nextcloud / nextcloud/server

Add an option to delete the local built-in group "admin"

Open
#42,481 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

0. Needs triage enhancement feature: ldap feature: users and groups hotspot: account name handling
Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 3h
Merged PRs (30d)
713

Description

The NC setup creates a user "admin" and a group "admin". While the admin user can be deleted, the admin group cannot. Moreover, it seems that there are certain permissions checks which are hard-coded for the literal string admin, see bug #42480. On top there is already an option to delegate some administrative privileges to other groups via ./settings/admin/admindelegation.

I would like to see an option which

  1. allows to delete the built-in group admin
  2. grant another group full admin rights

The feature administration delegation already provides a foundation for aspect 2. All what is missing is a new "super"-capability which grants full admin powers or (alternatively) additional capabilities which fill out the missing parts. This would also make the LDAP feature unnecessary which allows to promote a single LDAP group as admin group via php occ ldap:promote-group. Instead of a special feature which only works for LDAP-based groups (and which currently seems to be partially broken, see #42480), this would provide a generic solution to the problem.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the administration delegation feature at ./settings/admin/admindelegation and the existing php occ ldap:promote-group behavior. Trace how the built-in admin group and delegated administrative capabilities are enforced, including the permissions checks referenced by bug #42480. Done means the built-in group can be deleted and another group can receive complete administrative rights without LDAP-specific handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authorization
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.