From fa38a155cf2019c1fc7904ab47d37c0e7e558c13 Mon Sep 17 00:00:00 2001 From: James Moger Date: Fri, 21 Feb 2014 15:25:46 -0500 Subject: [PATCH] WindowsAuthProvider setting to restrict BUILTIN\Administrators Some environments do not want to automatically allow Windows admin accounts to be Gitblit admins. This patch allows disabling/enabling the relationship between Windows builtin admin accounts and Gitblit accounts. --- releases.moxie | 2 ++ src/main/distrib/data/gitblit.properties | 6 ++++++ src/main/java/com/gitblit/auth/WindowsAuthProvider.java | 8 +++++--- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/releases.moxie b/releases.moxie index 0aa35efa..da847641 100644 --- a/releases.moxie +++ b/releases.moxie @@ -62,6 +62,7 @@ r20: { - Support Markdown image links relative to the repository root (issue-324) - Added filesystem write permission check (issue-345) - Added GO launch parameter for redirecting logging to a rolling, daily log file (issue-348) + - Added settings to Windows authentication provider to permit/prohibit BUILTIN\Administrators from being Gitblit Admins (issue-354) - Support rendering confluence, mediawiki, textile, tracwiki, and twiki markup documents - Added setting to globally disable anonymous pushes in the receive pack - Added a normalized diffstat display to the commit, commitdiff, and compare pages @@ -90,6 +91,7 @@ r20: { - { name: 'realm.ldap.synchronize', defaultValue: 'false' } - { name: 'realm.ldap.syncPeriod', defaultValue: '5 MINUTES' } - { name: 'realm.ldap.removeDeletedUsers', defaultValue: 'true' } + - { name: 'realm.windows.permitBuiltInAdministrators', defaultValue: 'true' } - { name: 'web.commitMessageRenderer', defaultValue: 'plain' } - { name: 'web.documents', defaultValue: 'readme home index changelog contributing submitting_patches copying license notice authors' } - { name: 'web.showBranchGraph', defaultValue: 'true' } diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties index da638322..35ae16ab 100644 --- a/src/main/distrib/data/gitblit.properties +++ b/src/main/distrib/data/gitblit.properties @@ -1352,6 +1352,12 @@ realm.container.autoCreateAccounts = false # SINCE 1.3.0 realm.windows.allowGuests = false +# Allow user accounts belonging to the BUILTIN\Administrators group to be +# Gitblit administrators. +# +# SINCE 1.4.0 +realm.windows.permitBuiltInAdministrators = true + # The default domain for authentication. # # If specified, this domain will be used for authentication UNLESS the supplied diff --git a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java index 93cae046..ac15b28f 100644 --- a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java +++ b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java @@ -158,9 +158,11 @@ public class WindowsAuthProvider extends UsernamePasswordAuthenticationProvider groupNames.add(group.getFqn()); } - if (groupNames.contains("BUILTIN\\Administrators")) { - // local administrator - user.canAdmin = true; + if (settings.getBoolean(Keys.realm.windows.permitBuiltInAdministrators, true)) { + if (groupNames.contains("BUILTIN\\Administrators")) { + // local administrator + user.canAdmin = true; + } } // TODO consider mapping Windows groups to teams -- 2.39.5