From f8e7b516d923142a23058cb23ee817522686cfe3 Mon Sep 17 00:00:00 2001 From: Petr Viktorin Date: Wed, 23 May 2012 05:44:53 -0400 Subject: Prevent deletion of the last admin Raise an error when trying to delete the last user in the 'admins' group, or remove the last member from the group, or delete the group itself. https://fedorahosted.org/freeipa/ticket/2564 --- ipalib/plugins/user.py | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) (limited to 'ipalib/plugins/user.py') diff --git a/ipalib/plugins/user.py b/ipalib/plugins/user.py index b48e6802..7e98bba4 100644 --- a/ipalib/plugins/user.py +++ b/ipalib/plugins/user.py @@ -544,8 +544,13 @@ class user_del(LDAPDelete): msg_summary = _('Deleted user "%(value)s"') - def post_callback(self, ldap, dn, *keys, **options): - return True + def pre_callback(self, ldap, dn, *keys, **options): + protected_group_name = u'admins' + result = api.Command.group_show(protected_group_name) + if result['result'].get('member_user', []) == [keys[-1]]: + raise errors.LastMemberError(key=keys[-1], label=_(u'group'), + container=protected_group_name) + return dn api.register(user_del) -- cgit