Restrict user profile write acces to owner and super user

[rszwajko]

Before, every admin user has full write access to user profiles of other users.
After this patch only super users will be able to modify user profiles of other users.
Admin users will have read only access.

[rszwajko]

/ost

[sgratch]

@rszwajko LGTM
The only missing part is handling the UI side for the new account settings tab by displaying a popup error message in case of a non superuser trying to delete for someone else, e.g.

[rszwajko]

@sgratch
Similar as other errors on this screen this is handled by the notifications system (see below)

[rszwajko]

The functionality can be tested without PR #130 via REST API

curl -v \
--request DELETE \
--header 'Version: 4' \
--header 'Accept: application/xml' --header 'Content-Type: application/xml' \
--user "adminNotSuperUser@internal:password" \
{server}/ovirt-engine/api/users/{other_user_id}/options/{some_option_id}

Example result:

<fault>
    <detail>[User is not authorized to perform this action.]</detail>
    <reason>Operation Failed</reason>
</fault>

[sgratch]

@rszwajko other such errors of "User is not authorized to perform this action" generated by the Administration->Users dialog are displayed using a popup error message. Why not running the same for this new tab?

[rszwajko]

@sgratch

other such errors of "User is not authorized to perform this action" generated by the Administration->Users dialog are displayed using a popup error message. Why not running the same for this new tab?

This comment applies to error handling in PR #130. In March we discussed this topic and apart of wording there were no issues raised.
In Web Admin we have either default (generic) error handlers or custom handlers. On the screen added in PR #130 we are using a custom error handler.

[sgratch]

@rszwajko comments regarding the tests, except that LGTM

[rszwajko]

/ost

[rszwajko]

/ost