From 70f561c8959bde4b791b327061cb115bd4b2655e Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Tue, 17 May 2016 10:41:33 -0400
Subject: [PATCH 1/9] Make tab skip over 'SHOW' buttons next to sensitive /
 password prompts

---
 awx/ui/client/src/shared/form-generator.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/awx/ui/client/src/shared/form-generator.js b/awx/ui/client/src/shared/form-generator.js
index b05c9bd4ec..c9e367886e 100644
--- a/awx/ui/client/src/shared/form-generator.js
+++ b/awx/ui/client/src/shared/form-generator.js
@@ -918,6 +918,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += "<button class='btn btn-default show_input_button Form-passwordButton' ";
                             html += buildId(field, fld + "_show_input_button", this.form);
                             html += "aw-tool-tip='Toggle the display of plaintext.' aw-tip-placement='top' ";
+                            html += "tabindex='-1' ";
                             html += "ng-click='" + fld + "_field.toggleInput(\"#" + this.form.name + "_" + fld + "\")'";
                             html += (field.ngDisabled) ? "ng-disabled='" + field.ngDisabled + "'" : "";
                             html += ">\n" + field.showInputInnerHTML;

From 390ac656fab1ac0d5a26364de86ce98415d24ad7 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 16:02:10 -0400
Subject: [PATCH 2/9] Bolted is_system_auditor faux-field onto User

---
 awx/api/serializers.py      |  3 ++-
 awx/api/views.py            | 20 ++++++++++++++++++++
 awx/main/models/__init__.py | 14 ++++++++++++++
 3 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 89e8c6d719..1240f59403 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -679,12 +679,13 @@ class UserSerializer(BaseSerializer):
     password = serializers.CharField(required=False, default='', write_only=True,
                                      help_text='Write-only field used to change the password.')
     ldap_dn = serializers.CharField(source='profile.ldap_dn', read_only=True)
+    is_system_auditor = serializers.BooleanField()
 
     class Meta:
         model = User
         fields = ('*', '-name', '-description', '-modified',
                   '-summary_fields', 'username', 'first_name', 'last_name',
-                  'email', 'is_superuser', 'password', 'ldap_dn')
+                  'email', 'is_superuser', 'is_system_auditor', 'password', 'ldap_dn')
 
     def to_representation(self, obj):
         ret = super(UserSerializer, self).to_representation(obj)
diff --git a/awx/api/views.py b/awx/api/views.py
index 5ba7b5e56e..d22131e01f 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -727,6 +727,16 @@ class OrganizationUsersList(SubListCreateAttachDetachAPIView):
     parent_model = Organization
     relationship = 'member_role.members'
 
+    def post(self, request, *args, **kwargs):
+        ret = super(OrganizationUsersList, self).post( request, *args, **kwargs)
+        if request.data.get('is_system_auditor', False):
+            # This is a faux-field that just maps to checking the system
+            # auditor role member list.. unfortunately this means we can't
+            # set it on creation, and thus needs to be set here.
+            user = User.objects.get(id=ret.data['id'])
+            user.is_system_auditor = request.data['is_system_auditor']
+        return ret
+
 class OrganizationAdminsList(SubListCreateAttachDetachAPIView):
 
     model = User
@@ -1097,6 +1107,16 @@ class UserList(ListCreateAPIView):
     model = User
     serializer_class = UserSerializer
 
+    def post(self, request, *args, **kwargs):
+        ret = super(OrganizationUsersList, self).post( request, *args, **kwargs)
+        if request.data.get('is_system_auditor', False):
+            # This is a faux-field that just maps to checking the system
+            # auditor role member list.. unfortunately this means we can't
+            # set it on creation, and thus needs to be set here.
+            user = User.objects.get(id=ret.data['id'])
+            user.is_system_auditor = request.data['is_system_auditor']
+        return ret
+
 class UserMeList(ListAPIView):
 
     model = User
diff --git a/awx/main/models/__init__.py b/awx/main/models/__init__.py
index ed13b4a30c..5528776bdd 100644
--- a/awx/main/models/__init__.py
+++ b/awx/main/models/__init__.py
@@ -55,6 +55,20 @@ def user_get_admin_of_organizations(user):
 User.add_to_class('organizations', user_get_organizations)
 User.add_to_class('admin_of_organizations', user_get_admin_of_organizations)
 
+@property
+def user_is_system_auditor(user):
+    return Role.singleton('system_auditor').members.filter(id=user.id).exists()
+
+@user_is_system_auditor.setter
+def user_is_system_auditor(user, tf):
+    if user.id:
+        if tf:
+            Role.singleton('system_auditor').members.add(user)
+        else:
+            Role.singleton('system_auditor').members.remove(user)
+
+User.add_to_class('is_system_auditor', user_is_system_auditor)
+
 # Import signal handlers only after models have been defined.
 import awx.main.signals # noqa
 

From d79d8cbfba3ca2d74cf69a7851c036fca72fdb35 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 16:02:40 -0400
Subject: [PATCH 3/9] Don't let Org Admins promote themselves to System Admins

Nor System Auditor
---
 awx/api/views.py | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index d22131e01f..9bd1349253 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -1248,17 +1248,25 @@ class UserDetail(RetrieveUpdateDestroyAPIView):
         obj = self.get_object()
         can_change = request.user.can_access(User, 'change', obj, request.data)
         can_admin = request.user.can_access(User, 'admin', obj, request.data)
+
+        su_only_edit_fields = ('is_superuser', 'is_system_auditor')
+        admin_only_edit_fields = ('last_name', 'first_name', 'username', 'is_active')
+
+        fields_to_check = ()
+        if not request.user.is_superuser:
+            fields_to_check += su_only_edit_fields
+
         if can_change and not can_admin:
-            admin_only_edit_fields = ('last_name', 'first_name', 'username',
-                                      'is_active', 'is_superuser')
-            changed = {}
-            for field in admin_only_edit_fields:
-                left = getattr(obj, field, None)
-                right = request.data.get(field, None)
-                if left is not None and right is not None and left != right:
-                    changed[field] = (left, right)
-            if changed:
-                raise PermissionDenied('Cannot change %s.' % ', '.join(changed.keys()))
+            fields_to_check += admin_only_edit_fields
+
+        bad_changes = {}
+        for field in fields_to_check:
+            left = getattr(obj, field, None)
+            right = request.data.get(field, None)
+            if left is not None and right is not None and left != right:
+                bad_changes[field] = (left, right)
+        if bad_changes:
+            raise PermissionDenied('Cannot change %s.' % ', '.join(bad_changes.keys()))
 
     def destroy(self, request, *args, **kwargs):
         obj = self.get_object()

From 58f142e2e6291f9e280a29dee17067ff6a9bb0c9 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 16:05:35 -0400
Subject: [PATCH 4/9] Update user add/edit UI to support System Auditor setting

Also moved the LDAP indicator to be inline with the mockups (bubble next
to the uesrname in the upper left)

 #1937
 #1888
---
 awx/ui/client/legacy-styles/forms.less     |  4 +-
 awx/ui/client/src/controllers/Users.js     | 67 ++++++++++++++++++++--
 awx/ui/client/src/forms/Users.js           | 20 ++-----
 awx/ui/client/src/shared/form-generator.js | 11 +++-
 4 files changed, 78 insertions(+), 24 deletions(-)

diff --git a/awx/ui/client/legacy-styles/forms.less b/awx/ui/client/legacy-styles/forms.less
index 20bf364141..c8f30a3d16 100644
--- a/awx/ui/client/legacy-styles/forms.less
+++ b/awx/ui/client/legacy-styles/forms.less
@@ -49,7 +49,7 @@
     min-height: 40px;
 }
 
-.Form-title--is_superuser{
+.Form-title--is_superuser, .Form-title--is_system_auditor, .Form-title--is_ldap_user{
     height:15px;
     color: @default-interface-txt;
     background-color: @default-list-header-bg;
@@ -61,7 +61,7 @@
     margin-left: 10px;
     text-transform: uppercase;
     font-weight: 100;
-    position: absolute;
+    //position: absolute;
     margin-top: 2.25px;
     height: 16px;
 }
diff --git a/awx/ui/client/src/controllers/Users.js b/awx/ui/client/src/controllers/Users.js
index f6ac43d219..09bde96e87 100644
--- a/awx/ui/client/src/controllers/Users.js
+++ b/awx/ui/client/src/controllers/Users.js
@@ -10,6 +10,26 @@
  * @description This controller's the Users page
 */
 
