Handle Redfish PasswordChangeRequired
This enhances BMCWeb authentication to recognize when the user's password is
correct but expired. The Redfish SessionService is enhanced to comply with
the Redfish PasswordChangeRequired spec which allows the session to be
created, but limits that sesion to changing the password only, and includes
the PasswordChangeRequired message in the response body.
Specifically, when the account's password is expired, a successful
authentication via the following interfaces will have these results:
- POST /redfish/v1/SessionService/Sessions -- follows Redfish spec
- POST /login -- creates a session limited to changing the password,
similar to Redfish
- Basic authentication -- continues to treat the password
change required condition as an authentication failure and gives no
indication the password is expired.
- Cookie auth -- works as before
- Token auth -- works as before
This patchset is intended to allow web applications to use the presence
of the Redfish PasswordChangeRequired message or the extendedMessage
field to trigger the password change dialog.
This does not implement the PasswordChangeRequired property in the
ManagerAccount resource.
This implements the Redfish privilege overrides associated with the
ConfigureSelf privilege. Specifically, this correctly implements the
Password property override, and the ManagerAccount Resource URI override.
When an API results in 403 Forbidden and the issuing session has the
PasswordChangeRequired condition, appropriate JSON is given.
Tested:
Yes, see https://github.com/openbmc/bmcweb/issues/103
No, did not run Redfish validator
Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net>
Change-Id: Ibbf5f6414ac55c0e7bea14c721f6db227b52fe40
diff --git a/include/json_msg_utility.hpp b/include/json_msg_utility.hpp
new file mode 100644
index 0000000..e8c8b7f
--- /dev/null
+++ b/include/json_msg_utility.hpp
@@ -0,0 +1,51 @@
+#pragma once
+
+#include "crow/http_response.h"
+
+namespace crow
+{
+namespace msg
+{
+const std::string notFoundMsg = "404 Not Found";
+const std::string badReqMsg = "400 Bad Request";
+const std::string methodNotAllowedMsg = "405 Method Not Allowed";
+const std::string forbiddenMsg = "403 Forbidden";
+const std::string methodFailedMsg = "500 Method Call Failed";
+const std::string methodOutputFailedMsg = "500 Method Output Error";
+const std::string unAuthMsg = "401 Unauthorized"; // Unauthenticated
+
+const std::string notFoundDesc =
+ "org.freedesktop.DBus.Error.FileNotFound: path or object not found";
+const std::string propNotFoundDesc = "The specified property cannot be found";
+const std::string noJsonDesc = "No JSON object could be decoded";
+const std::string methodNotFoundDesc = "The specified method cannot be found";
+const std::string methodNotAllowedDesc = "Method not allowed";
+const std::string forbiddenPropDesc =
+ "The specified property cannot be created";
+const std::string forbiddenResDesc = "The specified resource cannot be created";
+const std::string unAuthDesc = "The authentication could not be applied";
+const std::string forbiddenURIDesc = "The session is not authorized to access URI: ";
+
+} // namespace msg
+
+inline void setErrorResponse(crow::Response &res,
+ boost::beast::http::status result,
+ const std::string &desc, const std::string &msg)
+{
+ res.result(result);
+ res.jsonValue = {{"data", {{"description", desc}}},
+ {"message", msg},
+ {"status", "error"}};
+}
+
+inline void setPasswordChangeRequired(crow::Response &res,
+ const std::string &username)
+{
+ res.jsonValue["extendedMessage"] =
+ "The password for this account must be changed. PATCH the 'Password' "
+ "property for the account under URI: "
+ "/redfish/v1/AccountService/Accounts/" +
+ username;
+}
+
+} // namespace crow