From 08f1e6f2fdb19db681c0560db53a7a5fa1ce3784 Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: Fri, 26 Apr 2024 20:10:03 +0300 Subject: [PATCH] trust: use context.principal only when it is defined In server-like context we use LDAPI connection with auto-binding to LDAP object based on the UID of the process connecting to LDAPI UNIX domain socket. This means context.principal is not set and we cannot use it. Make sure to reject requests unless we are operating as a Directory Manager in such cases. Fixes: https://pagure.io/freeipa/issue/9583 Signed-off-by: Alexander Bokovoy Reviewed-By: Thomas Woerner Reviewed-By: Rob Crittenden Reviewed-By: Rafael Guterres Jeffman --- ipaserver/plugins/trust.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ipaserver/plugins/trust.py b/ipaserver/plugins/trust.py index 9c4bb5f8b..42fcc49bf 100644 --- a/ipaserver/plugins/trust.py +++ b/ipaserver/plugins/trust.py @@ -1872,7 +1872,8 @@ class trust_enable_agent(Command): # the user must have the Replication Administrators privilege privilege = u'Replication Administrators' - if not principal_has_privilege(self.api, context.principal, privilege): + op_account = getattr(context, 'principal', None) + if not principal_has_privilege(self.api, op_account, privilege): raise errors.ACIError( info=_("not allowed to remotely add agent"))