blob: 7028260327cdf9cc9658ab1a7b00be09db977ff7 [file] [log] [blame]
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001/*
2// Copyright (c) 2018 Intel Corporation
3//
4// Licensed under the Apache License, Version 2.0 (the "License");
5// you may not use this file except in compliance with the License.
6// You may obtain a copy of the License at
7//
8// http://www.apache.org/licenses/LICENSE-2.0
9//
10// Unless required by applicable law or agreed to in writing, software
11// distributed under the License is distributed on an "AS IS" BASIS,
12// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13// See the License for the specific language governing permissions and
14// limitations under the License.
15*/
16#pragma once
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010017#include "node.hpp"
18
Ratan Gupta24c85422019-01-30 19:41:24 +053019#include <dbus_utility.hpp>
Ed Tanous65b0dc32018-09-19 16:04:03 -070020#include <error_messages.hpp>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070021#include <openbmc_dbus_rest.hpp>
Ed Tanousa8408792018-09-05 16:08:38 -070022#include <utils/json_utils.hpp>
Ed Tanousabf2add2019-01-22 16:40:12 -080023#include <variant>
Ed Tanousb9b2e0b2018-09-13 13:47:50 -070024
Ed Tanous1abe55e2018-09-05 08:30:59 -070025namespace redfish
26{
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +010027
Ratan Gupta6973a582018-12-13 18:25:44 +053028constexpr const char* ldapConfigObject =
29 "/xyz/openbmc_project/user/ldap/openldap";
Ratan Guptaab828d72019-04-22 14:18:33 +053030constexpr const char* ADConfigObject =
31 "/xyz/openbmc_project/user/ldap/active_directory";
32
Ratan Gupta6973a582018-12-13 18:25:44 +053033constexpr const char* ldapRootObject = "/xyz/openbmc_project/user/ldap";
34constexpr const char* ldapDbusService = "xyz.openbmc_project.Ldap.Config";
35constexpr const char* ldapConfigInterface =
36 "xyz.openbmc_project.User.Ldap.Config";
37constexpr const char* ldapCreateInterface =
38 "xyz.openbmc_project.User.Ldap.Create";
39constexpr const char* ldapEnableInterface = "xyz.openbmc_project.Object.Enable";
Ratan Gupta06785242019-07-26 22:30:16 +053040constexpr const char* ldapPrivMapperInterface =
41 "xyz.openbmc_project.User.PrivilegeMapper";
Ratan Gupta6973a582018-12-13 18:25:44 +053042constexpr const char* dbusObjManagerIntf = "org.freedesktop.DBus.ObjectManager";
43constexpr const char* propertyInterface = "org.freedesktop.DBus.Properties";
44constexpr const char* mapperBusName = "xyz.openbmc_project.ObjectMapper";
45constexpr const char* mapperObjectPath = "/xyz/openbmc_project/object_mapper";
46constexpr const char* mapperIntf = "xyz.openbmc_project.ObjectMapper";
47
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060048struct LDAPRoleMapData
49{
50 std::string groupName;
51 std::string privilege;
52};
53
Ratan Gupta6973a582018-12-13 18:25:44 +053054struct LDAPConfigData
55{
56 std::string uri{};
57 std::string bindDN{};
58 std::string baseDN{};
59 std::string searchScope{};
60 std::string serverType{};
61 bool serviceEnabled = false;
62 std::string userNameAttribute{};
63 std::string groupAttribute{};
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060064 std::vector<std::pair<std::string, LDAPRoleMapData>> groupRoleList;
Ratan Gupta6973a582018-12-13 18:25:44 +053065};
66
Przemyslaw Czarnowski107077d2019-07-11 10:16:43 +020067using DbusVariantType = sdbusplus::message::variant<bool, int32_t, std::string>;
68
69using DbusInterfaceType = boost::container::flat_map<
70 std::string, boost::container::flat_map<std::string, DbusVariantType>>;
71
72using ManagedObjectType =
73 std::vector<std::pair<sdbusplus::message::object_path, DbusInterfaceType>>;
74
Ratan Gupta6973a582018-12-13 18:25:44 +053075using GetObjectType =
76 std::vector<std::pair<std::string, std::vector<std::string>>>;
AppaRao Puli84e12cb2018-10-11 01:28:15 +053077
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060078inline std::string getRoleIdFromPrivilege(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053079{
80 if (role == "priv-admin")
81 {
82 return "Administrator";
83 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +053084 else if (role == "priv-user")
85 {
AppaRao Pulic80fee52019-10-16 14:49:36 +053086 return "ReadOnly";
AppaRao Puli84e12cb2018-10-11 01:28:15 +053087 }
88 else if (role == "priv-operator")
89 {
90 return "Operator";
