The ETH physics department is running an ELOG behind an Apache reverse proxy:

ProxyPass / http://localhost:$port/ retry=0
ProxyPassReverse / http://localhost:$port/
ProxyAddHeaders off

Authentication is done on the Apache side using LDAP authentication, example:

<Location /demo>
  Use PhysLDAP
  AuthType Basic
  AuthBasicProvider ldap
...
  Require valid-user
  RewriteEngine On
  RewriteCond %{LA-U:REMOTE_USER} (.+)
  RewriteRule . - [E=RU:%1,NS]
  RequestHeader add X-Forwarded-User %{RU}e
</Location>

And all ELOGs use the following config:

[demo]
Authentication = Webserver

For the PSI-Praktikum we had to create a logbook that is accessible without an ETH-Account. A new logbook was added, which is not authenticated via the proxy, but the ELOG internal authentication. In order to grant access to the students, I was made admin for that logbook. The configuration is the following:

[PSI-Praktikum]
Authentication = File
Password file = /home/wwwelog/private/password/psi-praktikum.xml
Admin user = damian

In order to prevent my user from editing the global configuration, top groups according to https://elog.psi.ch/elog/config.html#groups were introduced, with one top group for all the proxy-authenticated logbooks, and a separate one for the Praktikum logbook. However, even after doing this, I am still able to edit the [global] section. Is there a way to prevent this? Or is it not possible to have a global section that is not accessible by the top group admins?