IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Don't allow the admin user to be removed from the admins group.

Browse Source 
439281
This commit is contained in:
Rob Crittenden
2008-04-04 17:41:32 -04:00
parent cb4648a8af
commit ac5a35086e
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ipa-python/ipaerror.py
View File

@@ -173,6 +173,11 @@ INPUT_CANT_INACTIVATE = gen_error_code(
0x0008,
"This entry cannot be inactivated.")
INPUT_ADMIN_REQUIRED_IN_ADMINS = gen_error_code(
INPUT_CATEGORY,
0x0009,
"The admin user cannot be removed from the admins group.")
#
# Connection errors
#

10
ipa-server/xmlrpc-server/funcs.py
View File

@@ -1426,6 +1426,10 @@ class IPAServer:
old_group = self.get_entry_by_dn(group_dn, None, opts)
if old_group is None:
raise ipaerror.gen_exception(ipaerror.LDAP_NOT_FOUND)
if old_group.get('cn') == "admins":
member = self.get_entry_by_dn(member_dn, ['dn','uid'], opts)
if member.get('uid') == "admin":
raise ipaerror.gen_exception(ipaerror.INPUT_ADMIN_REQUIRED_IN_ADMINS)
new_group = copy.deepcopy(old_group)
if new_group.get('member') is not None:
@@ -1475,6 +1479,9 @@ class IPAServer:
except ipaerror.exception_for(ipaerror.STATUS_NOT_GROUP_MEMBER):
# not a member of the group
failed.append(member_dn)
except ipaerror.exception_for(ipaerror.INPUT_ADMIN_REQUIRED_IN_ADMINS):
# Can't remove admin from admins group
failed.append(member_dn)
return failed
@@ -1612,6 +1619,9 @@ class IPAServer:
except ipaerror.exception_for(ipaerror.STATUS_NOT_GROUP_MEMBER):
# User is not in the group
failed.append(group_dn)
except ipaerror.exception_for(ipaerror.INPUT_ADMIN_REQUIRED_IN_ADMINS):
# Can't remove admin from admins group
failed.append(member_dn)
return failed