[QA] Last admin can remove himself

[jnweiger]

Seen on v1.0.0-rc3 created with hetzner-deploy/make_ocis_eos_compose_test.sh (and earlier in v1.0.0-rc1 in #530 (comment))

Log in as moss,

• click on the 3x3 grid, then 'Accounts'
• in the ROLE column, change all 'Admin' to 'User' (normally there is only one such entry for moss himself).
• logout
• log in as moss

The system is now without admin user. Moss can no longer go to the Accounts page.

Expected behaviour: Removing the last admin should not be possible. An error message appears, when trying.

[micbar]

Accounts service was removed. Does this also work for LibreIDM? @rhafer

[kulmann]

Role assignments were never part of the accounts service. The described behaviour is still valid for the settings service (which currently is responsible for role assignments). The user-management app in web also doesn't prevent it.

[rhafer]

Currently the Graph API would allow for an admin to delete himself from the user database. So apart from fixing the Role Assignment to disallow the last admin removing it's assignment. I think we should also prevent admins to delete their own account via glauth.

[micbar]

Duplicate of #3713 Closing here.