blob: 3a1869f095073a96e4da539c1c15d1aa751844eb [file] [log] [blame]
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001/*
2// Copyright (c) 2018 Intel Corporation
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8// http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15*/
16#pragma once
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010017
Ed Tanous3ccb3ad2023-01-13 17:40:03 -080018#include "app.hpp"
19#include "dbus_utility.hpp"
20#include "error_messages.hpp"
Ed Tanous0ec8b832022-03-14 14:56:47 -070021#include "generated/enums/account_service.hpp"
Ed Tanous3ccb3ad2023-01-13 17:40:03 -080022#include "openbmc_dbus_rest.hpp"
23#include "persistent_data.hpp"
24#include "query.hpp"
Ed Tanous0ec8b832022-03-14 14:56:47 -070025#include "registries/privilege_registry.hpp"
Ed Tanous3ccb3ad2023-01-13 17:40:03 -080026#include "utils/dbus_utils.hpp"
27#include "utils/json_utils.hpp"
Ed Tanous0ec8b832022-03-14 14:56:47 -070028
Jonathan Doman1e1e5982021-06-11 09:36:17 -070029#include <sdbusplus/asio/property.hpp>
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +020030#include <sdbusplus/unpack_properties.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050031
George Liu2b731192023-01-11 16:27:13 +080032#include <array>
Abhishek Patelc7229812022-02-01 10:07:15 -060033#include <optional>
Ed Tanous3544d2a2023-08-06 18:12:20 -070034#include <ranges>
Abhishek Patelc7229812022-02-01 10:07:15 -060035#include <string>
George Liu2b731192023-01-11 16:27:13 +080036#include <string_view>
Abhishek Patelc7229812022-02-01 10:07:15 -060037#include <vector>
38
Ed Tanous1abe55e2018-09-05 08:30:59 -070039namespace redfish
40{
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010041
Ed Tanous23a21a12020-07-25 04:45:05 +000042constexpr const char* ldapConfigObjectName =
Ratan Gupta6973a582018-12-13 18:25:44 +053043 "/xyz/openbmc_project/user/ldap/openldap";
Ed Tanous2c70f802020-09-28 14:29:23 -070044constexpr const char* adConfigObject =
Ratan Guptaab828d72019-04-22 14:18:33 +053045 "/xyz/openbmc_project/user/ldap/active_directory";
46
P Dheeraj Srujan Kumarb477fd42021-12-16 07:17:51 +053047constexpr const char* rootUserDbusPath = "/xyz/openbmc_project/user/";
Ratan Gupta6973a582018-12-13 18:25:44 +053048constexpr const char* ldapRootObject = "/xyz/openbmc_project/user/ldap";
49constexpr const char* ldapDbusService = "xyz.openbmc_project.Ldap.Config";
50constexpr const char* ldapConfigInterface =
51 "xyz.openbmc_project.User.Ldap.Config";
52constexpr const char* ldapCreateInterface =
53 "xyz.openbmc_project.User.Ldap.Create";
54constexpr const char* ldapEnableInterface = "xyz.openbmc_project.Object.Enable";
Ratan Gupta06785242019-07-26 22:30:16 +053055constexpr const char* ldapPrivMapperInterface =
56 "xyz.openbmc_project.User.PrivilegeMapper";
Ratan Gupta6973a582018-12-13 18:25:44 +053057
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060058struct LDAPRoleMapData
59{
60 std::string groupName;
61 std::string privilege;
62};
63
Ratan Gupta6973a582018-12-13 18:25:44 +053064struct LDAPConfigData
65{
Ed Tanous47f29342024-03-19 12:18:06 -070066 std::string uri;
67 std::string bindDN;
68 std::string baseDN;
69 std::string searchScope;
70 std::string serverType;
Ratan Gupta6973a582018-12-13 18:25:44 +053071 bool serviceEnabled = false;
Ed Tanous47f29342024-03-19 12:18:06 -070072 std::string userNameAttribute;
73 std::string groupAttribute;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060074 std::vector<std::pair<std::string, LDAPRoleMapData>> groupRoleList;
Ratan Gupta6973a582018-12-13 18:25:44 +053075};
76
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060077inline std::string getRoleIdFromPrivilege(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053078{
79 if (role == "priv-admin")
80 {
81 return "Administrator";
82 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070083 if (role == "priv-user")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053084 {
AppaRao Pulic80fee52019-10-16 14:49:36 +053085 return "ReadOnly";
AppaRao Puli84e12cb2018-10-11 01:28:15 +053086 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070087 if (role == "priv-operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +053088 {
89 return "Operator";
90 }
91 return "";
92}
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060093inline std::string getPrivilegeFromRoleId(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053094{
95 if (role == "Administrator")
96 {
97 return "priv-admin";
98 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070099 if (role == "ReadOnly")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530100 {
101 return "priv-user";
102 }
Ed Tanous3174e4d2020-10-07 11:41:22 -0700103 if (role == "Operator")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530104 {
105 return "priv-operator";
106 }
107 return "";
108}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -0700109
Abhishek Patelc7229812022-02-01 10:07:15 -0600110/**
111 * @brief Maps user group names retrieved from D-Bus object to
112 * Account Types.
113 *
114 * @param[in] userGroups List of User groups
115 * @param[out] res AccountTypes populated
116 *
117 * @return true in case of success, false if UserGroups contains
118 * invalid group name(s).
119 */
120inline bool translateUserGroup(const std::vector<std::string>& userGroups,
121 crow::Response& res)
122{
123 std::vector<std::string> accountTypes;
124 for (const auto& userGroup : userGroups)
125 {
126 if (userGroup == "redfish")
127 {
128 accountTypes.emplace_back("Redfish");
129 accountTypes.emplace_back("WebUI");
130 }
131 else if (userGroup == "ipmi")
132 {
133 accountTypes.emplace_back("IPMI");
134 }
135 else if (userGroup == "ssh")
136 {
Abhishek Patelc7229812022-02-01 10:07:15 -0600137 accountTypes.emplace_back("ManagerConsole");
138 }
Ninad Palsule3e72c202023-03-27 17:19:55 -0500139 else if (userGroup == "hostconsole")
140 {
141 // The hostconsole group controls who can access the host console
142 // port via ssh and websocket.
143 accountTypes.emplace_back("HostConsole");
144 }
Abhishek Patelc7229812022-02-01 10:07:15 -0600145 else if (userGroup == "web")
146 {
147 // 'web' is one of the valid groups in the UserGroups property of
148 // the user account in the D-Bus object. This group is currently not
149 // doing anything, and is considered to be equivalent to 'redfish'.
150 // 'redfish' user group is mapped to 'Redfish'and 'WebUI'
151 // AccountTypes, so do nothing here...
152 }
153 else
154 {
Ed Tanous8ece0e42024-01-02 13:16:50 -0800155 // Invalid user group name. Caller throws an exception.
Abhishek Patelc7229812022-02-01 10:07:15 -0600156 return false;
157 }
158 }
159
160 res.jsonValue["AccountTypes"] = std::move(accountTypes);
161 return true;
162}
163
Abhishek Patel58345852022-02-02 08:54:25 -0600164/**
165 * @brief Builds User Groups from the Account Types
166 *
167 * @param[in] asyncResp Async Response
168 * @param[in] accountTypes List of Account Types
169 * @param[out] userGroups List of User Groups mapped from Account Types
170 *
171 * @return true if Account Types mapped to User Groups, false otherwise.
172 */
173inline bool
174 getUserGroupFromAccountType(crow::Response& res,
175 const std::vector<std::string>& accountTypes,
176 std::vector<std::string>& userGroups)
177{
178 // Need both Redfish and WebUI Account Types to map to 'redfish' User Group
179 bool redfishType = false;
180 bool webUIType = false;
181
182 for (const auto& accountType : accountTypes)
183 {
184 if (accountType == "Redfish")
185 {
186 redfishType = true;
187 }
188 else if (accountType == "WebUI")
189 {
190 webUIType = true;
191 }
192 else if (accountType == "IPMI")
193 {
194 userGroups.emplace_back("ipmi");
195 }
196 else if (accountType == "HostConsole")
197 {
198 userGroups.emplace_back("hostconsole");
199 }
200 else if (accountType == "ManagerConsole")
201 {
202 userGroups.emplace_back("ssh");
203 }
204 else
205 {
206 // Invalid Account Type
207 messages::propertyValueNotInList(res, "AccountTypes", accountType);
208 return false;
209 }
210 }
211
212 // Both Redfish and WebUI Account Types are needed to PATCH
213 if (redfishType ^ webUIType)
214 {
Ed Tanous62598e32023-07-17 17:06:25 -0700215 BMCWEB_LOG_ERROR(
216 "Missing Redfish or WebUI Account Type to set redfish User Group");
Abhishek Patel58345852022-02-02 08:54:25 -0600217 messages::strictAccountTypes(res, "AccountTypes");
218 return false;
219 }
220
221 if (redfishType && webUIType)
222 {
223 userGroups.emplace_back("redfish");
224 }
225
226 return true;
227}
228
229/**
230 * @brief Sets UserGroups property of the user based on the Account Types
231 *
232 * @param[in] accountTypes List of User Account Types
233 * @param[in] asyncResp Async Response
234 * @param[in] dbusObjectPath D-Bus Object Path
235 * @param[in] userSelf true if User is updating OWN Account Types
236 */
237inline void
238 patchAccountTypes(const std::vector<std::string>& accountTypes,
239 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
240 const std::string& dbusObjectPath, bool userSelf)
241{
242 // Check if User is disabling own Redfish Account Type
243 if (userSelf &&
244 (accountTypes.cend() ==
245 std::find(accountTypes.cbegin(), accountTypes.cend(), "Redfish")))
246 {
Ed Tanous62598e32023-07-17 17:06:25 -0700247 BMCWEB_LOG_ERROR(
248 "User disabling OWN Redfish Account Type is not allowed");
Abhishek Patel58345852022-02-02 08:54:25 -0600249 messages::strictAccountTypes(asyncResp->res, "AccountTypes");
250 return;
251 }
252
253 std::vector<std::string> updatedUserGroups;
254 if (!getUserGroupFromAccountType(asyncResp->res, accountTypes,
255 updatedUserGroups))
256 {
257 // Problem in mapping Account Types to User Groups, Error already
258 // logged.
