The admins group cannot be renamed.

433880

ipa-python/ipaerror.py

@@ -148,6 +148,11 @@ INPUT_NOT_DNS_A_RECORD = gen_error_code(
         0x0003,
         "The requested hostname is not a DNS A record. This is required by Kerberos.")
 
+INPUT_ADMINS_IMMUTABLE = gen_error_code(
+        INPUT_CATEGORY,
+        0x0004,
+        "The admins group cannot be renamed.")
+
 #
 # Connection errors
 #

ipa-server/xmlrpc-server/funcs.py

@@ -1518,6 +1518,9 @@ class IPAServer:
         if isinstance(newcn, str):
             newcn = [newcn]
 
+        if "admins" in oldcn:
+            raise ipaerror.gen_exception(ipaerror.INPUT_ADMINS_IMMUTABLE)
+
         oldcn.sort()
         newcn.sort()
         if oldcn != newcn: