commit 1c651ee12ad55ab6626c2baf3754aecda305ba43
author Joey Berkovitz <joey@berkovitz.us> Sun Aug 24 09:08:55 2025 -0400
committer Ed Tanous <ed@tanous.net> Thu Sep 04 22:05:46 2025 +0000
tree b8f06d6586bc10c07ef6566664f9ebdc698474c9
parent 05d84e4758941f95ab93608fe0158e8a28713381

PasswordChangeRequired: Fix error message

The PasswordChangeRequired error was incorrectly formatted. Per the
spec, it should be an error response and 403 on all requests except
for session creation, which is just a `@Message.ExtendedInfo`
annotation. See [1].

Tested:
  - Built a romulus image
  - Ran `passwd --expire root`
  - curl to Managers and session creation

```
╰─○ curl -kv --user "$BMC_USER:$BMC_PASS" https: //localhost:2443/redfish/v1/Managers
< HTTP/2 403
{
    "error": {
        "@Message.ExtendedInfo": [
            {
                "@odata.type": "#Message.v1_1_1.Message",
                "Message": "The password provided for this account must be changed before access is granted.  PATCH the Password property for this account located at the target URI '/redfish/v1/AccountService/Accounts/root' to complete this process.",
                "MessageArgs": [
                    "/redfish/v1/AccountService/Accounts/root"
                ],
                "MessageId": "Base.1.19.PasswordChangeRequired",
                "MessageSeverity": "Critical",
                "Resolution": "Change the password for this account using a PATCH to the Password property at the URI provided."
            }
        ],
        "code": "Base.1.19.PasswordChangeRequired",
        "message": "The password provided for this account must be changed before access is granted.  PATCH the Password property for this account located at the target URI '/redfish/v1/AccountService/Accounts/root' to complete this process."
    }
}

╰─○ curl -kv -X POST -H 'Content-Type: application/json' -d '{"UserName": "root", "Password": "..."}' https://localhost:2443/redfish/v1/SessionService/Sessions
< HTTP/2 201
{
  "@Message.ExtendedInfo": [
    {
      "@odata.type": "#Message.v1_1_1.Message",
      "Message": "The password provided for this account must be changed before access is granted.  PATCH the Password property for this account located at the target URI '/redfish/v1/AccountService/Accounts/root' to complete this process.",
      "MessageArgs": [
        "/redfish/v1/AccountService/Accounts/root"
      ],
      "MessageId": "Base.1.19.PasswordChangeRequired",
      "MessageSeverity": "Critical",
      "Resolution": "Change the password for this account using a PATCH to the Password property at the URI provided."
    }
  ],
  "@odata.id": "/redfish/v1/SessionService/Sessions/klDQdHSMME",
  "@odata.type": "#Session.v1_7_0.Session",
  "ClientOriginIPAddress": "0.0.0.0",
  "Description": "Manager User Session",
  "Id": "klDQdHSMME",
  "Name": "User Session",
  "Roles": [
    "Administrator"
  ],
  "UserName": "root"
}
```

[1]: https://www.dmtf.org/sites/default/files/standards/documents/DSP0266_1.22.1.html#password-change-required-handling
Change-Id: I959607d75b97133b950f43a7563e510ba885e032
Signed-off-by: Joey Berkovitz <joey@berkovitz.us>