Fix authorization for LDAP users
Modified the code to make an asynchronous call to GetUserInfo to get
the user role for authorization.
For local users, DBus matches are used to store user role map hot in
memory. Hence, bmcweb has to know whether a user is a local user or
LDAP user to get the role. To avoid this, removed the existing DBus
matches and modified the code to call GetUserInfo to get the role of
local users as well as LDAP users.
Tested:
- Created a local user having admin privilege and verified that he is
able to restart the system
/redfish/v1/Systems/system/Actions/ComputerSystem.Reset
-d '{"ResetType": "GracefulRestart"}'
- Created a local user having user privilege and verified that he is
unauthorized to restart the system
/redfish/v1/Systems/system/Actions/ComputerSystem.Reset
-d '{"ResetType": "GracefulRestart"}'
- Created a remote user having admin privilege and verified that he is
able to restart the system
/redfish/v1/Systems/system/Actions/ComputerSystem.Reset
-d '{"ResetType": "GracefulRestart"}'
- Created a remote user having user privilege and verified that he is
unauthorized to restart the system
/redfish/v1/Systems/system/Actions/ComputerSystem.Reset
-d '{"ResetType": "GracefulRestart"}'
- Tested Redfish ConfigureSelf privilege
Signed-off-by: RAJESWARAN THILLAIGOVINDAN <rajeswgo@in.ibm.com>
Change-Id: Ic3e46a0c0aff2cf456c98048350e58e302011c57
diff --git a/redfish-core/include/node.hpp b/redfish-core/include/node.hpp
index fddeaa0..9086f1e 100644
--- a/redfish-core/include/node.hpp
+++ b/redfish-core/include/node.hpp
@@ -178,9 +178,9 @@
*/
inline bool isAllowedWithoutConfigureSelf(const crow::Request& req)
{
- const std::string& userRole =
- crow::persistent_data::UserRoleMap::getInstance().getUserRole(
- req.session->username);
+ const std::string& userRole = req.userRole;
+ BMCWEB_LOG_DEBUG << "isAllowedWithoutConfigureSelf for the role "
+ << req.userRole;
Privileges effectiveUserPrivileges =
redfish::getUserPrivileges(userRole);
effectiveUserPrivileges.resetSinglePrivilege("ConfigureSelf");