From 46fbc11a93ad0b43c681ac4f1f3a1c36438c580a Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Thu, 25 Jun 2026 09:55:09 -0400 Subject: [PATCH] Other than skipauth type users (unix domain socket root/confluent), no longer allow confluent user addition/manipulation. --- confluent_server/confluent/auth.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/confluent_server/confluent/auth.py b/confluent_server/confluent/auth.py index ef0b5140..6fe925c2 100644 --- a/confluent_server/confluent/auth.py +++ b/confluent_server/confluent/auth.py @@ -208,6 +208,8 @@ def authorize(name, element, tenant=False, operation='create', # even if pam does authentication. if operation not in ('create', 'start', 'update', 'retrieve', 'delete', None): return False + if operation != 'retrieve' and (element.startswith('/users') or element.startswith('/usergroups')): + return False user, tenant = _get_usertenant(name, tenant) if tenant is not None and not configmanager.is_tenant(tenant): return False