It's not very ideal for admins to be able to change their ssh key via the web interface, since it can then be used to impersonate high-privilege users in other places. We should have a LocalSettings.php config option for blacklisting specific groups from changing their own SSH key.
Version: unspecified
Severity: normal
Even better, rather than a blacklist in OpenStackManager, we should add an ACI to the LDAP server that denies the OpenStackManager user from updating users in specific groups.
It's not very ideal for admins to be able to change their ssh key via the web interface, since it can then be used to impersonate high-privilege users in other places. W
Is this still valid and if so can you expand. it seems to me that if a user is able to login to the wikitech then they can login to horizon and thus console directly to any owned VM's im missing what additional access th e user has by bing able to change the ssh key.