blob: 0cf24ea35de201c1fe93da7696769e899759e99a [file] [log] [blame]
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001/*
2// Copyright (c) 2018 Intel Corporation
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8// http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15*/
16#pragma once
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010017#include "node.hpp"
18
Ratan Gupta24c85422019-01-30 19:41:24 +053019#include <dbus_utility.hpp>
Ed Tanous65b0dc32018-09-19 16:04:03 -070020#include <error_messages.hpp>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070021#include <openbmc_dbus_rest.hpp>
Ed Tanous52cc1122020-07-18 13:51:21 -070022#include <persistent_data.hpp>
Ed Tanousa8408792018-09-05 16:08:38 -070023#include <utils/json_utils.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050024
Ed Tanousabf2add2019-01-22 16:40:12 -080025#include <variant>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070026
Ed Tanous1abe55e2018-09-05 08:30:59 -070027namespace redfish
28{
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010029
Ed Tanous23a21a12020-07-25 04:45:05 +000030constexpr const char* ldapConfigObjectName =
Ratan Gupta6973a582018-12-13 18:25:44 +053031 "/xyz/openbmc_project/user/ldap/openldap";
Ed Tanous2c70f802020-09-28 14:29:23 -070032constexpr const char* adConfigObject =
Ratan Guptaab828d72019-04-22 14:18:33 +053033 "/xyz/openbmc_project/user/ldap/active_directory";
34
Ratan Gupta6973a582018-12-13 18:25:44 +053035constexpr const char* ldapRootObject = "/xyz/openbmc_project/user/ldap";
36constexpr const char* ldapDbusService = "xyz.openbmc_project.Ldap.Config";
37constexpr const char* ldapConfigInterface =
38 "xyz.openbmc_project.User.Ldap.Config";
39constexpr const char* ldapCreateInterface =
40 "xyz.openbmc_project.User.Ldap.Create";
41constexpr const char* ldapEnableInterface = "xyz.openbmc_project.Object.Enable";
Ratan Gupta06785242019-07-26 22:30:16 +053042constexpr const char* ldapPrivMapperInterface =
43 "xyz.openbmc_project.User.PrivilegeMapper";
Ratan Gupta6973a582018-12-13 18:25:44 +053044constexpr const char* dbusObjManagerIntf = "org.freedesktop.DBus.ObjectManager";
45constexpr const char* propertyInterface = "org.freedesktop.DBus.Properties";
46constexpr const char* mapperBusName = "xyz.openbmc_project.ObjectMapper";
47constexpr const char* mapperObjectPath = "/xyz/openbmc_project/object_mapper";
48constexpr const char* mapperIntf = "xyz.openbmc_project.ObjectMapper";
49
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060050struct LDAPRoleMapData
51{
52 std::string groupName;
53 std::string privilege;
54};
55
Ratan Gupta6973a582018-12-13 18:25:44 +053056struct LDAPConfigData
57{
58 std::string uri{};
59 std::string bindDN{};
60 std::string baseDN{};
61 std::string searchScope{};
62 std::string serverType{};
63 bool serviceEnabled = false;
64 std::string userNameAttribute{};
65 std::string groupAttribute{};
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060066 std::vector<std::pair<std::string, LDAPRoleMapData>> groupRoleList;
Ratan Gupta6973a582018-12-13 18:25:44 +053067};
68
Patrick Williams19bd78d2020-05-13 17:38:24 -050069using DbusVariantType = std::variant<bool, int32_t, std::string>;
Przemyslaw Czarnowski107077d2019-07-11 10:16:43 +020070
71using DbusInterfaceType = boost::container::flat_map<
72 std::string, boost::container::flat_map<std::string, DbusVariantType>>;
73
74using ManagedObjectType =
75 std::vector<std::pair<sdbusplus::message::object_path, DbusInterfaceType>>;
76
Ratan Gupta6973a582018-12-13 18:25:44 +053077using GetObjectType =
78 std::vector<std::pair<std::string, std::vector<std::string>>>;
AppaRao Puli84e12cb2018-10-11 01:28:15 +053079
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060080inline std::string getRoleIdFromPrivilege(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053081{
82 if (role == "priv-admin")
83 {
84 return "Administrator";
85 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070086 if (role == "priv-user")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053087 {
AppaRao Pulic80fee52019-10-16 14:49:36 +053088 return "ReadOnly";
AppaRao Puli84e12cb2018-10-11 01:28:15 +053089 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070090 if (role == "priv-operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053091 {
92 return "Operator";
93 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070094 if ((role == "") || (role == "priv-noaccess"))
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +000095 {
96 return "NoAccess";
97 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +053098 return "";
99}
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600100inline std::string getPrivilegeFromRoleId(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530101{
102 if (role == "Administrator")
103 {
104 return "priv-admin";
105 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700106 if (role == "ReadOnly")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530107 {
108 return "priv-user";
109 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700110 if (role == "Operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530111 {
112 return "priv-operator";
113 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700114 if ((role == "NoAccess") || (role == ""))
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +0000115 {
116 return "priv-noaccess";
117 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530118 return "";
119}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -0700120
Ed Tanous23a21a12020-07-25 04:45:05 +0000121inline void userErrorMessageHandler(const sd_bus_error* e,
Ed Tanousb5a76932020-09-29 16:16:58 -0700122 const std::shared_ptr<AsyncResp>& asyncResp,
Ed Tanous23a21a12020-07-25 04:45:05 +0000123 const std::string& newUser,
124 const std::string& username)
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000125{
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000126 if (e == nullptr)
127 {
128 messages::internalError(asyncResp->res);
129 return;
130 }
131
Manojkiran Eda055806b2020-11-03 09:36:28 +0530132 const char* errorMessage = e->name;
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000133 if (strcmp(errorMessage,
134 "xyz.openbmc_project.User.Common.Error.UserNameExists") == 0)
135 {
136 messages::resourceAlreadyExists(asyncResp->res,
Gunnar Mills8114bd42020-06-11 20:55:21 -0500137 "#ManagerAccount.v1_4_0.ManagerAccount",
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000138 "UserName", newUser);
139 }
140 else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
141 "UserNameDoesNotExist") == 0)
142 {
143 messages::resourceNotFound(
Gunnar Mills8114bd42020-06-11 20:55:21 -0500144 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount", username);
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000145 }
Ed Tanousd4d25792020-09-29 15:15:03 -0700146 else if ((strcmp(errorMessage,
147 "xyz.openbmc_project.Common.Error.InvalidArgument") ==
148 0) ||
149 (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
150 "UserNameGroupFail") == 0))
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000151 {
152 messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
153 }
154 else if (strcmp(errorMessage,
155 "xyz.openbmc_project.User.Common.Error.NoResource") == 0)
156 {
157 messages::createLimitReachedForResource(asyncResp->res);
158 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000159 else
160 {
161 messages::internalError(asyncResp->res);
162 }
163
164 return;
165}
166
Ed Tanous81ce6092020-12-17 16:54:55 +0000167inline void parseLDAPConfigData(nlohmann::json& jsonResponse,
Ed Tanous23a21a12020-07-25 04:45:05 +0000168 const LDAPConfigData& confData,
169 const std::string& ldapType)
Ratan Gupta6973a582018-12-13 18:25:44 +0530170{
Ratan Guptaab828d72019-04-22 14:18:33 +0530171 std::string service =
172 (ldapType == "LDAP") ? "LDAPService" : "ActiveDirectoryService";
Marri Devender Rao37cce912019-02-20 01:05:22 -0600173 nlohmann::json ldap = {
Ratan Gupta6973a582018-12-13 18:25:44 +0530174 {"ServiceEnabled", confData.serviceEnabled},
175 {"ServiceAddresses", nlohmann::json::array({confData.uri})},
176 {"Authentication",
177 {{"AuthenticationType", "UsernameAndPassword"},
Ratan Gupta6973a582018-12-13 18:25:44 +0530178 {"Username", confData.bindDN},
179 {"Password", nullptr}}},
180 {"LDAPService",
181 {{"SearchSettings",
182 {{"BaseDistinguishedNames",
183 nlohmann::json::array({confData.baseDN})},
184 {"UsernameAttribute", confData.userNameAttribute},
185 {"GroupsAttribute", confData.groupAttribute}}}}},
186 };
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600187
Ed Tanous81ce6092020-12-17 16:54:55 +0000188 jsonResponse[ldapType].update(ldap);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600189
Ed Tanous81ce6092020-12-17 16:54:55 +0000190 nlohmann::json& roleMapArray = jsonResponse[ldapType]["RemoteRoleMapping"];
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600191 roleMapArray = nlohmann::json::array();
192 for (auto& obj : confData.groupRoleList)
193 {
194 BMCWEB_LOG_DEBUG << "Pushing the data groupName="
195 << obj.second.groupName << "\n";
196 roleMapArray.push_back(
197 {nlohmann::json::array({"RemoteGroup", obj.second.groupName}),
198 nlohmann::json::array(
199 {"LocalRole", getRoleIdFromPrivilege(obj.second.privilege)})});
200 }
Ratan Gupta6973a582018-12-13 18:25:44 +0530201}
202
203/**
Ratan Gupta06785242019-07-26 22:30:16 +0530204 * @brief validates given JSON input and then calls appropriate method to
205 * create, to delete or to set Rolemapping object based on the given input.
206 *
207 */
Ed Tanous23a21a12020-07-25 04:45:05 +0000208inline void handleRoleMapPatch(
Ratan Gupta06785242019-07-26 22:30:16 +0530209 const std::shared_ptr<AsyncResp>& asyncResp,
210 const std::vector<std::pair<std::string, LDAPRoleMapData>>& roleMapObjData,
Ed Tanousf23b7292020-10-15 09:41:17 -0700211 const std::string& serverType, const std::vector<nlohmann::json>& input)
Ratan Gupta06785242019-07-26 22:30:16 +0530212{
213 for (size_t index = 0; index < input.size(); index++)
214 {
Ed Tanousf23b7292020-10-15 09:41:17 -0700215 const nlohmann::json& thisJson = input[index];
Ratan Gupta06785242019-07-26 22:30:16 +0530216
217 if (thisJson.is_null())
218 {
219 // delete the existing object
220 if (index < roleMapObjData.size())
221 {
222 crow::connections::systemBus->async_method_call(
223 [asyncResp, roleMapObjData, serverType,
224 index](const boost::system::error_code ec) {
225 if (ec)
226 {
227 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
228 messages::internalError(asyncResp->res);
229 return;
230 }
231 asyncResp->res
232 .jsonValue[serverType]["RemoteRoleMapping"][index] =
233 nullptr;
234 },
235 ldapDbusService, roleMapObjData[index].first,
236 "xyz.openbmc_project.Object.Delete", "Delete");
237 }
238 else
239 {
240 BMCWEB_LOG_ERROR << "Can't delete the object";
241 messages::propertyValueTypeError(
242 asyncResp->res, thisJson.dump(),
243 "RemoteRoleMapping/" + std::to_string(index));
244 return;
245 }
246 }
247 else if (thisJson.empty())
248 {
249 // Don't do anything for the empty objects,parse next json
250 // eg {"RemoteRoleMapping",[{}]}
251 }
252 else
253 {
254 // update/create the object
255 std::optional<std::string> remoteGroup;
256 std::optional<std::string> localRole;
257
Ed Tanousf23b7292020-10-15 09:41:17 -0700258 // This is a copy, but it's required in this case because of how
259 // readJson is structured
260 nlohmann::json thisJsonCopy = thisJson;
261 if (!json_util::readJson(thisJsonCopy, asyncResp->res,
262 "RemoteGroup", remoteGroup, "LocalRole",
263 localRole))
Ratan Gupta06785242019-07-26 22:30:16 +0530264 {
265 continue;
266 }
267
268 // Update existing RoleMapping Object
269 if (index < roleMapObjData.size())
270 {
271 BMCWEB_LOG_DEBUG << "Update Role Map Object";
272 // If "RemoteGroup" info is provided
273 if (remoteGroup)
274 {
275 crow::connections::systemBus->async_method_call(
276 [asyncResp, roleMapObjData, serverType, index,
277 remoteGroup](const boost::system::error_code ec) {
278 if (ec)
279 {
280 BMCWEB_LOG_ERROR << "DBUS response error: "
281 << ec;
282 messages::internalError(asyncResp->res);
283 return;
284 }
285 asyncResp->res
286 .jsonValue[serverType]["RemoteRoleMapping"]
287 [index]["RemoteGroup"] = *remoteGroup;
288 },
289 ldapDbusService, roleMapObjData[index].first,
290 propertyInterface, "Set",
291 "xyz.openbmc_project.User.PrivilegeMapperEntry",
292 "GroupName",
293 std::variant<std::string>(std::move(*remoteGroup)));
294 }
295
296 // If "LocalRole" info is provided
297 if (localRole)
298 {
299 crow::connections::systemBus->async_method_call(
300 [asyncResp, roleMapObjData, serverType, index,
301 localRole](const boost::system::error_code ec) {
302 if (ec)
303 {
304 BMCWEB_LOG_ERROR << "DBUS response error: "
305 << ec;
306 messages::internalError(asyncResp->res);
307 return;
308 }
309 asyncResp->res
310 .jsonValue[serverType]["RemoteRoleMapping"]
311 [index]["LocalRole"] = *localRole;
312 },
313 ldapDbusService, roleMapObjData[index].first,
314 propertyInterface, "Set",
315 "xyz.openbmc_project.User.PrivilegeMapperEntry",
316 "Privilege",
317 std::variant<std::string>(
318 getPrivilegeFromRoleId(std::move(*localRole))));
319 }
320 }
321 // Create a new RoleMapping Object.
322 else
323 {
324 BMCWEB_LOG_DEBUG
325 << "setRoleMappingProperties: Creating new Object";
326 std::string pathString =
327 "RemoteRoleMapping/" + std::to_string(index);
328
329 if (!localRole)
330 {
331 messages::propertyMissing(asyncResp->res,
332 pathString + "/LocalRole");
333 continue;
334 }
335 if (!remoteGroup)
336 {
337 messages::propertyMissing(asyncResp->res,
338 pathString + "/RemoteGroup");
339 continue;
340 }
341
342 std::string dbusObjectPath;
343 if (serverType == "ActiveDirectory")
344 {
Ed Tanous2c70f802020-09-28 14:29:23 -0700345 dbusObjectPath = adConfigObject;
Ratan Gupta06785242019-07-26 22:30:16 +0530346 }
347 else if (serverType == "LDAP")
348 {
Ed Tanous23a21a12020-07-25 04:45:05 +0000349 dbusObjectPath = ldapConfigObjectName;
Ratan Gupta06785242019-07-26 22:30:16 +0530350 }
351
352 BMCWEB_LOG_DEBUG << "Remote Group=" << *remoteGroup
353 << ",LocalRole=" << *localRole;
354
355 crow::connections::systemBus->async_method_call(
Ed Tanous271584a2019-07-09 16:24:22 -0700356 [asyncResp, serverType, localRole,
Ratan Gupta06785242019-07-26 22:30:16 +0530357 remoteGroup](const boost::system::error_code ec) {
358 if (ec)
359 {
360 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
361 messages::internalError(asyncResp->res);
362 return;
363 }
364 nlohmann::json& remoteRoleJson =
365 asyncResp->res
366 .jsonValue[serverType]["RemoteRoleMapping"];
367 remoteRoleJson.push_back(
368 {{"LocalRole", *localRole},
369 {"RemoteGroup", *remoteGroup}});
370 },
371 ldapDbusService, dbusObjectPath, ldapPrivMapperInterface,
Ed Tanous3174e4d2020-10-07 11:41:22 -0700372 "Create", *remoteGroup,
Ratan Gupta06785242019-07-26 22:30:16 +0530373 getPrivilegeFromRoleId(std::move(*localRole)));
374 }
375 }
376 }
377}
378
379/**
Ratan Gupta6973a582018-12-13 18:25:44 +0530380 * Function that retrieves all properties for LDAP config object
381 * into JSON
382 */
383template <typename CallbackFunc>
384inline void getLDAPConfigData(const std::string& ldapType,
385 CallbackFunc&& callback)
386{
Ratan Guptaab828d72019-04-22 14:18:33 +0530387
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600388 const std::array<const char*, 2> interfaces = {ldapEnableInterface,
Ratan Gupta6973a582018-12-13 18:25:44 +0530389 ldapConfigInterface};
390
391 crow::connections::systemBus->async_method_call(
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600392 [callback, ldapType](const boost::system::error_code ec,
393 const GetObjectType& resp) {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600394 if (ec || resp.empty())
395 {
396 BMCWEB_LOG_ERROR << "DBUS response error during getting of "
397 "service name: "
398 << ec;
Ed Tanous23a21a12020-07-25 04:45:05 +0000399 LDAPConfigData empty{};
400 callback(false, empty, ldapType);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600401 return;
402 }
403 std::string service = resp.begin()->first;
404 crow::connections::systemBus->async_method_call(
Ed Tanous81ce6092020-12-17 16:54:55 +0000405 [callback, ldapType](const boost::system::error_code errorCode,
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600406 const ManagedObjectType& ldapObjects) {
407 LDAPConfigData confData{};
Ed Tanous81ce6092020-12-17 16:54:55 +0000408 if (errorCode)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600409 {
410 callback(false, confData, ldapType);
411 BMCWEB_LOG_ERROR << "D-Bus responses error: "
Ed Tanous81ce6092020-12-17 16:54:55 +0000412 << errorCode;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600413 return;
414 }
415
416 std::string ldapDbusType;
417 std::string searchString;
418
419 if (ldapType == "LDAP")
420 {
421 ldapDbusType = "xyz.openbmc_project.User.Ldap.Config."
422 "Type.OpenLdap";
423 searchString = "openldap";
424 }
425 else if (ldapType == "ActiveDirectory")
426 {
427 ldapDbusType =
428 "xyz.openbmc_project.User.Ldap.Config.Type."
429 "ActiveDirectory";
430 searchString = "active_directory";
431 }
432 else
433 {
434 BMCWEB_LOG_ERROR
435 << "Can't get the DbusType for the given type="
436 << ldapType;
437 callback(false, confData, ldapType);
438 return;
439 }
440
441 std::string ldapEnableInterfaceStr = ldapEnableInterface;
442 std::string ldapConfigInterfaceStr = ldapConfigInterface;
443
444 for (const auto& object : ldapObjects)
445 {
446 // let's find the object whose ldap type is equal to the
447 // given type
448 if (object.first.str.find(searchString) ==
449 std::string::npos)
450 {
451 continue;
452 }
453
454 for (const auto& interface : object.second)
455 {
456 if (interface.first == ldapEnableInterfaceStr)
457 {
458 // rest of the properties are string.
459 for (const auto& property : interface.second)
460 {
461 if (property.first == "Enabled")
462 {
463 const bool* value =
464 std::get_if<bool>(&property.second);
465 if (value == nullptr)
466 {
467 continue;
468 }
469 confData.serviceEnabled = *value;
470 break;
471 }
472 }
473 }
474 else if (interface.first == ldapConfigInterfaceStr)
475 {
476
477 for (const auto& property : interface.second)
478 {
Ed Tanous271584a2019-07-09 16:24:22 -0700479 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600480 std::get_if<std::string>(
481 &property.second);
Ed Tanous271584a2019-07-09 16:24:22 -0700482 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600483 {
484 continue;
485 }
486 if (property.first == "LDAPServerURI")
487 {
Ed Tanous271584a2019-07-09 16:24:22 -0700488 confData.uri = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600489 }
490 else if (property.first == "LDAPBindDN")
491 {
Ed Tanous271584a2019-07-09 16:24:22 -0700492 confData.bindDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600493 }
494 else if (property.first == "LDAPBaseDN")
495 {
Ed Tanous271584a2019-07-09 16:24:22 -0700496 confData.baseDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600497 }
498 else if (property.first ==
499 "LDAPSearchScope")
500 {
Ed Tanous271584a2019-07-09 16:24:22 -0700501 confData.searchScope = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600502 }
503 else if (property.first ==
504 "GroupNameAttribute")
505 {
Ed Tanous271584a2019-07-09 16:24:22 -0700506 confData.groupAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600507 }
508 else if (property.first ==
509 "UserNameAttribute")
510 {
Ed Tanous271584a2019-07-09 16:24:22 -0700511 confData.userNameAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600512 }
513 else if (property.first == "LDAPType")
514 {
Ed Tanous271584a2019-07-09 16:24:22 -0700515 confData.serverType = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600516 }
517 }
518 }
519 else if (interface.first ==
520 "xyz.openbmc_project.User."