259 return;
260 }
Ed Tanousd02aad32024-02-13 14:43:34 -0800261 setDbusProperty(asyncResp, "xyz.openbmc_project.User.Manager",
262 dbusObjectPath, "xyz.openbmc_project.User.Attributes",
263 "UserGroups", "AccountTypes", updatedUserGroups);
Abhishek Patel58345852022-02-02 08:54:25 -0600264}
265
zhanghch058d1b46d2021-04-01 11:18:24 +0800266inline void userErrorMessageHandler(
267 const sd_bus_error* e, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
268 const std::string& newUser, const std::string& username)
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000269{
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000270 if (e == nullptr)
271 {
272 messages::internalError(asyncResp->res);
273 return;
274 }
275
Manojkiran Eda055806b2020-11-03 09:36:28 +0530276 const char* errorMessage = e->name;
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000277 if (strcmp(errorMessage,
278 "xyz.openbmc_project.User.Common.Error.UserNameExists") == 0)
279 {
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +0800280 messages::resourceAlreadyExists(asyncResp->res, "ManagerAccount",
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000281 "UserName", newUser);
282 }
283 else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
284 "UserNameDoesNotExist") == 0)
285 {
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +0800286 messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000287 }
Ed Tanousd4d25792020-09-29 15:15:03 -0700288 else if ((strcmp(errorMessage,
289 "xyz.openbmc_project.Common.Error.InvalidArgument") ==
290 0) ||
George Liu0fda0f12021-11-16 10:06:17 +0800291 (strcmp(
292 errorMessage,
293 "xyz.openbmc_project.User.Common.Error.UserNameGroupFail") ==
294 0))
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000295 {
296 messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
297 }
298 else if (strcmp(errorMessage,
299 "xyz.openbmc_project.User.Common.Error.NoResource") == 0)
300 {
301 messages::createLimitReachedForResource(asyncResp->res);
302 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000303 else
304 {
Gunnar Millsb8ad5832023-10-02 16:26:07 -0500305 BMCWEB_LOG_ERROR("DBUS response error {}", errorMessage);
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000306 messages::internalError(asyncResp->res);
307 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000308}
309
Ed Tanous81ce6092020-12-17 16:54:55 +0000310inline void parseLDAPConfigData(nlohmann::json& jsonResponse,
Ed Tanous23a21a12020-07-25 04:45:05 +0000311 const LDAPConfigData& confData,
312 const std::string& ldapType)
Ratan Gupta6973a582018-12-13 18:25:44 +0530313{
Ed Tanous49cc2632024-03-20 12:49:15 -0700314 nlohmann::json::object_t ldap;
Ed Tanous14766872022-03-15 10:44:42 -0700315 ldap["ServiceEnabled"] = confData.serviceEnabled;
Ed Tanous49cc2632024-03-20 12:49:15 -0700316 nlohmann::json::array_t serviceAddresses;
317 serviceAddresses.emplace_back(confData.uri);
318 ldap["ServiceAddresses"] = std::move(serviceAddresses);
319
320 nlohmann::json::object_t authentication;
321 authentication["AuthenticationType"] =
Ed Tanous0ec8b832022-03-14 14:56:47 -0700322 account_service::AuthenticationTypes::UsernameAndPassword;
Ed Tanous49cc2632024-03-20 12:49:15 -0700323 authentication["Username"] = confData.bindDN;
324 authentication["Password"] = nullptr;
325 ldap["Authentication"] = std::move(authentication);
Ed Tanous14766872022-03-15 10:44:42 -0700326
Ed Tanous49cc2632024-03-20 12:49:15 -0700327 nlohmann::json::object_t ldapService;
328 nlohmann::json::object_t searchSettings;
329 nlohmann::json::array_t baseDistinguishedNames;
330 baseDistinguishedNames.emplace_back(confData.baseDN);
Ed Tanous14766872022-03-15 10:44:42 -0700331
Ed Tanous49cc2632024-03-20 12:49:15 -0700332 searchSettings["BaseDistinguishedNames"] =
333 std::move(baseDistinguishedNames);
334 searchSettings["UsernameAttribute"] = confData.userNameAttribute;
335 searchSettings["GroupsAttribute"] = confData.groupAttribute;
336 ldapService["SearchSettings"] = std::move(searchSettings);
337 ldap["LDAPService"] = std::move(ldapService);
338
339 nlohmann::json::array_t roleMapArray;
Ed Tanous9eb808c2022-01-25 10:19:23 -0800340 for (const auto& obj : confData.groupRoleList)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600341 {
Ed Tanous62598e32023-07-17 17:06:25 -0700342 BMCWEB_LOG_DEBUG("Pushing the data groupName={}", obj.second.groupName);
Ed Tanous613dabe2022-07-09 11:17:36 -0700343
Ed Tanous613dabe2022-07-09 11:17:36 -0700344 nlohmann::json::object_t remoteGroup;
345 remoteGroup["RemoteGroup"] = obj.second.groupName;
Jorge Cisneros329f0342022-11-04 16:26:25 +0000346 remoteGroup["LocalRole"] = getRoleIdFromPrivilege(obj.second.privilege);
347 roleMapArray.emplace_back(std::move(remoteGroup));
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600348 }
Ed Tanous49cc2632024-03-20 12:49:15 -0700349
350 ldap["RemoteRoleMapping"] = std::move(roleMapArray);
351
352 jsonResponse[ldapType].update(ldap);
Ratan Gupta6973a582018-12-13 18:25:44 +0530353}
354
355/**
Ratan Gupta06785242019-07-26 22:30:16 +0530356 * @brief validates given JSON input and then calls appropriate method to
357 * create, to delete or to set Rolemapping object based on the given input.
358 *
359 */
Ed Tanous23a21a12020-07-25 04:45:05 +0000360inline void handleRoleMapPatch(
zhanghch058d1b46d2021-04-01 11:18:24 +0800361 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
Ratan Gupta06785242019-07-26 22:30:16 +0530362 const std::vector<std::pair<std::string, LDAPRoleMapData>>& roleMapObjData,
Ed Tanousc1019822024-03-06 12:54:38 -0800363 const std::string& serverType,
364 std::vector<std::variant<nlohmann::json::object_t, std::nullptr_t>>& input)
Ratan Gupta06785242019-07-26 22:30:16 +0530365{
366 for (size_t index = 0; index < input.size(); index++)
367 {
Ed Tanousc1019822024-03-06 12:54:38 -0800368 std::variant<nlohmann::json::object_t, std::nullptr_t>& thisJson =
369 input[index];
370 nlohmann::json::object_t* obj =
371 std::get_if<nlohmann::json::object_t>(&thisJson);
372 if (obj == nullptr)
Ratan Gupta06785242019-07-26 22:30:16 +0530373 {
374 // delete the existing object
375 if (index < roleMapObjData.size())
376 {
377 crow::connections::systemBus->async_method_call(
378 [asyncResp, roleMapObjData, serverType,
Ed Tanous5e7e2dc2023-02-16 10:37:01 -0800379 index](const boost::system::error_code& ec) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700380 if (ec)
381 {
Ed Tanous62598e32023-07-17 17:06:25 -0700382 BMCWEB_LOG_ERROR("DBUS response error: {}", ec);
Ed Tanous002d39b2022-05-31 08:59:27 -0700383 messages::internalError(asyncResp->res);
384 return;
385 }
Patrick Williams89492a12023-05-10 07:51:34 -0500386 asyncResp->res.jsonValue[serverType]["RemoteRoleMapping"]
387 [index] = nullptr;
Patrick Williams5a39f772023-10-20 11:20:21 -0500388 },
Ratan Gupta06785242019-07-26 22:30:16 +0530389 ldapDbusService, roleMapObjData[index].first,
390 "xyz.openbmc_project.Object.Delete", "Delete");
391 }
392 else
393 {
Ed Tanous62598e32023-07-17 17:06:25 -0700394 BMCWEB_LOG_ERROR("Can't delete the object");
Ed Tanousc1019822024-03-06 12:54:38 -0800395 messages::propertyValueTypeError(asyncResp->res, "null",
Ed Tanous2e8c4bd2022-06-27 12:59:12 -0700396 "RemoteRoleMapping/" +
397 std::to_string(index));
Ratan Gupta06785242019-07-26 22:30:16 +0530398 return;
399 }
400 }
Ed Tanousc1019822024-03-06 12:54:38 -0800401 else if (obj->empty())
Ratan Gupta06785242019-07-26 22:30:16 +0530402 {
403 // Don't do anything for the empty objects,parse next json
404 // eg {"RemoteRoleMapping",[{}]}
405 }
406 else
407 {
408 // update/create the object
409 std::optional<std::string> remoteGroup;
410 std::optional<std::string> localRole;
411
Ed Tanousc1019822024-03-06 12:54:38 -0800412 if (!json_util::readJsonObject(*obj, asyncResp->res, "RemoteGroup",
413 remoteGroup, "LocalRole", localRole))
Ratan Gupta06785242019-07-26 22:30:16 +0530414 {
415 continue;
416 }
417
418 // Update existing RoleMapping Object
419 if (index < roleMapObjData.size())
420 {
Ed Tanous62598e32023-07-17 17:06:25 -0700421 BMCWEB_LOG_DEBUG("Update Role Map Object");
Ratan Gupta06785242019-07-26 22:30:16 +0530422 // If "RemoteGroup" info is provided
423 if (remoteGroup)
424 {
Ed Tanousd02aad32024-02-13 14:43:34 -0800425 setDbusProperty(
426 asyncResp, ldapDbusService, roleMapObjData[index].first,
George Liu9ae226f2023-06-21 17:56:46 +0800427 "xyz.openbmc_project.User.PrivilegeMapperEntry",
Ed Tanousd02aad32024-02-13 14:43:34 -0800428 "GroupName",
429 std::format("RemoteRoleMapping/{}/RemoteGroup", index),
430 *remoteGroup);
Ratan Gupta06785242019-07-26 22:30:16 +0530431 }
432
433 // If "LocalRole" info is provided
434 if (localRole)
435 {
Ed Tanousd02aad32024-02-13 14:43:34 -0800436 setDbusProperty(
437 asyncResp, ldapDbusService, roleMapObjData[index].first,
George Liu9ae226f2023-06-21 17:56:46 +0800438 "xyz.openbmc_project.User.PrivilegeMapperEntry",
Ed Tanousd02aad32024-02-13 14:43:34 -0800439 "Privilege",
440 std::format("RemoteRoleMapping/{}/LocalRole", index),
441 *localRole);
Ratan Gupta06785242019-07-26 22:30:16 +0530442 }
443 }
444 // Create a new RoleMapping Object.
