From an non-wmf perspective, the most important aspect is documentation. It only takes 5 seconds to C&P the project id, but it might take several hours to find out that the configuration was changed.

In T379030#10318678, @Andrew wrote:

The proposed patch seems hazardous because if we start using names rather than IDs in ldap, that is actually a big change -- even though it feels like it's putting things back the way it was, it's actually changing ldap to store a new kind of thing that nothing that consumes ldap will be expecting.

First, some context: There isn't actually a change in ldap from one format to another; in all cases ldap is using the canonical ID of the project. It's just that IDs and names have recently diverged.

Change #1090854 had a related patch set uploaded (by Arturo Borrero Gonzalez; author: Arturo Borrero Gonzalez):

[operations/puppet@production] openstack: wmfkeystonehooks: create LDAP groups with project name

https://gerrit.wikimedia.org/r/1090854

Also in emails, e.g., regarding failed puppet runs

I just changed https://wikitech.wikimedia.org/wiki/Nova_Resource:Wikiqlever to include that other page. Maybe we can document that, and is that good enough?

Ah the SAL subpage page is already at the place where I would have expected it to be https://wikitech.wikimedia.org/wiki/Nova_Resource:5238620953c040e7a9effbe47d4e0932/SAL

The stupidest thing I can think of is moving https://wikitech.wikimedia.org/wiki/Nova_Resource:Wikiqlever to https://wikitech.wikimedia.org/wiki/Nova_Resource:5238620953c040e7a9effbe47d4e0932. One can then use displaytitle, etc to make it look nicer. I guess there was a reason for changing from semantic identifiers to identifiers with different desired properties. If we don't enforce uniqueness in project names anymore, it would be hard for the bot the guess the right project.

In T379030#10307609, @Physikerwelt wrote:

I tried that with the next log entry, which went https://sal.toolforge.org/__all__

In T379030#10291065, @bd808 wrote:

https://openstack-browser.toolforge.org/project/5238620953c040e7a9effbe47d4e0932 is the UUID named page for the "wikiqlever" project. Stashbot thinks that @Physikerwelt should have used !log 5238620953c040e7a9effbe47d4e0932 start setting up puppet master following https://wikitech.wikimedia.org/wiki/Help:Project_puppetserver based on the LDAP lookup data. This is really poor user experience (same for the UUID in the openstack-browser URL honestly) that we should figure out how to fix.

https://openstack-browser.toolforge.org/project/5238620953c040e7a9effbe47d4e0932 is the UUID named page for the "wikiqlever" project. Stashbot thinks that @Physikerwelt should have used !log 5238620953c040e7a9effbe47d4e0932 start setting up puppet master following https://wikitech.wikimedia.org/wiki/Help:Project_puppetserver based on the LDAP lookup data. This is really poor user experience (same for the UUID in the openstack-browser URL honestly) that we should figure out how to fix.