+const user_type_options = [
+    {type: 'normal'              , label: 'Normal User'          },
+    {type: 'system_auditor'      , label: 'System Auditor'       },
+    {type: 'system_administrator', label: 'System Administrator' },
+];
+
+function user_type_sync($scope) {
+    return (type_option) => {
+        $scope.is_superuser = false;
+        $scope.is_system_auditor = false;
+        switch (type_option.type) {
+            case 'system_administrator':
+                $scope.is_superuser = true;
+            break;
+            case 'system_auditor':
+                $scope.is_system_auditor = true;
+            break;
+        }
+    };
+}
 
 export function UsersList($scope, $rootScope, $location, $log, $stateParams,
     Rest, Alert, UserList, GenerateList, Prompt, SearchInit, PaginateInit,
@@ -116,10 +136,13 @@ UsersList.$inject = ['$scope', '$rootScope', '$location', '$log',
 ];
 
 
+
+
+
 export function UsersAdd($scope, $rootScope, $compile, $location, $log,
     $stateParams, UserForm, GenerateForm, Rest, Alert, ProcessErrors,
     ReturnToCaller, ClearScope, GetBasePath, LookUpInit, OrganizationList,
-    ResetForm, Wait, $state) {
+    ResetForm, Wait, CreateSelect2, $state) {
 
     ClearScope();
 
@@ -138,6 +161,15 @@ export function UsersAdd($scope, $rootScope, $compile, $location, $log,
 
     generator.reset();
 
+    $scope.user_type_options = user_type_options;
+    $scope.user_type = user_type_options[0]
+    $scope.$watch('user_type', user_type_sync($scope));
+
+    CreateSelect2({
+        element: '#user_user_type',
+        multiple: false
+    });
+
     // Configure the lookup dialog. If we're adding a user through the Organizations tab,
     // default the Organization value.
     LookUpInit({
@@ -177,7 +209,8 @@ export function UsersAdd($scope, $rootScope, $compile, $location, $log,
                         data[fld] = $scope[fld];
                     }
                 }
-                data.is_superuser = data.is_superuser || false;
+                data.is_superuser = $scope.is_superuser;
+                data.is_system_auditor = $scope.is_system_auditor;
                 Wait('start');
                 Rest.post(data)
                     .success(function (data) {
@@ -215,14 +248,14 @@ export function UsersAdd($scope, $rootScope, $compile, $location, $log,
 UsersAdd.$inject = ['$scope', '$rootScope', '$compile', '$location', '$log',
     '$stateParams', 'UserForm', 'GenerateForm', 'Rest', 'Alert',
     'ProcessErrors', 'ReturnToCaller', 'ClearScope', 'GetBasePath',
-    'LookUpInit', 'OrganizationList', 'ResetForm', 'Wait', '$state'
+    'LookUpInit', 'OrganizationList', 'ResetForm', 'Wait', 'CreateSelect2', '$state'
 ];
 
 
 export function UsersEdit($scope, $rootScope, $location,
     $stateParams, UserForm, GenerateForm, Rest, ProcessErrors,
     RelatedSearchInit, RelatedPaginateInit, ClearScope,
-    GetBasePath, ResetForm, Wait, $state) {
+    GetBasePath, ResetForm, Wait, CreateSelect2 ,$state) {
 
     ClearScope();
 
@@ -237,6 +270,10 @@ export function UsersEdit($scope, $rootScope, $location,
     generator.inject(form, { mode: 'edit', related: true, scope: $scope });
     generator.reset();
 
+    $scope.user_type_options = user_type_options;
+    $scope.user_type = user_type_options[0]
+    $scope.$watch('user_type', user_type_sync($scope));
+
     var setScopeFields = function(data){
         _(data)
         .pick(function(value, key){
@@ -278,6 +315,8 @@ export function UsersEdit($scope, $rootScope, $location,
              data[key] = $scope[key];
             }
         });
+        data.is_superuser = $scope.is_superuser;
+        data.is_system_auditor = $scope.is_system_auditor;
         return data;
     };
 
