commit	3e72c2027aa4e64b9892ab0d3970358ba446f1fa	[log] [tgz]
author	Ninad Palsule <ninadpalsule@us.ibm.com>	Mon Mar 27 17:19:55 2023 -0500
committer	Ed Tanous <ed@tanous.net>	Fri May 19 22:41:14 2023 +0000
tree	3f35b4bbe4d07b4e6df6ada02df888e22b4a792d
parent	15b89725c5dfab240685a4095015ca8479dc44d6 [diff]

Added new pre-defined usergroup called hostconsole

The new pre-defined usergroup named "hostconsole" is added to
differentiate access between host console and manager console.
The only users allowed to interact with host console are part of the
"hostconsole" group and they are in an administrator role.

Note: The changes are spread across multiple repositories listed under
"Related commits:"

The bmcweb changes to incorporate new group are as follows:
- The new user is added in the hostconsole group only if it has an
  administrative role.
- The ssh usergroup is only translated to ManagerConsole redfish group
  and hostconsole usergroup is translated to HostConsole redfish group.
- The following changes are made to check the privileges for host console
  access
    - The new OEM privilege "OpenBMCHostConsole" added for host console
      access. This privilege is not shared externally hence it is not
      documented.
    - Updated obmc_console BMCWEB_ROUTE to use the new privilege.
    - Router functions now save user role and user groups in the session
    - getUserPrivileges() function now takes session reference instead
      of user role. This function now also checks for the user group
      "hostconsole" and add the new privilege if user is member of this
      group.
    - Updated all callers of the getUserPrivileges to pass session
      reference.
    - Added test to validate that new privilege is set correctly.

Tested:
  Loaded code on the system and validated that;
  - New user gets added in hostconsole group. NOTE: Prior to this commit
    all groups are assigned to new user. This drop does not change that
    behavior.
  - Access from the web gui is only available for users in hostconsole
    group. Used IBM internal simulator called simics to test this. This
    simulator allows accessing openbmc from GUI.
  - Checked the role collection and there is no change.
  $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \
         https://${bmc}/redfish/v1/AccountService/Roles
  $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \
         https://${bmc}/redfish/v1/AccountService/Roles/Administrator
  $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \
         https://${bmc}/redfish/v1/AccountService/Roles/ReadOnly
  $ curl -k -H "X-Auth-Token: $TOKEN" -X GET \
         https://${bmc}/redfish/v1/AccountService/Roles/Operator

  - HostConsole is in AccountType when hostconsole group is present in
    UserGroups D-Bus property

  $ id user99
  uid=1006(user99) gid=100(users) groups=1000(priv-admin),1005(web),\
      1006(redfish),1013(hostconsole),100(users)

  $ curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99
  {
    "@odata.id": "/redfish/v1/AccountService/Accounts/user99",
    "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount",
    "AccountTypes": [
      "HostConsole",
      "Redfish",
      "WebUI",
      "ManagerConsole"
    ],
    "Description": "User Account",
    "Enabled": true,
    "Id": "user99",
    "Links": {
      "Role": {
        "@odata.id": "/redfish/v1/AccountService/Roles/Administrator"
      }
    },
    "Locked": false,
    "Locked@Redfish.AllowableValues": [
      "false"
    ],
    "Name": "User Account",
    "Password": null,
    "PasswordChangeRequired": false,
    "RoleId": "Administrator",
    "UserName": "user99"

  - The hostconsole group is not present for readonly or operator users
    and also made sure that console access is not provided. This testing
    is done one the system and console access was tried by modifying the
    https://github.com/openbmc/bmcweb/blob/master/scripts/websocket_test.py

    + curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99
    {
      "@odata.id": "/redfish/v1/AccountService/Accounts/user99",
      "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount",
      "AccountTypes": [
        "IPMI",
        "Redfish",
        "WebUI",
        "ManagerConsole"
      ],
      "Description": "User Account",
      "Enabled": true,
      "Id": "user99",
      "Links": {
        "Role": {
          "@odata.id": "/redfish/v1/AccountService/Roles/ReadOnly"
        }
      },
      "Locked": false,
      "Locked@Redfish.AllowableValues": [
        "false"
      ],
      "Name": "User Account",
      "Password": null,
      "PasswordChangeRequired": false,
      "RoleId": "ReadOnly",
      "UserName": "user99"

    [INFO "http_connection.hpp":209] Request:  0x150ac38 HTTP/1.1 GET /console0 ::ffff:x.x.xx.xxx
    [DEBUG "routing.hpp":1265] Matched rule (upgrade) '/console0' 1 / 2
    [DEBUG "routing.hpp":1084] userName = user99 userRole = priv-user
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ipmi
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=redfish
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ssh
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=web
    [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: Login
    [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureSelf
    [DEBUG "routing.hpp":113] checkPrivileges: OEM REQUIRED: OpenBMCHostConsole
    [ERROR "routing.hpp":1192] Insufficient Privilege

