restapi: Restrict access to domain user API for non-admin users

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/logging/Messages.java

@@ -54,4 +54,8 @@ public enum Messages {
     VALUE_OUT_OF_RANGE_DETAIL_TEMPLATE,
 
     NOT_SUPPORTED_REASON,
+
+    PERMISSION_DENIED_REASON,
+
+    PERMISSION_DENIED_DETAIL
 }

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/BaseBackendResource.java

@@ -413,6 +413,27 @@ protected boolean isFiltered() {
         return result;
     }
 
+    /**
+     * @return true if current user has admin permission, otherwise false.
+     */
+    protected boolean isAdmin() {
+        DbUser user = getCurrent().getUser();
+        return user.isAdmin();
+    }
+
+    /**
+     * This method will raise an WebFaultException if current user does not have admin permissions.
+     */
+    protected void checkAdminPermission() {
+        if (!isAdmin()) {
+            throw new WebFaultException(null,
+                    localize(Messages.PERMISSION_DENIED_REASON),
+                    localize(Messages.PERMISSION_DENIED_DETAIL),
+                    Status.FORBIDDEN);
+        }
+    }
+
+
     /**
      * Follows links in the entity according to value of "follow" URL query parameter.
      * A valid value of'follow' is a comma separated list of strings, which represent

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/aaa/BackendDomainUserResource.java

@@ -41,6 +41,8 @@ public void setParent(BackendDomainUsersResource parent) {
 
     @Override
     public User get() {
+        checkAdminPermission();
+
         String directoryId;
         try {
             directoryId = DirectoryEntryIdUtils.decode(id);

backend/manager/modules/restapi/jaxrs/src/main/java/org/ovirt/engine/api/restapi/resource/aaa/BackendDomainUsersResource.java

@@ -75,6 +75,7 @@ private Users mapUsers(List<DirectoryUser> entities) {
 
     @Override
     public Users list() {
+        checkAdminPermission();
         return mapUsers(getDomainUsers());
     }
 

backend/manager/modules/restapi/jaxrs/src/main/resources/org/ovirt/engine/api/restapi/logging/Messages.properties

@@ -25,3 +25,5 @@ VALUE_OUT_OF_RANGE_DETAIL_TEMPLATE=The value {0} of attribute ''{1}'' is outside
 DISK_UPDATE_NOT_PERMITTED=Updating disk attributes other than QCOW version is permitted only for disk-attachments, which reside under VMs.
 CPU_UPDATE_NOT_PERMITTED=Attempt to automatically configure CPU topology or pinning while CPU topology or pinning is also specified.
 NOT_SUPPORTED_REASON=The input is unsupported. {0} is not supported.
+PERMISSION_DENIED_REASON=Permission denied
+PERMISSION_DENIED_DETAIL=This operation requires administrative privileges to access domain users information