WindowsAuthProvider setting to restrict BUILTIN\Administrators

Some environments do not want to automatically allow Windows admin
accounts to be Gitblit admins.  This patch allows disabling/enabling the
relationship between Windows builtin admin accounts and Gitblit accounts.

2 files changed, 11 insertions, 3 deletions

diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties
index da638322..35ae16ab 100644
--- a/src/main/distrib/data/gitblit.properties
+++ b/src/main/distrib/data/gitblit.properties
@@ -1352,6 +1352,12 @@ realm.container.autoCreateAccounts = false
 # SINCE 1.3.0

 realm.windows.allowGuests = false

 

+# Allow user accounts belonging to the BUILTIN\Administrators group to be

+# Gitblit administrators.

+#

+# SINCE 1.4.0

+realm.windows.permitBuiltInAdministrators = true

+

 # The default domain for authentication.

 #

 # If specified, this domain will be used for authentication UNLESS the supplied

diff --git a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
index 93cae046..ac15b28f 100644
--- a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
+++ b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
@@ -158,9 +158,11 @@ public class WindowsAuthProvider extends UsernamePasswordAuthenticationProvider
        		groupNames.add(group.getFqn());
         }
 
-        if (groupNames.contains("BUILTIN\\Administrators")) {
-        	// local administrator
-        	user.canAdmin = true;
+       	if (settings.getBoolean(Keys.realm.windows.permitBuiltInAdministrators, true)) {
+       		if (groupNames.contains("BUILTIN\\Administrators")) {
+       			// local administrator
+       			user.canAdmin = true;
+       		}
         }
 
         // TODO consider mapping Windows groups to teams