445 else
446 {
Ed Tanous62598e32023-07-17 17:06:25 -0700447 BMCWEB_LOG_DEBUG(
448 "setRoleMappingProperties: Creating new Object");
Patrick Williams89492a12023-05-10 07:51:34 -0500449 std::string pathString = "RemoteRoleMapping/" +
450 std::to_string(index);
Ratan Gupta06785242019-07-26 22:30:16 +0530451
452 if (!localRole)
453 {
454 messages::propertyMissing(asyncResp->res,
455 pathString + "/LocalRole");
456 continue;
457 }
458 if (!remoteGroup)
459 {
460 messages::propertyMissing(asyncResp->res,
461 pathString + "/RemoteGroup");
462 continue;
463 }
464
465 std::string dbusObjectPath;
466 if (serverType == "ActiveDirectory")
467 {
Ed Tanous2c70f802020-09-28 14:29:23 -0700468 dbusObjectPath = adConfigObject;
Ratan Gupta06785242019-07-26 22:30:16 +0530469 }
470 else if (serverType == "LDAP")
471 {
Ed Tanous23a21a12020-07-25 04:45:05 +0000472 dbusObjectPath = ldapConfigObjectName;
Ratan Gupta06785242019-07-26 22:30:16 +0530473 }
474
Ed Tanous62598e32023-07-17 17:06:25 -0700475 BMCWEB_LOG_DEBUG("Remote Group={},LocalRole={}", *remoteGroup,
476 *localRole);
Ratan Gupta06785242019-07-26 22:30:16 +0530477
478 crow::connections::systemBus->async_method_call(
Ed Tanous271584a2019-07-09 16:24:22 -0700479 [asyncResp, serverType, localRole,
Ed Tanous5e7e2dc2023-02-16 10:37:01 -0800480 remoteGroup](const boost::system::error_code& ec) {
Ed Tanous002d39b2022-05-31 08:59:27 -0700481 if (ec)
482 {
Ed Tanous62598e32023-07-17 17:06:25 -0700483 BMCWEB_LOG_ERROR("DBUS response error: {}", ec);
Ed Tanous002d39b2022-05-31 08:59:27 -0700484 messages::internalError(asyncResp->res);
485 return;
486 }
487 nlohmann::json& remoteRoleJson =
488 asyncResp->res
489 .jsonValue[serverType]["RemoteRoleMapping"];
490 nlohmann::json::object_t roleMapEntry;
491 roleMapEntry["LocalRole"] = *localRole;
492 roleMapEntry["RemoteGroup"] = *remoteGroup;
Patrick Williamsb2ba3072023-05-12 10:27:39 -0500493 remoteRoleJson.emplace_back(std::move(roleMapEntry));
Patrick Williams5a39f772023-10-20 11:20:21 -0500494 },
Ratan Gupta06785242019-07-26 22:30:16 +0530495 ldapDbusService, dbusObjectPath, ldapPrivMapperInterface,
Ed Tanous3174e4d2020-10-07 11:41:22 -0700496 "Create", *remoteGroup,
Ratan Gupta06785242019-07-26 22:30:16 +0530497 getPrivilegeFromRoleId(std::move(*localRole)));
498 }
499 }
500 }
501}
502
503/**
Ratan Gupta6973a582018-12-13 18:25:44 +0530504 * Function that retrieves all properties for LDAP config object
505 * into JSON
506 */
507template <typename CallbackFunc>
508inline void getLDAPConfigData(const std::string& ldapType,
509 CallbackFunc&& callback)
510{
George Liu2b731192023-01-11 16:27:13 +0800511 constexpr std::array<std::string_view, 2> interfaces = {
512 ldapEnableInterface, ldapConfigInterface};
Ratan Gupta6973a582018-12-13 18:25:44 +0530513
George Liu2b731192023-01-11 16:27:13 +0800514 dbus::utility::getDbusObject(
515 ldapConfigObjectName, interfaces,
Ed Tanousc1019822024-03-06 12:54:38 -0800516 [callback,
517 ldapType](const boost::system::error_code& ec,
518 const dbus::utility::MapperGetObject& resp) mutable {
Ed Tanous002d39b2022-05-31 08:59:27 -0700519 if (ec || resp.empty())
520 {
Carson Labradobf2dded2023-08-10 00:37:06 +0000521 BMCWEB_LOG_WARNING(
Ed Tanous62598e32023-07-17 17:06:25 -0700522 "DBUS response error during getting of service name: {}", ec);
Ed Tanous002d39b2022-05-31 08:59:27 -0700523 LDAPConfigData empty{};
524 callback(false, empty, ldapType);
525 return;
526 }
527 std::string service = resp.begin()->first;
George Liu5eb468d2023-06-20 17:03:24 +0800528 sdbusplus::message::object_path path(ldapRootObject);
529 dbus::utility::getManagedObjects(
530 service, path,
Ed Tanousc1019822024-03-06 12:54:38 -0800531 [callback, ldapType](
532 const boost::system::error_code& ec2,
533 const dbus::utility::ManagedObjectType& ldapObjects) mutable {
Ed Tanous002d39b2022-05-31 08:59:27 -0700534 LDAPConfigData confData{};
Ed Tanous8b242752023-06-27 17:17:13 -0700535 if (ec2)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600536 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700537 callback(false, confData, ldapType);
Carson Labradobf2dded2023-08-10 00:37:06 +0000538 BMCWEB_LOG_WARNING("D-Bus responses error: {}", ec2);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600539 return;
540 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600541
Ed Tanous002d39b2022-05-31 08:59:27 -0700542 std::string ldapDbusType;
543 std::string searchString;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600544
Ed Tanous002d39b2022-05-31 08:59:27 -0700545 if (ldapType == "LDAP")
546 {
547 ldapDbusType =
548 "xyz.openbmc_project.User.Ldap.Config.Type.OpenLdap";
549 searchString = "openldap";
550 }
551 else if (ldapType == "ActiveDirectory")
552 {
553 ldapDbusType =
554 "xyz.openbmc_project.User.Ldap.Config.Type.ActiveDirectory";
555 searchString = "active_directory";
556 }
557 else
558 {
Ed Tanous62598e32023-07-17 17:06:25 -0700559 BMCWEB_LOG_ERROR("Can't get the DbusType for the given type={}",
560 ldapType);
Ed Tanous002d39b2022-05-31 08:59:27 -0700561 callback(false, confData, ldapType);
562 return;
563 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600564
Ed Tanous002d39b2022-05-31 08:59:27 -0700565 std::string ldapEnableInterfaceStr = ldapEnableInterface;
566 std::string ldapConfigInterfaceStr = ldapConfigInterface;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600567
Ed Tanous002d39b2022-05-31 08:59:27 -0700568 for (const auto& object : ldapObjects)
569 {
570 // let's find the object whose ldap type is equal to the
571 // given type
572 if (object.first.str.find(searchString) == std::string::npos)
573 {
574 continue;
575 }
576
577 for (const auto& interface : object.second)
578 {
579 if (interface.first == ldapEnableInterfaceStr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600580 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700581 // rest of the properties are string.
582 for (const auto& property : interface.second)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600583 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700584 if (property.first == "Enabled")
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600585 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700586 const bool* value =
587 std::get_if<bool>(&property.second);
588 if (value == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600589 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700590 continue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600591 }
Ed Tanous002d39b2022-05-31 08:59:27 -0700592 confData.serviceEnabled = *value;
593 break;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600594 }
595 }
596 }
Ed Tanous002d39b2022-05-31 08:59:27 -0700597 else if (interface.first == ldapConfigInterfaceStr)
598 {
Ed Tanous002d39b2022-05-31 08:59:27 -0700599 for (const auto& property : interface.second)
600 {
601 const std::string* strValue =
602 std::get_if<std::string>(&property.second);
603 if (strValue == nullptr)
604 {
605 continue;
606 }
607 if (property.first == "LDAPServerURI")
608 {
609 confData.uri = *strValue;
610 }
611 else if (property.first == "LDAPBindDN")
612 {
613 confData.bindDN = *strValue;
614 }
615 else if (property.first == "LDAPBaseDN")
616 {
617 confData.baseDN = *strValue;
618 }
619 else if (property.first == "LDAPSearchScope")
620 {
621 confData.searchScope = *strValue;
622 }
623 else if (property.first == "GroupNameAttribute")
624 {
625 confData.groupAttribute = *strValue;
626 }
627 else if (property.first == "UserNameAttribute")
628 {
629 confData.userNameAttribute = *strValue;
630 }
631 else if (property.first == "LDAPType")
632 {
633 confData.serverType = *strValue;
634 }
635 }
636 }
637 else if (interface.first ==
638 "xyz.openbmc_project.User.PrivilegeMapperEntry")
639 {
640 LDAPRoleMapData roleMapData{};
641 for (const auto& property : interface.second)
642 {
643 const std::string* strValue =
644 std::get_if<std::string>(&property.second);
645
646 if (strValue == nullptr)
647 {
648 continue;
649 }
650
651 if (property.first == "GroupName")
652 {
653 roleMapData.groupName = *strValue;
654 }
655 else if (property.first == "Privilege")
656 {
657 roleMapData.privilege = *strValue;
658 }
659 }
660
661 confData.groupRoleList.emplace_back(object.first.str,
662 roleMapData);
663 }
664 }
665 }
666 callback(true, confData, ldapType);
George Liu2b731192023-01-11 16:27:13 +0800667 });
Patrick Williams5a39f772023-10-20 11:20:21 -0500668 });
Ratan Gupta6973a582018-12-13 18:25:44 +0530669}
670
Ed Tanous6c51eab2021-06-03 12:30:29 -0700671/**
Ed Tanous6c51eab2021-06-03 12:30:29 -0700672 * @brief updates the LDAP server address and updates the
673 json response with the new value.
674 * @param serviceAddressList address to be updated.
675 * @param asyncResp pointer to the JSON response
676 * @param ldapServerElementName Type of LDAP
677 server(openLDAP/ActiveDirectory)
678 */
Ratan Gupta8a07d282019-03-16 08:33:47 +0530679
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700680inline void handleServiceAddressPatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700681 const std::vector<std::string>& serviceAddressList,
682 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
683 const std::string& ldapServerElementName,
684 const std::string& ldapConfigObject)
685{
Ed Tanousd02aad32024-02-13 14:43:34 -0800686 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
687 ldapConfigInterface, "LDAPServerURI",
688 ldapServerElementName + "/ServiceAddress",
689 serviceAddressList.front());
Ed Tanous6c51eab2021-06-03 12:30:29 -0700690}
691/**
692 * @brief updates the LDAP Bind DN and updates the
693 json response with the new value.
694 * @param username name of the user which needs to be updated.
695 * @param asyncResp pointer to the JSON response
696 * @param ldapServerElementName Type of LDAP
697 server(openLDAP/ActiveDirectory)
698 */
Ratan Gupta8a07d282019-03-16 08:33:47 +0530699
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700700inline void
701 handleUserNamePatch(const std::string& username,
702 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
703 const std::string& ldapServerElementName,
704 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700705{
Ed Tanousd02aad32024-02-13 14:43:34 -0800706 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
707 ldapConfigInterface, "LDAPBindDN",
708 ldapServerElementName + "/Authentication/Username",
709 username);
Ed Tanous6c51eab2021-06-03 12:30:29 -0700710}
711
712/**
713 * @brief updates the LDAP password
714 * @param password : ldap password which needs to be updated.
715 * @param asyncResp pointer to the JSON response
716 * @param ldapServerElementName Type of LDAP
717 * server(openLDAP/ActiveDirectory)
718 */
719
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700720inline void
721 handlePasswordPatch(const std::string& password,
722 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
723 const std::string& ldapServerElementName,
724 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700725{
Ed Tanousd02aad32024-02-13 14:43:34 -0800726 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
727 ldapConfigInterface, "LDAPBindDNPassword",
728 ldapServerElementName + "/Authentication/Password",
729 password);
Ed Tanous6c51eab2021-06-03 12:30:29 -0700730}
731
732/**
733 * @brief updates the LDAP BaseDN and updates the
734 json response with the new value.
735 * @param baseDNList baseDN list which needs to be updated.
736 * @param asyncResp pointer to the JSON response
737 * @param ldapServerElementName Type of LDAP
738 server(openLDAP/ActiveDirectory)
739 */
740
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700741inline void
742 handleBaseDNPatch(const std::vector<std::string>& baseDNList,
743 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
744 const std::string& ldapServerElementName,
745 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700746{
Ed Tanousd02aad32024-02-13 14:43:34 -0800747 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
748 ldapConfigInterface, "LDAPBaseDN",
749 ldapServerElementName +
750 "/LDAPService/SearchSettings/BaseDistinguishedNames",
751 baseDNList.front());
Ed Tanous6c51eab2021-06-03 12:30:29 -0700752}
753/**
754 * @brief updates the LDAP user name attribute and updates the
755 json response with the new value.
756 * @param userNameAttribute attribute to be updated.
757 * @param asyncResp pointer to the JSON response
758 * @param ldapServerElementName Type of LDAP
759 server(openLDAP/ActiveDirectory)
760 */
761
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700762inline void
763 handleUserNameAttrPatch(const std::string& userNameAttribute,
764 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
765 const std::string& ldapServerElementName,
766 const std::string& ldapConfigObject)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700767{
Ed Tanousd02aad32024-02-13 14:43:34 -0800768 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
769 ldapConfigInterface, "UserNameAttribute",
770 ldapServerElementName +
771 "LDAPService/SearchSettings/UsernameAttribute",
772 userNameAttribute);
Ed Tanous6c51eab2021-06-03 12:30:29 -0700773}
774/**
775 * @brief updates the LDAP group attribute and updates the
776 json response with the new value.
777 * @param groupsAttribute attribute to be updated.
778 * @param asyncResp pointer to the JSON response
779 * @param ldapServerElementName Type of LDAP
780 server(openLDAP/ActiveDirectory)
781 */
782
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700783inline void handleGroupNameAttrPatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700784 const std::string& groupsAttribute,
785 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
786 const std::string& ldapServerElementName,
787 const std::string& ldapConfigObject)
788{
Ed Tanousd02aad32024-02-13 14:43:34 -0800789 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
790 ldapConfigInterface, "GroupNameAttribute",
791 ldapServerElementName +
792 "/LDAPService/SearchSettings/GroupsAttribute",
793 groupsAttribute);
Ed Tanous6c51eab2021-06-03 12:30:29 -0700794}
795/**
796 * @brief updates the LDAP service enable and updates the
797 json response with the new value.
798 * @param input JSON data.
