Limit the validation key to creating non-admin clients

This allows us to make the validation key a non-admin key.

Author: tfheen

chef-server-api/app/controllers/application.rb

@@ -88,6 +88,14 @@ def is_admin
     end
   end
 
+  def is_admin_or_validator
+    if @auth_user.admin || @auth_user.name == Chef::Config[:validation_client_name]
+      true
+    else
+      raise Unauthorized, "You are not allowed to take this action."
+    end
+  end
+
   def is_correct_node
     if @auth_user.admin || @auth_user.name == params[:id]
       true

chef-server-api/app/controllers/clients.rb

@@ -23,7 +23,8 @@ class ChefServerApi::Clients < ChefServerApi::Application
   provides :json
 
   before :authenticate_every
-  before :is_admin, :only => [ :index, :create, :update, :destroy ]
+  before :is_admin, :only => [ :index, :update, :destroy ]
+  before :is_admin_or_validator, :only => [ :create ]
   before :is_correct_node, :only => [ :show ]
 
   # GET /clients
@@ -48,7 +49,13 @@ def create
     exists = true 
     if params.has_key?(:inflated_object)
       params[:name] ||= params[:inflated_object].name
-      params[:admin] ||= params[:inflated_object].admin
+      # We can only get here if we're admin or the validator. Only
+      # allow creating admin clients if we're already an admin.
+      if @client.admin
+        params[:admin] ||= params[:inflated_object].admin
+      else
+        params[:admin] = false
+      end
     end
 
     begin