From cb50cea104ae8edb0ca28341cf9bc994a5f2f8b5 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Thu, 20 Aug 2020 21:40:57 -0700
Subject: [PATCH] GUACAMOLE-1149: Refuse to update skeleton database users.

---
 .../guacamole/auth/jdbc/user/UserService.java      | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
index 50b9e4295..d22e909a1 100644
--- a/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
+++ b/extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/UserService.java
@@ -260,7 +260,19 @@ public class UserService extends ModeledDirectoryObjectService<ModeledUser, User
             ModeledUser object, UserModel model) throws GuacamoleException {
 
         super.beforeUpdate(user, object, model);
-        
+
+        // Refuse to update if the user is a skeleton and does not actually
+        // exist in the database (this will happen if the user is authenticated
+        // via a non-database authentication provider)
+        if (object.isSkeleton()) {
+            logger.info("Data cannot be stored for user \"{}\" as they do not "
+                    + "have an account within the database. If this is "
+                    + "unexpected, consider allowing automatic creation of "
+                    + "user accounts.", object.getIdentifier());
+            throw new GuacamoleUnsupportedException("User does not exist "
+                    + "within the database and cannot be updated.");
+        }
+
         // Username must not be blank
         if (model.getIdentifier() == null || model.getIdentifier().trim().isEmpty())
             throw new GuacamoleClientException("The username must not be blank.");