521 "PrivilegeMapperEntry")
522 {
523 LDAPRoleMapData roleMapData{};
524 for (const auto& property : interface.second)
525 {
Ed Tanous271584a2019-07-09 16:24:22 -0700526 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600527 std::get_if<std::string>(
528 &property.second);
529
Ed Tanous271584a2019-07-09 16:24:22 -0700530 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600531 {
532 continue;
533 }
534
535 if (property.first == "GroupName")
536 {
Ed Tanous271584a2019-07-09 16:24:22 -0700537 roleMapData.groupName = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600538 }
539 else if (property.first == "Privilege")
540 {
Ed Tanous271584a2019-07-09 16:24:22 -0700541 roleMapData.privilege = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600542 }
543 }
544
Ed Tanous0f0353b2019-10-24 11:37:51 -0700545 confData.groupRoleList.emplace_back(
546 object.first.str, roleMapData);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600547 }
548 }
549 }
550 callback(true, confData, ldapType);
551 },
552 service, ldapRootObject, dbusObjManagerIntf,
553 "GetManagedObjects");
554 },
555 mapperBusName, mapperObjectPath, mapperIntf, "GetObject",
Ed Tanous23a21a12020-07-25 04:45:05 +0000556 ldapConfigObjectName, interfaces);
Ratan Gupta6973a582018-12-13 18:25:44 +0530557}
558
Ed Tanous1abe55e2018-09-05 08:30:59 -0700559class AccountService : public Node
560{
561 public:
Ed Tanous23a21a12020-07-25 04:45:05 +0000562 AccountService(App& app) : Node(app, "/redfish/v1/AccountService/")
Ed Tanous1abe55e2018-09-05 08:30:59 -0700563 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700564 entityPrivileges = {
Gunnar Mills3c5a3762020-01-29 15:21:30 -0600565 {boost::beast::http::verb::get, {{"Login"}}},
Ed Tanous1abe55e2018-09-05 08:30:59 -0700566 {boost::beast::http::verb::head, {{"Login"}}},
567 {boost::beast::http::verb::patch, {{"ConfigureUsers"}}},
568 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
569 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
570 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
571 }
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +0100572
Ed Tanous1abe55e2018-09-05 08:30:59 -0700573 private:
Ratan Gupta8a07d282019-03-16 08:33:47 +0530574 /**
575 * @brief parses the authentication section under the LDAP
576 * @param input JSON data
577 * @param asyncResp pointer to the JSON response
578 * @param userName userName to be filled from the given JSON.
579 * @param password password to be filled from the given JSON.
580 */
581 void
582 parseLDAPAuthenticationJson(nlohmann::json input,
583 const std::shared_ptr<AsyncResp>& asyncResp,
584 std::optional<std::string>& username,
585 std::optional<std::string>& password)
586 {
587 std::optional<std::string> authType;
588
589 if (!json_util::readJson(input, asyncResp->res, "AuthenticationType",
590 authType, "Username", username, "Password",
591 password))
592 {
593 return;
594 }
595 if (!authType)
596 {
597 return;
598 }
599 if (*authType != "UsernameAndPassword")
600 {
601 messages::propertyValueNotInList(asyncResp->res, *authType,
602 "AuthenticationType");
603 return;
604 }
605 }
606 /**
607 * @brief parses the LDAPService section under the LDAP
608 * @param input JSON data
609 * @param asyncResp pointer to the JSON response
610 * @param baseDNList baseDN to be filled from the given JSON.
611 * @param userNameAttribute userName to be filled from the given JSON.
612 * @param groupaAttribute password to be filled from the given JSON.
613 */
614
615 void parseLDAPServiceJson(
616 nlohmann::json input, const std::shared_ptr<AsyncResp>& asyncResp,
617 std::optional<std::vector<std::string>>& baseDNList,
618 std::optional<std::string>& userNameAttribute,
619 std::optional<std::string>& groupsAttribute)
620 {
621 std::optional<nlohmann::json> searchSettings;
622
623 if (!json_util::readJson(input, asyncResp->res, "SearchSettings",
624 searchSettings))
625 {
626 return;
627 }
628 if (!searchSettings)
629 {
630 return;
631 }
632 if (!json_util::readJson(*searchSettings, asyncResp->res,
633 "BaseDistinguishedNames", baseDNList,
634 "UsernameAttribute", userNameAttribute,
635 "GroupsAttribute", groupsAttribute))
636 {
637 return;
638 }
639 }
640 /**
641 * @brief updates the LDAP server address and updates the
642 json response with the new value.
643 * @param serviceAddressList address to be updated.
644 * @param asyncResp pointer to the JSON response
645 * @param ldapServerElementName Type of LDAP
646 server(openLDAP/ActiveDirectory)
647 */
648
649 void handleServiceAddressPatch(
650 const std::vector<std::string>& serviceAddressList,
651 const std::shared_ptr<AsyncResp>& asyncResp,
652 const std::string& ldapServerElementName,
653 const std::string& ldapConfigObject)
654 {
655 crow::connections::systemBus->async_method_call(
656 [asyncResp, ldapServerElementName,
657 serviceAddressList](const boost::system::error_code ec) {
658 if (ec)
659 {
660 BMCWEB_LOG_DEBUG
Gunnar Millsc61704a2020-07-08 13:47:06 -0500661 << "Error Occurred in updating the service address";
Ratan Gupta8a07d282019-03-16 08:33:47 +0530662 messages::internalError(asyncResp->res);
663 return;
664 }
665 std::vector<std::string> modifiedserviceAddressList = {
666 serviceAddressList.front()};
667 asyncResp->res
668 .jsonValue[ldapServerElementName]["ServiceAddresses"] =
669 modifiedserviceAddressList;
670 if ((serviceAddressList).size() > 1)
671 {
672 messages::propertyValueModified(asyncResp->res,
673 "ServiceAddresses",
674 serviceAddressList.front());
675 }
676 BMCWEB_LOG_DEBUG << "Updated the service address";
677 },
678 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
679 ldapConfigInterface, "LDAPServerURI",
680 std::variant<std::string>(serviceAddressList.front()));
681 }
682 /**
683 * @brief updates the LDAP Bind DN and updates the
684 json response with the new value.
685 * @param username name of the user which needs to be updated.
686 * @param asyncResp pointer to the JSON response
687 * @param ldapServerElementName Type of LDAP
688 server(openLDAP/ActiveDirectory)
689 */
690
691 void handleUserNamePatch(const std::string& username,
692 const std::shared_ptr<AsyncResp>& asyncResp,
693 const std::string& ldapServerElementName,
694 const std::string& ldapConfigObject)
695 {
696 crow::connections::systemBus->async_method_call(
697 [asyncResp, username,
698 ldapServerElementName](const boost::system::error_code ec) {
699 if (ec)
700 {
701 BMCWEB_LOG_DEBUG
Gunnar Millsc61704a2020-07-08 13:47:06 -0500702 << "Error occurred in updating the username";
Ratan Gupta8a07d282019-03-16 08:33:47 +0530703 messages::internalError(asyncResp->res);
704 return;
705 }
706 asyncResp->res.jsonValue[ldapServerElementName]
707 ["Authentication"]["Username"] =
708 username;
709 BMCWEB_LOG_DEBUG << "Updated the username";
710 },
711 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
712 ldapConfigInterface, "LDAPBindDN",
713 std::variant<std::string>(username));
714 }
715
716 /**
717 * @brief updates the LDAP password
718 * @param password : ldap password which needs to be updated.
719 * @param asyncResp pointer to the JSON response
720 * @param ldapServerElementName Type of LDAP
721 * server(openLDAP/ActiveDirectory)
722 */
723
724 void handlePasswordPatch(const std::string& password,
725 const std::shared_ptr<AsyncResp>& asyncResp,
726 const std::string& ldapServerElementName,
727 const std::string& ldapConfigObject)
728 {
729 crow::connections::systemBus->async_method_call(
730 [asyncResp, password,
731 ldapServerElementName](const boost::system::error_code ec) {
732 if (ec)
733 {
734 BMCWEB_LOG_DEBUG
Gunnar Millsc61704a2020-07-08 13:47:06 -0500735 << "Error occurred in updating the password";
Ratan Gupta8a07d282019-03-16 08:33:47 +0530736 messages::internalError(asyncResp->res);
737 return;
738 }
739 asyncResp->res.jsonValue[ldapServerElementName]
740 ["Authentication"]["Password"] = "";
741 BMCWEB_LOG_DEBUG << "Updated the password";
742 },
743 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
744 ldapConfigInterface, "LDAPBindDNPassword",
745 std::variant<std::string>(password));
746 }
747
748 /**
749 * @brief updates the LDAP BaseDN and updates the
750 json response with the new value.
751 * @param baseDNList baseDN list which needs to be updated.
