When user who is both a superuser and a restricted user, LDAP Search prioritizes restricted user over superuser and comes back with Unauthorized on trying to create an organization:
.. if features.SUPERUSERS_ORG_CREATION_ONLY and not SuperUserPermission().can(): raise Unauthorized() user = get_authenticated_user() org_data = request.get_json() existing = None # Super users should be able to create new orgs regardless of user restriction if user.username not in app.config.get("SUPER_USERS", None): if features.RESTRICTED_USERS and usermanager.is_restricted_user(user.username): raise Unauthorized() ...
def is_restricted_user(self, username: str, include_robots: bool = True) -> bool: """ Returns if the given username represents a restricted user. """ if include_robots: username = username.split("+", 1)[0] if super().restricted_whitelist_is_set() and not super().is_restricted_user(username): return False return self.federated_users.is_restricted_user(username) or super().is_restricted_user( username )
def is_restricted_user(self, username: str, include_robots: bool = True) -> bool: if include_robots: username = username.split("+")[0] if self._restricted_users_array: usernames = self._restricted_users_array.value.decode("utf8").split(",") return not (username in usernames) else: return True
https://github.com/quay/quay/blob/dc8ad71acdef45e28fe8c6186d1892b91c839f64/util/config/superusermanager.py#L83-L91
credit goes to rhn-support-ibazulic for the code analysis. If this could be changed so that the superuser is prioritized over the restricted user that would be awesome.
Dan Shoemaker