Disallow user group creation when server has OIDC auth with group sync enabled.
Ylian Saint-Hilaire committed
Sep 24, 2023 at 20:51 UTC
dd279d3ea268a82efad78e60c0e36d10c9f54764
1 file changed
+8
-1
meshuser.js
+8
-1
@@ -1491,7 +1491,14 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
1491
var ugrpdomain, err = null;
1492
try {
1493
// Check if we are in a mode that does not allow manual user group creation
1494
- if (domain.auth == 'ldap') { err = "Not allowed in LDAP mode"; }
1494
+ if (
1495
+ (typeof domain.authstrategies == 'object') &&
1496
+ (typeof domain.authstrategies['oidc'] == 'object') &&
1497
+ (typeof domain.authstrategies['oidc'].groups == 'object') &&
1498
+ ((domain.authstrategies['oidc'].groups.sync == true) || ((typeof domain.authstrategies['oidc'].groups.sync == 'object') && (domain.authstrategies['oidc'].groups.sync.enabled == true)))
1499
+ ) {
1500
+ err = "Not allowed in OIDC mode with user group sync.";
1501
+ }
1502
1503
// Check if we have new group restriction
1504
if ((user.siteadmin & SITERIGHT_USERGROUPS) == 0) { err = "Permission denied"; }