[GLPI 9.1.3] tech user can delete superadmin - how to avoid?

Mastermixer · 2017-05-22 16:00:41

Hi!

Just a question for security reasons:

Is it possible to delete the superadmin account with a tech account?

The tech user must be able to:

- add user
- change user
- delete user

Is it possible to change, add or delete a superadmin only from the superadmin account?

The tech user should not be able to change superuser password or add a new superuser or delete the superuser.

Thanks for the good work!

Greeting,
Mike

pippo · 2017-05-22 16:09:49

Hi Mastermixer,

You can change this in :

Administration -> Profiles -> Tech (or the profile you want to modifiy).

In the profile, go to "Administration". You will find a line named "Users" where you can allow or forbid updates, creation, deletions etc... of users.

Hope this will help you.

Pippo

yllen · 2017-05-22 17:59:50

You can only delete profile with less rights than your profile

Mastermixer · 2017-05-23 09:53:52

Hi Nelly,

First try: "tech - Root Entity (R)" user can delete a new created superuser with "superuser - Root Entity (R)" profile.

What means "less rights"? Which settings are responsible to decide "less"?

Thanks for your help.

Best regards,
Mike

yllen · 2017-05-23 12:47:44

glpi compares value of all rights for each profile.
Has your Tech profile right to manage profile?

Mastermixer · 2017-06-02 08:50:28

No, the tech profile has no right to manage profiles.
The first five checkmarks and the add external are set for the administration (user).
The tech user is recursive (R).

Which settings are responsible next?

Thank you.

Best regards,
Mike

yllen · 2017-06-06 11:42:33

For your tech profile, don't allow right to delete user

Mastermixer · 2017-06-07 09:43:34

Ok, this works and a tech user can only create users with a profile that has equal or less rights.

If a user has to be deleted, the team leader will do this with different rights (profile).
But in this case we have the same problem as before... this means, only superadmins should have the right to delete users?

Best regards,
Mike

yllen · 2017-06-08 10:33:51

For me, yes.
A superadmin profile should be given to very few people. The superadmin is the global manager of all the entity, it's not a technician.

Forum GLPI-Project

Announcement

#1 2017-05-22 16:00:41

[GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#2 2017-05-22 16:09:49

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#3 2017-05-22 17:59:50

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#4 2017-05-23 09:53:52

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#5 2017-05-23 12:47:44

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#6 2017-06-02 08:50:28

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#7 2017-06-06 11:42:33

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#8 2017-06-07 09:43:34

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

#9 2017-06-08 10:33:51

Re: [GLPI 9.1.3] tech user can delete superadmin - how to avoid?

Board footer