799 * @param asyncResp pointer to the JSON response
800 * @param ldapServerElementName Type of LDAP
801 server(openLDAP/ActiveDirectory)
802 */
803
Ed Tanous4f48d5f2021-06-21 08:27:45 -0700804inline void handleServiceEnablePatch(
Ed Tanous6c51eab2021-06-03 12:30:29 -0700805 bool serviceEnabled, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
806 const std::string& ldapServerElementName,
807 const std::string& ldapConfigObject)
808{
Ed Tanousd02aad32024-02-13 14:43:34 -0800809 setDbusProperty(asyncResp, ldapDbusService, ldapConfigObject,
810 ldapEnableInterface, "Enabled",
811 ldapServerElementName + "/ServiceEnabled", serviceEnabled);
Ed Tanous6c51eab2021-06-03 12:30:29 -0700812}
813
Ed Tanousc1019822024-03-06 12:54:38 -0800814struct AuthMethods
Ed Tanous6c51eab2021-06-03 12:30:29 -0700815{
816 std::optional<bool> basicAuth;
817 std::optional<bool> cookie;
818 std::optional<bool> sessionToken;
819 std::optional<bool> xToken;
820 std::optional<bool> tls;
Ed Tanousc1019822024-03-06 12:54:38 -0800821};
Ed Tanous6c51eab2021-06-03 12:30:29 -0700822
Ed Tanousc1019822024-03-06 12:54:38 -0800823inline void
824 handleAuthMethodsPatch(const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
825 const AuthMethods& auth)
826{
827 persistent_data::AuthConfigMethods& authMethodsConfig =
Ed Tanous6c51eab2021-06-03 12:30:29 -0700828 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
829
Ed Tanousc1019822024-03-06 12:54:38 -0800830 if (auth.basicAuth)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700831 {
832#ifndef BMCWEB_ENABLE_BASIC_AUTHENTICATION
833 messages::actionNotSupported(
George Liu0fda0f12021-11-16 10:06:17 +0800834 asyncResp->res,
835 "Setting BasicAuth when basic-auth feature is disabled");
Ed Tanous6c51eab2021-06-03 12:30:29 -0700836 return;
837#endif
Ed Tanousc1019822024-03-06 12:54:38 -0800838 authMethodsConfig.basic = *auth.basicAuth;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700839 }
840
Ed Tanousc1019822024-03-06 12:54:38 -0800841 if (auth.cookie)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700842 {
843#ifndef BMCWEB_ENABLE_COOKIE_AUTHENTICATION
George Liu0fda0f12021-11-16 10:06:17 +0800844 messages::actionNotSupported(
845 asyncResp->res,
846 "Setting Cookie when cookie-auth feature is disabled");
Ed Tanous6c51eab2021-06-03 12:30:29 -0700847 return;
848#endif
Ed Tanousc1019822024-03-06 12:54:38 -0800849 authMethodsConfig.cookie = *auth.cookie;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700850 }
851
Ed Tanousc1019822024-03-06 12:54:38 -0800852 if (auth.sessionToken)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700853 {
854#ifndef BMCWEB_ENABLE_SESSION_AUTHENTICATION
855 messages::actionNotSupported(
George Liu0fda0f12021-11-16 10:06:17 +0800856 asyncResp->res,
857 "Setting SessionToken when session-auth feature is disabled");
Ed Tanous6c51eab2021-06-03 12:30:29 -0700858 return;
859#endif
Ed Tanousc1019822024-03-06 12:54:38 -0800860 authMethodsConfig.sessionToken = *auth.sessionToken;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700861 }
862
Ed Tanousc1019822024-03-06 12:54:38 -0800863 if (auth.xToken)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700864 {
865#ifndef BMCWEB_ENABLE_XTOKEN_AUTHENTICATION
George Liu0fda0f12021-11-16 10:06:17 +0800866 messages::actionNotSupported(
867 asyncResp->res,
868 "Setting XToken when xtoken-auth feature is disabled");
Ed Tanous6c51eab2021-06-03 12:30:29 -0700869 return;
870#endif
Ed Tanousc1019822024-03-06 12:54:38 -0800871 authMethodsConfig.xtoken = *auth.xToken;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700872 }
873
Ed Tanousc1019822024-03-06 12:54:38 -0800874 if (auth.tls)
Ed Tanous6c51eab2021-06-03 12:30:29 -0700875 {
876#ifndef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
George Liu0fda0f12021-11-16 10:06:17 +0800877 messages::actionNotSupported(
878 asyncResp->res,
879 "Setting TLS when mutual-tls-auth feature is disabled");
Ed Tanous6c51eab2021-06-03 12:30:29 -0700880 return;
881#endif
Ed Tanousc1019822024-03-06 12:54:38 -0800882 authMethodsConfig.tls = *auth.tls;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700883 }
884
885 if (!authMethodsConfig.basic && !authMethodsConfig.cookie &&
886 !authMethodsConfig.sessionToken && !authMethodsConfig.xtoken &&
887 !authMethodsConfig.tls)
888 {
889 // Do not allow user to disable everything
890 messages::actionNotSupported(asyncResp->res,
891 "of disabling all available methods");
892 return;
893 }
894
895 persistent_data::SessionStore::getInstance().updateAuthMethodsConfig(
896 authMethodsConfig);
897 // Save configuration immediately
898 persistent_data::getConfig().writeData();
899
900 messages::success(asyncResp->res);
901}
902
903/**
904 * @brief Get the required values from the given JSON, validates the
905 * value and create the LDAP config object.
906 * @param input JSON data
907 * @param asyncResp pointer to the JSON response
908 * @param serverType Type of LDAP server(openLDAP/ActiveDirectory)
909 */
910
Ed Tanousc1019822024-03-06 12:54:38 -0800911inline void handleLDAPPatch(nlohmann::json::object_t& input,
Ed Tanous6c51eab2021-06-03 12:30:29 -0700912 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
913 const std::string& serverType)
914{
915 std::string dbusObjectPath;
916 if (serverType == "ActiveDirectory")
917 {
918 dbusObjectPath = adConfigObject;
919 }
920 else if (serverType == "LDAP")
921 {
922 dbusObjectPath = ldapConfigObjectName;
923 }
924 else
925 {
926 return;
927 }
928
Ed Tanousc1019822024-03-06 12:54:38 -0800929 std::optional<std::string> authType;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700930 std::optional<std::vector<std::string>> serviceAddressList;
931 std::optional<bool> serviceEnabled;
932 std::optional<std::vector<std::string>> baseDNList;
933 std::optional<std::string> userNameAttribute;
934 std::optional<std::string> groupsAttribute;
935 std::optional<std::string> userName;
936 std::optional<std::string> password;
Ed Tanousc1019822024-03-06 12:54:38 -0800937 std::optional<
938 std::vector<std::variant<nlohmann::json::object_t, std::nullptr_t>>>
939 remoteRoleMapData;
940 // clang-format off
941 if (!json_util::readJsonObject(input, asyncResp->res,
942 "Authentication/AuthenticationType", authType,
943 "Authentication/Username", userName,
944 "Authentication/Password", password,
945 "LDAPService/SearchSettings/BaseDistinguishedNames", baseDNList,
946 "LDAPService/SearchSettings/UsernameAttribute", userNameAttribute,
947 "LDAPService/SearchSettings/GroupsAttribute", groupsAttribute,
948 "ServiceAddresses", serviceAddressList,
949 "ServiceEnabled", serviceEnabled,
950 "RemoteRoleMapping", remoteRoleMapData))
Ed Tanous6c51eab2021-06-03 12:30:29 -0700951 {
952 return;
953 }
Ed Tanousc1019822024-03-06 12:54:38 -0800954 // clang-format on
Ed Tanous6c51eab2021-06-03 12:30:29 -0700955
Ed Tanousc1019822024-03-06 12:54:38 -0800956 if (authType && *authType != "UsernameAndPassword")
Ed Tanous6c51eab2021-06-03 12:30:29 -0700957 {
Ed Tanousc1019822024-03-06 12:54:38 -0800958 messages::propertyValueNotInList(asyncResp->res, *authType,
959 "AuthenticationType");
960 return;
Ed Tanous6c51eab2021-06-03 12:30:29 -0700961 }
Ed Tanousc1019822024-03-06 12:54:38 -0800962
Ed Tanous6c51eab2021-06-03 12:30:29 -0700963 if (serviceAddressList)
964 {
Ed Tanous26f69762022-01-25 09:49:11 -0800965 if (serviceAddressList->empty())
Ratan Guptaeb2bbe52019-04-22 14:27:01 +0530966 {
Ed Tanouse2616cc2022-06-27 12:45:55 -0700967 messages::propertyValueNotInList(
968 asyncResp->res, *serviceAddressList, "ServiceAddress");
Ed Tanouscb13a392020-07-25 19:02:03 +0000969 return;
970 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700971 }
972 if (baseDNList)
973 {
Ed Tanous26f69762022-01-25 09:49:11 -0800974 if (baseDNList->empty())
Ratan Gupta8a07d282019-03-16 08:33:47 +0530975 {
Ed Tanouse2616cc2022-06-27 12:45:55 -0700976 messages::propertyValueNotInList(asyncResp->res, *baseDNList,
Ed Tanous6c51eab2021-06-03 12:30:29 -0700977 "BaseDistinguishedNames");
Ratan Gupta8a07d282019-03-16 08:33:47 +0530978 return;
979 }
Ed Tanous6c51eab2021-06-03 12:30:29 -0700980 }
Ratan Gupta8a07d282019-03-16 08:33:47 +0530981
Ed Tanous6c51eab2021-06-03 12:30:29 -0700982 // nothing to update, then return
983 if (!userName && !password && !serviceAddressList && !baseDNList &&
984 !userNameAttribute && !groupsAttribute && !serviceEnabled &&
985 !remoteRoleMapData)
986 {
987 return;
988 }
989
990 // Get the existing resource first then keep modifying
991 // whenever any property gets updated.
Ed Tanous002d39b2022-05-31 08:59:27 -0700992 getLDAPConfigData(
993 serverType,
994 [asyncResp, userName, password, baseDNList, userNameAttribute,
995 groupsAttribute, serviceAddressList, serviceEnabled, dbusObjectPath,
996 remoteRoleMapData](bool success, const LDAPConfigData& confData,
Ed Tanousc1019822024-03-06 12:54:38 -0800997 const std::string& serverT) mutable {
Ed Tanous6c51eab2021-06-03 12:30:29 -0700998 if (!success)
Ratan Gupta8a07d282019-03-16 08:33:47 +0530999 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001000 messages::internalError(asyncResp->res);
1001 return;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301002 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001003 parseLDAPConfigData(asyncResp->res.jsonValue, confData, serverT);
1004 if (confData.serviceEnabled)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301005 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001006 // Disable the service first and update the rest of
1007 // the properties.
1008 handleServiceEnablePatch(false, asyncResp, serverT, dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301009 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001010
Ratan Gupta8a07d282019-03-16 08:33:47 +05301011 if (serviceAddressList)
1012 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001013 handleServiceAddressPatch(*serviceAddressList, asyncResp, serverT,
1014 dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301015 }
Ed Tanous6c51eab2021-06-03 12:30:29 -07001016 if (userName)
1017 {
1018 handleUserNamePatch(*userName, asyncResp, serverT, dbusObjectPath);
1019 }
1020 if (password)
1021 {
1022 handlePasswordPatch(*password, asyncResp, serverT, dbusObjectPath);
1023 }
1024
Ratan Gupta8a07d282019-03-16 08:33:47 +05301025 if (baseDNList)
1026 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001027 handleBaseDNPatch(*baseDNList, asyncResp, serverT, dbusObjectPath);
1028 }
1029 if (userNameAttribute)
1030 {
1031 handleUserNameAttrPatch(*userNameAttribute, asyncResp, serverT,
1032 dbusObjectPath);
1033 }
1034 if (groupsAttribute)
1035 {
1036 handleGroupNameAttrPatch(*groupsAttribute, asyncResp, serverT,
1037 dbusObjectPath);
1038 }
1039 if (serviceEnabled)
1040 {
1041 // if user has given the value as true then enable
1042 // the service. if user has given false then no-op
1043 // as service is already stopped.
1044 if (*serviceEnabled)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301045 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001046 handleServiceEnablePatch(*serviceEnabled, asyncResp, serverT,
1047 dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301048 }
1049 }
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001050 else
1051 {
Ed Tanous6c51eab2021-06-03 12:30:29 -07001052 // if user has not given the service enabled value
1053 // then revert it to the same state as it was
1054 // before.
1055 handleServiceEnablePatch(confData.serviceEnabled, asyncResp,
1056 serverT, dbusObjectPath);
jayaprakash Mutyala96200602020-04-08 11:09:10 +00001057 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001058
Ed Tanous6c51eab2021-06-03 12:30:29 -07001059 if (remoteRoleMapData)
1060 {
1061 handleRoleMapPatch(asyncResp, confData.groupRoleList, serverT,
1062 *remoteRoleMapData);
1063 }
Patrick Williams5a39f772023-10-20 11:20:21 -05001064 });
Ed Tanous6c51eab2021-06-03 12:30:29 -07001065}
1066
Abhishek Patel58345852022-02-02 08:54:25 -06001067inline void updateUserProperties(
1068 std::shared_ptr<bmcweb::AsyncResp> asyncResp, const std::string& username,
1069 const std::optional<std::string>& password,
1070 const std::optional<bool>& enabled,
1071 const std::optional<std::string>& roleId, const std::optional<bool>& locked,
1072 std::optional<std::vector<std::string>> accountTypes, bool userSelf)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001073{
P Dheeraj Srujan Kumarb477fd42021-12-16 07:17:51 +05301074 sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
1075 tempObjPath /= username;
1076 std::string dbusObjectPath(tempObjPath);
Ed Tanous6c51eab2021-06-03 12:30:29 -07001077
1078 dbus::utility::checkDbusPathExists(
Ed Tanous618c14b2022-06-30 17:44:25 -07001079 dbusObjectPath, [dbusObjectPath, username, password, roleId, enabled,
Abhishek Patel58345852022-02-02 08:54:25 -06001080 locked, accountTypes(std::move(accountTypes)),
1081 userSelf, asyncResp{std::move(asyncResp)}](int rc) {
Patrick Williams5a39f772023-10-20 11:20:21 -05001082 if (rc <= 0)
1083 {
1084 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1085 username);
1086 return;
1087 }
1088
1089 if (password)
1090 {
1091 int retval = pamUpdatePassword(username, *password);
1092
1093 if (retval == PAM_USER_UNKNOWN)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001094 {
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +08001095 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1096 username);
Patrick Williams5a39f772023-10-20 11:20:21 -05001097 }
1098 else if (retval == PAM_AUTHTOK_ERR)
1099 {
1100 // If password is invalid
1101 messages::propertyValueFormatError(asyncResp->res, nullptr,
1102 "Password");
1103 BMCWEB_LOG_ERROR("pamUpdatePassword Failed");
1104 }
1105 else if (retval != PAM_SUCCESS)
1106 {
1107 messages::internalError(asyncResp->res);
Ed Tanous6c51eab2021-06-03 12:30:29 -07001108 return;
1109 }
Patrick Williams5a39f772023-10-20 11:20:21 -05001110 else
Ed Tanous618c14b2022-06-30 17:44:25 -07001111 {
Patrick Williams5a39f772023-10-20 11:20:21 -05001112 messages::success(asyncResp->res);
Ed Tanous618c14b2022-06-30 17:44:25 -07001113 }
Patrick Williams5a39f772023-10-20 11:20:21 -05001114 }
Ed Tanous618c14b2022-06-30 17:44:25 -07001115
Patrick Williams5a39f772023-10-20 11:20:21 -05001116 if (enabled)
1117 {
Ed Tanousd02aad32024-02-13 14:43:34 -08001118 setDbusProperty(asyncResp, "xyz.openbmc_project.User.Manager",
1119 dbusObjectPath,
1120 "xyz.openbmc_project.User.Attributes",
1121 "UserEnabled", "Enabled", *enabled);
Patrick Williams5a39f772023-10-20 11:20:21 -05001122 }
1123
1124 if (roleId)
1125 {
1126 std::string priv = getPrivilegeFromRoleId(*roleId);
1127 if (priv.empty())
1128 {
1129 messages::propertyValueNotInList(asyncResp->res, true,
1130 "Locked");
1131 return;
Ed Tanous618c14b2022-06-30 17:44:25 -07001132 }
Ed Tanousd02aad32024-02-13 14:43:34 -08001133 setDbusProperty(asyncResp, "xyz.openbmc_project.User.Manager",
1134 dbusObjectPath,
1135 "xyz.openbmc_project.User.Attributes",
1136 "UserPrivilege", "RoleId", priv);
Patrick Williams5a39f772023-10-20 11:20:21 -05001137 }
1138
1139 if (locked)
1140 {
1141 // admin can unlock the account which is locked by
1142 // successive authentication failures but admin should
1143 // not be allowed to lock an account.
1144 if (*locked)
Abhishek Patel58345852022-02-02 08:54:25 -06001145 {
Patrick Williams5a39f772023-10-20 11:20:21 -05001146 messages::propertyValueNotInList(asyncResp->res, "true",
1147 "Locked");
1148 return;
Abhishek Patel58345852022-02-02 08:54:25 -06001149 }
Ed Tanousd02aad32024-02-13 14:43:34 -08001150 setDbusProperty(asyncResp, "xyz.openbmc_project.User.Manager",
1151 dbusObjectPath,
1152 "xyz.openbmc_project.User.Attributes",
1153 "UserLockedForFailedAttempt", "Locked", *locked);
Patrick Williams5a39f772023-10-20 11:20:21 -05001154 }
1155
1156 if (accountTypes)
1157 {
1158 patchAccountTypes(*accountTypes, asyncResp, dbusObjectPath,
1159 userSelf);
1160 }
1161 });
Ed Tanous6c51eab2021-06-03 12:30:29 -07001162}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001163
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001164inline void handleAccountServiceHead(
1165 App& app, const crow::Request& req,
1166 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
Ed Tanous1ef4c342022-05-12 16:12:36 -07001167{
1168 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1169 {
1170 return;
1171 }
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001172 asyncResp->res.addHeader(
1173 boost::beast::http::field::link,
1174 "</redfish/v1/JsonSchemas/AccountService/AccountService.json>; rel=describedby");
1175}
1176
1177inline void
1178 handleAccountServiceGet(App& app, const crow::Request& req,
1179 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1180{
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001181 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1182 {
1183 return;
1184 }
Ninad Palsule3e72c202023-03-27 17:19:55 -05001185
1186 if (req.session == nullptr)
1187 {
1188 messages::internalError(asyncResp->res);
1189 return;
1190 }
1191
Ed Tanousc1019822024-03-06 12:54:38 -08001192 const persistent_data::AuthConfigMethods& authMethodsConfig =
1193 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
1194
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001195 asyncResp->res.addHeader(
1196 boost::beast::http::field::link,
1197 "</redfish/v1/JsonSchemas/AccountService/AccountService.json>; rel=describedby");
1198
Ed Tanous1ef4c342022-05-12 16:12:36 -07001199 nlohmann::json& json = asyncResp->res.jsonValue;
1200 json["@odata.id"] = "/redfish/v1/AccountService";
1201 json["@odata.type"] = "#AccountService."
1202 "v1_10_0.AccountService";
1203 json["Id"] = "AccountService";
1204 json["Name"] = "Account Service";
1205 json["Description"] = "Account Service";
1206 json["ServiceEnabled"] = true;
1207 json["MaxPasswordLength"] = 20;
1208 json["Accounts"]["@odata.id"] = "/redfish/v1/AccountService/Accounts";
1209 json["Roles"]["@odata.id"] = "/redfish/v1/AccountService/Roles";
1210 json["Oem"]["OpenBMC"]["@odata.type"] =
Ed Tanous5b5574a2022-09-26 19:53:36 -07001211 "#OpenBMCAccountService.v1_0_0.AccountService";
Ed Tanous1ef4c342022-05-12 16:12:36 -07001212 json["Oem"]["OpenBMC"]["@odata.id"] =
1213 "/redfish/v1/AccountService#/Oem/OpenBMC";
1214 json["Oem"]["OpenBMC"]["AuthMethods"]["BasicAuth"] =
1215 authMethodsConfig.basic;
1216 json["Oem"]["OpenBMC"]["AuthMethods"]["SessionToken"] =
1217 authMethodsConfig.sessionToken;
1218 json["Oem"]["OpenBMC"]["AuthMethods"]["XToken"] = authMethodsConfig.xtoken;
1219 json["Oem"]["OpenBMC"]["AuthMethods"]["Cookie"] = authMethodsConfig.cookie;
1220 json["Oem"]["OpenBMC"]["AuthMethods"]["TLS"] = authMethodsConfig.tls;
1221
1222 // /redfish/v1/AccountService/LDAP/Certificates is something only
1223 // ConfigureManager can access then only display when the user has
1224 // permissions ConfigureManager
1225 Privileges effectiveUserPrivileges =
Ninad Palsule3e72c202023-03-27 17:19:55 -05001226 redfish::getUserPrivileges(*req.session);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001227
1228 if (isOperationAllowedWithPrivileges({{"ConfigureManager"}},
1229 effectiveUserPrivileges))
1230 {
1231 asyncResp->res.jsonValue["LDAP"]["Certificates"]["@odata.id"] =
1232 "/redfish/v1/AccountService/LDAP/Certificates";
1233 }
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +02001234 sdbusplus::asio::getAllProperties(
1235 *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1236 "/xyz/openbmc_project/user", "xyz.openbmc_project.User.AccountPolicy",
Ed Tanous5e7e2dc2023-02-16 10:37:01 -08001237 [asyncResp](const boost::system::error_code& ec,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001238 const dbus::utility::DBusPropertiesMap& propertiesList) {
1239 if (ec)
1240 {
1241 messages::internalError(asyncResp->res);
1242 return;
1243 }
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +02001244
Ed Tanous62598e32023-07-17 17:06:25 -07001245 BMCWEB_LOG_DEBUG("Got {}properties for AccountService",
1246 propertiesList.size());
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +02001247
1248 const uint8_t* minPasswordLength = nullptr;
1249 const uint32_t* accountUnlockTimeout = nullptr;
1250 const uint16_t* maxLoginAttemptBeforeLockout = nullptr;
1251
1252 const bool success = sdbusplus::unpackPropertiesNoThrow(
1253 dbus_utils::UnpackErrorPrinter(), propertiesList,
1254 "MinPasswordLength", minPasswordLength, "AccountUnlockTimeout",
1255 accountUnlockTimeout, "MaxLoginAttemptBeforeLockout",
1256 maxLoginAttemptBeforeLockout);
1257
1258 if (!success)
Ed Tanous1ef4c342022-05-12 16:12:36 -07001259 {
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +02001260 messages::internalError(asyncResp->res);
1261 return;
Ed Tanous1ef4c342022-05-12 16:12:36 -07001262 }
Krzysztof Grobelnyd1bde9e2022-09-07 10:40:51 +02001263
1264 if (minPasswordLength != nullptr)
1265 {
1266 asyncResp->res.jsonValue["MinPasswordLength"] = *minPasswordLength;
1267 }
1268
1269 if (accountUnlockTimeout != nullptr)
1270 {
1271 asyncResp->res.jsonValue["AccountLockoutDuration"] =
1272 *accountUnlockTimeout;
1273 }
1274
1275 if (maxLoginAttemptBeforeLockout != nullptr)
1276 {
1277 asyncResp->res.jsonValue["AccountLockoutThreshold"] =
1278 *maxLoginAttemptBeforeLockout;
1279 }
Patrick Williams5a39f772023-10-20 11:20:21 -05001280 });
Ed Tanous1ef4c342022-05-12 16:12:36 -07001281
Ed Tanous02cad962022-06-30 16:50:15 -07001282 auto callback = [asyncResp](bool success, const LDAPConfigData& confData,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001283 const std::string& ldapType) {
1284 if (!success)
1285 {
1286 return;
1287 }
1288 parseLDAPConfigData(asyncResp->res.jsonValue, confData, ldapType);
1289 };
1290
1291 getLDAPConfigData("LDAP", callback);
1292 getLDAPConfigData("ActiveDirectory", callback);
1293}
1294
1295inline void handleAccountServicePatch(
1296 App& app, const crow::Request& req,
1297 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1298{
1299 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1300 {
1301 return;
1302 }
1303 std::optional<uint32_t> unlockTimeout;