752 * @param asyncResp pointer to the JSON response
753 * @param ldapServerElementName Type of LDAP
754 server(openLDAP/ActiveDirectory)
755 */
756
757 void handleBaseDNPatch(const std::vector<std::string>& baseDNList,
758 const std::shared_ptr<AsyncResp>& asyncResp,
759 const std::string& ldapServerElementName,
760 const std::string& ldapConfigObject)
761 {
762 crow::connections::systemBus->async_method_call(
763 [asyncResp, baseDNList,
764 ldapServerElementName](const boost::system::error_code ec) {
765 if (ec)
766 {
Gunnar Millsc61704a2020-07-08 13:47:06 -0500767 BMCWEB_LOG_DEBUG
768 << "Error Occurred in Updating the base DN";
Ratan Gupta8a07d282019-03-16 08:33:47 +0530769 messages::internalError(asyncResp->res);
770 return;
771 }
772 auto& serverTypeJson =
773 asyncResp->res.jsonValue[ldapServerElementName];
774 auto& searchSettingsJson =
775 serverTypeJson["LDAPService"]["SearchSettings"];
776 std::vector<std::string> modifiedBaseDNList = {
777 baseDNList.front()};
778 searchSettingsJson["BaseDistinguishedNames"] =
779 modifiedBaseDNList;
780 if (baseDNList.size() > 1)
781 {
782 messages::propertyValueModified(asyncResp->res,
783 "BaseDistinguishedNames",
784 baseDNList.front());
785 }
786 BMCWEB_LOG_DEBUG << "Updated the base DN";
787 },
788 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
789 ldapConfigInterface, "LDAPBaseDN",
790 std::variant<std::string>(baseDNList.front()));
791 }
792 /**
793 * @brief updates the LDAP user name attribute and updates the
794 json response with the new value.
795 * @param userNameAttribute attribute to be updated.
796 * @param asyncResp pointer to the JSON response
797 * @param ldapServerElementName Type of LDAP
798 server(openLDAP/ActiveDirectory)
799 */
800
801 void handleUserNameAttrPatch(const std::string& userNameAttribute,
802 const std::shared_ptr<AsyncResp>& asyncResp,
803 const std::string& ldapServerElementName,
804 const std::string& ldapConfigObject)
805 {
806 crow::connections::systemBus->async_method_call(
807 [asyncResp, userNameAttribute,
808 ldapServerElementName](const boost::system::error_code ec) {
809 if (ec)
810 {
Gunnar Millsc61704a2020-07-08 13:47:06 -0500811 BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
Ratan Gupta8a07d282019-03-16 08:33:47 +0530812 "username attribute";
813 messages::internalError(asyncResp->res);
814 return;
815 }
816 auto& serverTypeJson =
817 asyncResp->res.jsonValue[ldapServerElementName];
818 auto& searchSettingsJson =
819 serverTypeJson["LDAPService"]["SearchSettings"];
820 searchSettingsJson["UsernameAttribute"] = userNameAttribute;
821 BMCWEB_LOG_DEBUG << "Updated the user name attr.";
822 },
823 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
824 ldapConfigInterface, "UserNameAttribute",
825 std::variant<std::string>(userNameAttribute));
826 }
827 /**
828 * @brief updates the LDAP group attribute and updates the
829 json response with the new value.
830 * @param groupsAttribute attribute to be updated.
831 * @param asyncResp pointer to the JSON response
832 * @param ldapServerElementName Type of LDAP
833 server(openLDAP/ActiveDirectory)
834 */
835
836 void handleGroupNameAttrPatch(const std::string& groupsAttribute,
837 const std::shared_ptr<AsyncResp>& asyncResp,
838 const std::string& ldapServerElementName,
839 const std::string& ldapConfigObject)
840 {
841 crow::connections::systemBus->async_method_call(
842 [asyncResp, groupsAttribute,
843 ldapServerElementName](const boost::system::error_code ec) {
844 if (ec)
845 {
Gunnar Millsc61704a2020-07-08 13:47:06 -0500846 BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
Ratan Gupta8a07d282019-03-16 08:33:47 +0530847 "groupname attribute";
848 messages::internalError(asyncResp->res);
849 return;
850 }
851 auto& serverTypeJson =
852 asyncResp->res.jsonValue[ldapServerElementName];
853 auto& searchSettingsJson =
854 serverTypeJson["LDAPService"]["SearchSettings"];
855 searchSettingsJson["GroupsAttribute"] = groupsAttribute;
856 BMCWEB_LOG_DEBUG << "Updated the groupname attr";
857 },
858 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
859 ldapConfigInterface, "GroupNameAttribute",
860 std::variant<std::string>(groupsAttribute));
861 }
862 /**
863 * @brief updates the LDAP service enable and updates the
864 json response with the new value.
865 * @param input JSON data.
866 * @param asyncResp pointer to the JSON response
867 * @param ldapServerElementName Type of LDAP
868 server(openLDAP/ActiveDirectory)
869 */
870
871 void handleServiceEnablePatch(bool serviceEnabled,
872 const std::shared_ptr<AsyncResp>& asyncResp,
873 const std::string& ldapServerElementName,
874 const std::string& ldapConfigObject)
875 {
876 crow::connections::systemBus->async_method_call(
877 [asyncResp, serviceEnabled,
878 ldapServerElementName](const boost::system::error_code ec) {
879 if (ec)
880 {
881 BMCWEB_LOG_DEBUG
Gunnar Millsc61704a2020-07-08 13:47:06 -0500882 << "Error Occurred in Updating the service enable";
Ratan Gupta8a07d282019-03-16 08:33:47 +0530883 messages::internalError(asyncResp->res);
884 return;
885 }
886 asyncResp->res
887 .jsonValue[ldapServerElementName]["ServiceEnabled"] =
888 serviceEnabled;
889 BMCWEB_LOG_DEBUG << "Updated Service enable = "
890 << serviceEnabled;
891 },
892 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
893 ldapEnableInterface, "Enabled", std::variant<bool>(serviceEnabled));
894 }
895
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100896 void handleAuthMethodsPatch(nlohmann::json& input,
897 const std::shared_ptr<AsyncResp>& asyncResp)
898 {
899 std::optional<bool> basicAuth;
900 std::optional<bool> cookie;
901 std::optional<bool> sessionToken;
902 std::optional<bool> xToken;
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200903 std::optional<bool> tls;
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100904
905 if (!json_util::readJson(input, asyncResp->res, "BasicAuth", basicAuth,
906 "Cookie", cookie, "SessionToken", sessionToken,
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200907 "XToken", xToken, "TLS", tls))
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100908 {
909 BMCWEB_LOG_ERROR << "Cannot read values from AuthMethod tag";
910 return;
911 }
912
913 // Make a copy of methods configuration
Ed Tanous52cc1122020-07-18 13:51:21 -0700914 persistent_data::AuthConfigMethods authMethodsConfig =
915 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100916
917 if (basicAuth)
918 {
Alan Kuof16f6262020-12-08 19:29:59 +0800919#ifndef BMCWEB_ENABLE_BASIC_AUTHENTICATION
920 messages::actionNotSupported(
921 asyncResp->res, "Setting BasicAuth when basic-auth feature "
922 "is disabled");
923 return;
924#endif
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100925 authMethodsConfig.basic = *basicAuth;
926 }
927
928 if (cookie)
929 {
Alan Kuof16f6262020-12-08 19:29:59 +0800930#ifndef BMCWEB_ENABLE_COOKIE_AUTHENTICATION
931 messages::actionNotSupported(
932 asyncResp->res, "Setting Cookie when cookie-auth feature "
933 "is disabled");
934 return;
935#endif
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100936 authMethodsConfig.cookie = *cookie;
937 }
938
939 if (sessionToken)
940 {
Alan Kuof16f6262020-12-08 19:29:59 +0800941#ifndef BMCWEB_ENABLE_SESSION_AUTHENTICATION
942 messages::actionNotSupported(
943 asyncResp->res,
944 "Setting SessionToken when session-auth feature "
945 "is disabled");
946 return;
947#endif
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100948 authMethodsConfig.sessionToken = *sessionToken;
949 }
950
951 if (xToken)
952 {
Alan Kuof16f6262020-12-08 19:29:59 +0800953#ifndef BMCWEB_ENABLE_XTOKEN_AUTHENTICATION
954 messages::actionNotSupported(
955 asyncResp->res, "Setting XToken when xtoken-auth feature "
956 "is disabled");
957 return;
958#endif
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100959 authMethodsConfig.xtoken = *xToken;
960 }
961
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200962 if (tls)
963 {
Alan Kuof16f6262020-12-08 19:29:59 +0800964#ifndef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
965 messages::actionNotSupported(
966 asyncResp->res, "Setting TLS when mutual-tls-auth feature "
967 "is disabled");
968 return;
969#endif
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200970 authMethodsConfig.tls = *tls;
971 }
972
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100973 if (!authMethodsConfig.basic && !authMethodsConfig.cookie &&
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200974 !authMethodsConfig.sessionToken && !authMethodsConfig.xtoken &&
975 !authMethodsConfig.tls)
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100976 {
977 // Do not allow user to disable everything
978 messages::actionNotSupported(asyncResp->res,
979 "of disabling all available methods");
980 return;
981 }
982
Ed Tanous52cc1122020-07-18 13:51:21 -0700983 persistent_data::SessionStore::getInstance().updateAuthMethodsConfig(
984 authMethodsConfig);
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100985 // Save configuration immediately
Ed Tanous52cc1122020-07-18 13:51:21 -0700986 persistent_data::getConfig().writeData();
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100987
988 messages::success(asyncResp->res);
989 }
990
Ratan Gupta8a07d282019-03-16 08:33:47 +0530991 /**
992 * @brief Get the required values from the given JSON, validates the
993 * value and create the LDAP config object.
