No warning or notification displayed while changing the admin user privilege from admin to normal.

Archives AWX Project
1

Hello,

While changing the admin user privileges from “Administrator” to any other type we didn’t get any warning or notification.

Also, while investigating the bug I found that the default admin user can be deleted and can have its permissions changed from “administrator” to some other type. This could lead to account hijacking considering the fact that any user with administrator role can delete or modify the default admin user.
I wonder if this an expected behavior for the default admin user? If not, would it not be better to disable delete option and user_type options for the default admin user?

Thanks
Soniya

2

Hi Soniya

This isn’t a bug but you could consider it a feature request perhaps.

As with root under Linux, once you are the privileged user, you can do stupid things if you want to!

Many may want to disable the default admin account, and use named user accounts with admin rights. This is better for tracking/auditing.

You also have to trust anyone with admin rights to do sensible things. This is no different from any other OS.

Regards
Phil.