blob: 31bdd169e43e6c378b6135bd73fbc5a76e2260f1 [file] [log] [blame]
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001/*
2// Copyright (c) 2018 Intel Corporation
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8// http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15*/
16#pragma once
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010017
John Edward Broadbent7e860f12021-04-08 15:57:16 -070018#include <app.hpp>
Ratan Gupta24c85422019-01-30 19:41:24 +053019#include <dbus_utility.hpp>
Ed Tanous65b0dc32018-09-19 16:04:03 -070020#include <error_messages.hpp>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070021#include <openbmc_dbus_rest.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -070022#include <persistent_data.hpp>
Ed Tanoused398212021-06-09 17:05:54 -070023#include <registries/privilege_registry.hpp>
Ed Tanousa8408792018-09-05 16:08:38 -070024#include <utils/json_utils.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050025
Ed Tanousabf2add2019-01-22 16:40:12 -080026#include <variant>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070027
Ed Tanous1abe55e2018-09-05 08:30:59 -070028namespace redfish
29{
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010030
Ed Tanous23a21a12020-07-25 04:45:05 +000031constexpr const char* ldapConfigObjectName =
Ratan Gupta6973a582018-12-13 18:25:44 +053032 "/xyz/openbmc_project/user/ldap/openldap";
Ed Tanous2c70f802020-09-28 14:29:23 -070033constexpr const char* adConfigObject =
Ratan Guptaab828d72019-04-22 14:18:33 +053034 "/xyz/openbmc_project/user/ldap/active_directory";
35
Ratan Gupta6973a582018-12-13 18:25:44 +053036constexpr const char* ldapRootObject = "/xyz/openbmc_project/user/ldap";
37constexpr const char* ldapDbusService = "xyz.openbmc_project.Ldap.Config";
38constexpr const char* ldapConfigInterface =
39 "xyz.openbmc_project.User.Ldap.Config";
40constexpr const char* ldapCreateInterface =
41 "xyz.openbmc_project.User.Ldap.Create";
42constexpr const char* ldapEnableInterface = "xyz.openbmc_project.Object.Enable";
Ratan Gupta06785242019-07-26 22:30:16 +053043constexpr const char* ldapPrivMapperInterface =
44 "xyz.openbmc_project.User.PrivilegeMapper";
Ratan Gupta6973a582018-12-13 18:25:44 +053045constexpr const char* dbusObjManagerIntf = "org.freedesktop.DBus.ObjectManager";
46constexpr const char* propertyInterface = "org.freedesktop.DBus.Properties";
47constexpr const char* mapperBusName = "xyz.openbmc_project.ObjectMapper";
48constexpr const char* mapperObjectPath = "/xyz/openbmc_project/object_mapper";
49constexpr const char* mapperIntf = "xyz.openbmc_project.ObjectMapper";
50
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060051struct LDAPRoleMapData
52{
53 std::string groupName;
54 std::string privilege;
55};
56
Ratan Gupta6973a582018-12-13 18:25:44 +053057struct LDAPConfigData
58{
59 std::string uri{};
60 std::string bindDN{};
61 std::string baseDN{};
62 std::string searchScope{};
63 std::string serverType{};
64 bool serviceEnabled = false;
65 std::string userNameAttribute{};
66 std::string groupAttribute{};
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060067 std::vector<std::pair<std::string, LDAPRoleMapData>> groupRoleList;
Ratan Gupta6973a582018-12-13 18:25:44 +053068};
69
Patrick Williams19bd78d2020-05-13 17:38:24 -050070using DbusVariantType = std::variant<bool, int32_t, std::string>;
Przemyslaw Czarnowski107077d2019-07-11 10:16:43 +020071
72using DbusInterfaceType = boost::container::flat_map<
73 std::string, boost::container::flat_map<std::string, DbusVariantType>>;
74
75using ManagedObjectType =
76 std::vector<std::pair<sdbusplus::message::object_path, DbusInterfaceType>>;
77
Ratan Gupta6973a582018-12-13 18:25:44 +053078using GetObjectType =
79 std::vector<std::pair<std::string, std::vector<std::string>>>;
AppaRao Puli84e12cb2018-10-11 01:28:15 +053080
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060081inline std::string getRoleIdFromPrivilege(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053082{
83 if (role == "priv-admin")
84 {
85 return "Administrator";
86 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070087 if (role == "priv-user")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053088 {
AppaRao Pulic80fee52019-10-16 14:49:36 +053089 return "ReadOnly";
AppaRao Puli84e12cb2018-10-11 01:28:15 +053090 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070091 if (role == "priv-operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053092 {
93 return "Operator";
94 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070095 if ((role == "") || (role == "priv-noaccess"))
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +000096 {
97 return "NoAccess";
98 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +053099 return "";
100}
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600101inline std::string getPrivilegeFromRoleId(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530102{
103 if (role == "Administrator")
104 {
105 return "priv-admin";
106 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700107 if (role == "ReadOnly")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530108 {
109 return "priv-user";
110 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700111 if (role == "Operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530112 {
113 return "priv-operator";
114 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700115 if ((role == "NoAccess") || (role == ""))
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +0000116 {
117 return "priv-noaccess";
118 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530119 return "";
120}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -0700121
zhanghch058d1b46d2021-04-01 11:18:24 +0800122inline void userErrorMessageHandler(
123 const sd_bus_error* e, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
124 const std::string& newUser, const std::string& username)
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000125{
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000126 if (e == nullptr)
127 {
128 messages::internalError(asyncResp->res);
129 return;
130 }
131
Manojkiran Eda055806b2020-11-03 09:36:28 +0530132 const char* errorMessage = e->name;
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000133 if (strcmp(errorMessage,
134 "xyz.openbmc_project.User.Common.Error.UserNameExists") == 0)
135 {
136 messages::resourceAlreadyExists(asyncResp->res,
Gunnar Mills8114bd42020-06-11 20:55:21 -0500137 "#ManagerAccount.v1_4_0.ManagerAccount",
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000138 "UserName", newUser);
139 }
140 else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
141 "UserNameDoesNotExist") == 0)
142 {
143 messages::resourceNotFound(
Gunnar Mills8114bd42020-06-11 20:55:21 -0500144 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount", username);
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000145 }
Ed Tanousd4d25792020-09-29 15:15:03 -0700146 else if ((strcmp(errorMessage,
147 "xyz.openbmc_project.Common.Error.InvalidArgument") ==
148 0) ||
149 (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
150 "UserNameGroupFail") == 0))
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000151 {
152 messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
153 }
154 else if (strcmp(errorMessage,
155 "xyz.openbmc_project.User.Common.Error.NoResource") == 0)
156 {
157 messages::createLimitReachedForResource(asyncResp->res);
158 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000159 else
160 {
161 messages::internalError(asyncResp->res);
162 }
163
164 return;
165}
166
Ed Tanous81ce6092020-12-17 16:54:55 +0000167inline void parseLDAPConfigData(nlohmann::json& jsonResponse,
Ed Tanous23a21a12020-07-25 04:45:05 +0000168 const LDAPConfigData& confData,
169 const std::string& ldapType)
Ratan Gupta6973a582018-12-13 18:25:44 +0530170{
Ratan Guptaab828d72019-04-22 14:18:33 +0530171 std::string service =
172 (ldapType == "LDAP") ? "LDAPService" : "ActiveDirectoryService";
Marri Devender Rao37cce912019-02-20 01:05:22 -0600173 nlohmann::json ldap = {
Ratan Gupta6973a582018-12-13 18:25:44 +0530174 {"ServiceEnabled", confData.serviceEnabled},
175 {"ServiceAddresses", nlohmann::json::array({confData.uri})},
176 {"Authentication",
177 {{"AuthenticationType", "UsernameAndPassword"},
Ratan Gupta6973a582018-12-13 18:25:44 +0530178 {"Username", confData.bindDN},
179 {"Password", nullptr}}},
180 {"LDAPService",
181 {{"SearchSettings",
182 {{"BaseDistinguishedNames",
183 nlohmann::json::array({confData.baseDN})},
184 {"UsernameAttribute", confData.userNameAttribute},
185 {"GroupsAttribute", confData.groupAttribute}}}}},
186 };
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600187
Ed Tanous81ce6092020-12-17 16:54:55 +0000188 jsonResponse[ldapType].update(ldap);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600189
Ed Tanous81ce6092020-12-17 16:54:55 +0000190 nlohmann::json& roleMapArray = jsonResponse[ldapType]["RemoteRoleMapping"];
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600191 roleMapArray = nlohmann::json::array();
192 for (auto& obj : confData.groupRoleList)
193 {
194 BMCWEB_LOG_DEBUG << "Pushing the data groupName="
195 << obj.second.groupName << "\n";
196 roleMapArray.push_back(
197 {nlohmann::json::array({"RemoteGroup", obj.second.groupName}),
198 nlohmann::json::array(
199 {"LocalRole", getRoleIdFromPrivilege(obj.second.privilege)})});
200 }
Ratan Gupta6973a582018-12-13 18:25:44 +0530201}
202
203/**
Ratan Gupta06785242019-07-26 22:30:16 +0530204 * @brief validates given JSON input and then calls appropriate method to
205 * create, to delete or to set Rolemapping object based on the given input.
