#8878 Prevent deletion of 'admin' account with web UI
Closed: fixed 2 years ago by rcritten. Opened 3 years ago by ettlz.

Issue

I created an additional administrator user called 'ipaadmin' through the web UI and deleted the original 'admin' account (wanting to reserve the latter for local use on specific machines). This worked OK until it was time for a routine IPA server upgrade, and that process then broke.

While on reflection I was likely doing something quite inadvisable, I can't help but feel the UI (or some other element of the IPA stack) should either have failed deleting 'admin', or at least told me doing this was a Very Bad Idea.

Steps to Reproduce

  1. Log into web UI as 'admin'.
  2. Create an account and add it to the IPA administrators group.
  3. Log out, then back in as this new administrator.
  4. Delete the 'admin' account.

Actual behavior

One can delete the 'admin' account with no more resistance than any other account.

Expected behavior

Unable to delete 'admin' account, or lots of warnings that this will wreak havoc upon the realm.

Version/Release/Distribution

freeipa-server-4.9.3-4.fc34.x86_64


Yes, we should add a list of protected users like there is for protected groups.

i also delete admin user and failed to upgrade.

how can i add admin user again?

Metadata Update from @rcritten:
- Issue assigned to rcritten

2 years ago

master:

  • dea3592 Prevent the admin user from being deleted

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://bugzilla.redhat.com/show_bug.cgi?id=1821181

2 years ago

ipa-4-10:

  • 4b02322 Prevent the admin user from being deleted

ipa-4-9:

  • f215d3f Prevent the admin user from being deleted

Metadata Update from @rcritten:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

2 years ago

master:

  • e49ec10 ipatests: update expected webui msg for admin deletion

ipa-4-10:

  • 13d5e88 ipatests: update expected webui msg for admin deletion

ipa-4-9:

  • 7d62d84 ipatests: update expected webui msg for admin deletion

Log in to comment on this ticket.

Metadata