prevent last admin from being disabled

We prevent the last member of the admin group from being deleted. The
same check needs to be performed when disabling a user.

* Moved the code in del_user to the common subroutine
  check_protected_member() and call it from both user_del and
  user_disable. Note, unlike user_del user_disable does not have a
  'pre' callback therefore the check function is called in
  user_disable's execute routine.

* Make check_protected_member() aware of disabled members. It's not
  sufficient to check which members of the protected group are
  present, one must only consider those members which are enabled.

* Add tests to test_user_plugin.py.

  - verify you cannot delete nor disable the last member of the admin
    group

  - verify when the admin group contains disabled users in addition to
    enabled users only the enabled users are considered when
    determining if the last admin is about to be disabled or deleted.

* Replace duplicated hardcoded values in the tests with variables or
  subroutines, this makes the individual tests a bit more succinct and
  easier to copy/modify.

* Update error msg to reflect either deleting or disabling is an error.

https://fedorahosted.org/freeipa/ticket/2979
This commit is contained in:
John Dennis
2012-08-16 20:28:44 -04:00
committed by Martin Kosek
parent 557b260550
commit 4f03aed5e6
3 changed files with 304 additions and 174 deletions

View File

@@ -1627,18 +1627,18 @@ class DependentEntry(ExecutionError):
class LastMemberError(ExecutionError):
"""
**4308** Raised when an entry being deleted is last member of a protected group
**4308** Raised when an entry being deleted or disabled is last member of a protected group
For example:
>>> raise LastMemberError(key=u'admin', label=u'group', container=u'admins')
Traceback (most recent call last):
...
LastMemberError: admin cannot be deleted because it is the last member of group admins
LastMemberError: admin cannot be deleted or disabled because it is the last member of group admins
"""
errno = 4308
format = _('%(key)s cannot be deleted because it is the last member of %(label)s %(container)s')
format = _('%(key)s cannot be deleted or disabled because it is the last member of %(label)s %(container)s')
class ProtectedEntryError(ExecutionError):