Yeah. RTFM. All of it.

And understand it.

At least he was able to recover the issue. Good on him for that. And missing one sentence is an easy thing to do when what you are reading is about as exciting as watching paint dry.

But as an admin, what your doing is important (at least, the consequences may be). So read that manual.

And test it too. Spin up a test version of the system, ideally with a copy of some real data and then implement the change on the test system to see if it works properly. This should be the case for changes on any critical systems really, always have a test environment you can break and rebuild without impacting production.

Yeah. RTFM. All of it. And understand it.

With LDAP? All and Understand is at best a tall order either separately or together. Complex, convoluted and in places just plain daft.

But in this case I guess it was the ticketing system that was at fault as it would appear to support only one authentication service at a time (clearly didn't use pam and nss.)

Presumably the fix was to export the user accounts from the Oracle RDBMS, massage into ldif files and import into ldap or alternatively knock up a gateway from ldap to the existing Oracle system

I couldn't agree more. But... the warnings come after the spell!

The corollary of this is: When you write documentation, assume that if anyone even looks at it, they probably won't read it all, so at least highlight important points.

"And missing one sentence is an easy thing to do when what you are reading is about as exciting as watching paint dry."

My job once involved watching paint dry - and it was actually quite exciting. Unfortunately, I'm not allowed to say where it was...

"The request was then extended to applying LDAP to the customer ticketing system"

if the Ticketing System was home-made, he should've asked the developer(s) on the best way to do it, if it was commercial (as it seems the case, since there was a documentation) he should've asked the company that made that thing and was also providing support (I assume somebody that run a "nation-sized" system does also pay for support for his wares).

So life lesson: ASK THE F*ING QUESTION before "assuming".

"So life lesson: ASK THE F*ING QUESTION before "assuming"."

Sometimes that's the case, but life and most work is based on assumptions and generalisations. As a primitive form of learning they are arguably these are the very foundations of civilisation. Logically, would you expect or even harbour reasonable doubt that implementing better authentication to delete all existing user records? Really? Somebody, somewhere thought "if a sysadmin implements LADP, then the system should delete all user records". Now there's the fuckwit responsible here, not "Blair".

And the author of the shitty manual that doesn't make clear the huge consequences. Hiding something of huge consequence as though it's trivial is a grade A failure.

I suspect that the stupid, stupid idea of deleting all users was only ever tested on a small dev system that it was trivially easy to roll back and forward, and where there were no operational consequences or angry managers.

Ut ullam impedit amet et. Harum voluptatum debitis itaque corrupti libero dolorum. Doloribus nihil sit laborum. Laborum amet est est. Qui quo in voluptas maxime doloremque cumque voluptas. Officia sequi voluptates placeat. Impedit non et minima. Veniam doloremque qui dolorem excepturi autem debitis. Minima voluptatibus magni aperiam temporibus atque ullam iure. Aut dolores unde enim odit cupiditate non numquam et. Praesentium ut veniam quis ut voluptatem inventore at. Voluptate voluptas omnis a qui temporibus. Tempore facilis tenetur consequuntur. Quod voluptates sed inventore blanditiis. Sint voluptatibus optio enim incidunt deleniti nostrum. Molestias corporis et corrupti velit eius natus. Sint delectus rerum praesentium nemo. Et dicta odit dolor. Quos repellendus et saepe consequatur rem molestiae nesciunt. If you switch to ldap all accounts will be completely deleted because this is a feature. Soluta beatae perferendis sed. Est temporibus natus ab odio tenetur nemo alias. Ex sed consectetur possimus quia animi. Doloribus nihil cumque commodi recusandae id dolores quisquam cupididate.

I should try this with my next annual performance review

Lorum ipsum I deserve a one hundred percent payrise dolor sit amet

Or maybe an "are you sure you want to nuke your user records?" popup? (or y/N prompt in CLI).

They get abused for trivial actions too often, but i feel like the possible consequences here are severe enough for that...

Along with the fact that configuration changes generally shouldn't be deleting user data in the first place. Is it really necessary to delete all user records instead of creating a users_ldap table, or creating a "authentication source" column? oh my, did i just accidentally create a feature to use multiple auth sources simultaneously too??

He felt something might be awry as while he lay in the dentist's chair, his phone scarcely stopped buzzing.

Blair bolted back to the office and gave himself a crash course in Oracle database recovery.

So he went back and gave the database a filling?

RMAN, that was a good story...

Getting Oracle to work properly is like pulling teeth

Getting Oracle licensed properly without overpaying like they want to trick you into is like pulling teeth.

According to Oracle, there is only underpayment they can prove, and underpayment they are currently unable to prove (don't worry, they will at some point).

What is the 'overpayment' you speak of?

I have been in the situation of trying to understand Oracle restore, and get it working for a system migration ...... and I'd rather have been in the Dentist's chair .... having root canal work .... without anaesthetic!

----------> The icon for root canal work!

I am currently dealing with a supplier who uses MFA ( the TOTP kind) for me to logon and create certificates for our machines to access our data in their "lake"

The MFA has out of the blue stopped working despite me having a record of the initial secret key .

Their only solution to this is to delete my account and recreate it , which will invalidate the certificates i've crated and validated and signed etc for our servers to talk .

As a password reset solution I find this less than satisfactory.

They are also unable to answer any questions on why this happened , or why they cant just reset the MFA , or how exactly the MFA works as "a third party is providing the MFA"

This is a very large NHS healthcare provider .

sorry for the off topic rant , this is pissing me off no end - the link is "authentication" I guess .

Is this the thing that lets me login on 3 different apps my employer uses with the same password, but when I change my password, Google pw manager will ask me to type the new password on all of them?

Is this how any of this is supposed to work? For my employer, only one change and all the apps obey the new password, but for me, I have to type it again on every app, it just doesn't read my new credentials and let me through?

Isn't it supposed to skip every login prompt down the road once I'm logged back in with the new pw? What's the point of unifying all the passwords if you have to type them (or Google asks to update it for me) every time?

I would use the Windows user icon, but you know...

TLDR I have a grievance about typing passwords over and over on several places, if they are synchronized. Yeah, token and man-in-the-middle and all that.