206 *
207 */
Ed Tanous23a21a12020-07-25 04:45:05 +0000208inline void handleRoleMapPatch(
zhanghch058d1b46d2021-04-01 11:18:24 +0800209 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
Ratan Gupta06785242019-07-26 22:30:16 +0530210 const std::vector<std::pair<std::string, LDAPRoleMapData>>& roleMapObjData,
Ed Tanousf23b7292020-10-15 09:41:17 -0700211 const std::string& serverType, const std::vector<nlohmann::json>& input)
Ratan Gupta06785242019-07-26 22:30:16 +0530212{
213 for (size_t index = 0; index < input.size(); index++)
214 {
Ed Tanousf23b7292020-10-15 09:41:17 -0700215 const nlohmann::json& thisJson = input[index];
Ratan Gupta06785242019-07-26 22:30:16 +0530216
217 if (thisJson.is_null())
218 {
219 // delete the existing object
220 if (index < roleMapObjData.size())
221 {
222 crow::connections::systemBus->async_method_call(
223 [asyncResp, roleMapObjData, serverType,
224 index](const boost::system::error_code ec) {
225 if (ec)
226 {
227 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
228 messages::internalError(asyncResp->res);
229 return;
230 }
231 asyncResp->res
232 .jsonValue[serverType]["RemoteRoleMapping"][index] =
233 nullptr;
234 },
235 ldapDbusService, roleMapObjData[index].first,
236 "xyz.openbmc_project.Object.Delete", "Delete");
237 }
238 else
239 {
240 BMCWEB_LOG_ERROR << "Can't delete the object";
241 messages::propertyValueTypeError(
Ed Tanous71f52d92021-02-19 08:51:17 -0800242 asyncResp->res,
243 thisJson.dump(2, ' ', true,
244 nlohmann::json::error_handler_t::replace),
Ratan Gupta06785242019-07-26 22:30:16 +0530245 "RemoteRoleMapping/" + std::to_string(index));
246 return;
247 }
248 }
249 else if (thisJson.empty())
250 {
251 // Don't do anything for the empty objects,parse next json
252 // eg {"RemoteRoleMapping",[{}]}
253 }
254 else
255 {
256 // update/create the object
257 std::optional<std::string> remoteGroup;
258 std::optional<std::string> localRole;
259
Ed Tanousf23b7292020-10-15 09:41:17 -0700260 // This is a copy, but it's required in this case because of how
261 // readJson is structured
262 nlohmann::json thisJsonCopy = thisJson;
263 if (!json_util::readJson(thisJsonCopy, asyncResp->res,
264 "RemoteGroup", remoteGroup, "LocalRole",
265 localRole))
Ratan Gupta06785242019-07-26 22:30:16 +0530266 {
267 continue;
268 }
269
270 // Update existing RoleMapping Object
271 if (index < roleMapObjData.size())
272 {
273 BMCWEB_LOG_DEBUG << "Update Role Map Object";
274 // If "RemoteGroup" info is provided
275 if (remoteGroup)
276 {
277 crow::connections::systemBus->async_method_call(
278 [asyncResp, roleMapObjData, serverType, index,
279 remoteGroup](const boost::system::error_code ec) {
280 if (ec)
281 {
282 BMCWEB_LOG_ERROR << "DBUS response error: "
283 << ec;
284 messages::internalError(asyncResp->res);
285 return;
286 }
287 asyncResp->res
288 .jsonValue[serverType]["RemoteRoleMapping"]
289 [index]["RemoteGroup"] = *remoteGroup;
290 },
291 ldapDbusService, roleMapObjData[index].first,
292 propertyInterface, "Set",
293 "xyz.openbmc_project.User.PrivilegeMapperEntry",
294 "GroupName",
295 std::variant<std::string>(std::move(*remoteGroup)));
296 }
297
298 // If "LocalRole" info is provided
299 if (localRole)
300 {
301 crow::connections::systemBus->async_method_call(
302 [asyncResp, roleMapObjData, serverType, index,
303 localRole](const boost::system::error_code ec) {
304 if (ec)
305 {
306 BMCWEB_LOG_ERROR << "DBUS response error: "
307 << ec;
308 messages::internalError(asyncResp->res);
309 return;
310 }
311 asyncResp->res
312 .jsonValue[serverType]["RemoteRoleMapping"]
313 [index]["LocalRole"] = *localRole;
314 },
315 ldapDbusService, roleMapObjData[index].first,
316 propertyInterface, "Set",
317 "xyz.openbmc_project.User.PrivilegeMapperEntry",
318 "Privilege",
319 std::variant<std::string>(
320 getPrivilegeFromRoleId(std::move(*localRole))));
321 }
322 }
323 // Create a new RoleMapping Object.
324 else
325 {
326 BMCWEB_LOG_DEBUG
327 << "setRoleMappingProperties: Creating new Object";
328 std::string pathString =
329 "RemoteRoleMapping/" + std::to_string(index);
330
331 if (!localRole)
332 {
333 messages::propertyMissing(asyncResp->res,
334 pathString + "/LocalRole");
335 continue;
336 }
337 if (!remoteGroup)
338 {
339 messages::propertyMissing(asyncResp->res,
340 pathString + "/RemoteGroup");
341 continue;
342 }
343
344 std::string dbusObjectPath;
345 if (serverType == "ActiveDirectory")
346 {
Ed Tanous2c70f802020-09-28 14:29:23 -0700347 dbusObjectPath = adConfigObject;
Ratan Gupta06785242019-07-26 22:30:16 +0530348 }
349 else if (serverType == "LDAP")
350 {
Ed Tanous23a21a12020-07-25 04:45:05 +0000351 dbusObjectPath = ldapConfigObjectName;
Ratan Gupta06785242019-07-26 22:30:16 +0530352 }
353
354 BMCWEB_LOG_DEBUG << "Remote Group=" << *remoteGroup
355 << ",LocalRole=" << *localRole;
356
357 crow::connections::systemBus->async_method_call(
Ed Tanous271584a2019-07-09 16:24:22 -0700358 [asyncResp, serverType, localRole,
Ratan Gupta06785242019-07-26 22:30:16 +0530359 remoteGroup](const boost::system::error_code ec) {
360 if (ec)
361 {
362 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
363 messages::internalError(asyncResp->res);
364 return;
365 }
366 nlohmann::json& remoteRoleJson =
367 asyncResp->res
368 .jsonValue[serverType]["RemoteRoleMapping"];
369 remoteRoleJson.push_back(
370 {{"LocalRole", *localRole},
371 {"RemoteGroup", *remoteGroup}});
372 },
373 ldapDbusService, dbusObjectPath, ldapPrivMapperInterface,
Ed Tanous3174e4d2020-10-07 11:41:22 -0700374 "Create", *remoteGroup,
Ratan Gupta06785242019-07-26 22:30:16 +0530375 getPrivilegeFromRoleId(std::move(*localRole)));
376 }
377 }
378 }
379}
380
381/**
Ratan Gupta6973a582018-12-13 18:25:44 +0530382 * Function that retrieves all properties for LDAP config object
383 * into JSON
384 */
385template <typename CallbackFunc>
386inline void getLDAPConfigData(const std::string& ldapType,
387 CallbackFunc&& callback)
388{
Ratan Guptaab828d72019-04-22 14:18:33 +0530389
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600390 const std::array<const char*, 2> interfaces = {ldapEnableInterface,
Ratan Gupta6973a582018-12-13 18:25:44 +0530391 ldapConfigInterface};
392
393 crow::connections::systemBus->async_method_call(
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600394 [callback, ldapType](const boost::system::error_code ec,
395 const GetObjectType& resp) {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600396 if (ec || resp.empty())
397 {
398 BMCWEB_LOG_ERROR << "DBUS response error during getting of "
399 "service name: "
400 << ec;
Ed Tanous23a21a12020-07-25 04:45:05 +0000401 LDAPConfigData empty{};
402 callback(false, empty, ldapType);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600403 return;
404 }
405 std::string service = resp.begin()->first;
406 crow::connections::systemBus->async_method_call(
Ed Tanous81ce6092020-12-17 16:54:55 +0000407 [callback, ldapType](const boost::system::error_code errorCode,
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600408 const ManagedObjectType& ldapObjects) {
409 LDAPConfigData confData{};
Ed Tanous81ce6092020-12-17 16:54:55 +0000410 if (errorCode)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600411 {
412 callback(false, confData, ldapType);
413 BMCWEB_LOG_ERROR << "D-Bus responses error: "
Ed Tanous81ce6092020-12-17 16:54:55 +0000414 << errorCode;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600415 return;
416 }
417
418 std::string ldapDbusType;
419 std::string searchString;
420
421 if (ldapType == "LDAP")
422 {
423 ldapDbusType = "xyz.openbmc_project.User.Ldap.Config."