@@ -292,6 +331,24 @@ export function UsersEdit($scope, $rootScope, $location,
             master.ldap_user = $scope.ldap_user;
             $scope.socialAuthUser = (data.auth.length > 0) ? true : false;
 
+            $scope.user_type = $scope.user_type_options[0];
+            $scope.is_system_auditor = false;
+            $scope.is_superuser = false;
+            if (data.is_system_auditor) {
+                $scope.user_type = $scope.user_type_options[1];
+                $scope.is_system_auditor = true;
+            }
+            if (data.is_superuser) {
+                $scope.user_type = $scope.user_type_options[2];
+                $scope.is_superuser = true;
+            }
+
+            CreateSelect2({
+                element: '#user_user_type',
+                multiple: false
+            });
+
+
             setScopeFields(data);
             setScopeRelated(data, form.related);
 
@@ -353,5 +410,5 @@ export function UsersEdit($scope, $rootScope, $location,
 UsersEdit.$inject = ['$scope', '$rootScope', '$location',
     '$stateParams', 'UserForm', 'GenerateForm', 'Rest', 'ProcessErrors',
     'RelatedSearchInit', 'RelatedPaginateInit', 'ClearScope', 'GetBasePath',
-    'ResetForm', 'Wait', '$state'
+    'ResetForm', 'Wait', 'CreateSelect2', '$state'
 ];
diff --git a/awx/ui/client/src/forms/Users.js b/awx/ui/client/src/forms/Users.js
index 1fa3db40d6..03d816749b 100644
--- a/awx/ui/client/src/forms/Users.js
+++ b/awx/ui/client/src/forms/Users.js
@@ -87,21 +87,13 @@ export default
                     associated: 'password',
                     autocomplete: false
                 },
-                is_superuser: {
-                    label: 'Superuser <span style="text-transform:none;">(User has full system administration privileges)</span>',
-                    type: 'checkbox',
-                    trueValue: 'true',
-                    falseValue: 'false',
-                    "default": 'false',
-                    ngShow: "current_user['is_superuser'] == true",
-                    ngModel: 'is_superuser'
+                user_type: {
+                    label: 'User Type',
+                    type: 'select',
+                    ngOptions: 'item as item.label for item in user_type_options track by item.type',
+                    disableChooseOption: true,
+                    ngModel: 'user_type',
                 },
-                ldap_user: {
-                    label: 'Created by LDAP',
-                    type: 'checkbox',
-                    readonly: true,
-                    awFeature: 'ldap'
-                }
             },
 
             buttons: {
diff --git a/awx/ui/client/src/shared/form-generator.js b/awx/ui/client/src/shared/form-generator.js
index c9e367886e..60e6f1e7a9 100644
--- a/awx/ui/client/src/shared/form-generator.js
+++ b/awx/ui/client/src/shared/form-generator.js
@@ -1101,7 +1101,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
 
                         html += "<div class=\"Form-dropDownContainer\">\n";
                         html += "<select ";
-                        html += "ng-model=\"" + fld + '" ';
+                        html += "ng-model=\"" + (field.ngModel ? field.ngModel : fld) + '" ';
                         html += 'name="' + fld + '" ';
                         html += "class=\"form-control Form-dropDown";
                         html += "\" ";
@@ -1109,6 +1109,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                         html += (field.ngChange) ? this.attr(field, 'ngChange') : "";
                         html += (field.ngDisabled) ? this.attr(field, 'ngDisabled'): "";
                         html += (field.ngRequired) ? this.attr(field, 'ngRequired') : "";
+                        html += (field.ngInit) ? this.attr(field, 'ngInit') : "";
                         html += buildId(field, fld, this.form);
                         html += (options.mode === 'edit' && field.editRequired) ? "required " : "";
                         html += (options.mode === 'add' && field.addRequired) ? "required " : "";
@@ -1121,7 +1122,7 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                             html += field.awRequiredWhen.alwaysShowAsterisk ? "data-awrequired-always-show-asterisk=true " : "";
                         }
                         html += ">\n";
-                        if(!field.multiSelect){
+                        if(!field.multiSelect && !field.disableChooseOption){
                             html += "<option value=\"\">";
                                 // Add a custom default select 'value' (default text)
                             html += (field.defaultText) ? field.defaultText : "Choose a " + field.label.toLowerCase();
@@ -1469,7 +1470,11 @@ angular.module('FormGenerator', [GeneratorHelpers.name, 'Utilities', listGenerat
                     html += (options.mode === 'edit') ? this.form.editTitle : this.form.addTitle;
                     if(this.form.name === "user"){
                         html+= "<span class=\"Form-title--is_superuser\" "+
-                            "ng-if=is_superuser>System Administrator</span>";
+                            "ng-show='is_superuser'>Admin</span>";
+                        html+= "<span class=\"Form-title--is_system_auditor\" "+
+                            "ng-show='is_system_auditor'>Auditor</span>";
+                        html+= "<span class=\"Form-title--is_ldap_user\" "+
+                            "ng-show='ldap_user'>LDAP</span>";
                     }
                     html += "</div>\n";
                     html += "<div class=\"Form-header--fields\">";

