commit 8e69d148249f6a45cea10e988ec03430a5932784
author anil kumar appana <anil.kumarx.appana@intel.com> Mon Aug 26 12:49:15 2019 +0000
committer Ed Tanous <ed.tanous@intel.com> Mon Sep 16 14:41:46 2019 +0000
tree 9cd99e10acd64bca089f5181a13c7fe3185a0954
parent 017848263e97e6eb9f7d486071a616626fec0591

Fix remove callback user privilege access to login

Callback privilege user must not be allowed to login,similar to IPMI.
This user is used for callback purpose from IPMI point of it, and
must be maintained in bmcweb to be consistent with IPMI, Hence
removing the access to login for callback user

Tested:
1.Create a user with username 'test1' and privilege -
  "Callback" via Redfish.
2.Using that Callback level credentials, try to do
  "Get" at this URI https://<ip-addr>/redfish/v1/Systems/system
3.output: Forbidden
4.use same URL to login from webUI with callback privilege
  https://<ip-addr>/redfish/v1/Systems/system
5.output: Forbidden
Signed-off-by: anil kumar appana <anil.kumarx.appana@intel.com>
Change-Id: I86dac565fc874e5d0fe033640ffc3de576a1f693

redfish-core/include/privileges.hpp

diff --git a/redfish-core/include/privileges.hpp b/redfish-core/include/privileges.hpp
index ec6e6a5..113f66a 100644
--- a/redfish-core/include/privileges.hpp
+++ b/redfish-core/include/privileges.hpp
@@ -192,12 +192,18 @@
         static Privileges op{"Login", "ConfigureSelf", "ConfigureComponents"};
         return op;
     }
-    else
+    else if (userRole == "priv-user")
     {
         // Redfish privilege : Readonly
         static Privileges readOnly{"Login", "ConfigureSelf"};
         return readOnly;
     }
+    else
+    {
+        // Redfish Privilege : No privileges for callback users
+        static Privileges noPriv{};
+        return noPriv;
+    }
 }
 
 using OperationMap = boost::container::flat_map<boost::beast::http::verb,

redfish-core/lib/roles.hpp

diff --git a/redfish-core/lib/roles.hpp b/redfish-core/lib/roles.hpp
index fbe8653..956f566 100644
--- a/redfish-core/lib/roles.hpp
+++ b/redfish-core/lib/roles.hpp
@@ -61,7 +61,7 @@
     }
     else if (role == "Callback")
     {
-        privArray = {"Login"};
+        privArray = {};
     }
     else
     {