how to add a sysadmin in ldap and puppet

howto/ldap.md

@@ -236,6 +236,26 @@ Save the file and exit the editor. `ldapvi` will prompt you to confirm
 the changes, you can review with the <kbd>v</kbd> key or save with
 <kbd>y</kbd>.
 
+### Adding/removing an admin
+
+The LDAP administrator group is a special group that is not defined
+through the `supplementaryGid` field, but by adding users into the
+group itself. With `ldapvi` (see above), you need to add a `member:`
+line, for example:
+
+```
+2 cn=LDAP Administrator,ou=users,dc=torproject,dc=org
+objectClass: top
+objectClass: groupOfNames
+cn: LDAP administrator
+member: uid=anarcat,ou=users,dc=torproject,dc=org
+```
+
+To remove the user from the admin group, remove the line.
+
+The group grants the user access to administer LDAP directly, for
+example making any change through `ldapvi`.
+
 ## Searching LDAP
 
 This will load a text editor with a dump of all the users (useful to

howto/new-person.md

@@ -133,8 +133,8 @@ Many of those are granted as part of the routine "core tor membership" admission
 
 Other accounts required for full TPA access:
 
- 1. [ ] LDAP admin access
- 2. [ ] [puppet](howto/puppet) git repository access
+ 1. [ ] [LDAP admin access](howto/ldap#adding-removing-an-admin)
+ 2. [ ] [puppet](howto/puppet#adding-removing-a-global-admin) git repository access
  3. [ ] TPA password manager access (`admin/tor-passwords.git` in gitolite)
  4. [ ] Sunet cloud access (e.g. `Message-ID: <87bm1gb5wk.fsf@nordberg.se>`)
  5. [ ] [Nextcloud](https://nc.torproject.net) admin account

howto/puppet.md

@@ -487,6 +487,15 @@ argument from Hiera. This is how the transition to a managed
     operate a change. You can then examine the output and see if the
     change is legitimate or abort the configuration change.
 
+## Adding/removing a global admin
+
+To add a new sysadmin, you need to add their SSH key to the root
+account everywhere. This can be done in the `profile::admins::key`
+field in `hiera/common.yaml`.
+
+You also need to add them to the `adm` group in LDAP, see [adding
+users to a group in LDAP](howto/ldap#adding-removing-users-in-a-group).
+
 ## Troubleshooting
 
 ### Running Puppet by hand and logging