commit ca0c93bb09587903a6dd43926799a967f10bafcd
author Ed Tanous <ed.tanous@intel.com> Thu Sep 19 11:53:50 2019 -0700
committer Ed Tanous <ed.tanous@intel.com> Wed Oct 02 20:16:04 2019 +0000
tree acf23dd8bb3fc8a413152a8fd9233233fa0d5c2c
parent e56c7b7092298c609831a65bcc8c21e62d422ba7

Fix role map persistence

Now that we have a live role map, there's no need to track the users
role in the session object, we have the ability to get it every time.

This issue manifests itself in a fairly nefarious situation:
1. Log in, user is assigned a session, with role
2. BMC reboots.  Session is persisted and restored, but role is removed.
3. User now has a valid session, but isn't authorized to do anything,
which results in a 403.  In the webui, this results in an inability to
log out.

Tested (TODO):
Log in and log out functions.  Reboot BMC, verify that webui doesn't log
back out or return 403.

Signed-off-by: Ed Tanous <ed.tanous@intel.com>
Change-Id: I9bbf682d062150aa1c877217f037221471e58e9f

crow/include/crow/routing.h

diff --git a/crow/include/crow/routing.h b/crow/include/crow/routing.h
index c97c874..0be5dbd 100644
--- a/crow/include/crow/routing.h
+++ b/crow/include/crow/routing.h
@@ -1234,7 +1234,9 @@
         if (req.session != nullptr)
         {
             // Get the user role from the session.
-            const std::string& userRole = req.session->userRole;
+            const std::string& userRole =
+                persistent_data::UserRoleMap::getInstance().getUserRole(
+                    req.session->username);
 
             BMCWEB_LOG_DEBUG << "USER ROLE=" << userRole;
 

include/sessions.hpp

diff --git a/include/sessions.hpp b/include/sessions.hpp
index c7c92ce..2900cd5 100644
--- a/include/sessions.hpp
+++ b/include/sessions.hpp
@@ -29,8 +29,6 @@
 constexpr char const* userAttrIface = "xyz.openbmc_project.User.Attributes";
 constexpr char const* dbusPropertiesIface = "org.freedesktop.DBus.Properties";
 
-class SessionStore;
-
 struct UserRoleMap
 {
     using GetManagedPropertyType =
@@ -275,7 +273,6 @@
     std::string uniqueId;
     std::string sessionToken;
     std::string username;
-    std::string userRole;
     std::string csrfToken;
     std::chrono::time_point<std::chrono::steady_clock> lastUpdated;
     PersistenceType persistence;
@@ -385,13 +382,8 @@
             uniqueId[i] = alphanum[dist(rd)];
         }
 
-        // Get the User Privilege
-        const std::string& role =
-            UserRoleMap::getInstance().getUserRole(username);
-
-        BMCWEB_LOG_DEBUG << "user name=\"" << username << "\" role = " << role;
         auto session = std::make_shared<UserSession>(UserSession{
-            uniqueId, sessionToken, std::string(username), role, csrfToken,
+            uniqueId, sessionToken, std::string(username), csrfToken,
             std::chrono::steady_clock::now(), persistence});
         auto it = authTokens.emplace(std::make_pair(sessionToken, session));
         // Only need to write to disk if session isn't about to be destroyed.