91 }
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +000092 else if ((role == "") || (role == "priv-noaccess"))
93 {
94 return "NoAccess";
95 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +053096 return "";
97}
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -060098inline std::string getPrivilegeFromRoleId(std::string_view role)
AppaRao Puli84e12cb2018-10-11 01:28:15 +053099{
100 if (role == "Administrator")
101 {
102 return "priv-admin";
103 }
AppaRao Pulic80fee52019-10-16 14:49:36 +0530104 else if (role == "ReadOnly")
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530105 {
106 return "priv-user";
107 }
108 else if (role == "Operator")
109 {
110 return "priv-operator";
111 }
jayaprakash Mutyalae9e6d242019-07-29 11:59:08 +0000112 else if (role == "NoAccess")
113 {
114 return "priv-noaccess";
115 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +0530116 return "";
117}
Ed Tanousb9b2e0b2018-09-13 13:47:50 -0700118
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +0000119void userErrorMessageHandler(const sd_bus_error* e,
120 std::shared_ptr<AsyncResp> asyncResp,
121 const std::string& newUser,
122 const std::string& username)
123{
124 const char* errorMessage = e->name;
125 if (e == nullptr)
126 {
127 messages::internalError(asyncResp->res);
128 return;
129 }
130
131 if (strcmp(errorMessage,
132 "xyz.openbmc_project.User.Common.Error.UserNameExists") == 0)
133 {
134 messages::resourceAlreadyExists(asyncResp->res,
135 "#ManagerAccount.v1_0_3.ManagerAccount",
136 "UserName", newUser);
137 }
138 else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
139 "UserNameDoesNotExist") == 0)
140 {
141 messages::resourceNotFound(
142 asyncResp->res, "#ManagerAccount.v1_0_3.ManagerAccount", username);
143 }
144 else if (strcmp(errorMessage,
145 "xyz.openbmc_project.Common.Error.InvalidArgument") == 0)
146 {
147 messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
148 }
149 else if (strcmp(errorMessage,
150 "xyz.openbmc_project.User.Common.Error.NoResource") == 0)
151 {
152 messages::createLimitReachedForResource(asyncResp->res);
153 }
154 else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
155 "UserNameGroupFail") == 0)
156 {
157 messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
158 }
159 else
160 {
161 messages::internalError(asyncResp->res);
162 }
163
164 return;
165}
166
Ratan Gupta6973a582018-12-13 18:25:44 +0530167void parseLDAPConfigData(nlohmann::json& json_response,
Ratan Guptaab828d72019-04-22 14:18:33 +0530168 const LDAPConfigData& confData,
169 const std::string& ldapType)
Ratan Gupta6973a582018-12-13 18:25:44 +0530170{
Ratan Guptaab828d72019-04-22 14:18:33 +0530171 std::string service =
172 (ldapType == "LDAP") ? "LDAPService" : "ActiveDirectoryService";
Marri Devender Rao37cce912019-02-20 01:05:22 -0600173 nlohmann::json ldap = {
Ratan Gupta6973a582018-12-13 18:25:44 +0530174 {"ServiceEnabled", confData.serviceEnabled},
175 {"ServiceAddresses", nlohmann::json::array({confData.uri})},
176 {"Authentication",
177 {{"AuthenticationType", "UsernameAndPassword"},
Ratan Gupta6973a582018-12-13 18:25:44 +0530178 {"Username", confData.bindDN},
179 {"Password", nullptr}}},
180 {"LDAPService",
181 {{"SearchSettings",
182 {{"BaseDistinguishedNames",
183 nlohmann::json::array({confData.baseDN})},
184 {"UsernameAttribute", confData.userNameAttribute},
185 {"GroupsAttribute", confData.groupAttribute}}}}},
186 };
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600187
Marri Devender Rao37cce912019-02-20 01:05:22 -0600188 json_response[ldapType].update(std::move(ldap));
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600189
190 nlohmann::json& roleMapArray = json_response[ldapType]["RemoteRoleMapping"];
191 roleMapArray = nlohmann::json::array();
192 for (auto& obj : confData.groupRoleList)
193 {
194 BMCWEB_LOG_DEBUG << "Pushing the data groupName="
195 << obj.second.groupName << "\n";
196 roleMapArray.push_back(
197 {nlohmann::json::array({"RemoteGroup", obj.second.groupName}),
198 nlohmann::json::array(
199 {"LocalRole", getRoleIdFromPrivilege(obj.second.privilege)})});
200 }
Ratan Gupta6973a582018-12-13 18:25:44 +0530201}
202
203/**
Ratan Gupta06785242019-07-26 22:30:16 +0530204 * @brief validates given JSON input and then calls appropriate method to
205 * create, to delete or to set Rolemapping object based on the given input.