994 * @param input JSON data
995 * @param asyncResp pointer to the JSON response
996 * @param serverType Type of LDAP server(openLDAP/ActiveDirectory)
997 */
998
999 void handleLDAPPatch(nlohmann::json& input,
1000 const std::shared_ptr<AsyncResp>& asyncResp,
Ratan Gupta8a07d282019-03-16 08:33:47 +05301001 const std::string& serverType)
1002 {
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301003 std::string dbusObjectPath;
1004 if (serverType == "ActiveDirectory")
1005 {
Ed Tanous2c70f802020-09-28 14:29:23 -07001006 dbusObjectPath = adConfigObject;
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301007 }
1008 else if (serverType == "LDAP")
1009 {
Ed Tanous23a21a12020-07-25 04:45:05 +00001010 dbusObjectPath = ldapConfigObjectName;
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301011 }
Ed Tanouscb13a392020-07-25 19:02:03 +00001012 else
1013 {
1014 return;
1015 }
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301016
Ratan Gupta8a07d282019-03-16 08:33:47 +05301017 std::optional<nlohmann::json> authentication;
1018 std::optional<nlohmann::json> ldapService;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301019 std::optional<std::vector<std::string>> serviceAddressList;
1020 std::optional<bool> serviceEnabled;
1021 std::optional<std::vector<std::string>> baseDNList;
1022 std::optional<std::string> userNameAttribute;
1023 std::optional<std::string> groupsAttribute;
1024 std::optional<std::string> userName;
1025 std::optional<std::string> password;
Ratan Gupta06785242019-07-26 22:30:16 +05301026 std::optional<std::vector<nlohmann::json>> remoteRoleMapData;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301027
1028 if (!json_util::readJson(input, asyncResp->res, "Authentication",
1029 authentication, "LDAPService", ldapService,
1030 "ServiceAddresses", serviceAddressList,
Ratan Gupta06785242019-07-26 22:30:16 +05301031 "ServiceEnabled", serviceEnabled,
1032 "RemoteRoleMapping", remoteRoleMapData))
Ratan Gupta8a07d282019-03-16 08:33:47 +05301033 {
1034 return;
1035 }
1036
1037 if (authentication)
1038 {
1039 parseLDAPAuthenticationJson(*authentication, asyncResp, userName,
1040 password);
1041 }
1042 if (ldapService)
1043 {
1044 parseLDAPServiceJson(*ldapService, asyncResp, baseDNList,
1045 userNameAttribute, groupsAttribute);
1046 }
Ratan Gupta8a07d282019-03-16 08:33:47 +05301047 if (serviceAddressList)
1048 {
1049 if ((*serviceAddressList).size() == 0)
1050 {
1051 messages::propertyValueNotInList(asyncResp->res, "[]",
1052 "ServiceAddress");
1053 return;
1054 }
1055 }
1056 if (baseDNList)
1057 {
1058 if ((*baseDNList).size() == 0)
1059 {
1060 messages::propertyValueNotInList(asyncResp->res, "[]",
1061 "BaseDistinguishedNames");
1062 return;
1063 }
1064 }
1065
1066 // nothing to update, then return
1067 if (!userName && !password && !serviceAddressList && !baseDNList &&
Ratan Gupta06785242019-07-26 22:30:16 +05301068 !userNameAttribute && !groupsAttribute && !serviceEnabled &&
1069 !remoteRoleMapData)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301070 {
1071 return;
1072 }
1073
1074 // Get the existing resource first then keep modifying
1075 // whenever any property gets updated.
Ed Tanousb5a76932020-09-29 16:16:58 -07001076 getLDAPConfigData(
1077 serverType, [this, asyncResp, userName, password, baseDNList,
1078 userNameAttribute, groupsAttribute, serviceAddressList,
1079 serviceEnabled, dbusObjectPath, remoteRoleMapData](
1080 bool success, const LDAPConfigData& confData,
1081 const std::string& serverT) {
1082 if (!success)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301083 {
Ed Tanousb5a76932020-09-29 16:16:58 -07001084 messages::internalError(asyncResp->res);
1085 return;
1086 }
1087 parseLDAPConfigData(asyncResp->res.jsonValue, confData,
1088 serverT);
1089 if (confData.serviceEnabled)
1090 {
1091 // Disable the service first and update the rest of
1092 // the properties.
1093 handleServiceEnablePatch(false, asyncResp, serverT,
1094 dbusObjectPath);
1095 }
1096
1097 if (serviceAddressList)
1098 {
1099 handleServiceAddressPatch(*serviceAddressList, asyncResp,
1100 serverT, dbusObjectPath);
1101 }
1102 if (userName)
1103 {
1104 handleUserNamePatch(*userName, asyncResp, serverT,
1105 dbusObjectPath);
1106 }
1107 if (password)
1108 {
1109 handlePasswordPatch(*password, asyncResp, serverT,
1110 dbusObjectPath);
1111 }
1112
1113 if (baseDNList)
1114 {
1115 handleBaseDNPatch(*baseDNList, asyncResp, serverT,
1116 dbusObjectPath);
1117 }
1118 if (userNameAttribute)
1119 {
1120 handleUserNameAttrPatch(*userNameAttribute, asyncResp,
1121 serverT, dbusObjectPath);
1122 }
1123 if (groupsAttribute)
1124 {
1125 handleGroupNameAttrPatch(*groupsAttribute, asyncResp,
Ed Tanous23a21a12020-07-25 04:45:05 +00001126 serverT, dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301127 }
Ed Tanousb5a76932020-09-29 16:16:58 -07001128 if (serviceEnabled)
1129 {
1130 // if user has given the value as true then enable
1131 // the service. if user has given false then no-op
1132 // as service is already stopped.
1133 if (*serviceEnabled)
1134 {
1135 handleServiceEnablePatch(*serviceEnabled, asyncResp,
1136 serverT, dbusObjectPath);
1137 }
1138 }
1139 else
1140 {
1141 // if user has not given the service enabled value
1142 // then revert it to the same state as it was
1143 // before.
1144 handleServiceEnablePatch(confData.serviceEnabled, asyncResp,
1145 serverT, dbusObjectPath);
1146 }
Ratan Gupta06785242019-07-26 22:30:16 +05301147
Ed Tanousb5a76932020-09-29 16:16:58 -07001148 if (remoteRoleMapData)
1149 {
Ed Tanousb5a76932020-09-29 16:16:58 -07001150 handleRoleMapPatch(asyncResp, confData.groupRoleList,
Ed Tanousf23b7292020-10-15 09:41:17 -07001151 serverT, *remoteRoleMapData);
Ed Tanousb5a76932020-09-29 16:16:58 -07001152 }
1153 });
Ratan Gupta8a07d282019-03-16 08:33:47 +05301154 }
Ed Tanousd4b54432019-07-17 22:51:55 +00001155
Ed Tanouscb13a392020-07-25 19:02:03 +00001156 void doGet(crow::Response& res, const crow::Request&,
1157 const std::vector<std::string>&) override
Ed Tanous1abe55e2018-09-05 08:30:59 -07001158 {
Ed Tanous52cc1122020-07-18 13:51:21 -07001159 const persistent_data::AuthConfigMethods& authMethodsConfig =
1160 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001161
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301162 auto asyncResp = std::make_shared<AsyncResp>(res);
1163 res.jsonValue = {
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301164 {"@odata.id", "/redfish/v1/AccountService"},
1165 {"@odata.type", "#AccountService."
Gunnar Millsba9dd4a2020-02-20 10:40:18 -06001166 "v1_5_0.AccountService"},
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301167 {"Id", "AccountService"},
1168 {"Name", "Account Service"},
1169 {"Description", "Account Service"},
1170 {"ServiceEnabled", true},
AppaRao Puli343ff2e2019-03-24 00:42:13 +05301171 {"MaxPasswordLength", 20},
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301172 {"Accounts",
1173 {{"@odata.id", "/redfish/v1/AccountService/Accounts"}}},
Marri Devender Rao37cce912019-02-20 01:05:22 -06001174 {"Roles", {{"@odata.id", "/redfish/v1/AccountService/Roles"}}},
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001175 {"Oem",
1176 {{"OpenBMC",
1177 {{"@odata.type", "#OemAccountService.v1_0_0.AccountService"},
1178 {"AuthMethods",
1179 {
1180 {"BasicAuth", authMethodsConfig.basic},
1181 {"SessionToken", authMethodsConfig.sessionToken},
1182 {"XToken", authMethodsConfig.xtoken},
1183 {"Cookie", authMethodsConfig.cookie},
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +02001184 {"TLS", authMethodsConfig.tls},
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001185 }}}}}},
Marri Devender Rao37cce912019-02-20 01:05:22 -06001186 {"LDAP",
1187 {{"Certificates",
1188 {{"@odata.id",
1189 "/redfish/v1/AccountService/LDAP/Certificates"}}}}}};
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301190 crow::connections::systemBus->async_method_call(
1191 [asyncResp](
1192 const boost::system::error_code ec,
1193 const std::vector<std::pair<
Ed Tanousabf2add2019-01-22 16:40:12 -08001194 std::string, std::variant<uint32_t, uint16_t, uint8_t>>>&
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301195 propertiesList) {
1196 if (ec)
1197 {
1198 messages::internalError(asyncResp->res);
1199 return;
1200 }
1201 BMCWEB_LOG_DEBUG << "Got " << propertiesList.size()
1202 << "properties for AccountService";
1203 for (const std::pair<std::string,
Ed Tanousabf2add2019-01-22 16:40:12 -08001204 std::variant<uint32_t, uint16_t, uint8_t>>&
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301205 property : propertiesList)
1206 {
1207 if (property.first == "MinPasswordLength")
1208 {
1209 const uint8_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001210 std::get_if<uint8_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301211 if (value != nullptr)
1212 {
1213 asyncResp->res.jsonValue["MinPasswordLength"] =
1214 *value;
1215 }
1216 }
1217 if (property.first == "AccountUnlockTimeout")
1218 {
1219 const uint32_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001220 std::get_if<uint32_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301221 if (value != nullptr)
1222 {
1223 asyncResp->res.jsonValue["AccountLockoutDuration"] =
1224 *value;
1225 }
1226 }
1227 if (property.first == "MaxLoginAttemptBeforeLockout")
1228 {
1229 const uint16_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001230 std::get_if<uint16_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301231 if (value != nullptr)
1232 {
1233 asyncResp->res
1234 .jsonValue["AccountLockoutThreshold"] = *value;
1235 }
1236 }
1237 }
1238 },
1239 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1240 "org.freedesktop.DBus.Properties", "GetAll",
1241 "xyz.openbmc_project.User.AccountPolicy");
Ratan Gupta6973a582018-12-13 18:25:44 +05301242
Ratan Guptaab828d72019-04-22 14:18:33 +05301243 auto callback = [asyncResp](bool success, LDAPConfigData& confData,
1244 const std::string& ldapType) {
Ed Tanouscb13a392020-07-25 19:02:03 +00001245 if (!success)
1246 {
1247 return;
1248 }
Ratan Guptaab828d72019-04-22 14:18:33 +05301249 parseLDAPConfigData(asyncResp->res.jsonValue, confData, ldapType);
1250 };
1251
1252 getLDAPConfigData("LDAP", callback);
1253 getLDAPConfigData("ActiveDirectory", callback);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301254 }
Ratan Gupta6973a582018-12-13 18:25:44 +05301255
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301256 void doPatch(crow::Response& res, const crow::Request& req,
Ed Tanouscb13a392020-07-25 19:02:03 +00001257 const std::vector<std::string>&) override
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301258 {
1259 auto asyncResp = std::make_shared<AsyncResp>(res);
1260
1261 std::optional<uint32_t> unlockTimeout;
1262 std::optional<uint16_t> lockoutThreshold;
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301263 std::optional<uint16_t> minPasswordLength;
1264 std::optional<uint16_t> maxPasswordLength;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301265 std::optional<nlohmann::json> ldapObject;
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301266 std::optional<nlohmann::json> activeDirectoryObject;
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001267 std::optional<nlohmann::json> oemObject;
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301268
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001269 if (!json_util::readJson(
1270 req, res, "AccountLockoutDuration", unlockTimeout,
1271 "AccountLockoutThreshold", lockoutThreshold,
1272 "MaxPasswordLength", maxPasswordLength, "MinPasswordLength",
1273 minPasswordLength, "LDAP", ldapObject, "ActiveDirectory",
1274 activeDirectoryObject, "Oem", oemObject))
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301275 {
1276 return;
1277 }
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301278
1279 if (minPasswordLength)
1280 {
1281 messages::propertyNotWritable(asyncResp->res, "MinPasswordLength");
1282 }
1283
1284 if (maxPasswordLength)
1285 {
1286 messages::propertyNotWritable(asyncResp->res, "MaxPasswordLength");
1287 }
1288
Ratan Gupta8a07d282019-03-16 08:33:47 +05301289 if (ldapObject)
1290 {
Ed Tanouscb13a392020-07-25 19:02:03 +00001291 handleLDAPPatch(*ldapObject, asyncResp, "LDAP");
Ratan Gupta8a07d282019-03-16 08:33:47 +05301292 }
1293
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001294 if (std::optional<nlohmann::json> oemOpenBMCObject;
1295 oemObject &&
1296 json_util::readJson(*oemObject, res, "OpenBMC", oemOpenBMCObject))
1297 {
1298 if (std::optional<nlohmann::json> authMethodsObject;
1299 oemOpenBMCObject &&
1300 json_util::readJson(*oemOpenBMCObject, res, "AuthMethods",
1301 authMethodsObject))
1302 {
1303 if (authMethodsObject)
1304 {
1305 handleAuthMethodsPatch(*authMethodsObject, asyncResp);
1306 }
1307 }
1308 }
1309
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301310 if (activeDirectoryObject)
1311 {
Ed Tanouscb13a392020-07-25 19:02:03 +00001312 handleLDAPPatch(*activeDirectoryObject, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301313 "ActiveDirectory");
1314 }
1315
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301316 if (unlockTimeout)
1317 {
1318 crow::connections::systemBus->async_method_call(
1319 [asyncResp](const boost::system::error_code ec) {
1320 if (ec)
1321 {
1322 messages::internalError(asyncResp->res);
1323 return;
1324 }
Ratan Guptaadd61332019-02-13 20:49:16 +05301325 messages::success(asyncResp->res);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301326 },
1327 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1328 "org.freedesktop.DBus.Properties", "Set",
1329 "xyz.openbmc_project.User.AccountPolicy",
Ed Tanousabf2add2019-01-22 16:40:12 -08001330 "AccountUnlockTimeout", std::variant<uint32_t>(*unlockTimeout));
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301331 }
1332 if (lockoutThreshold)
1333 {
1334 crow::connections::systemBus->async_method_call(
1335 [asyncResp](const boost::system::error_code ec) {
1336 if (ec)
1337 {
1338 messages::internalError(asyncResp->res);
1339 return;
1340 }
Ratan Guptaadd61332019-02-13 20:49:16 +05301341 messages::success(asyncResp->res);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301342 },
1343 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1344 "org.freedesktop.DBus.Properties", "Set",
1345 "xyz.openbmc_project.User.AccountPolicy",
1346 "MaxLoginAttemptBeforeLockout",
Ed Tanousabf2add2019-01-22 16:40:12 -08001347 std::variant<uint16_t>(*lockoutThreshold));
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301348 }
Ed Tanous1abe55e2018-09-05 08:30:59 -07001349 }
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001350};
Tanousf00032d2018-11-05 01:18:10 -03001351
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001352class AccountsCollection : public Node
1353{
1354 public:
Ed Tanous52cc1122020-07-18 13:51:21 -07001355 AccountsCollection(App& app) :
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001356 Node(app, "/redfish/v1/AccountService/Accounts/")
1357 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001358 entityPrivileges = {
Gunnar Millsf3659102020-01-29 16:23:28 -06001359 // According to the PrivilegeRegistry, GET should actually be
1360 // "Login". A "Login" only privilege would return an empty "Members"
1361 // list. Not going to worry about this since none of the defined
1362 // roles are just "Login". E.g. Readonly is {"Login",
1363 // "ConfigureSelf"}. In the rare event anyone defines a role that
1364 // has Login but not ConfigureSelf, implement this.
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001365 {boost::beast::http::verb::get,
Gunnar Millsf3659102020-01-29 16:23:28 -06001366 {{"ConfigureUsers"}, {"ConfigureSelf"}}},
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001367 {boost::beast::http::verb::head, {{"Login"}}},
1368 {boost::beast::http::verb::patch, {{"ConfigureUsers"}}},
1369 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
1370 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
1371 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
1372 }
1373
1374 private:
1375 void doGet(crow::Response& res, const crow::Request& req,
Ed Tanouscb13a392020-07-25 19:02:03 +00001376 const std::vector<std::string>&) override
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001377 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001378 auto asyncResp = std::make_shared<AsyncResp>(res);
Gunnar Mills94400962020-02-14 11:56:41 -06001379 res.jsonValue = {{"@odata.id", "/redfish/v1/AccountService/Accounts"},
Ed Tanous0f74e642018-11-12 15:17:05 -08001380 {"@odata.type", "#ManagerAccountCollection."
1381 "ManagerAccountCollection"},
1382 {"Name", "Accounts Collection"},
1383 {"Description", "BMC User Accounts"}};
1384
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001385 crow::connections::systemBus->async_method_call(
Gunnar Millsf3659102020-01-29 16:23:28 -06001386 [asyncResp, &req, this](const boost::system::error_code ec,
1387 const ManagedObjectType& users) {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001388 if (ec)
1389 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001390 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001391 return;
1392 }
1393
1394 nlohmann::json& memberArray =
1395 asyncResp->res.jsonValue["Members"];
1396 memberArray = nlohmann::json::array();
1397
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001398 for (auto& user : users)
1399 {
1400 const std::string& path =
1401 static_cast<const std::string&>(user.first);
Ed Tanousf23b7292020-10-15 09:41:17 -07001402 std::size_t lastIndex = path.rfind('/');
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001403 if (lastIndex == std::string::npos)
1404 {
1405 lastIndex = 0;
1406 }
1407 else
1408 {
1409 lastIndex += 1;
1410 }
Gunnar Millsf3659102020-01-29 16:23:28 -06001411
1412 // As clarified by Redfish here:
1413 // https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration
1414 // Users without ConfigureUsers, only see their own account.
1415 // Users with ConfigureUsers, see all accounts.
1416 if (req.session->username == path.substr(lastIndex) ||
1417 isAllowedWithoutConfigureSelf(req))
1418 {
1419 memberArray.push_back(
1420 {{"@odata.id",
1421 "/redfish/v1/AccountService/Accounts/" +
1422 path.substr(lastIndex)}});
1423 }
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001424 }
Gunnar Millsf3659102020-01-29 16:23:28 -06001425 asyncResp->res.jsonValue["Members@odata.count"] =
1426 memberArray.size();
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001427 },
1428 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1429 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
1430 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001431 void doPost(crow::Response& res, const crow::Request& req,
Ed Tanouscb13a392020-07-25 19:02:03 +00001432 const std::vector<std::string>&) override
Ed Tanous04ae99e2018-09-20 15:54:36 -07001433 {
1434 auto asyncResp = std::make_shared<AsyncResp>(res);
1435
Ed Tanous9712f8a2018-09-21 13:38:49 -07001436 std::string username;
1437 std::string password;
Ed Tanousa24526d2018-12-10 15:17:59 -08001438 std::optional<std::string> roleId("User");
1439 std::optional<bool> enabled = true;
Ed Tanous9712f8a2018-09-21 13:38:49 -07001440 if (!json_util::readJson(req, res, "UserName", username, "Password",
1441 password, "RoleId", roleId, "Enabled",
1442 enabled))
Ed Tanous04ae99e2018-09-20 15:54:36 -07001443 {
1444 return;
1445 }
1446
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001447 std::string priv = getPrivilegeFromRoleId(*roleId);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301448 if (priv.empty())
Ed Tanous04ae99e2018-09-20 15:54:36 -07001449 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001450 messages::propertyValueNotInList(asyncResp->res, *roleId, "RoleId");
Ed Tanous04ae99e2018-09-20 15:54:36 -07001451 return;
1452 }
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001453 // TODO: Following override will be reverted once support in
1454 // phosphor-user-manager is added. In order to avoid dependency issues,
1455 // this is added in bmcweb, which will removed, once
1456 // phosphor-user-manager supports priv-noaccess.
1457 if (priv == "priv-noaccess")
1458 {
1459 roleId = "";
1460 }
1461 else
1462 {
1463 roleId = priv;
1464 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001465
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001466 // Reading AllGroups property
Ed Tanous04ae99e2018-09-20 15:54:36 -07001467 crow::connections::systemBus->async_method_call(
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001468 [asyncResp, username, password{std::move(password)}, roleId,
1469 enabled](const boost::system::error_code ec,
1470 const std::variant<std::vector<std::string>>& allGroups) {
Ed Tanous04ae99e2018-09-20 15:54:36 -07001471 if (ec)
1472 {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001473 BMCWEB_LOG_DEBUG << "ERROR with async_method_call";
1474 messages::internalError(asyncResp->res);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001475 return;
1476 }
1477
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001478 const std::vector<std::string>* allGroupsList =
1479 std::get_if<std::vector<std::string>>(&allGroups);
1480
1481 if (allGroupsList == nullptr || allGroupsList->empty())
Ed Tanous04ae99e2018-09-20 15:54:36 -07001482 {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001483 messages::internalError(asyncResp->res);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001484 return;
1485 }
1486
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001487 crow::connections::systemBus->async_method_call(
Ed Tanousf23b7292020-10-15 09:41:17 -07001488 [asyncResp, username,
1489 password](const boost::system::error_code ec2,
1490 sdbusplus::message::message& m) {
Ed Tanous23a21a12020-07-25 04:45:05 +00001491 if (ec2)
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001492 {
anil kumar appana0d4197e2019-06-13 15:06:23 +00001493 userErrorMessageHandler(m.get_error(), asyncResp,
1494 username, "");
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001495 return;
1496 }
1497
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001498 if (pamUpdatePassword(username, password) !=
1499 PAM_SUCCESS)
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001500 {
1501 // At this point we have a user that's been created,
1502 // but the password set failed.Something is wrong,
1503 // so delete the user that we've already created
1504 crow::connections::systemBus->async_method_call(
Ed Tanous23a21a12020-07-25 04:45:05 +00001505 [asyncResp, password](
1506 const boost::system::error_code ec3) {
1507 if (ec3)
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001508 {
1509 messages::internalError(asyncResp->res);
1510 return;
1511 }
1512
anil kumar appana0d4197e2019-06-13 15:06:23 +00001513 // If password is invalid
1514 messages::propertyValueFormatError(
1515 asyncResp->res, password, "Password");
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001516 },
1517 "xyz.openbmc_project.User.Manager",
1518 "/xyz/openbmc_project/user/" + username,
1519 "xyz.openbmc_project.Object.Delete", "Delete");
1520
1521 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1522 return;
1523 }
1524
1525 messages::created(asyncResp->res);
1526 asyncResp->res.addHeader(
1527 "Location",
1528 "/redfish/v1/AccountService/Accounts/" + username);
1529 },
1530 "xyz.openbmc_project.User.Manager",
1531 "/xyz/openbmc_project/user",
1532 "xyz.openbmc_project.User.Manager", "CreateUser", username,
1533 *allGroupsList, *roleId, *enabled);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001534 },
1535 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001536 "org.freedesktop.DBus.Properties", "Get",
1537 "xyz.openbmc_project.User.Manager", "AllGroups");
Ed Tanous04ae99e2018-09-20 15:54:36 -07001538 }
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001539};
1540
1541class ManagerAccount : public Node
1542{
1543 public:
Ed Tanous52cc1122020-07-18 13:51:21 -07001544 ManagerAccount(App& app) :
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001545 Node(app, "/redfish/v1/AccountService/Accounts/<str>/", std::string())
1546 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001547 entityPrivileges = {
1548 {boost::beast::http::verb::get,
1549 {{"ConfigureUsers"}, {"ConfigureManager"}, {"ConfigureSelf"}}},
1550 {boost::beast::http::verb::head, {{"Login"}}},
Joseph Reynolds900f9492019-11-25 15:37:29 -06001551 {boost::beast::http::verb::patch,
1552 {{"ConfigureUsers"}, {"ConfigureSelf"}}},
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001553 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
1554 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
1555 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
1556 }
1557
1558 private:
1559 void doGet(crow::Response& res, const crow::Request& req,
1560 const std::vector<std::string>& params) override
1561 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001562 auto asyncResp = std::make_shared<AsyncResp>(res);
1563
1564 if (params.size() != 1)
1565 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001566 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001567 return;
1568 }
1569
Joseph Reynolds900f9492019-11-25 15:37:29 -06001570 // Perform a proper ConfigureSelf authority check. If the
1571 // user is operating on an account not their own, then their
1572 // ConfigureSelf privilege does not apply. In this case,
1573 // perform the authority check again without the user's
1574 // ConfigureSelf privilege.
1575 if (req.session->username != params[0])
1576 {
1577 if (!isAllowedWithoutConfigureSelf(req))
1578 {
1579 BMCWEB_LOG_DEBUG << "GET Account denied access";
1580 messages::insufficientPrivilege(asyncResp->res);
1581 return;
1582 }
1583 }
1584
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001585 crow::connections::systemBus->async_method_call(
1586 [asyncResp, accountName{std::string(params[0])}](
1587 const boost::system::error_code ec,
1588 const ManagedObjectType& users) {
1589 if (ec)
1590 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001591 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001592 return;
1593 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301594 auto userIt = users.begin();
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001595
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301596 for (; userIt != users.end(); userIt++)
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001597 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301598 if (boost::ends_with(userIt->first.str, "/" + accountName))
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001599 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301600 break;
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001601 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301602 }
1603 if (userIt == users.end())
1604 {
1605 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1606 accountName);
1607 return;
1608 }
Ayushi Smriti4e68c452019-09-04 14:37:55 +05301609
1610 asyncResp->res.jsonValue = {
Gunnar Mills8114bd42020-06-11 20:55:21 -05001611 {"@odata.type", "#ManagerAccount.v1_4_0.ManagerAccount"},
Ayushi Smriti4e68c452019-09-04 14:37:55 +05301612 {"Name", "User Account"},
1613 {"Description", "User Account"},
Gunnar Mills8114bd42020-06-11 20:55:21 -05001614 {"Password", nullptr},
1615 {"AccountTypes", {"Redfish"}}};
Ayushi Smriti4e68c452019-09-04 14:37:55 +05301616
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301617 for (const auto& interface : userIt->second)
1618 {
1619 if (interface.first ==
1620 "xyz.openbmc_project.User.Attributes")
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001621 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301622 for (const auto& property : interface.second)
Ed Tanous65b0dc32018-09-19 16:04:03 -07001623 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301624 if (property.first == "UserEnabled")
Ed Tanous65b0dc32018-09-19 16:04:03 -07001625 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301626 const bool* userEnabled =
Ed Tanousabf2add2019-01-22 16:40:12 -08001627 std::get_if<bool>(&property.second);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301628 if (userEnabled == nullptr)
Ed Tanous65b0dc32018-09-19 16:04:03 -07001629 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301630 BMCWEB_LOG_ERROR
1631 << "UserEnabled wasn't a bool";
1632 messages::internalError(asyncResp->res);
1633 return;
Ed Tanous65b0dc32018-09-19 16:04:03 -07001634 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301635 asyncResp->res.jsonValue["Enabled"] =
1636 *userEnabled;
1637 }
1638 else if (property.first ==
1639 "UserLockedForFailedAttempt")
1640 {
1641 const bool* userLocked =
Ed Tanousabf2add2019-01-22 16:40:12 -08001642 std::get_if<bool>(&property.second);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301643 if (userLocked == nullptr)
1644 {
1645 BMCWEB_LOG_ERROR << "UserLockedForF"
1646 "ailedAttempt "
1647 "wasn't a bool";
1648 messages::internalError(asyncResp->res);
1649 return;
1650 }
1651 asyncResp->res.jsonValue["Locked"] =
1652 *userLocked;
Ratan Gupta24c85422019-01-30 19:41:24 +05301653 asyncResp->res.jsonValue
1654 ["Locked@Redfish.AllowableValues"] = {
Joseph Reynolds3bf4e632020-02-06 14:44:32 -06001655 "false"}; // can only unlock accounts
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301656 }
1657 else if (property.first == "UserPrivilege")
1658 {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001659 const std::string* userPrivPtr =
Ed Tanousabf2add2019-01-22 16:40:12 -08001660 std::get_if<std::string>(&property.second);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001661 if (userPrivPtr == nullptr)
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301662 {
1663 BMCWEB_LOG_ERROR
1664 << "UserPrivilege wasn't a "
1665 "string";
1666 messages::internalError(asyncResp->res);
1667 return;
1668 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001669 std::string role =
1670 getRoleIdFromPrivilege(*userPrivPtr);
1671 if (role.empty())
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301672 {
1673 BMCWEB_LOG_ERROR << "Invalid user role";
1674 messages::internalError(asyncResp->res);
1675 return;
1676 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001677 asyncResp->res.jsonValue["RoleId"] = role;
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301678
1679 asyncResp->res.jsonValue["Links"]["Role"] = {
1680 {"@odata.id", "/redfish/v1/AccountService/"
1681 "Roles/" +
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001682 role}};
Ed Tanous65b0dc32018-09-19 16:04:03 -07001683 }
Joseph Reynolds3bf4e632020-02-06 14:44:32 -06001684 else if (property.first == "UserPasswordExpired")
1685 {
1686 const bool* userPasswordExpired =
1687 std::get_if<bool>(&property.second);
1688 if (userPasswordExpired == nullptr)
1689 {
1690 BMCWEB_LOG_ERROR << "UserPassword"
1691 "Expired "
1692 "wasn't a bool";
1693 messages::internalError(asyncResp->res);
1694 return;
1695 }
1696 asyncResp->res
1697 .jsonValue["PasswordChangeRequired"] =
1698 *userPasswordExpired;
1699 }
Ed Tanous65b0dc32018-09-19 16:04:03 -07001700 }
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001701 }
1702 }
1703
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301704 asyncResp->res.jsonValue["@odata.id"] =
1705 "/redfish/v1/AccountService/Accounts/" + accountName;
1706 asyncResp->res.jsonValue["Id"] = accountName;
1707 asyncResp->res.jsonValue["UserName"] = accountName;
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001708 },
1709 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1710 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
1711 }
Ed Tanousa8408792018-09-05 16:08:38 -07001712
1713 void doPatch(crow::Response& res, const crow::Request& req,
1714 const std::vector<std::string>& params) override
1715 {
1716 auto asyncResp = std::make_shared<AsyncResp>(res);
Ed Tanousa8408792018-09-05 16:08:38 -07001717 if (params.size() != 1)
1718 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001719 messages::internalError(asyncResp->res);
Ed Tanousa8408792018-09-05 16:08:38 -07001720 return;
1721 }
1722
Ed Tanousa24526d2018-12-10 15:17:59 -08001723 std::optional<std::string> newUserName;
1724 std::optional<std::string> password;
1725 std::optional<bool> enabled;
1726 std::optional<std::string> roleId;
Ratan Gupta24c85422019-01-30 19:41:24 +05301727 std::optional<bool> locked;
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301728 if (!json_util::readJson(req, res, "UserName", newUserName, "Password",
Ratan Gupta24c85422019-01-30 19:41:24 +05301729 password, "RoleId", roleId, "Enabled", enabled,
1730 "Locked", locked))
Ed Tanousa8408792018-09-05 16:08:38 -07001731 {
1732 return;
1733 }
1734
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301735 const std::string& username = params[0];
Ed Tanousa8408792018-09-05 16:08:38 -07001736
Joseph Reynolds900f9492019-11-25 15:37:29 -06001737 // Perform a proper ConfigureSelf authority check. If the
1738 // session is being used to PATCH a property other than
1739 // Password, then the ConfigureSelf privilege does not apply.
