From ab5465639d5c083d6396551f06c450fe4d349d1b Mon Sep 17 00:00:00 2001 From: Alexander Bokovoy Date: May 22 2024 08:03:38 +0000 Subject: server: use context.principal only when it is defined In server-like context we use LDAPI connection with auto-binding to LDAP object based on the UID of the process connecting to LDAPI UNIX domain socket. This means context.principal is not set and we cannot use it. Make sure to reject requests unless we are operating as a Directory Manager in such cases. Fixes: https://pagure.io/freeipa/issue/9583 Signed-off-by: Alexander Bokovoy Reviewed-By: Thomas Woerner Reviewed-By: Rob Crittenden Reviewed-By: Rafael Guterres Jeffman --- diff --git a/ipaserver/plugins/server.py b/ipaserver/plugins/server.py index 01d16b8..99b8252 100644 --- a/ipaserver/plugins/server.py +++ b/ipaserver/plugins/server.py @@ -934,7 +934,8 @@ class server_conncheck(crud.PKQuery): # the user must have the Replication Administrators privilege privilege = u'Replication Administrators' - if not principal_has_privilege(self.api, context.principal, privilege): + op_account = getattr(context, 'principal', None) + if not principal_has_privilege(self.api, op_account, privilege): raise errors.ACIError( info=_("not allowed to perform server connection check"))