From 9e562deb0c26adae3342a6be2143e3261a99a3c8 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 16:50:43 -0400
Subject: [PATCH 5/9] Copy paste error

---
 awx/api/views.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index 9bd1349253..3e1e9ed823 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -1108,7 +1108,7 @@ class UserList(ListCreateAPIView):
     serializer_class = UserSerializer
 
     def post(self, request, *args, **kwargs):
-        ret = super(OrganizationUsersList, self).post( request, *args, **kwargs)
+        ret = super(UserList, self).post( request, *args, **kwargs)
         if request.data.get('is_system_auditor', False):
             # This is a faux-field that just maps to checking the system
             # auditor role member list.. unfortunately this means we can't

From 49a2f6b5359691761e82e808b654c214153d233b Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 16:50:52 -0400
Subject: [PATCH 6/9] Default is_system_auditor to False in serializer for API
 compatibility

---
 awx/api/serializers.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/awx/api/serializers.py b/awx/api/serializers.py
index 1240f59403..7b4b45c316 100644
--- a/awx/api/serializers.py
+++ b/awx/api/serializers.py
@@ -679,7 +679,7 @@ class UserSerializer(BaseSerializer):
     password = serializers.CharField(required=False, default='', write_only=True,
                                      help_text='Write-only field used to change the password.')
     ldap_dn = serializers.CharField(source='profile.ldap_dn', read_only=True)
-    is_system_auditor = serializers.BooleanField()
+    is_system_auditor = serializers.BooleanField(default=False)
 
     class Meta:
         model = User

From 9fba513c4fe8b84fedf57a892af59dba29406947 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Wed, 18 May 2016 17:01:38 -0400
Subject: [PATCH 7/9] Protect against bad posts, fixes some test cases

---
 awx/api/views.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index 3e1e9ed823..fda15f2730 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -729,7 +729,7 @@ class OrganizationUsersList(SubListCreateAttachDetachAPIView):
 
     def post(self, request, *args, **kwargs):
         ret = super(OrganizationUsersList, self).post( request, *args, **kwargs)
-        if request.data.get('is_system_auditor', False):
+        if type(request.data) is dict and request.data.get('is_system_auditor', False):
             # This is a faux-field that just maps to checking the system
             # auditor role member list.. unfortunately this means we can't
             # set it on creation, and thus needs to be set here.
@@ -1109,7 +1109,7 @@ class UserList(ListCreateAPIView):
 
     def post(self, request, *args, **kwargs):
         ret = super(UserList, self).post( request, *args, **kwargs)
-        if request.data.get('is_system_auditor', False):
+        if type(request.data) is dict and request.data.get('is_system_auditor', False):
             # This is a faux-field that just maps to checking the system
             # auditor role member list.. unfortunately this means we can't
             # set it on creation, and thus needs to be set here.