1740 // If the user is operating on an account not their own, then
1741 // their ConfigureSelf privilege does not apply. In either
1742 // case, perform the authority check again without the user's
1743 // ConfigureSelf privilege.
1744 if ((username != req.session->username) ||
1745 (newUserName || enabled || roleId || locked))
1746 {
1747 if (!isAllowedWithoutConfigureSelf(req))
1748 {
1749 BMCWEB_LOG_WARNING << "PATCH Password denied access";
1750 asyncResp->res.clear();
1751 messages::insufficientPrivilege(asyncResp->res);
1752 return;
1753 }
1754 }
1755
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001756 // if user name is not provided in the patch method or if it
1757 // matches the user name in the URI, then we are treating it as updating
1758 // user properties other then username. If username provided doesn't
1759 // match the URI, then we are treating this as user rename request.
1760 if (!newUserName || (newUserName.value() == username))
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301761 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301762 updateUserProperties(asyncResp, username, password, enabled, roleId,
1763 locked);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301764 return;
1765 }
Ed Tanous3174e4d2020-10-07 11:41:22 -07001766 crow::connections::systemBus->async_method_call(
1767 [this, asyncResp, username, password(std::move(password)),
Ed Tanousf23b7292020-10-15 09:41:17 -07001768 roleId(std::move(roleId)), enabled,
Ed Tanous3174e4d2020-10-07 11:41:22 -07001769 newUser{std::string(*newUserName)},
Ed Tanousf23b7292020-10-15 09:41:17 -07001770 locked](const boost::system::error_code ec,
1771 sdbusplus::message::message& m) {
Ed Tanous3174e4d2020-10-07 11:41:22 -07001772 if (ec)
1773 {
1774 userErrorMessageHandler(m.get_error(), asyncResp, newUser,
1775 username);
1776 return;
1777 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301778
Ed Tanous3174e4d2020-10-07 11:41:22 -07001779 updateUserProperties(asyncResp, newUser, password, enabled,
1780 roleId, locked);
1781 },
1782 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1783 "xyz.openbmc_project.User.Manager", "RenameUser", username,
1784 *newUserName);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301785 }
1786
1787 void updateUserProperties(std::shared_ptr<AsyncResp> asyncResp,
1788 const std::string& username,
Ed Tanousa24526d2018-12-10 15:17:59 -08001789 std::optional<std::string> password,
1790 std::optional<bool> enabled,
Ratan Gupta24c85422019-01-30 19:41:24 +05301791 std::optional<std::string> roleId,
1792 std::optional<bool> locked)
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301793 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301794 std::string dbusObjectPath = "/xyz/openbmc_project/user/" + username;
1795 dbus::utility::escapePathForDbus(dbusObjectPath);
1796
Ratan Gupta22c33712019-05-03 21:50:28 +05301797 dbus::utility::checkDbusPathExists(
Ratan Gupta24c85422019-01-30 19:41:24 +05301798 dbusObjectPath,
1799 [dbusObjectPath(std::move(dbusObjectPath)), username,
Ed Tanousf23b7292020-10-15 09:41:17 -07001800 password(std::move(password)), roleId(std::move(roleId)), enabled,
1801 locked, asyncResp{std::move(asyncResp)}](int rc) {
Ratan Gupta24c85422019-01-30 19:41:24 +05301802 if (!rc)
1803 {
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001804 messages::resourceNotFound(
Gunnar Mills8114bd42020-06-11 20:55:21 -05001805 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount",
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001806 username);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301807 return;
Ratan Gupta24c85422019-01-30 19:41:24 +05301808 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001809
1810 if (password)
1811 {
1812 int retval = pamUpdatePassword(username, *password);
1813
1814 if (retval == PAM_USER_UNKNOWN)
1815 {
1816 messages::resourceNotFound(
1817 asyncResp->res,
Gunnar Mills8114bd42020-06-11 20:55:21 -05001818 "#ManagerAccount.v1_4_0.ManagerAccount", username);
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001819 }
1820 else if (retval == PAM_AUTHTOK_ERR)
1821 {
1822 // If password is invalid
1823 messages::propertyValueFormatError(
1824 asyncResp->res, *password, "Password");
1825 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1826 }
1827 else if (retval != PAM_SUCCESS)
1828 {
1829 messages::internalError(asyncResp->res);
1830 return;
1831 }
1832 }
1833
Ratan Gupta24c85422019-01-30 19:41:24 +05301834 if (enabled)
1835 {
1836 crow::connections::systemBus->async_method_call(
1837 [asyncResp](const boost::system::error_code ec) {
1838 if (ec)
1839 {
1840 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1841 << ec;
1842 messages::internalError(asyncResp->res);
1843 return;
1844 }
1845 messages::success(asyncResp->res);
1846 return;
1847 },
1848 "xyz.openbmc_project.User.Manager",
1849 dbusObjectPath.c_str(),
1850 "org.freedesktop.DBus.Properties", "Set",
1851 "xyz.openbmc_project.User.Attributes", "UserEnabled",
1852 std::variant<bool>{*enabled});
1853 }
Ed Tanous9712f8a2018-09-21 13:38:49 -07001854
Ratan Gupta24c85422019-01-30 19:41:24 +05301855 if (roleId)
1856 {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001857 std::string priv = getPrivilegeFromRoleId(*roleId);
Ratan Gupta24c85422019-01-30 19:41:24 +05301858 if (priv.empty())
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301859 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301860 messages::propertyValueNotInList(asyncResp->res,
1861 *roleId, "RoleId");
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301862 return;
1863 }
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001864 if (priv == "priv-noaccess")
1865 {
1866 priv = "";
1867 }
Ratan Gupta24c85422019-01-30 19:41:24 +05301868
1869 crow::connections::systemBus->async_method_call(
1870 [asyncResp](const boost::system::error_code ec) {
1871 if (ec)
1872 {
1873 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1874 << ec;
1875 messages::internalError(asyncResp->res);
1876 return;
1877 }
1878 messages::success(asyncResp->res);
1879 },
1880 "xyz.openbmc_project.User.Manager",
1881 dbusObjectPath.c_str(),
1882 "org.freedesktop.DBus.Properties", "Set",
1883 "xyz.openbmc_project.User.Attributes", "UserPrivilege",
1884 std::variant<std::string>{priv});
1885 }
1886
1887 if (locked)
1888 {
1889 // admin can unlock the account which is locked by
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001890 // successive authentication failures but admin should
1891 // not be allowed to lock an account.
Ratan Gupta24c85422019-01-30 19:41:24 +05301892 if (*locked)
1893 {
1894 messages::propertyValueNotInList(asyncResp->res, "true",
1895 "Locked");
1896 return;
1897 }
1898
1899 crow::connections::systemBus->async_method_call(
1900 [asyncResp](const boost::system::error_code ec) {
1901 if (ec)
1902 {
1903 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1904 << ec;
1905 messages::internalError(asyncResp->res);
1906 return;
1907 }
1908 messages::success(asyncResp->res);
1909 return;
1910 },
1911 "xyz.openbmc_project.User.Manager",
1912 dbusObjectPath.c_str(),
1913 "org.freedesktop.DBus.Properties", "Set",
1914 "xyz.openbmc_project.User.Attributes",
1915 "UserLockedForFailedAttempt",
Patrick Williams19bd78d2020-05-13 17:38:24 -05001916 std::variant<bool>{*locked});
Ratan Gupta24c85422019-01-30 19:41:24 +05301917 }
1918 });
Ed Tanousa8408792018-09-05 16:08:38 -07001919 }
Ed Tanous06e086d2018-09-19 17:19:52 -07001920
Ed Tanouscb13a392020-07-25 19:02:03 +00001921 void doDelete(crow::Response& res, const crow::Request&,
Ed Tanous06e086d2018-09-19 17:19:52 -07001922 const std::vector<std::string>& params) override
1923 {
1924 auto asyncResp = std::make_shared<AsyncResp>(res);
1925
1926 if (params.size() != 1)
1927 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001928 messages::internalError(asyncResp->res);
Ed Tanous06e086d2018-09-19 17:19:52 -07001929 return;
1930 }
1931
1932 const std::string userPath = "/xyz/openbmc_project/user/" + params[0];
1933
1934 crow::connections::systemBus->async_method_call(
Ed Tanousf23b7292020-10-15 09:41:17 -07001935 [asyncResp,
1936 username{params[0]}](const boost::system::error_code ec) {
Ed Tanous06e086d2018-09-19 17:19:52 -07001937 if (ec)
1938 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001939 messages::resourceNotFound(
Gunnar Mills8114bd42020-06-11 20:55:21 -05001940 asyncResp->res, "#ManagerAccount.v1_4_0.ManagerAccount",
Jason M. Billsf12894f2018-10-09 12:45:45 -07001941 username);
Ed Tanous06e086d2018-09-19 17:19:52 -07001942 return;
1943 }
1944
Jason M. Billsf12894f2018-10-09 12:45:45 -07001945 messages::accountRemoved(asyncResp->res);
Ed Tanous06e086d2018-09-19 17:19:52 -07001946 },
1947 "xyz.openbmc_project.User.Manager", userPath,
1948 "xyz.openbmc_project.Object.Delete", "Delete");
1949 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301950};
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001951
Ed Tanous1abe55e2018-09-05 08:30:59 -07001952} // namespace redfish