424 "Type.OpenLdap";
425 searchString = "openldap";
426 }
427 else if (ldapType == "ActiveDirectory")
428 {
429 ldapDbusType =
430 "xyz.openbmc_project.User.Ldap.Config.Type."
431 "ActiveDirectory";
432 searchString = "active_directory";
433 }
434 else
435 {
436 BMCWEB_LOG_ERROR
437 << "Can't get the DbusType for the given type="
438 << ldapType;
439 callback(false, confData, ldapType);
440 return;
441 }
442
443 std::string ldapEnableInterfaceStr = ldapEnableInterface;
444 std::string ldapConfigInterfaceStr = ldapConfigInterface;
445
446 for (const auto& object : ldapObjects)
447 {
448 // let's find the object whose ldap type is equal to the
449 // given type
450 if (object.first.str.find(searchString) ==
451 std::string::npos)
452 {
453 continue;
454 }
455
456 for (const auto& interface : object.second)
457 {
458 if (interface.first == ldapEnableInterfaceStr)
459 {
460 // rest of the properties are string.
461 for (const auto& property : interface.second)
462 {
463 if (property.first == "Enabled")
464 {
465 const bool* value =
466 std::get_if<bool>(&property.second);
467 if (value == nullptr)
468 {
469 continue;
470 }
471 confData.serviceEnabled = *value;
472 break;
473 }
474 }
475 }
476 else if (interface.first == ldapConfigInterfaceStr)
477 {
478
479 for (const auto& property : interface.second)
480 {
Ed Tanous271584a2019-07-09 16:24:22 -0700481 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600482 std::get_if<std::string>(
483 &property.second);
Ed Tanous271584a2019-07-09 16:24:22 -0700484 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600485 {
486 continue;
487 }
488 if (property.first == "LDAPServerURI")
489 {
Ed Tanous271584a2019-07-09 16:24:22 -0700490 confData.uri = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600491 }
492 else if (property.first == "LDAPBindDN")
493 {
Ed Tanous271584a2019-07-09 16:24:22 -0700494 confData.bindDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600495 }
496 else if (property.first == "LDAPBaseDN")
497 {
Ed Tanous271584a2019-07-09 16:24:22 -0700498 confData.baseDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600499 }
500 else if (property.first ==
501 "LDAPSearchScope")
502 {
Ed Tanous271584a2019-07-09 16:24:22 -0700503 confData.searchScope = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600504 }
505 else if (property.first ==
506 "GroupNameAttribute")
507 {
Ed Tanous271584a2019-07-09 16:24:22 -0700508 confData.groupAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600509 }
510 else if (property.first ==
511 "UserNameAttribute")
512 {
Ed Tanous271584a2019-07-09 16:24:22 -0700513 confData.userNameAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600514 }
515 else if (property.first == "LDAPType")
516 {
Ed Tanous271584a2019-07-09 16:24:22 -0700517 confData.serverType = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600518 }
519 }
520 }
521 else if (interface.first ==
522 "xyz.openbmc_project.User."
523 "PrivilegeMapperEntry")
524 {
525 LDAPRoleMapData roleMapData{};
526 for (const auto& property : interface.second)
527 {
Ed Tanous271584a2019-07-09 16:24:22 -0700528 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600529 std::get_if<std::string>(
530 &property.second);
531
Ed Tanous271584a2019-07-09 16:24:22 -0700532 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600533 {
534 continue;
535 }
536
537 if (property.first == "GroupName")
538 {
Ed Tanous271584a2019-07-09 16:24:22 -0700539 roleMapData.groupName = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600540 }
541 else if (property.first == "Privilege")
542 {
Ed Tanous271584a2019-07-09 16:24:22 -0700543 roleMapData.privilege = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600544 }
545 }
546
Ed Tanous0f0353b2019-10-24 11:37:51 -0700547 confData.groupRoleList.emplace_back(
548 object.first.str, roleMapData);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600549 }
550 }
551 }
552 callback(true, confData, ldapType);
553 },
554 service, ldapRootObject, dbusObjManagerIntf,
555 "GetManagedObjects");
556 },
557 mapperBusName, mapperObjectPath, mapperIntf, "GetObject",
Ed Tanous23a21a12020-07-25 04:45:05 +0000558 ldapConfigObjectName, interfaces);
Ratan Gupta6973a582018-12-13 18:25:44 +0530559}
560
Ed Tanous6c51eab2021-06-03 12:30:29 -0700561/**
562 * @brief parses the authentication section under the LDAP
563 * @param input JSON data
564 * @param asyncResp pointer to the JSON response
565 * @param userName userName to be filled from the given JSON.
566 * @param password password to be filled from the given JSON.
567 */
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700568inline void parseLDAPAuthenticationJson(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700569 nlohmann::json input, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
570 std::optional<std::string>& username, std::optional<std::string>& password)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700571{
Ed Tanous6c51eab2021-06-03 12:30:29 -0700572 std::optional<std::string> authType;
573
574 if (!json_util::readJson(input, asyncResp->res, "AuthenticationType",
575 authType, "Username", username, "Password",
576 password))
Ed Tanous1abe55e2018-09-05 08:30:59 -0700577 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700578 return;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700579 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700580 if (!authType)
Ratan Gupta8a07d282019-03-16 08:33:47 +0530581 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700582 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530583 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700584 if (*authType != "UsernameAndPassword")
Ratan Gupta8a07d282019-03-16 08:33:47 +0530585 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700586 messages::propertyValueNotInList(asyncResp->res, *authType,
587 "AuthenticationType");
588 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530589 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700590}
591/**
592 * @brief parses the LDAPService section under the LDAP
593 * @param input JSON data
594 * @param asyncResp pointer to the JSON response
595 * @param baseDNList baseDN to be filled from the given JSON.
596 * @param userNameAttribute userName to be filled from the given JSON.
597 * @param groupaAttribute password to be filled from the given JSON.
598 */
Ratan Gupta8a07d282019-03-16 08:33:47 +0530599
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700600inline void
601 parseLDAPServiceJson(nlohmann::json input,
602 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
603 std::optional<std::vector<std::string>>& baseDNList,
604 std::optional<std::string>& userNameAttribute,
605 std::optional<std::string>& groupsAttribute)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700606{
607 std::optional<nlohmann::json> searchSettings;
608
609 if (!json_util::readJson(input, asyncResp->res, "SearchSettings",
610 searchSettings))
Ratan Gupta8a07d282019-03-16 08:33:47 +0530611 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700612 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530613 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700614 if (!searchSettings)
Ratan Gupta8a07d282019-03-16 08:33:47 +0530615 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700616 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530617 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700618 if (!json_util::readJson(*searchSettings, asyncResp->res,
619 "BaseDistinguishedNames", baseDNList,
620 "UsernameAttribute", userNameAttribute,
621 "GroupsAttribute", groupsAttribute))
Ratan Gupta8a07d282019-03-16 08:33:47 +0530622 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700623 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530624 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700625}
626/**
627 * @brief updates the LDAP server address and updates the
628 json response with the new value.
629 * @param serviceAddressList address to be updated.
630 * @param asyncResp pointer to the JSON response
631 * @param ldapServerElementName Type of LDAP
632 server(openLDAP/ActiveDirectory)
633 */
Ratan Gupta8a07d282019-03-16 08:33:47 +0530634
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700635inline void handleServiceAddressPatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700636 const std::vector<std::string>& serviceAddressList,
637 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
638 const std::string& ldapServerElementName,
639 const std::string& ldapConfigObject)
640{
641 crow::connections::systemBus->async_method_call(
642 [asyncResp, ldapServerElementName,
643 serviceAddressList](const boost::system::error_code ec) {
644 if (ec)
645 {
646 BMCWEB_LOG_DEBUG
647 << "Error Occurred in updating the service address";
648 messages::internalError(asyncResp->res);
649 return;
650 }
651 std::vector<std::string> modifiedserviceAddressList = {
652 serviceAddressList.front()};
653 asyncResp->res
654 .jsonValue[ldapServerElementName]["ServiceAddresses"] =
655 modifiedserviceAddressList;
656 if ((serviceAddressList).size() > 1)
657 {
658 messages::propertyValueModified(asyncResp->res,
659 "ServiceAddresses",
660 serviceAddressList.front());
661 }
662 BMCWEB_LOG_DEBUG << "Updated the service address";
663 },
664 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
665 ldapConfigInterface, "LDAPServerURI",
666 std::variant<std::string>(serviceAddressList.front()));
667}
668/**
669 * @brief updates the LDAP Bind DN and updates the
670 json response with the new value.
671 * @param username name of the user which needs to be updated.
672 * @param asyncResp pointer to the JSON response
673 * @param ldapServerElementName Type of LDAP
674 server(openLDAP/ActiveDirectory)
675 */
Ratan Gupta8a07d282019-03-16 08:33:47 +0530676
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700677inline void
678 handleUserNamePatch(const std::string& username,
679 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
680 const std::string& ldapServerElementName,
681 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700682{
683 crow::connections::systemBus->async_method_call(
684 [asyncResp, username,
685 ldapServerElementName](const boost::system::error_code ec) {
686 if (ec)
687 {
688 BMCWEB_LOG_DEBUG << "Error occurred in updating the username";
689 messages::internalError(asyncResp->res);
690 return;
691 }
692 asyncResp->res.jsonValue[ldapServerElementName]["Authentication"]
693 ["Username"] = username;
694 BMCWEB_LOG_DEBUG << "Updated the username";
695 },
696 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
697 ldapConfigInterface, "LDAPBindDN", std::variant<std::string>(username));
698}
699
700/**
701 * @brief updates the LDAP password
702 * @param password : ldap password which needs to be updated.
703 * @param asyncResp pointer to the JSON response
704 * @param ldapServerElementName Type of LDAP
705 * server(openLDAP/ActiveDirectory)
706 */
707
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700708inline void
709 handlePasswordPatch(const std::string& password,
710 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
711 const std::string& ldapServerElementName,
712 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700713{
714 crow::connections::systemBus->async_method_call(
715 [asyncResp, password,
716 ldapServerElementName](const boost::system::error_code ec) {
717 if (ec)
718 {
719 BMCWEB_LOG_DEBUG << "Error occurred in updating the password";
720 messages::internalError(asyncResp->res);
721 return;
722 }
723 asyncResp->res.jsonValue[ldapServerElementName]["Authentication"]
724 ["Password"] = "";
725 BMCWEB_LOG_DEBUG << "Updated the password";
726 },
727 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
728 ldapConfigInterface, "LDAPBindDNPassword",
729 std::variant<std::string>(password));
730}
731
732/**
733 * @brief updates the LDAP BaseDN and updates the
734 json response with the new value.
735 * @param baseDNList baseDN list which needs to be updated.
736 * @param asyncResp pointer to the JSON response
737 * @param ldapServerElementName Type of LDAP
738 server(openLDAP/ActiveDirectory)
739 */
740
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700741inline void
742 handleBaseDNPatch(const std::vector<std::string>& baseDNList,
743 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
744 const std::string& ldapServerElementName,
745 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700746{
747 crow::connections::systemBus->async_method_call(
748 [asyncResp, baseDNList,
749 ldapServerElementName](const boost::system::error_code ec) {
750 if (ec)
751 {
752 BMCWEB_LOG_DEBUG << "Error Occurred in Updating the base DN";
753 messages::internalError(asyncResp->res);
754 return;
755 }
756 auto& serverTypeJson =
757 asyncResp->res.jsonValue[ldapServerElementName];
758 auto& searchSettingsJson =
759 serverTypeJson["LDAPService"]["SearchSettings"];
760 std::vector<std::string> modifiedBaseDNList = {baseDNList.front()};
761 searchSettingsJson["BaseDistinguishedNames"] = modifiedBaseDNList;
762 if (baseDNList.size() > 1)
763 {
764 messages::propertyValueModified(asyncResp->res,
765 "BaseDistinguishedNames",
766 baseDNList.front());
767 }
768 BMCWEB_LOG_DEBUG << "Updated the base DN";
769 },
770 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
771 ldapConfigInterface, "LDAPBaseDN",
772 std::variant<std::string>(baseDNList.front()));
773}
774/**
775 * @brief updates the LDAP user name attribute and updates the
776 json response with the new value.
777 * @param userNameAttribute attribute to be updated.
778 * @param asyncResp pointer to the JSON response
779 * @param ldapServerElementName Type of LDAP
780 server(openLDAP/ActiveDirectory)
781 */
782
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700783inline void
784 handleUserNameAttrPatch(const std::string& userNameAttribute,
785 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
786 const std::string& ldapServerElementName,
787 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700788{
789 crow::connections::systemBus->async_method_call(
790 [asyncResp, userNameAttribute,
791 ldapServerElementName](const boost::system::error_code ec) {
792 if (ec)
793 {
794 BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
795 "username attribute";
796 messages::internalError(asyncResp->res);
797 return;
798 }
799 auto& serverTypeJson =
800 asyncResp->res.jsonValue[ldapServerElementName];
801 auto& searchSettingsJson =
802 serverTypeJson["LDAPService"]["SearchSettings"];
803 searchSettingsJson["UsernameAttribute"] = userNameAttribute;
804 BMCWEB_LOG_DEBUG << "Updated the user name attr.";
805 },
806 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
807 ldapConfigInterface, "UserNameAttribute",
808 std::variant<std::string>(userNameAttribute));
809}
810/**
811 * @brief updates the LDAP group attribute and updates the
812 json response with the new value.
813 * @param groupsAttribute attribute to be updated.
814 * @param asyncResp pointer to the JSON response
815 * @param ldapServerElementName Type of LDAP
816 server(openLDAP/ActiveDirectory)
817 */
818
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700819inline void handleGroupNameAttrPatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700820 const std::string& groupsAttribute,
821 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
822 const std::string& ldapServerElementName,
823 const std::string& ldapConfigObject)
824{
825 crow::connections::systemBus->async_method_call(
826 [asyncResp, groupsAttribute,
827 ldapServerElementName](const boost::system::error_code ec) {
828 if (ec)
829 {
830 BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
831 "groupname attribute";
832 messages::internalError(asyncResp->res);
833 return;
834 }
835 auto& serverTypeJson =
836 asyncResp->res.jsonValue[ldapServerElementName];
837 auto& searchSettingsJson =
838 serverTypeJson["LDAPService"]["SearchSettings"];
839 searchSettingsJson["GroupsAttribute"] = groupsAttribute;
840 BMCWEB_LOG_DEBUG << "Updated the groupname attr";
841 },
842 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
843 ldapConfigInterface, "GroupNameAttribute",
844 std::variant<std::string>(groupsAttribute));
845}
846/**
847 * @brief updates the LDAP service enable and updates the
848 json response with the new value.
849 * @param input JSON data.
850 * @param asyncResp pointer to the JSON response
851 * @param ldapServerElementName Type of LDAP
852 server(openLDAP/ActiveDirectory)
853 */
854
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700855inline void handleServiceEnablePatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700856 bool serviceEnabled, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
857 const std::string& ldapServerElementName,
858 const std::string& ldapConfigObject)
859{
860 crow::connections::systemBus->async_method_call(
861 [asyncResp, serviceEnabled,
862 ldapServerElementName](const boost::system::error_code ec) {
863 if (ec)
864 {
865 BMCWEB_LOG_DEBUG
866 << "Error Occurred in Updating the service enable";
867 messages::internalError(asyncResp->res);
868 return;
869 }
870 asyncResp->res.jsonValue[ldapServerElementName]["ServiceEnabled"] =
871 serviceEnabled;
872 BMCWEB_LOG_DEBUG << "Updated Service enable = " << serviceEnabled;
873 },
874 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
875 ldapEnableInterface, "Enabled", std::variant<bool>(serviceEnabled));
876}
877
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700878inline void
879 handleAuthMethodsPatch(nlohmann::json& input,
880 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700881{
882 std::optional<bool> basicAuth;
883 std::optional<bool> cookie;
884 std::optional<bool> sessionToken;
885 std::optional<bool> xToken;
886 std::optional<bool> tls;
887
888 if (!json_util::readJson(input, asyncResp->res, "BasicAuth", basicAuth,
889 "Cookie", cookie, "SessionToken", sessionToken,
890 "XToken", xToken, "TLS", tls))
Ratan Gupta8a07d282019-03-16 08:33:47 +0530891 {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700892 BMCWEB_LOG_ERROR << "Cannot read values from AuthMethod tag";
893 return;
894 }
895
896 // Make a copy of methods configuration
897 persistent_data::AuthConfigMethods authMethodsConfig =
898 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
899
900 if (basicAuth)
901 {
902#ifndef BMCWEB_ENABLE_BASIC_AUTHENTICATION
903 messages::actionNotSupported(
904 asyncResp->res, "Setting BasicAuth when basic-auth feature "
905 "is disabled");
906 return;
907#endif
908 authMethodsConfig.basic = *basicAuth;
909 }
910
911 if (cookie)
912 {
913#ifndef BMCWEB_ENABLE_COOKIE_AUTHENTICATION
914 messages::actionNotSupported(asyncResp->res,
915 "Setting Cookie when cookie-auth feature "
916 "is disabled");
917 return;
918#endif
919 authMethodsConfig.cookie = *cookie;
920 }
921
922 if (sessionToken)
923 {
924#ifndef BMCWEB_ENABLE_SESSION_AUTHENTICATION
925 messages::actionNotSupported(
926 asyncResp->res, "Setting SessionToken when session-auth feature "
927 "is disabled");
928 return;
929#endif
930 authMethodsConfig.sessionToken = *sessionToken;
931 }
932
933 if (xToken)
934 {
935#ifndef BMCWEB_ENABLE_XTOKEN_AUTHENTICATION
936 messages::actionNotSupported(asyncResp->res,
937 "Setting XToken when xtoken-auth feature "
938 "is disabled");
939 return;
940#endif
941 authMethodsConfig.xtoken = *xToken;
942 }
943
944 if (tls)
945 {
946#ifndef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
947 messages::actionNotSupported(asyncResp->res,
948 "Setting TLS when mutual-tls-auth feature "
949 "is disabled");
950 return;
951#endif
952 authMethodsConfig.tls = *tls;
953 }
954
955 if (!authMethodsConfig.basic && !authMethodsConfig.cookie &&
956 !authMethodsConfig.sessionToken && !authMethodsConfig.xtoken &&
957 !authMethodsConfig.tls)
958 {
959 // Do not allow user to disable everything
960 messages::actionNotSupported(asyncResp->res,
961 "of disabling all available methods");
962 return;
963 }
964
965 persistent_data::SessionStore::getInstance().updateAuthMethodsConfig(
966 authMethodsConfig);
967 // Save configuration immediately
968 persistent_data::getConfig().writeData();
969
970 messages::success(asyncResp->res);
971}
972
973/**
974 * @brief Get the required values from the given JSON, validates the
975 * value and create the LDAP config object.
976 * @param input JSON data
977 * @param asyncResp pointer to the JSON response
978 * @param serverType Type of LDAP server(openLDAP/ActiveDirectory)
979 */
980
981inline void handleLDAPPatch(nlohmann::json& input,
982 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
983 const std::string& serverType)
984{
985 std::string dbusObjectPath;
986 if (serverType == "ActiveDirectory")
987 {
988 dbusObjectPath = adConfigObject;
989 }
990 else if (serverType == "LDAP")
991 {
992 dbusObjectPath = ldapConfigObjectName;
993 }
994 else
995 {
996 return;
997 }
998
999 std::optional<nlohmann::json> authentication;
1000 std::optional<nlohmann::json> ldapService;
1001 std::optional<std::vector<std::string>> serviceAddressList;
1002 std::optional<bool> serviceEnabled;
1003 std::optional<std::vector<std::string>> baseDNList;
1004 std::optional<std::string> userNameAttribute;
1005 std::optional<std::string> groupsAttribute;
1006 std::optional<std::string> userName;
1007 std::optional<std::string> password;
1008 std::optional<std::vector<nlohmann::json>> remoteRoleMapData;
1009
1010 if (!json_util::readJson(input, asyncResp->res, "Authentication",
1011 authentication, "LDAPService", ldapService,
1012 "ServiceAddresses", serviceAddressList,
1013 "ServiceEnabled", serviceEnabled,
1014 "RemoteRoleMapping", remoteRoleMapData))
1015 {
1016 return;
1017 }
1018
1019 if (authentication)
1020 {
1021 parseLDAPAuthenticationJson(*authentication, asyncResp, userName,
1022 password);
1023 }
1024 if (ldapService)
1025 {
1026 parseLDAPServiceJson(*ldapService, asyncResp, baseDNList,
1027 userNameAttribute, groupsAttribute);
1028 }
1029 if (serviceAddressList)
1030 {
1031 if ((*serviceAddressList).size() == 0)
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301032 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001033 messages::propertyValueNotInList(asyncResp->res, "[]",
1034 "ServiceAddress");
Ed Tanouscb13a392020-07-25 19:02:03 +00001035 return;
1036 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001037 }
1038 if (baseDNList)
1039 {
1040 if ((*baseDNList).size() == 0)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301041 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001042 messages::propertyValueNotInList(asyncResp->res, "[]",
1043 "BaseDistinguishedNames");
Ratan Gupta8a07d282019-03-16 08:33:47 +05301044 return;
1045 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001046 }
Ratan Gupta8a07d282019-03-16 08:33:47 +05301047
Ed Tanous6c51eab2021-06-03 12:30:29 -07001048 // nothing to update, then return
1049 if (!userName && !password && !serviceAddressList && !baseDNList &&
1050 !userNameAttribute && !groupsAttribute && !serviceEnabled &&
1051 !remoteRoleMapData)
1052 {
1053 return;
1054 }
1055
1056 // Get the existing resource first then keep modifying
1057 // whenever any property gets updated.
1058 getLDAPConfigData(serverType, [asyncResp, userName, password, baseDNList,
1059 userNameAttribute, groupsAttribute,
1060 serviceAddressList, serviceEnabled,
1061 dbusObjectPath, remoteRoleMapData](
1062 bool success,
1063 const LDAPConfigData& confData,
1064 const std::string& serverT) {
1065 if (!success)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301066 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001067 messages::internalError(asyncResp->res);
1068 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301069 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001070 parseLDAPConfigData(asyncResp->res.jsonValue, confData, serverT);
1071 if (confData.serviceEnabled)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301072 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001073 // Disable the service first and update the rest of
1074 // the properties.
1075 handleServiceEnablePatch(false, asyncResp, serverT, dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301076 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001077
Ratan Gupta8a07d282019-03-16 08:33:47 +05301078 if (serviceAddressList)
1079 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001080 handleServiceAddressPatch(*serviceAddressList, asyncResp, serverT,
1081 dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301082 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001083 if (userName)
1084 {
1085 handleUserNamePatch(*userName, asyncResp, serverT, dbusObjectPath);
1086 }
1087 if (password)
1088 {
1089 handlePasswordPatch(*password, asyncResp, serverT, dbusObjectPath);
1090 }
1091
Ratan Gupta8a07d282019-03-16 08:33:47 +05301092 if (baseDNList)
1093 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001094 handleBaseDNPatch(*baseDNList, asyncResp, serverT, dbusObjectPath);
1095 }
1096 if (userNameAttribute)
1097 {
1098 handleUserNameAttrPatch(*userNameAttribute, asyncResp, serverT,
1099 dbusObjectPath);
1100 }
1101 if (groupsAttribute)
1102 {
1103 handleGroupNameAttrPatch(*groupsAttribute, asyncResp, serverT,
1104 dbusObjectPath);
1105 }
1106 if (serviceEnabled)
1107 {
1108 // if user has given the value as true then enable
1109 // the service. if user has given false then no-op
1110 // as service is already stopped.
1111 if (*serviceEnabled)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301112 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001113 handleServiceEnablePatch(*serviceEnabled, asyncResp, serverT,
1114 dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301115 }
1116 }
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001117 else
1118 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001119 // if user has not given the service enabled value
1120 // then revert it to the same state as it was
1121 // before.
1122 handleServiceEnablePatch(confData.serviceEnabled, asyncResp,
1123 serverT, dbusObjectPath);
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001124 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001125
Ed Tanous6c51eab2021-06-03 12:30:29 -07001126 if (remoteRoleMapData)
1127 {
1128 handleRoleMapPatch(asyncResp, confData.groupRoleList, serverT,
1129 *remoteRoleMapData);
1130 }
1131 });
1132}
1133
1134inline void updateUserProperties(std::shared_ptr<bmcweb::AsyncResp> asyncResp,
1135 const std::string& username,
1136 std::optional<std::string> password,
1137 std::optional<bool> enabled,
1138 std::optional<std::string> roleId,
1139 std::optional<bool> locked)
1140{
1141 std::string dbusObjectPath = "/xyz/openbmc_project/user/" + username;
1142 dbus::utility::escapePathForDbus(dbusObjectPath);
1143
1144 dbus::utility::checkDbusPathExists(
1145 dbusObjectPath,
1146 [dbusObjectPath(std::move(dbusObjectPath)), username,
1147 password(std::move(password)), roleId(std::move(roleId)), enabled,
1148 locked, asyncResp{std::move(asyncResp)}](int rc) {
1149 if (!rc)
1150 {
1151 messages::resourceNotFound(
1152 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount",
1153 username);
1154 return;
1155 }
1156
1157 if (password)
1158 {
1159 int retval = pamUpdatePassword(username, *password);
1160
1161 if (retval == PAM_USER_UNKNOWN)
Ed Tanous04ae99e2018-09-20 15:54:36 -07001162 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001163 messages::resourceNotFound(
1164 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount",
1165 username);
1166 }
1167 else if (retval == PAM_AUTHTOK_ERR)
1168 {
1169 // If password is invalid
1170 messages::propertyValueFormatError(asyncResp->res,
1171 *password, "Password");
1172 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1173 }
1174 else if (retval != PAM_SUCCESS)
1175 {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001176 messages::internalError(asyncResp->res);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001177 return;
1178 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001179 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001180
Ed Tanous6c51eab2021-06-03 12:30:29 -07001181 if (enabled)
1182 {
1183 crow::connections::systemBus->async_method_call(
1184 [asyncResp](const boost::system::error_code ec) {
1185 if (ec)
1186 {
1187 BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1188 messages::internalError(asyncResp->res);
1189 return;
1190 }
1191 messages::success(asyncResp->res);
1192 return;
1193 },
1194 "xyz.openbmc_project.User.Manager", dbusObjectPath.c_str(),
1195 "org.freedesktop.DBus.Properties", "Set",
1196 "xyz.openbmc_project.User.Attributes", "UserEnabled",
1197 std::variant<bool>{*enabled});
1198 }
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001199
Ed Tanous6c51eab2021-06-03 12:30:29 -07001200 if (roleId)
1201 {
1202 std::string priv = getPrivilegeFromRoleId(*roleId);
1203 if (priv.empty())
Ed Tanous04ae99e2018-09-20 15:54:36 -07001204 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001205 messages::propertyValueNotInList(asyncResp->res, *roleId,
1206 "RoleId");
1207 return;
1208 }
1209 if (priv == "priv-noaccess")
1210 {
1211 priv = "";
1212 }
1213
1214 crow::connections::systemBus->async_method_call(
1215 [asyncResp](const boost::system::error_code ec) {
1216 if (ec)
1217 {
1218 BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1219 messages::internalError(asyncResp->res);
1220 return;
1221 }
1222 messages::success(asyncResp->res);
1223 },
1224 "xyz.openbmc_project.User.Manager", dbusObjectPath.c_str(),
1225 "org.freedesktop.DBus.Properties", "Set",
1226 "xyz.openbmc_project.User.Attributes", "UserPrivilege",
1227 std::variant<std::string>{priv});
1228 }
1229
1230 if (locked)
1231 {
1232 // admin can unlock the account which is locked by
1233 // successive authentication failures but admin should
1234 // not be allowed to lock an account.
1235 if (*locked)
1236 {
1237 messages::propertyValueNotInList(asyncResp->res, "true",
1238 "Locked");
Ed Tanous04ae99e2018-09-20 15:54:36 -07001239 return;
1240 }
1241
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001242 crow::connections::systemBus->async_method_call(
Ed Tanous6c51eab2021-06-03 12:30:29 -07001243 [asyncResp](const boost::system::error_code ec) {
1244 if (ec)
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001245 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001246 BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1247 messages::internalError(asyncResp->res);
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001248 return;
1249 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001250 messages::success(asyncResp->res);
1251 return;
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001252 },
Ed Tanous6c51eab2021-06-03 12:30:29 -07001253 "xyz.openbmc_project.User.Manager", dbusObjectPath.c_str(),
1254 "org.freedesktop.DBus.Properties", "Set",
1255 "xyz.openbmc_project.User.Attributes",
1256 "UserLockedForFailedAttempt", std::variant<bool>{*locked});
1257 }
1258 });
1259}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001260
Ed Tanous6c51eab2021-06-03 12:30:29 -07001261inline void requestAccountServiceRoutes(App& app)
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001262{
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001263
Ed Tanous6c51eab2021-06-03 12:30:29 -07001264 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
Ed Tanoused398212021-06-09 17:05:54 -07001265 .privileges(redfish::privileges::getAccountService)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001266 .methods(
Abhishek Patel72048782021-06-02 09:53:24 -05001267 boost::beast::http::verb::get)([](const crow::Request& req,
Ed Tanous6c51eab2021-06-03 12:30:29 -07001268 const std::shared_ptr<
1269 bmcweb::AsyncResp>& asyncResp)
1270 -> void {
1271 const persistent_data::AuthConfigMethods& authMethodsConfig =
1272 persistent_data::SessionStore::getInstance()
1273 .getAuthMethodsConfig();
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001274
Ed Tanous6c51eab2021-06-03 12:30:29 -07001275 asyncResp->res.jsonValue = {
1276 {"@odata.id", "/redfish/v1/AccountService"},
1277 {"@odata.type", "#AccountService."
1278 "v1_5_0.AccountService"},
1279 {"Id", "AccountService"},
1280 {"Name", "Account Service"},
1281 {"Description", "Account Service"},
1282 {"ServiceEnabled", true},
1283 {"MaxPasswordLength", 20},
1284 {"Accounts",
1285 {{"@odata.id", "/redfish/v1/AccountService/Accounts"}}},
1286 {"Roles", {{"@odata.id", "/redfish/v1/AccountService/Roles"}}},
1287 {"Oem",
1288 {{"OpenBMC",
1289 {{"@odata.type", "#OemAccountService.v1_0_0.AccountService"},
1290 {"AuthMethods",
1291 {
1292 {"BasicAuth", authMethodsConfig.basic},
1293 {"SessionToken", authMethodsConfig.sessionToken},
1294 {"XToken", authMethodsConfig.xtoken},
1295 {"Cookie", authMethodsConfig.cookie},
1296 {"TLS", authMethodsConfig.tls},
Abhishek Patel72048782021-06-02 09:53:24 -05001297 }}}}}}};
1298 // /redfish/v1/AccountService/LDAP/Certificates is something only
1299 // ConfigureManager can access then only display when the user has
1300 // permissions ConfigureManager
1301 Privileges effectiveUserPrivileges =
1302 redfish::getUserPrivileges(req.userRole);
1303
1304 if (isOperationAllowedWithPrivileges({{"ConfigureManager"}},
1305 effectiveUserPrivileges))
1306 {
1307 asyncResp->res.jsonValue["LDAP"] = {
1308 {"Certificates",
1309 {{"@odata.id",
1310 "/redfish/v1/AccountService/LDAP/Certificates"}}}};
1311 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001312 crow::connections::systemBus->async_method_call(
1313 [asyncResp](
1314 const boost::system::error_code ec,
1315 const std::vector<
1316 std::pair<std::string,
1317 std::variant<uint32_t, uint16_t, uint8_t>>>&
1318 propertiesList) {
1319 if (ec)
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001320 {
1321 messages::internalError(asyncResp->res);
1322 return;
1323 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001324 BMCWEB_LOG_DEBUG << "Got " << propertiesList.size()
1325 << "properties for AccountService";
1326 for (const std::pair<std::string,
1327 std::variant<uint32_t, uint16_t,
1328 uint8_t>>& property :
1329 propertiesList)
1330 {
1331 if (property.first == "MinPasswordLength")
1332 {
1333 const uint8_t* value =
1334 std::get_if<uint8_t>(&property.second);
1335 if (value != nullptr)
Ratan Gupta24c85422019-01-30 19:41:24 +05301336 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001337 asyncResp->res.jsonValue["MinPasswordLength"] =
1338 *value;
Ratan Gupta24c85422019-01-30 19:41:24 +05301339 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001340 }
1341 if (property.first == "AccountUnlockTimeout")
1342 {
1343 const uint32_t* value =
1344 std::get_if<uint32_t>(&property.second);
1345 if (value != nullptr)
1346 {
1347 asyncResp->res
1348 .jsonValue["AccountLockoutDuration"] =
1349 *value;
1350 }
1351 }
1352 if (property.first == "MaxLoginAttemptBeforeLockout")
1353 {
1354 const uint16_t* value =
1355 std::get_if<uint16_t>(&property.second);
1356 if (value != nullptr)
1357 {
1358 asyncResp->res
1359 .jsonValue["AccountLockoutThreshold"] =
1360 *value;
1361 }
1362 }
1363 }
1364 },
1365 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1366 "org.freedesktop.DBus.Properties", "GetAll",
1367 "xyz.openbmc_project.User.AccountPolicy");
1368
1369 auto callback = [asyncResp](bool success, LDAPConfigData& confData,
1370 const std::string& ldapType) {
1371 if (!success)
1372 {
1373 return;
1374 }
1375 parseLDAPConfigData(asyncResp->res.jsonValue, confData,
1376 ldapType);
1377 };
1378
1379 getLDAPConfigData("LDAP", callback);
1380 getLDAPConfigData("ActiveDirectory", callback);
1381 });
1382
1383 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
Ed Tanoused398212021-06-09 17:05:54 -07001384 .privileges(redfish::privileges::getManagerAccountCollection)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001385 .methods(boost::beast::http::verb::get)(
1386 [](const crow::Request& req,
1387 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) -> void {
1388 asyncResp->res.jsonValue = {
1389 {"@odata.id", "/redfish/v1/AccountService/Accounts"},
1390 {"@odata.type", "#ManagerAccountCollection."
1391 "ManagerAccountCollection"},
1392 {"Name", "Accounts Collection"},
1393 {"Description", "BMC User Accounts"}};
1394
Ed Tanous6c51eab2021-06-03 12:30:29 -07001395 Privileges effectiveUserPrivileges =
1396 redfish::getUserPrivileges(req.userRole);
Ed Tanous6c51eab2021-06-03 12:30:29 -07001397
1398 std::string thisUser = req.session->username;
1399
1400 crow::connections::systemBus->async_method_call(
Ed Tanouscef1ddf2021-06-03 13:45:10 -07001401 [asyncResp, thisUser, effectiveUserPrivileges](
1402 const boost::system::error_code ec,
1403 const ManagedObjectType& users) {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001404 if (ec)
1405 {
1406 messages::internalError(asyncResp->res);
Ratan Gupta24c85422019-01-30 19:41:24 +05301407 return;
Ed Tanous6c51eab2021-06-03 12:30:29 -07001408 }
Ed Tanous9712f8a2018-09-21 13:38:49 -07001409
Ed Tanouscef1ddf2021-06-03 13:45:10 -07001410 bool userCanSeeAllAccounts =
1411 effectiveUserPrivileges.isSupersetOf(
Ed Tanous4f48d5f2021-06-21 08:27:45 -07001412 {"ConfigureUsers"});
Ed Tanouscef1ddf2021-06-03 13:45:10 -07001413
1414 bool userCanSeeSelf =
1415 effectiveUserPrivileges.isSupersetOf(
Ed Tanous4f48d5f2021-06-21 08:27:45 -07001416 {"ConfigureSelf"});
Ed Tanouscef1ddf2021-06-03 13:45:10 -07001417
Ed Tanous6c51eab2021-06-03 12:30:29 -07001418 nlohmann::json& memberArray =
1419 asyncResp->res.jsonValue["Members"];
1420 memberArray = nlohmann::json::array();
Ratan Gupta24c85422019-01-30 19:41:24 +05301421
Ed Tanous6c51eab2021-06-03 12:30:29 -07001422 for (auto& userpath : users)
1423 {
1424 std::string user = userpath.first.filename();
1425 if (user.empty())
Ratan Gupta24c85422019-01-30 19:41:24 +05301426 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301427 messages::internalError(asyncResp->res);
Ed Tanous6c51eab2021-06-03 12:30:29 -07001428 BMCWEB_LOG_ERROR << "Invalid firmware ID";
1429
Ratan Gupta24c85422019-01-30 19:41:24 +05301430 return;
1431 }
Ratan Gupta24c85422019-01-30 19:41:24 +05301432
Ed Tanous6c51eab2021-06-03 12:30:29 -07001433 // As clarified by Redfish here:
1434 // https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration
1435 // Users without ConfigureUsers, only see their own
1436 // account. Users with ConfigureUsers, see all
1437 // accounts.
Ed Tanouscef1ddf2021-06-03 13:45:10 -07001438 if (userCanSeeAllAccounts ||
1439 (thisUser == user && userCanSeeSelf))
Ratan Gupta24c85422019-01-30 19:41:24 +05301440 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001441 memberArray.push_back(
1442 {{"@odata.id",
1443 "/redfish/v1/AccountService/Accounts/" +
1444 user}});
Ratan Gupta24c85422019-01-30 19:41:24 +05301445 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001446 }
1447 asyncResp->res.jsonValue["Members@odata.count"] =
1448 memberArray.size();
1449 },
1450 "xyz.openbmc_project.User.Manager",
1451 "/xyz/openbmc_project/user",
1452 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
Ratan Gupta24c85422019-01-30 19:41:24 +05301453 });
Ed Tanous06e086d2018-09-19 17:19:52 -07001454
Ed Tanous6c51eab2021-06-03 12:30:29 -07001455 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
Ed Tanoused398212021-06-09 17:05:54 -07001456 .privileges(redfish::privileges::postManagerAccountCollection)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001457 .methods(boost::beast::http::verb::post)([](const crow::Request& req,
1458 const std::shared_ptr<
1459 bmcweb::AsyncResp>&
1460 asyncResp) -> void {
1461 std::string username;
1462 std::string password;
1463 std::optional<std::string> roleId("User");
1464 std::optional<bool> enabled = true;
1465 if (!json_util::readJson(req, asyncResp->res, "UserName", username,
1466 "Password", password, "RoleId", roleId,
1467 "Enabled", enabled))
1468 {
1469 return;
1470 }
Ed Tanous06e086d2018-09-19 17:19:52 -07001471
Ed Tanous6c51eab2021-06-03 12:30:29 -07001472 std::string priv = getPrivilegeFromRoleId(*roleId);
1473 if (priv.empty())
1474 {
1475 messages::propertyValueNotInList(asyncResp->res, *roleId,
1476 "RoleId");
1477 return;
1478 }
1479 // TODO: Following override will be reverted once support in
1480 // phosphor-user-manager is added. In order to avoid dependency
1481 // issues, this is added in bmcweb, which will removed, once
1482 // phosphor-user-manager supports priv-noaccess.
1483 if (priv == "priv-noaccess")
1484 {
1485 roleId = "";
1486 }
1487 else
1488 {
1489 roleId = priv;
1490 }
Ed Tanous06e086d2018-09-19 17:19:52 -07001491
Ed Tanous6c51eab2021-06-03 12:30:29 -07001492 // Reading AllGroups property
1493 crow::connections::systemBus->async_method_call(
1494 [asyncResp, username, password{std::move(password)}, roleId,
1495 enabled](
1496 const boost::system::error_code ec,
1497 const std::variant<std::vector<std::string>>& allGroups) {
1498 if (ec)
1499 {
1500 BMCWEB_LOG_DEBUG << "ERROR with async_method_call";
1501 messages::internalError(asyncResp->res);
1502 return;
1503 }
Ed Tanous06e086d2018-09-19 17:19:52 -07001504
Ed Tanous6c51eab2021-06-03 12:30:29 -07001505 const std::vector<std::string>* allGroupsList =
1506 std::get_if<std::vector<std::string>>(&allGroups);
1507
1508 if (allGroupsList == nullptr || allGroupsList->empty())
1509 {
1510 messages::internalError(asyncResp->res);
1511 return;
1512 }
1513
1514 crow::connections::systemBus->async_method_call(
1515 [asyncResp, username,
1516 password](const boost::system::error_code ec2,
1517 sdbusplus::message::message& m) {
1518 if (ec2)
1519 {
1520 userErrorMessageHandler(
1521 m.get_error(), asyncResp, username, "");
1522 return;
1523 }
1524
1525 if (pamUpdatePassword(username, password) !=
1526 PAM_SUCCESS)
1527 {
1528 // At this point we have a user that's been
1529 // created, but the password set
1530 // failed.Something is wrong, so delete the user
1531 // that we've already created
1532 crow::connections::systemBus->async_method_call(
1533 [asyncResp, password](
1534 const boost::system::error_code ec3) {
1535 if (ec3)
1536 {
1537 messages::internalError(
1538 asyncResp->res);
1539 return;
1540 }
1541
1542 // If password is invalid
1543 messages::propertyValueFormatError(
1544 asyncResp->res, password,
1545 "Password");
1546 },
1547 "xyz.openbmc_project.User.Manager",
1548 "/xyz/openbmc_project/user/" + username,
1549 "xyz.openbmc_project.Object.Delete",
1550 "Delete");
1551
1552 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1553 return;
1554 }
1555
1556 messages::created(asyncResp->res);
1557 asyncResp->res.addHeader(
1558 "Location",
1559 "/redfish/v1/AccountService/Accounts/" +
1560 username);
1561 },
1562 "xyz.openbmc_project.User.Manager",
1563 "/xyz/openbmc_project/user",
1564 "xyz.openbmc_project.User.Manager", "CreateUser",
1565 username, *allGroupsList, *roleId, *enabled);
1566 },
1567 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1568 "org.freedesktop.DBus.Properties", "Get",
1569 "xyz.openbmc_project.User.Manager", "AllGroups");
1570 });
1571
1572 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanoused398212021-06-09 17:05:54 -07001573 .privileges(redfish::privileges::getManagerAccount)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001574 .methods(
1575 boost::beast::http::verb::
1576 get)([](const crow::Request& req,
1577 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1578 const std::string& accountName) -> void {
1579 if (req.session->username != accountName)
1580 {
1581 // At this point we've determined that the user is trying to
1582 // modify a user that isn't them. We need to verify that they
1583 // have permissions to modify other users, so re-run the auth
1584 // check with the same permissions, minus ConfigureSelf.
1585 Privileges effectiveUserPrivileges =
1586 redfish::getUserPrivileges(req.userRole);
1587 Privileges requiredPermissionsToChangeNonSelf = {
Ed Tanous4f48d5f2021-06-21 08:27:45 -07001588 "ConfigureUsers", "ConfigureManager"};
Ed Tanous6c51eab2021-06-03 12:30:29 -07001589 if (!effectiveUserPrivileges.isSupersetOf(
1590 requiredPermissionsToChangeNonSelf))
Ed Tanous06e086d2018-09-19 17:19:52 -07001591 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001592 BMCWEB_LOG_DEBUG << "GET Account denied access";
1593 messages::insufficientPrivilege(asyncResp->res);
1594 return;
1595 }
1596 }
1597
1598 crow::connections::systemBus->async_method_call(
1599 [asyncResp, accountName](const boost::system::error_code ec,
1600 const ManagedObjectType& users) {
1601 if (ec)
1602 {
1603 messages::internalError(asyncResp->res);
1604 return;
1605 }
1606 auto userIt = users.begin();
1607
1608 for (; userIt != users.end(); userIt++)
1609 {
1610 if (boost::ends_with(userIt->first.str,
1611 "/" + accountName))
1612 {
1613 break;
1614 }
1615 }
1616 if (userIt == users.end())
1617 {
1618 messages::resourceNotFound(
1619 asyncResp->res, "ManagerAccount", accountName);
1620 return;
1621 }
1622
1623 asyncResp->res.jsonValue = {
1624 {"@odata.type",
1625 "#ManagerAccount.v1_4_0.ManagerAccount"},
1626 {"Name", "User Account"},
1627 {"Description", "User Account"},
1628 {"Password", nullptr},
1629 {"AccountTypes", {"Redfish"}}};
1630
1631 for (const auto& interface : userIt->second)
1632 {
1633 if (interface.first ==
1634 "xyz.openbmc_project.User.Attributes")
1635 {
1636 for (const auto& property : interface.second)
1637 {
1638 if (property.first == "UserEnabled")
1639 {
1640 const bool* userEnabled =
1641 std::get_if<bool>(&property.second);
1642 if (userEnabled == nullptr)
1643 {
1644 BMCWEB_LOG_ERROR
1645 << "UserEnabled wasn't a bool";
1646 messages::internalError(asyncResp->res);
1647 return;
1648 }
1649 asyncResp->res.jsonValue["Enabled"] =
1650 *userEnabled;
1651 }
1652 else if (property.first ==
1653 "UserLockedForFailedAttempt")
1654 {
1655 const bool* userLocked =
1656 std::get_if<bool>(&property.second);
1657 if (userLocked == nullptr)
1658 {
1659 BMCWEB_LOG_ERROR << "UserLockedForF"
1660 "ailedAttempt "
1661 "wasn't a bool";
1662 messages::internalError(asyncResp->res);
1663 return;
1664 }
1665 asyncResp->res.jsonValue["Locked"] =
1666 *userLocked;
1667 asyncResp->res.jsonValue
1668 ["Locked@Redfish.AllowableValues"] = {
1669 "false"}; // can only unlock accounts
1670 }
1671 else if (property.first == "UserPrivilege")
1672 {
1673 const std::string* userPrivPtr =
1674 std::get_if<std::string>(
1675 &property.second);
1676 if (userPrivPtr == nullptr)
1677 {
1678 BMCWEB_LOG_ERROR
1679 << "UserPrivilege wasn't a "
1680 "string";
1681 messages::internalError(asyncResp->res);
1682 return;
1683 }
1684 std::string role =
1685 getRoleIdFromPrivilege(*userPrivPtr);
1686 if (role.empty())
1687 {
1688 BMCWEB_LOG_ERROR << "Invalid user role";
1689 messages::internalError(asyncResp->res);
1690 return;
1691 }
1692 asyncResp->res.jsonValue["RoleId"] = role;
1693
1694 asyncResp->res.jsonValue["Links"]["Role"] =
1695 {{"@odata.id",
1696 "/redfish/v1/AccountService/"
1697 "Roles/" +
1698 role}};
1699 }
1700 else if (property.first ==
1701 "UserPasswordExpired")
1702 {
1703 const bool* userPasswordExpired =
1704 std::get_if<bool>(&property.second);
1705 if (userPasswordExpired == nullptr)
1706 {
1707 BMCWEB_LOG_ERROR << "UserPassword"
1708 "Expired "
1709 "wasn't a bool";
1710 messages::internalError(asyncResp->res);
1711 return;
1712 }
1713 asyncResp->res
1714 .jsonValue["PasswordChangeRequired"] =
1715 *userPasswordExpired;
1716 }
1717 }
1718 }
1719 }
1720
1721 asyncResp->res.jsonValue["@odata.id"] =
1722 "/redfish/v1/AccountService/Accounts/" + accountName;
1723 asyncResp->res.jsonValue["Id"] = accountName;
1724 asyncResp->res.jsonValue["UserName"] = accountName;
1725 },
1726 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1727 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
1728 });
1729
1730 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanoused398212021-06-09 17:05:54 -07001731 // TODO this privilege should be using the generated endpoints, but
1732 // because of the special handling of ConfigureSelf, it's not able to
1733 // yet
Ed Tanous6c51eab2021-06-03 12:30:29 -07001734 .privileges({{"ConfigureUsers"}, {"ConfigureSelf"}})
1735 .methods(boost::beast::http::verb::patch)(
1736 [](const crow::Request& req,
1737 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1738 const std::string& username) -> void {
1739 std::optional<std::string> newUserName;
1740 std::optional<std::string> password;
1741 std::optional<bool> enabled;
1742 std::optional<std::string> roleId;
1743 std::optional<bool> locked;
1744 if (!json_util::readJson(req, asyncResp->res, "UserName",
1745 newUserName, "Password", password,
1746 "RoleId", roleId, "Enabled", enabled,
1747 "Locked", locked))
1748 {
Ed Tanous06e086d2018-09-19 17:19:52 -07001749 return;
1750 }
1751
Ed Tanous6c51eab2021-06-03 12:30:29 -07001752 // Perform a proper ConfigureSelf authority check. If the
1753 // session is being used to PATCH a property other than
1754 // Password, then the ConfigureSelf privilege does not apply.
1755 // If the user is operating on an account not their own, then
1756 // their ConfigureSelf privilege does not apply. In either
1757 // case, perform the authority check again without the user's
1758 // ConfigureSelf privilege.
1759 if ((username != req.session->username))
1760 {
1761 Privileges requiredPermissionsToChangeNonSelf = {
Ed Tanous4f48d5f2021-06-21 08:27:45 -07001762 "ConfigureUsers"};
Ed Tanous6c51eab2021-06-03 12:30:29 -07001763 Privileges effectiveUserPrivileges =
1764 redfish::getUserPrivileges(req.userRole);
1765
1766 if (!effectiveUserPrivileges.isSupersetOf(
1767 requiredPermissionsToChangeNonSelf))
1768 {
1769 messages::insufficientPrivilege(asyncResp->res);
1770 return;
1771 }
1772 }
1773
1774 // if user name is not provided in the patch method or if it
1775 // matches the user name in the URI, then we are treating it as
1776 // updating user properties other then username. If username
1777 // provided doesn't match the URI, then we are treating this as
1778 // user rename request.
1779 if (!newUserName || (newUserName.value() == username))
1780 {
1781 updateUserProperties(asyncResp, username, password, enabled,
1782 roleId, locked);
1783 return;
1784 }
1785 crow::connections::systemBus->async_method_call(
1786 [asyncResp, username, password(std::move(password)),
1787 roleId(std::move(roleId)), enabled,
1788 newUser{std::string(*newUserName)},
1789 locked](const boost::system::error_code ec,
1790 sdbusplus::message::message& m) {
1791 if (ec)
1792 {
1793 userErrorMessageHandler(m.get_error(), asyncResp,
1794 newUser, username);
1795 return;
1796 }
1797
1798 updateUserProperties(asyncResp, newUser, password,
1799 enabled, roleId, locked);
1800 },
1801 "xyz.openbmc_project.User.Manager",
1802 "/xyz/openbmc_project/user",
1803 "xyz.openbmc_project.User.Manager", "RenameUser", username,
1804 *newUserName);
1805 });
1806
1807 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanoused398212021-06-09 17:05:54 -07001808 .privileges(redfish::privileges::deleteManagerAccount)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001809 .methods(boost::beast::http::verb::delete_)(
1810 [](const crow::Request& /*req*/,
1811 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1812 const std::string& username) -> void {
1813 const std::string userPath =
1814 "/xyz/openbmc_project/user/" + username;
1815
1816 crow::connections::systemBus->async_method_call(
1817 [asyncResp, username](const boost::system::error_code ec) {
1818 if (ec)
1819 {
1820 messages::resourceNotFound(
1821 asyncResp->res,
1822 "#ManagerAccount.v1_4_0.ManagerAccount",
1823 username);
1824 return;
1825 }
1826
1827 messages::accountRemoved(asyncResp->res);
1828 },
1829 "xyz.openbmc_project.User.Manager", userPath,
1830 "xyz.openbmc_project.Object.Delete", "Delete");
1831 });
1832}
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001833
Ed Tanous1abe55e2018-09-05 08:30:59 -07001834} // namespace redfish