fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -7,9 +7,11 @@ common name, which OpenVPN and IKEv2 accept. A Manager-only account is an accoun
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
-account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which
-vpn-router-setup adds and keeps for the metrics service, as metrics.service_account names it; it
-cannot sign in to the web service. Users exist whether or not a P2S system is enabled.
+account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which cannot
+sign in to the web service; an administrator adds one for a service that checks passwords
+against the directory. The internal one is the account metrics.service_account names while
+metrics are enabled, which vpn-router-setup adds and whose password it keeps (metrics_account).
+Users exist whether or not a P2S system is enabled.
 
 A group is a groupOfNames in ou=groups with a name, which follows the rules of user names, an
 optional description and at least one member; a group cannot be empty, so the last member
@@ -192,14 +194,27 @@ def service(attributes):
     return SERVICE_SCOPE.encode() in (value.lower() for value in attributes.get('vpnRouterScope', []))
 
 
+def metrics_account():
+    """The internal service account: the one metrics.service_account names while metrics are enabled, else None."""
+    try:
+        metrics = vpnrouter.load_config()['metrics']
+    except SystemExit:
+        return None
+    return metrics['service_account'] if metrics['enabled'] else None
+
+
 def summary(attributes):
-    """A user as the answers show it; a person attribute the entry does not have is None."""
+    """A user as the answers show it; a person attribute the entry does not have is None.
+
+    internal is whether it is the internal service account (metrics_account).
+    """
     name = attributes['uid'][0].decode()
     lock = attributes.get('pwdAccountLockedTime', [None])[0]
     user = {
         'name': name,
         'manager_only': manager_only(attributes),
         'service': service(attributes),
+        'internal': service(attributes) and name == metrics_account(),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
         'certificate': certificate(name)[0].is_file(),
@@ -225,8 +240,8 @@ def list_users(connection):
 
 def add(connection, name, password, values, service=False):
     """Add a user: a VPN user with its certificate when values gives all three person attributes, a Manager-only account
-    with at most the e-mail address when it gives neither name, and, with service, which only vpn-router-setup uses, a
-    service account, with at most the e-mail address too."""
+    with at most the e-mail address when it gives neither name, and, with service, a service account, with at most the
+    e-mail address too."""
     check_name(name)
     details = person(values, required=False)
     vpn_user = 'givenName' in details or 'sn' in details