Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-9352

LDAP superuser not able to create organizations

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False
    • Compatibility/Configuration
    • Impediment
    • Quay Enterprise
    • Important
    • Customer Facing, Customer Reported

      When user who is both a superuser and a restricted user, LDAP Search prioritizes restricted user over superuser and comes back with Unauthorized on trying to create an organization:

      ..
              if features.SUPERUSERS_ORG_CREATION_ONLY and not SuperUserPermission().can():
                  raise Unauthorized()
      
      
              user = get_authenticated_user()
              org_data = request.get_json()
              existing = None
      
      
              # Super users should be able to create new orgs regardless of user restriction
              if user.username not in app.config.get("SUPER_USERS", None):
                  if features.RESTRICTED_USERS and usermanager.is_restricted_user(user.username):
                      raise Unauthorized()
      ...
      

      https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/endpoints/api/organization.py#L154-L164

      def is_restricted_user(self, username: str, include_robots: bool = True) -> bool:
              """
              Returns if the given username represents a restricted user.
              """
              if include_robots:
                  username = username.split("+", 1)[0]
      
      
              if super().restricted_whitelist_is_set() and not super().is_restricted_user(username):
                  return False
      
      
              return self.federated_users.is_restricted_user(username) or super().is_restricted_user(
                  username
              )
      

      https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/data/users/__init__.py#L437-L449

      def is_restricted_user(self, username: str, include_robots: bool = True) -> bool:
              if include_robots:
                  username = username.split("+")[0]
      
      
              if self._restricted_users_array:
                  usernames = self._restricted_users_array.value.decode("utf8").split(",")
                  return not (username in usernames)
              else:
                  return True
      

      https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/util/config/superusermanager.py#L83-L91
      credit goes to rhn-support-ibazulic for the code analysis. If this could be changed so that the superuser is prioritized over the restricted user that would be awesome.

      Dan Shoemaker

              Unassigned Unassigned
              dshoemak@redhat.com Dan S
              Ivan Bazulic
              Votes:
              1 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: