From fa38a155cf2019c1fc7904ab47d37c0e7e558c13 Mon Sep 17 00:00:00 2001
From: James Moger <james.moger@gitblit.com>
Date: Fri, 21 Feb 2014 15:25:46 -0500
Subject: [PATCH] WindowsAuthProvider setting to restrict BUILTIN\Administrators
---
releases.moxie | 2 ++
src/main/distrib/data/gitblit.properties | 6 ++++++
src/main/java/com/gitblit/auth/WindowsAuthProvider.java | 8 +++++---
3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/releases.moxie b/releases.moxie
index 0aa35ef..da84764 100644
--- a/releases.moxie
+++ b/releases.moxie
@@ -62,6 +62,7 @@
- Support Markdown image links relative to the repository root (issue-324)
- Added filesystem write permission check (issue-345)
- Added GO launch parameter for redirecting logging to a rolling, daily log file (issue-348)
+ - Added settings to Windows authentication provider to permit/prohibit BUILTIN\Administrators from being Gitblit Admins (issue-354)
- Support rendering confluence, mediawiki, textile, tracwiki, and twiki markup documents
- Added setting to globally disable anonymous pushes in the receive pack
- Added a normalized diffstat display to the commit, commitdiff, and compare pages
@@ -90,6 +91,7 @@
- { name: 'realm.ldap.synchronize', defaultValue: 'false' }
- { name: 'realm.ldap.syncPeriod', defaultValue: '5 MINUTES' }
- { name: 'realm.ldap.removeDeletedUsers', defaultValue: 'true' }
+ - { name: 'realm.windows.permitBuiltInAdministrators', defaultValue: 'true' }
- { name: 'web.commitMessageRenderer', defaultValue: 'plain' }
- { name: 'web.documents', defaultValue: 'readme home index changelog contributing submitting_patches copying license notice authors' }
- { name: 'web.showBranchGraph', defaultValue: 'true' }
diff --git a/src/main/distrib/data/gitblit.properties b/src/main/distrib/data/gitblit.properties
index da63832..35ae16a 100644
--- a/src/main/distrib/data/gitblit.properties
+++ b/src/main/distrib/data/gitblit.properties
@@ -1352,6 +1352,12 @@
# SINCE 1.3.0
realm.windows.allowGuests = false
+# Allow user accounts belonging to the BUILTIN\Administrators group to be
+# Gitblit administrators.
+#
+# SINCE 1.4.0
+realm.windows.permitBuiltInAdministrators = true
+
# The default domain for authentication.
#
# If specified, this domain will be used for authentication UNLESS the supplied
diff --git a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
index 93cae04..ac15b28 100644
--- a/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
+++ b/src/main/java/com/gitblit/auth/WindowsAuthProvider.java
@@ -158,9 +158,11 @@
groupNames.add(group.getFqn());
}
- if (groupNames.contains("BUILTIN\\Administrators")) {
- // local administrator
- user.canAdmin = true;
+ if (settings.getBoolean(Keys.realm.windows.permitBuiltInAdministrators, true)) {
+ if (groupNames.contains("BUILTIN\\Administrators")) {
+ // local administrator
+ user.canAdmin = true;
+ }
}
// TODO consider mapping Windows groups to teams
--
Gitblit v1.9.1