    + curl -k https://${bmc}/redfish/v1/AccountService/Accounts/user99
    {
      "@odata.id": "/redfish/v1/AccountService/Accounts/user99",
      "@odata.type": "#ManagerAccount.v1_4_0.ManagerAccount",
      "AccountTypes": [
        "IPMI",
        "Redfish",
        "WebUI",
        "ManagerConsole"
      ],
      "Description": "User Account",
      "Enabled": true,
      "Id": "user99",
      "Links": {
        "Role": {
          "@odata.id": "/redfish/v1/AccountService/Roles/Operator"
        }
      },
      "Locked": false,
      "Locked@Redfish.AllowableValues": [
        "false"
      ],
      "Name": "User Account",
      "Password": null,
      "PasswordChangeRequired": false,
      "RoleId": "Operator",
      "UserName": "user99"

    [INFO "http_connection.hpp":209] Request:  0x21c7c38 HTTP/1.1 GET /console0 ::ffff:x.x.xx.xxx
    [DEBUG "routing.hpp":1265] Matched rule (upgrade) '/console0' 1 / 2
    [DEBUG "routing.hpp":1084] userName = user99 userRole = priv-operator
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ipmi
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=redfish
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=ssh
    [DEBUG "routing.hpp":1123] IsUserPrivileged: group=web
    [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: Login
    [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureComponents
    [DEBUG "routing.hpp":93] checkPrivileges: BASE USER: ConfigureSelf
    [DEBUG "routing.hpp":113] checkPrivileges: OEM REQUIRED: OpenBMCHostConsole
    [ERROR "routing.hpp":1192] Insufficient Privilege

Related commits:
  NOTE: docs, openbmc, obmc-console changes are already merged. bmcweb
        and phosphor-user-manager will be merged together.
  docs: https://gerrit.openbmc.org/c/openbmc/docs/+/60968
  phosphor-user-manager: https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/61583
  openbmc: https://gerrit.openbmc.org/c/openbmc/openbmc/+/61582
  obmc-console: https://gerrit.openbmc.org/c/openbmc/obmc-console/+/61581
  bmcweb: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/61580

Change-Id: Ia5a33dafc9a76444e6a8e74e752f0f90cb0a31c8
Signed-off-by: Ninad Palsule <ninadpalsule@us.ibm.com>

9 files changed

tree: 3f35b4bbe4d07b4e6df6ada02df888e22b4a792d

README.md

OpenBMC webserver

This component attempts to be a "do everything" embedded webserver for OpenBMC.

Features

The webserver implements a few distinct interfaces:

DBus event websocket. Allows registering on changes to specific dbus paths, properties, and will send an event from the websocket if those filters match.
OpenBMC DBus REST api. Allows direct, low interference, high fidelity access to dbus and the objects it represents.
Serial: A serial websocket for interacting with the host serial console through websockets.
Redfish: A protocol compliant, DBus to Redfish translator.
KVM: A websocket based implementation of the RFB (VNC) frame buffer protocol intended to mate to webui-vue to provide a complete KVM implementation.

Protocols

bmcweb at a protocol level supports http and https. TLS is supported through OpenSSL.

AuthX

Authentication

Bmcweb supports multiple authentication protocols:

Basic authentication per RFC7617
Cookie based authentication for authenticating against webui-vue
Mutual TLS authentication based on OpenSSL
Session authentication through webui-vue
XToken based authentication conformant to Redfish DSP0266

Each of these types of authentication is able to be enabled or disabled both via runtime policy changes (through the relevant Redfish APIs) or via configure time options. All authentication mechanisms supporting username/password are routed to libpam, to allow for customization in authentication implementations.

Authorization

All authorization in bmcweb is determined at routing time, and per route, and conform to the Redfish PrivilegeRegistry.

*Note: Non-Redfish functions are mapped to the closest equivalent Redfish privilege level.

Configuration

bmcweb is configured per the meson build files. Available options are documented in meson_options.txt

Compile bmcweb with default options

meson setup builddir
ninja -C builddir

If any of the dependencies are not found on the host system during configuration, meson will automatically download them via its wrap dependencies mentioned in bmcweb/subprojects.

Use of persistent data

bmcweb relies on some on-system data for storage of persistent data that is internal to the process. Details on the exact data stored and when it is read/written can seen from the persistent_data namespace.

TLS certificate generation

When SSL support is enabled and a usable certificate is not found, bmcweb will generate a self-signed a certificate before launching the server. Please see the bmcweb source code for details on the parameters this certificate is built with.

Redfish Aggregation

bmcweb is capable of aggregating resources from satellite BMCs. Refer to AGGREGATION.md for more information on how to enable and use this feature.