1304 std::optional<uint16_t> lockoutThreshold;
1305 std::optional<uint8_t> minPasswordLength;
1306 std::optional<uint16_t> maxPasswordLength;
Ed Tanousc1019822024-03-06 12:54:38 -08001307 std::optional<nlohmann::json::object_t> ldapObject;
1308 std::optional<nlohmann::json::object_t> activeDirectoryObject;
1309 AuthMethods auth;
1310 // clang-format off
Ed Tanous1ef4c342022-05-12 16:12:36 -07001311 if (!json_util::readJsonPatch(
Ed Tanousc1019822024-03-06 12:54:38 -08001312 req, asyncResp->res,
1313 "AccountLockoutDuration", unlockTimeout,
1314 "AccountLockoutThreshold", lockoutThreshold,
1315 "MaxPasswordLength", maxPasswordLength,
1316 "MinPasswordLength", minPasswordLength,
1317 "LDAP", ldapObject,
1318 "ActiveDirectory", activeDirectoryObject,
1319 "Oem/OpenBMC/AuthMethods/BasicAuth", auth.basicAuth,
1320 "Oem/OpenBMC/AuthMethods/Cookie", auth.cookie,
1321 "Oem/OpenBMC/AuthMethods/SessionToken", auth.sessionToken,
1322 "Oem/OpenBMC/AuthMethods/XToken", auth.xToken,
1323 "Oem/OpenBMC/AuthMethods/TLS", auth.tls))
Ed Tanous1ef4c342022-05-12 16:12:36 -07001324 {
1325 return;
1326 }
Ed Tanousc1019822024-03-06 12:54:38 -08001327 // clang-format on
Ed Tanous1ef4c342022-05-12 16:12:36 -07001328
1329 if (minPasswordLength)
1330 {
Ed Tanousd02aad32024-02-13 14:43:34 -08001331 setDbusProperty(
1332 asyncResp, "xyz.openbmc_project.User.Manager",
1333 sdbusplus::message::object_path("/xyz/openbmc_project/user"),
George Liu9ae226f2023-06-21 17:56:46 +08001334 "xyz.openbmc_project.User.AccountPolicy", "MinPasswordLength",
Ed Tanousd02aad32024-02-13 14:43:34 -08001335 "MinPasswordLength", *minPasswordLength);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001336 }
1337
1338 if (maxPasswordLength)
1339 {
1340 messages::propertyNotWritable(asyncResp->res, "MaxPasswordLength");
1341 }
1342
1343 if (ldapObject)
1344 {
1345 handleLDAPPatch(*ldapObject, asyncResp, "LDAP");
1346 }
1347
Ed Tanousc1019822024-03-06 12:54:38 -08001348 handleAuthMethodsPatch(asyncResp, auth);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001349
1350 if (activeDirectoryObject)
1351 {
1352 handleLDAPPatch(*activeDirectoryObject, asyncResp, "ActiveDirectory");
1353 }
1354
1355 if (unlockTimeout)
1356 {
Ed Tanousd02aad32024-02-13 14:43:34 -08001357 setDbusProperty(
1358 asyncResp, "xyz.openbmc_project.User.Manager",
1359 sdbusplus::message::object_path("/xyz/openbmc_project/user"),
Ed Tanous1ef4c342022-05-12 16:12:36 -07001360 "xyz.openbmc_project.User.AccountPolicy", "AccountUnlockTimeout",
Ed Tanousd02aad32024-02-13 14:43:34 -08001361 "AccountLockoutDuration", *unlockTimeout);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001362 }
1363 if (lockoutThreshold)
1364 {
Ed Tanousd02aad32024-02-13 14:43:34 -08001365 setDbusProperty(
1366 asyncResp, "xyz.openbmc_project.User.Manager",
1367 sdbusplus::message::object_path("/xyz/openbmc_project/user"),
George Liu9ae226f2023-06-21 17:56:46 +08001368 "xyz.openbmc_project.User.AccountPolicy",
Ed Tanousd02aad32024-02-13 14:43:34 -08001369 "MaxLoginAttemptBeforeLockout", "AccountLockoutThreshold",
1370 *lockoutThreshold);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001371 }
1372}
1373
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001374inline void handleAccountCollectionHead(
Ed Tanous1ef4c342022-05-12 16:12:36 -07001375 App& app, const crow::Request& req,
1376 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1377{
1378 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1379 {
1380 return;
1381 }
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001382 asyncResp->res.addHeader(
1383 boost::beast::http::field::link,
1384 "</redfish/v1/JsonSchemas/ManagerAccountCollection.json>; rel=describedby");
1385}
1386
1387inline void handleAccountCollectionGet(
1388 App& app, const crow::Request& req,
1389 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1390{
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001391 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1392 {
1393 return;
1394 }
Ninad Palsule3e72c202023-03-27 17:19:55 -05001395
1396 if (req.session == nullptr)
1397 {
1398 messages::internalError(asyncResp->res);
1399 return;
1400 }
1401
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001402 asyncResp->res.addHeader(
1403 boost::beast::http::field::link,
1404 "</redfish/v1/JsonSchemas/ManagerAccountCollection.json>; rel=describedby");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001405
1406 asyncResp->res.jsonValue["@odata.id"] =
1407 "/redfish/v1/AccountService/Accounts";
1408 asyncResp->res.jsonValue["@odata.type"] = "#ManagerAccountCollection."
1409 "ManagerAccountCollection";
1410 asyncResp->res.jsonValue["Name"] = "Accounts Collection";
1411 asyncResp->res.jsonValue["Description"] = "BMC User Accounts";
1412
1413 Privileges effectiveUserPrivileges =
Ninad Palsule3e72c202023-03-27 17:19:55 -05001414 redfish::getUserPrivileges(*req.session);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001415
1416 std::string thisUser;
1417 if (req.session)
1418 {
1419 thisUser = req.session->username;
1420 }
George Liu5eb468d2023-06-20 17:03:24 +08001421 sdbusplus::message::object_path path("/xyz/openbmc_project/user");
1422 dbus::utility::getManagedObjects(
1423 "xyz.openbmc_project.User.Manager", path,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001424 [asyncResp, thisUser, effectiveUserPrivileges](
Ed Tanous5e7e2dc2023-02-16 10:37:01 -08001425 const boost::system::error_code& ec,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001426 const dbus::utility::ManagedObjectType& users) {
1427 if (ec)
1428 {
1429 messages::internalError(asyncResp->res);
1430 return;
1431 }
1432
1433 bool userCanSeeAllAccounts =
1434 effectiveUserPrivileges.isSupersetOf({"ConfigureUsers"});
1435
1436 bool userCanSeeSelf =
1437 effectiveUserPrivileges.isSupersetOf({"ConfigureSelf"});
1438
1439 nlohmann::json& memberArray = asyncResp->res.jsonValue["Members"];
1440 memberArray = nlohmann::json::array();
1441
1442 for (const auto& userpath : users)
1443 {
1444 std::string user = userpath.first.filename();
1445 if (user.empty())
1446 {
1447 messages::internalError(asyncResp->res);
Ed Tanous62598e32023-07-17 17:06:25 -07001448 BMCWEB_LOG_ERROR("Invalid firmware ID");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001449
1450 return;
1451 }
1452
1453 // As clarified by Redfish here:
1454 // https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration
1455 // Users without ConfigureUsers, only see their own
1456 // account. Users with ConfigureUsers, see all
1457 // accounts.
1458 if (userCanSeeAllAccounts || (thisUser == user && userCanSeeSelf))
1459 {
1460 nlohmann::json::object_t member;
Ed Tanous3b327802023-08-14 09:23:43 -07001461 member["@odata.id"] = boost::urls::format(
1462 "/redfish/v1/AccountService/Accounts/{}", user);
Patrick Williamsb2ba3072023-05-12 10:27:39 -05001463 memberArray.emplace_back(std::move(member));
Ed Tanous1ef4c342022-05-12 16:12:36 -07001464 }
1465 }
1466 asyncResp->res.jsonValue["Members@odata.count"] = memberArray.size();
Patrick Williams5a39f772023-10-20 11:20:21 -05001467 });
Ed Tanous1ef4c342022-05-12 16:12:36 -07001468}
1469
Ninad Palsule97e90da2023-05-17 14:04:52 -05001470inline void processAfterCreateUser(
1471 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1472 const std::string& username, const std::string& password,
1473 const boost::system::error_code& ec, sdbusplus::message_t& m)
1474{
1475 if (ec)
1476 {
1477 userErrorMessageHandler(m.get_error(), asyncResp, username, "");
1478 return;
1479 }
1480
1481 if (pamUpdatePassword(username, password) != PAM_SUCCESS)
1482 {
1483 // At this point we have a user that's been
1484 // created, but the password set
1485 // failed.Something is wrong, so delete the user
1486 // that we've already created
1487 sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
1488 tempObjPath /= username;
1489 const std::string userPath(tempObjPath);
1490
1491 crow::connections::systemBus->async_method_call(
1492 [asyncResp, password](const boost::system::error_code& ec3) {
1493 if (ec3)
1494 {
1495 messages::internalError(asyncResp->res);
1496 return;
1497 }
1498
1499 // If password is invalid
Jason M. Bills9bd80832023-08-30 15:19:41 -07001500 messages::propertyValueFormatError(asyncResp->res, nullptr,
Ninad Palsule97e90da2023-05-17 14:04:52 -05001501 "Password");
Patrick Williams5a39f772023-10-20 11:20:21 -05001502 },
Ninad Palsule97e90da2023-05-17 14:04:52 -05001503 "xyz.openbmc_project.User.Manager", userPath,
1504 "xyz.openbmc_project.Object.Delete", "Delete");
1505
Ed Tanous62598e32023-07-17 17:06:25 -07001506 BMCWEB_LOG_ERROR("pamUpdatePassword Failed");
Ninad Palsule97e90da2023-05-17 14:04:52 -05001507 return;
1508 }
1509
1510 messages::created(asyncResp->res);
1511 asyncResp->res.addHeader("Location",
1512 "/redfish/v1/AccountService/Accounts/" + username);
1513}
1514
1515inline void processAfterGetAllGroups(
1516 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1517 const std::string& username, const std::string& password,
Ed Tanouse01d0c32023-06-30 13:21:32 -07001518 const std::string& roleId, bool enabled,
Ninad Palsule9ba73932023-06-01 16:38:57 -05001519 std::optional<std::vector<std::string>> accountTypes,
Ninad Palsule97e90da2023-05-17 14:04:52 -05001520 const std::vector<std::string>& allGroupsList)
Ninad Palsule97e90da2023-05-17 14:04:52 -05001521{
Ninad Palsule3e72c202023-03-27 17:19:55 -05001522 std::vector<std::string> userGroups;
Ninad Palsule9ba73932023-06-01 16:38:57 -05001523 std::vector<std::string> accountTypeUserGroups;
1524
1525 // If user specified account types then convert them to unix user groups
1526 if (accountTypes)
1527 {
1528 if (!getUserGroupFromAccountType(asyncResp->res, *accountTypes,
1529 accountTypeUserGroups))
1530 {
1531 // Problem in mapping Account Types to User Groups, Error already
1532 // logged.
1533 return;
1534 }
1535 }
1536
Ninad Palsule3e72c202023-03-27 17:19:55 -05001537 for (const auto& grp : allGroupsList)
1538 {
Ninad Palsule9ba73932023-06-01 16:38:57 -05001539 // If user specified the account type then only accept groups which are
1540 // in the account types group list.
1541 if (!accountTypeUserGroups.empty())
1542 {
1543 bool found = false;
1544 for (const auto& grp1 : accountTypeUserGroups)
1545 {
1546 if (grp == grp1)
1547 {
1548 found = true;
1549 break;
1550 }
1551 }
1552 if (!found)
1553 {
1554 continue;
1555 }
1556 }
1557
Ninad Palsule3e72c202023-03-27 17:19:55 -05001558 // Console access is provided to the user who is a member of
1559 // hostconsole group and has a administrator role. So, set
1560 // hostconsole group only for the administrator.
Ninad Palsule9ba73932023-06-01 16:38:57 -05001561 if ((grp == "hostconsole") && (roleId != "priv-admin"))
Ninad Palsule3e72c202023-03-27 17:19:55 -05001562 {
Ninad Palsule9ba73932023-06-01 16:38:57 -05001563 if (!accountTypeUserGroups.empty())
1564 {
Ed Tanous62598e32023-07-17 17:06:25 -07001565 BMCWEB_LOG_ERROR(
1566 "Only administrator can get HostConsole access");
Ninad Palsule9ba73932023-06-01 16:38:57 -05001567 asyncResp->res.result(boost::beast::http::status::bad_request);
1568 return;
1569 }
1570 continue;
Ninad Palsule3e72c202023-03-27 17:19:55 -05001571 }
Ninad Palsule9ba73932023-06-01 16:38:57 -05001572 userGroups.emplace_back(grp);
1573 }
1574
1575 // Make sure user specified groups are valid. This is internal error because
1576 // it some inconsistencies between user manager and bmcweb.
1577 if (!accountTypeUserGroups.empty() &&
1578 accountTypeUserGroups.size() != userGroups.size())
1579 {
1580 messages::internalError(asyncResp->res);
1581 return;
Ninad Palsule3e72c202023-03-27 17:19:55 -05001582 }
Ninad Palsule97e90da2023-05-17 14:04:52 -05001583 crow::connections::systemBus->async_method_call(
1584 [asyncResp, username, password](const boost::system::error_code& ec2,
1585 sdbusplus::message_t& m) {
1586 processAfterCreateUser(asyncResp, username, password, ec2, m);
Patrick Williams5a39f772023-10-20 11:20:21 -05001587 },
Ninad Palsule97e90da2023-05-17 14:04:52 -05001588 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
Ninad Palsule3e72c202023-03-27 17:19:55 -05001589 "xyz.openbmc_project.User.Manager", "CreateUser", username, userGroups,
Ed Tanouse01d0c32023-06-30 13:21:32 -07001590 roleId, enabled);
Ninad Palsule97e90da2023-05-17 14:04:52 -05001591}
1592
Ed Tanous1ef4c342022-05-12 16:12:36 -07001593inline void handleAccountCollectionPost(
1594 App& app, const crow::Request& req,
1595 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1596{
1597 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1598 {
1599 return;
1600 }
1601 std::string username;
1602 std::string password;
Ed Tanouse01d0c32023-06-30 13:21:32 -07001603 std::optional<std::string> roleIdJson;
1604 std::optional<bool> enabledJson;
Ninad Palsule9ba73932023-06-01 16:38:57 -05001605 std::optional<std::vector<std::string>> accountTypes;
Ed Tanouse01d0c32023-06-30 13:21:32 -07001606 if (!json_util::readJsonPatch(req, asyncResp->res, "UserName", username,
1607 "Password", password, "RoleId", roleIdJson,
1608 "Enabled", enabledJson, "AccountTypes",
1609 accountTypes))
Ed Tanous1ef4c342022-05-12 16:12:36 -07001610 {
1611 return;
1612 }
1613
Ed Tanouse01d0c32023-06-30 13:21:32 -07001614 std::string roleId = roleIdJson.value_or("User");
1615 std::string priv = getPrivilegeFromRoleId(roleId);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001616 if (priv.empty())
1617 {
Ed Tanouse01d0c32023-06-30 13:21:32 -07001618 messages::propertyValueNotInList(asyncResp->res, roleId, "RoleId");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001619 return;
1620 }
Asmitha Karunanithi239adf82022-03-25 02:59:03 -05001621 roleId = priv;
Ed Tanous1ef4c342022-05-12 16:12:36 -07001622
Ed Tanouse01d0c32023-06-30 13:21:32 -07001623 bool enabled = enabledJson.value_or(true);
1624
Ed Tanous1ef4c342022-05-12 16:12:36 -07001625 // Reading AllGroups property
1626 sdbusplus::asio::getProperty<std::vector<std::string>>(
1627 *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1628 "/xyz/openbmc_project/user", "xyz.openbmc_project.User.Manager",
1629 "AllGroups",
Ninad Palsule9ba73932023-06-01 16:38:57 -05001630 [asyncResp, username, password{std::move(password)}, roleId, enabled,
1631 accountTypes](const boost::system::error_code& ec,
1632 const std::vector<std::string>& allGroupsList) {
Ed Tanous1ef4c342022-05-12 16:12:36 -07001633 if (ec)
1634 {
Ed Tanous62598e32023-07-17 17:06:25 -07001635 BMCWEB_LOG_DEBUG("ERROR with async_method_call");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001636 messages::internalError(asyncResp->res);
1637 return;
1638 }
1639
1640 if (allGroupsList.empty())
1641 {
1642 messages::internalError(asyncResp->res);
1643 return;
1644 }
1645
Ninad Palsule97e90da2023-05-17 14:04:52 -05001646 processAfterGetAllGroups(asyncResp, username, password, roleId, enabled,
Ninad Palsule9ba73932023-06-01 16:38:57 -05001647 accountTypes, allGroupsList);
Patrick Williams5a39f772023-10-20 11:20:21 -05001648 });
Ed Tanous1ef4c342022-05-12 16:12:36 -07001649}
1650
1651inline void
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001652 handleAccountHead(App& app, const crow::Request& req,
1653 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1654 const std::string& /*accountName*/)
Ed Tanous1ef4c342022-05-12 16:12:36 -07001655{
1656 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1657 {
1658 return;
1659 }
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001660 asyncResp->res.addHeader(
1661 boost::beast::http::field::link,
1662 "</redfish/v1/JsonSchemas/ManagerAccount/ManagerAccount.json>; rel=describedby");
1663}
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001664
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001665inline void
1666 handleAccountGet(App& app, const crow::Request& req,
1667 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1668 const std::string& accountName)
1669{
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001670 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1671 {
1672 return;
1673 }
1674 asyncResp->res.addHeader(
1675 boost::beast::http::field::link,
1676 "</redfish/v1/JsonSchemas/ManagerAccount/ManagerAccount.json>; rel=describedby");
1677
Ed Tanous1ef4c342022-05-12 16:12:36 -07001678#ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1679 // If authentication is disabled, there are no user accounts
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +08001680 messages::resourceNotFound(asyncResp->res, "ManagerAccount", accountName);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001681 return;
Ed Tanous1ef4c342022-05-12 16:12:36 -07001682#endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
Jiaqing Zhaoafd369c2023-03-07 15:12:22 +08001683
Ed Tanous1ef4c342022-05-12 16:12:36 -07001684 if (req.session == nullptr)
1685 {
1686 messages::internalError(asyncResp->res);
1687 return;
1688 }
1689 if (req.session->username != accountName)
1690 {
1691 // At this point we've determined that the user is trying to
1692 // modify a user that isn't them. We need to verify that they
1693 // have permissions to modify other users, so re-run the auth
1694 // check with the same permissions, minus ConfigureSelf.
1695 Privileges effectiveUserPrivileges =
Ninad Palsule3e72c202023-03-27 17:19:55 -05001696 redfish::getUserPrivileges(*req.session);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001697 Privileges requiredPermissionsToChangeNonSelf = {"ConfigureUsers",
1698 "ConfigureManager"};
1699 if (!effectiveUserPrivileges.isSupersetOf(
1700 requiredPermissionsToChangeNonSelf))
1701 {
Ed Tanous62598e32023-07-17 17:06:25 -07001702 BMCWEB_LOG_DEBUG("GET Account denied access");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001703 messages::insufficientPrivilege(asyncResp->res);
1704 return;
1705 }
1706 }
1707
George Liu5eb468d2023-06-20 17:03:24 +08001708 sdbusplus::message::object_path path("/xyz/openbmc_project/user");
1709 dbus::utility::getManagedObjects(
1710 "xyz.openbmc_project.User.Manager", path,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001711 [asyncResp,
Ed Tanous5e7e2dc2023-02-16 10:37:01 -08001712 accountName](const boost::system::error_code& ec,
Ed Tanous1ef4c342022-05-12 16:12:36 -07001713 const dbus::utility::ManagedObjectType& users) {
1714 if (ec)
1715 {
1716 messages::internalError(asyncResp->res);
1717 return;
1718 }
Ed Tanous3544d2a2023-08-06 18:12:20 -07001719 const auto userIt = std::ranges::find_if(
Michael Shen80f79a42023-08-24 13:41:53 +00001720 users,
1721 [accountName](
1722 const std::pair<sdbusplus::message::object_path,
1723 dbus::utility::DBusInterfacesMap>& user) {
1724 return accountName == user.first.filename();
Patrick Williams5a39f772023-10-20 11:20:21 -05001725 });
Ed Tanous1ef4c342022-05-12 16:12:36 -07001726
1727 if (userIt == users.end())
1728 {
1729 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1730 accountName);
1731 return;
1732 }
1733
1734 asyncResp->res.jsonValue["@odata.type"] =
Abhishek Patel58345852022-02-02 08:54:25 -06001735 "#ManagerAccount.v1_7_0.ManagerAccount";
Ed Tanous1ef4c342022-05-12 16:12:36 -07001736 asyncResp->res.jsonValue["Name"] = "User Account";
1737 asyncResp->res.jsonValue["Description"] = "User Account";
1738 asyncResp->res.jsonValue["Password"] = nullptr;
Abhishek Patel58345852022-02-02 08:54:25 -06001739 asyncResp->res.jsonValue["StrictAccountTypes"] = true;
Ed Tanous1ef4c342022-05-12 16:12:36 -07001740
1741 for (const auto& interface : userIt->second)
1742 {
1743 if (interface.first == "xyz.openbmc_project.User.Attributes")
1744 {
1745 for (const auto& property : interface.second)
1746 {
1747 if (property.first == "UserEnabled")
1748 {
1749 const bool* userEnabled =
1750 std::get_if<bool>(&property.second);
1751 if (userEnabled == nullptr)
1752 {
Ed Tanous62598e32023-07-17 17:06:25 -07001753 BMCWEB_LOG_ERROR("UserEnabled wasn't a bool");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001754 messages::internalError(asyncResp->res);
1755 return;
1756 }
1757 asyncResp->res.jsonValue["Enabled"] = *userEnabled;
1758 }
1759 else if (property.first == "UserLockedForFailedAttempt")
1760 {
1761 const bool* userLocked =
1762 std::get_if<bool>(&property.second);
1763 if (userLocked == nullptr)
1764 {
Ed Tanous62598e32023-07-17 17:06:25 -07001765 BMCWEB_LOG_ERROR("UserLockedForF"
1766 "ailedAttempt "
1767 "wasn't a bool");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001768 messages::internalError(asyncResp->res);
1769 return;
1770 }
1771 asyncResp->res.jsonValue["Locked"] = *userLocked;
1772 asyncResp->res
1773 .jsonValue["Locked@Redfish.AllowableValues"] = {
1774 "false"}; // can only unlock accounts
1775 }
1776 else if (property.first == "UserPrivilege")
1777 {
1778 const std::string* userPrivPtr =
1779 std::get_if<std::string>(&property.second);
1780 if (userPrivPtr == nullptr)
1781 {
Ed Tanous62598e32023-07-17 17:06:25 -07001782 BMCWEB_LOG_ERROR("UserPrivilege wasn't a "
1783 "string");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001784 messages::internalError(asyncResp->res);
1785 return;
1786 }
1787 std::string role = getRoleIdFromPrivilege(*userPrivPtr);
1788 if (role.empty())
1789 {
Ed Tanous62598e32023-07-17 17:06:25 -07001790 BMCWEB_LOG_ERROR("Invalid user role");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001791 messages::internalError(asyncResp->res);
1792 return;
1793 }
1794 asyncResp->res.jsonValue["RoleId"] = role;
1795
1796 nlohmann::json& roleEntry =
1797 asyncResp->res.jsonValue["Links"]["Role"];
Ed Tanous3b327802023-08-14 09:23:43 -07001798 roleEntry["@odata.id"] = boost::urls::format(
1799 "/redfish/v1/AccountService/Roles/{}", role);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001800 }
1801 else if (property.first == "UserPasswordExpired")
1802 {
1803 const bool* userPasswordExpired =
1804 std::get_if<bool>(&property.second);
