rgw/admin: 'user modify' won't change existing account id

Signed-off-by: Casey Bodley <cbodley@redhat.com>
(cherry picked from commit 750d2d69992fa6fc02d4b7497b5469daa7158ed5)

diff --git a/src/rgw/driver/rados/rgw_user.cc b/src/rgw/driver/rados/rgw_user.cc
index c71eed93767cf02e06954402adecfb00e4612405..d764bd6c181e963b6b0b5f4ab0ae42d93f60a42f 100644 (file)
--- a/src/rgw/driver/rados/rgw_user.cc
+++ b/src/rgw/driver/rados/rgw_user.cc
@@ -2133,6 +2133,11 @@ int RGWUser::execute_modify(const DoutPrefixProvider *dpp, RGWUserAdminOpState&
       return -EINVAL;
     }
     if (user_info.account_id != op_state.account_id) {
+      // allow users to migrate into an account, but don't allow them to leave
+      if (!user_info.account_id.empty()) {
+        set_err_msg(err_msg, "users cannot be moved out of their account");
+        return -EINVAL;
+      }
       user_info.account_id = op_state.account_id;
 
       // tenant must match new account.tenant