freeipa

#9489 The change for preventing deletion of the admin user caused a regression in disable
Closed: fixed by frenaud. Opened by rcritten.

Closed: fixed
Reopen Issue

Issue

https://pagure.io/freeipa/issue/8878 provided a change to prevent the admin user from being deleted. The function check_protected_member() was updated to skip the group check and enforce that protected users aren't being changed.

The check for disabling the last admin should be restored.

Steps to Reproduce

  1. ipa user-disable admin

Actual behavior

$ ipa user-disable admin
ipa: ERROR: user admin cannot be deleted/modified: privileged user

Metadata Update from @rcritten:
- Issue assigned to rcritten

Hello,
we use a FreeIPA (docker: freeipa/freeipa-server:rocky-9-4.10.2) based central auth-system for our VPN connection. The VPN endpoint is opened widely, now there is nonstop brute-force-attacking.

We have a high-security admin pw, but it would be better to disable admin account - is there a way to do so?

Regards, Bence

master:

  • 6b0f6ff19e4b56b775cca91435be0a612600f837 Allow the admin user to be disabled

ipa-4-11:

  • 93ecb2966a8fc71aae512fa312914668d286eb2e Allow the admin user to be disabled

ipa-4-10:

  • b8c5b930e5116ba7e9852049144d28bfb76eacac Allow the admin user to be disabled

ipa-4-9:

  • 137814f2f075bdf8f0112942655a5e3882cfa88a Allow the admin user to be disabled

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

master:

  • dda223668acf76f19efc6b85829139beba424cd6 webui test: Update message for admin disable

ipa-4-11:

  • 0ccff908ce774837b0c30cd8fa07545615370a59 webui test: Update message for admin disable

ipa-4-10:

  • d2fa1241294a8886cc79b6f6da23963b27656223 webui test: Update message for admin disable

ipa-4-9:

  • 36d093374d0a59e52cd1759de5469938a4ed72fb webui test: Update message for admin disable

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-34756, https://issues.redhat.com/browse/RHEL-34757
Metadata

regression

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.