1805 if (userPasswordExpired == nullptr)
1806 {
Ed Tanous62598e32023-07-17 17:06:25 -07001807 BMCWEB_LOG_ERROR(
1808 "UserPasswordExpired wasn't a bool");
Ed Tanous1ef4c342022-05-12 16:12:36 -07001809 messages::internalError(asyncResp->res);
1810 return;
1811 }
1812 asyncResp->res.jsonValue["PasswordChangeRequired"] =
1813 *userPasswordExpired;
1814 }
Abhishek Patelc7229812022-02-01 10:07:15 -06001815 else if (property.first == "UserGroups")
1816 {
1817 const std::vector<std::string>* userGroups =
1818 std::get_if<std::vector<std::string>>(
1819 &property.second);
1820 if (userGroups == nullptr)
1821 {
Ed Tanous62598e32023-07-17 17:06:25 -07001822 BMCWEB_LOG_ERROR(
1823 "userGroups wasn't a string vector");
Abhishek Patelc7229812022-02-01 10:07:15 -06001824 messages::internalError(asyncResp->res);
1825 return;
1826 }
1827 if (!translateUserGroup(*userGroups, asyncResp->res))
1828 {
Ed Tanous62598e32023-07-17 17:06:25 -07001829 BMCWEB_LOG_ERROR("userGroups mapping failed");
Abhishek Patelc7229812022-02-01 10:07:15 -06001830 messages::internalError(asyncResp->res);
1831 return;
1832 }
1833 }
Ed Tanous1ef4c342022-05-12 16:12:36 -07001834 }
1835 }
1836 }
1837
Ed Tanous3b327802023-08-14 09:23:43 -07001838 asyncResp->res.jsonValue["@odata.id"] = boost::urls::format(
1839 "/redfish/v1/AccountService/Accounts/{}", accountName);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001840 asyncResp->res.jsonValue["Id"] = accountName;
1841 asyncResp->res.jsonValue["UserName"] = accountName;
Patrick Williams5a39f772023-10-20 11:20:21 -05001842 });
Ed Tanous1ef4c342022-05-12 16:12:36 -07001843}
1844
1845inline void
Gunnar Mills20fc3072023-01-27 15:13:36 -06001846 handleAccountDelete(App& app, const crow::Request& req,
1847 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1848 const std::string& username)
Ed Tanous1ef4c342022-05-12 16:12:36 -07001849{
1850 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1851 {
1852 return;
1853 }
1854
1855#ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1856 // If authentication is disabled, there are no user accounts
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +08001857 messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001858 return;
1859
1860#endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1861 sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
1862 tempObjPath /= username;
1863 const std::string userPath(tempObjPath);
1864
1865 crow::connections::systemBus->async_method_call(
Ed Tanous5e7e2dc2023-02-16 10:37:01 -08001866 [asyncResp, username](const boost::system::error_code& ec) {
Ed Tanous1ef4c342022-05-12 16:12:36 -07001867 if (ec)
1868 {
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +08001869 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
Ed Tanous1ef4c342022-05-12 16:12:36 -07001870 username);
1871 return;
1872 }
1873
1874 messages::accountRemoved(asyncResp->res);
Patrick Williams5a39f772023-10-20 11:20:21 -05001875 },
Ed Tanous1ef4c342022-05-12 16:12:36 -07001876 "xyz.openbmc_project.User.Manager", userPath,
1877 "xyz.openbmc_project.Object.Delete", "Delete");
1878}
1879
1880inline void
1881 handleAccountPatch(App& app, const crow::Request& req,
1882 const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1883 const std::string& username)
1884{
1885 if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1886 {
1887 return;
1888 }
1889#ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1890 // If authentication is disabled, there are no user accounts
Jiaqing Zhaod8a5d5d2022-08-05 16:21:51 +08001891 messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001892 return;
1893
1894#endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1895 std::optional<std::string> newUserName;
1896 std::optional<std::string> password;
1897 std::optional<bool> enabled;
1898 std::optional<std::string> roleId;
1899 std::optional<bool> locked;
Abhishek Patel58345852022-02-02 08:54:25 -06001900 std::optional<std::vector<std::string>> accountTypes;
1901
1902 bool userSelf = (username == req.session->username);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001903
1904 if (req.session == nullptr)
1905 {
1906 messages::internalError(asyncResp->res);
1907 return;
1908 }
1909
1910 Privileges effectiveUserPrivileges =
Ninad Palsule3e72c202023-03-27 17:19:55 -05001911 redfish::getUserPrivileges(*req.session);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001912 Privileges configureUsers = {"ConfigureUsers"};
1913 bool userHasConfigureUsers =
1914 effectiveUserPrivileges.isSupersetOf(configureUsers);
1915 if (userHasConfigureUsers)
1916 {
1917 // Users with ConfigureUsers can modify for all users
Abhishek Patel58345852022-02-02 08:54:25 -06001918 if (!json_util::readJsonPatch(
1919 req, asyncResp->res, "UserName", newUserName, "Password",
1920 password, "RoleId", roleId, "Enabled", enabled, "Locked",
1921 locked, "AccountTypes", accountTypes))
Ed Tanous1ef4c342022-05-12 16:12:36 -07001922 {
1923 return;
1924 }
1925 }
1926 else
1927 {
1928 // ConfigureSelf accounts can only modify their own account
Abhishek Patel58345852022-02-02 08:54:25 -06001929 if (!userSelf)
Ed Tanous1ef4c342022-05-12 16:12:36 -07001930 {
1931 messages::insufficientPrivilege(asyncResp->res);
1932 return;
1933 }
1934
1935 // ConfigureSelf accounts can only modify their password
1936 if (!json_util::readJsonPatch(req, asyncResp->res, "Password",
1937 password))
1938 {
1939 return;
1940 }
1941 }
1942
1943 // if user name is not provided in the patch method or if it
1944 // matches the user name in the URI, then we are treating it as
1945 // updating user properties other then username. If username
1946 // provided doesn't match the URI, then we are treating this as
1947 // user rename request.
1948 if (!newUserName || (newUserName.value() == username))
1949 {
1950 updateUserProperties(asyncResp, username, password, enabled, roleId,
Abhishek Patel58345852022-02-02 08:54:25 -06001951 locked, accountTypes, userSelf);
Ed Tanous1ef4c342022-05-12 16:12:36 -07001952 return;
1953 }
1954 crow::connections::systemBus->async_method_call(
1955 [asyncResp, username, password(std::move(password)),
1956 roleId(std::move(roleId)), enabled, newUser{std::string(*newUserName)},
Abhishek Patel58345852022-02-02 08:54:25 -06001957 locked, userSelf, accountTypes(std::move(accountTypes))](
Ed Tanouse81de512023-06-27 17:07:00 -07001958 const boost::system::error_code& ec, sdbusplus::message_t& m) {
Ed Tanous1ef4c342022-05-12 16:12:36 -07001959 if (ec)
1960 {
1961 userErrorMessageHandler(m.get_error(), asyncResp, newUser,
1962 username);
1963 return;
1964 }
1965
1966 updateUserProperties(asyncResp, newUser, password, enabled, roleId,
Abhishek Patel58345852022-02-02 08:54:25 -06001967 locked, accountTypes, userSelf);
Patrick Williams5a39f772023-10-20 11:20:21 -05001968 },
Ed Tanous1ef4c342022-05-12 16:12:36 -07001969 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1970 "xyz.openbmc_project.User.Manager", "RenameUser", username,
1971 *newUserName);
1972}
1973
Ed Tanous6c51eab2021-06-03 12:30:29 -07001974inline void requestAccountServiceRoutes(App& app)
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001975{
Ed Tanous6c51eab2021-06-03 12:30:29 -07001976 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001977 .privileges(redfish::privileges::headAccountService)
1978 .methods(boost::beast::http::verb::head)(
1979 std::bind_front(handleAccountServiceHead, std::ref(app)));
1980
1981 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
Ed Tanoused398212021-06-09 17:05:54 -07001982 .privileges(redfish::privileges::getAccountService)
Ed Tanous002d39b2022-05-31 08:59:27 -07001983 .methods(boost::beast::http::verb::get)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07001984 std::bind_front(handleAccountServiceGet, std::ref(app)));
Ed Tanous6c51eab2021-06-03 12:30:29 -07001985
Ed Tanousf5ffd802021-07-19 10:55:33 -07001986 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
Gunnar Mills1ec43ee2022-01-04 15:39:52 -06001987 .privileges(redfish::privileges::patchAccountService)
Ed Tanousf5ffd802021-07-19 10:55:33 -07001988 .methods(boost::beast::http::verb::patch)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07001989 std::bind_front(handleAccountServicePatch, std::ref(app)));
Ed Tanousf5ffd802021-07-19 10:55:33 -07001990
Ed Tanous6c51eab2021-06-03 12:30:29 -07001991 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
Ed Tanous4c7d4d32022-07-07 15:29:35 -07001992 .privileges(redfish::privileges::headManagerAccountCollection)
1993 .methods(boost::beast::http::verb::head)(
1994 std::bind_front(handleAccountCollectionHead, std::ref(app)));
1995
1996 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
Ed Tanoused398212021-06-09 17:05:54 -07001997 .privileges(redfish::privileges::getManagerAccountCollection)
Ed Tanous6c51eab2021-06-03 12:30:29 -07001998 .methods(boost::beast::http::verb::get)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07001999 std::bind_front(handleAccountCollectionGet, std::ref(app)));
Ed Tanous06e086d2018-09-19 17:19:52 -07002000
Ed Tanous6c51eab2021-06-03 12:30:29 -07002001 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
Ed Tanoused398212021-06-09 17:05:54 -07002002 .privileges(redfish::privileges::postManagerAccountCollection)
Ed Tanous002d39b2022-05-31 08:59:27 -07002003 .methods(boost::beast::http::verb::post)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07002004 std::bind_front(handleAccountCollectionPost, std::ref(app)));
Ed Tanous002d39b2022-05-31 08:59:27 -07002005
2006 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanous4c7d4d32022-07-07 15:29:35 -07002007 .privileges(redfish::privileges::headManagerAccount)
2008 .methods(boost::beast::http::verb::head)(
2009 std::bind_front(handleAccountHead, std::ref(app)));
2010
2011 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanous002d39b2022-05-31 08:59:27 -07002012 .privileges(redfish::privileges::getManagerAccount)
2013 .methods(boost::beast::http::verb::get)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07002014 std::bind_front(handleAccountGet, std::ref(app)));
Ed Tanous6c51eab2021-06-03 12:30:29 -07002015
2016 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanoused398212021-06-09 17:05:54 -07002017 // TODO this privilege should be using the generated endpoints, but
2018 // because of the special handling of ConfigureSelf, it's not able to
2019 // yet
Ed Tanous6c51eab2021-06-03 12:30:29 -07002020 .privileges({{"ConfigureUsers"}, {"ConfigureSelf"}})
2021 .methods(boost::beast::http::verb::patch)(
Ed Tanous1ef4c342022-05-12 16:12:36 -07002022 std::bind_front(handleAccountPatch, std::ref(app)));
Ed Tanous6c51eab2021-06-03 12:30:29 -07002023
2024 BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
Ed Tanoused398212021-06-09 17:05:54 -07002025 .privileges(redfish::privileges::deleteManagerAccount)
Ed Tanous6c51eab2021-06-03 12:30:29 -07002026 .methods(boost::beast::http::verb::delete_)(
Gunnar Mills20fc3072023-01-27 15:13:36 -06002027 std::bind_front(handleAccountDelete, std::ref(app)));
Ed Tanous6c51eab2021-06-03 12:30:29 -07002028}
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01002029
Ed Tanous1abe55e2018-09-05 08:30:59 -07002030} // namespace redfish