From 23e7e12a0437c5df9f05e8ecc8f4758e43318f8f Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Thu, 19 May 2016 13:07:58 -0400
Subject: [PATCH 8/9] Support creating system auditors through all 4 of our
 user creation endpoints

---
 awx/api/views.py | 50 ++++++++++++++++++++++++++++++------------------
 1 file changed, 31 insertions(+), 19 deletions(-)

diff --git a/awx/api/views.py b/awx/api/views.py
index fda15f2730..86994ff82b 100644
--- a/awx/api/views.py
+++ b/awx/api/views.py
@@ -720,24 +720,31 @@ class OrganizationInventoriesList(SubListAPIView):
     parent_model = Organization
     relationship = 'inventories'
 
-class OrganizationUsersList(SubListCreateAttachDetachAPIView):
+
+class BaseUsersList(SubListCreateAttachDetachAPIView):
+    def post(self, request, *args, **kwargs):
+        ret = super(BaseUsersList, self).post( request, *args, **kwargs)
+        try:
+            if request.data.get('is_system_auditor', False):
+                # This is a faux-field that just maps to checking the system
+                # auditor role member list.. unfortunately this means we can't
+                # set it on creation, and thus needs to be set here.
+                user = User.objects.get(id=ret.data['id'])
+                user.is_system_auditor = request.data['is_system_auditor']
+                ret.data['is_system_auditor'] = request.data['is_system_auditor']
+        except AttributeError as exc:
+            print(exc)
+            pass
+        return ret
+
+class OrganizationUsersList(BaseUsersList):
 
     model = User
     serializer_class = UserSerializer
     parent_model = Organization
     relationship = 'member_role.members'
 
-    def post(self, request, *args, **kwargs):
-        ret = super(OrganizationUsersList, self).post( request, *args, **kwargs)
-        if type(request.data) is dict and request.data.get('is_system_auditor', False):
-            # This is a faux-field that just maps to checking the system
-            # auditor role member list.. unfortunately this means we can't
-            # set it on creation, and thus needs to be set here.
-            user = User.objects.get(id=ret.data['id'])
-            user.is_system_auditor = request.data['is_system_auditor']
-        return ret
-
-class OrganizationAdminsList(SubListCreateAttachDetachAPIView):
+class OrganizationAdminsList(BaseUsersList):
 
     model = User
     serializer_class = UserSerializer
@@ -840,7 +847,7 @@ class TeamDetail(RetrieveUpdateDestroyAPIView):
     model = Team
     serializer_class = TeamSerializer
 
-class TeamUsersList(SubListCreateAttachDetachAPIView):
+class TeamUsersList(BaseUsersList):
 
     model = User
     serializer_class = UserSerializer
@@ -1109,12 +1116,17 @@ class UserList(ListCreateAPIView):
 
     def post(self, request, *args, **kwargs):
         ret = super(UserList, self).post( request, *args, **kwargs)
-        if type(request.data) is dict and request.data.get('is_system_auditor', False):
-            # This is a faux-field that just maps to checking the system
-            # auditor role member list.. unfortunately this means we can't
-            # set it on creation, and thus needs to be set here.
-            user = User.objects.get(id=ret.data['id'])
-            user.is_system_auditor = request.data['is_system_auditor']
+        try:
+            if request.data.get('is_system_auditor', False):
+                # This is a faux-field that just maps to checking the system
+                # auditor role member list.. unfortunately this means we can't
+                # set it on creation, and thus needs to be set here.
+                user = User.objects.get(id=ret.data['id'])
+                user.is_system_auditor = request.data['is_system_auditor']
+                ret.data['is_system_auditor'] = request.data['is_system_auditor']
+        except AttributeError as exc:
+            print(exc)
+            pass
         return ret
 
 class UserMeList(ListAPIView):

From 49b88dd646dbfd1f15e480cc6b3ee9868c6b8fb7 Mon Sep 17 00:00:00 2001
From: Akita Noek <anoek@ansible.com>
Date: Thu, 19 May 2016 13:34:51 -0400
Subject: [PATCH 9/9] Hide the user type selection for non super users

 Completes UI portion of #1974
---
 awx/ui/client/src/forms/Users.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/awx/ui/client/src/forms/Users.js b/awx/ui/client/src/forms/Users.js
index 03d816749b..ce172747f0 100644
--- a/awx/ui/client/src/forms/Users.js
+++ b/awx/ui/client/src/forms/Users.js
@@ -93,6 +93,7 @@ export default
                     ngOptions: 'item as item.label for item in user_type_options track by item.type',
                     disableChooseOption: true,
                     ngModel: 'user_type',
+                    ngShow: 'current_user["is_superuser"]',
                 },
             },