206 *
207 */
208static void handleRoleMapPatch(
209 const std::shared_ptr<AsyncResp>& asyncResp,
210 const std::vector<std::pair<std::string, LDAPRoleMapData>>& roleMapObjData,
211 const std::string& serverType, std::vector<nlohmann::json>& input)
212{
213 for (size_t index = 0; index < input.size(); index++)
214 {
215 nlohmann::json& thisJson = input[index];
216
217 if (thisJson.is_null())
218 {
219 // delete the existing object
220 if (index < roleMapObjData.size())
221 {
222 crow::connections::systemBus->async_method_call(
223 [asyncResp, roleMapObjData, serverType,
224 index](const boost::system::error_code ec) {
225 if (ec)
226 {
227 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
228 messages::internalError(asyncResp->res);
229 return;
230 }
231 asyncResp->res
232 .jsonValue[serverType]["RemoteRoleMapping"][index] =
233 nullptr;
234 },
235 ldapDbusService, roleMapObjData[index].first,
236 "xyz.openbmc_project.Object.Delete", "Delete");
237 }
238 else
239 {
240 BMCWEB_LOG_ERROR << "Can't delete the object";
241 messages::propertyValueTypeError(
242 asyncResp->res, thisJson.dump(),
243 "RemoteRoleMapping/" + std::to_string(index));
244 return;
245 }
246 }
247 else if (thisJson.empty())
248 {
249 // Don't do anything for the empty objects,parse next json
250 // eg {"RemoteRoleMapping",[{}]}
251 }
252 else
253 {
254 // update/create the object
255 std::optional<std::string> remoteGroup;
256 std::optional<std::string> localRole;
257
258 if (!json_util::readJson(thisJson, asyncResp->res, "RemoteGroup",
259 remoteGroup, "LocalRole", localRole))
260 {
261 continue;
262 }
263
264 // Update existing RoleMapping Object
265 if (index < roleMapObjData.size())
266 {
267 BMCWEB_LOG_DEBUG << "Update Role Map Object";
268 // If "RemoteGroup" info is provided
269 if (remoteGroup)
270 {
271 crow::connections::systemBus->async_method_call(
272 [asyncResp, roleMapObjData, serverType, index,
273 remoteGroup](const boost::system::error_code ec) {
274 if (ec)
275 {
276 BMCWEB_LOG_ERROR << "DBUS response error: "
277 << ec;
278 messages::internalError(asyncResp->res);
279 return;
280 }
281 asyncResp->res
282 .jsonValue[serverType]["RemoteRoleMapping"]
283 [index]["RemoteGroup"] = *remoteGroup;
284 },
285 ldapDbusService, roleMapObjData[index].first,
286 propertyInterface, "Set",
287 "xyz.openbmc_project.User.PrivilegeMapperEntry",
288 "GroupName",
289 std::variant<std::string>(std::move(*remoteGroup)));
290 }
291
292 // If "LocalRole" info is provided
293 if (localRole)
294 {
295 crow::connections::systemBus->async_method_call(
296 [asyncResp, roleMapObjData, serverType, index,
297 localRole](const boost::system::error_code ec) {
298 if (ec)
299 {
300 BMCWEB_LOG_ERROR << "DBUS response error: "
301 << ec;
302 messages::internalError(asyncResp->res);
303 return;
304 }
305 asyncResp->res
306 .jsonValue[serverType]["RemoteRoleMapping"]
307 [index]["LocalRole"] = *localRole;
308 },
309 ldapDbusService, roleMapObjData[index].first,
310 propertyInterface, "Set",
311 "xyz.openbmc_project.User.PrivilegeMapperEntry",
312 "Privilege",
313 std::variant<std::string>(
314 getPrivilegeFromRoleId(std::move(*localRole))));
315 }
316 }
317 // Create a new RoleMapping Object.
318 else
319 {
320 BMCWEB_LOG_DEBUG
321 << "setRoleMappingProperties: Creating new Object";
322 std::string pathString =
323 "RemoteRoleMapping/" + std::to_string(index);
324
325 if (!localRole)
326 {
327 messages::propertyMissing(asyncResp->res,
328 pathString + "/LocalRole");
329 continue;
330 }
331 if (!remoteGroup)
332 {
333 messages::propertyMissing(asyncResp->res,
334 pathString + "/RemoteGroup");
335 continue;
336 }
337
338 std::string dbusObjectPath;
339 if (serverType == "ActiveDirectory")
340 {
341 dbusObjectPath = ADConfigObject;
342 }
343 else if (serverType == "LDAP")
344 {
345 dbusObjectPath = ldapConfigObject;
346 }
347
348 BMCWEB_LOG_DEBUG << "Remote Group=" << *remoteGroup
349 << ",LocalRole=" << *localRole;
350
351 crow::connections::systemBus->async_method_call(
Ed Tanous271584a2019-07-09 16:24:22 -0700352 [asyncResp, serverType, localRole,
Ratan Gupta06785242019-07-26 22:30:16 +0530353 remoteGroup](const boost::system::error_code ec) {
354 if (ec)
355 {
356 BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
357 messages::internalError(asyncResp->res);
358 return;
359 }
360 nlohmann::json& remoteRoleJson =
361 asyncResp->res
362 .jsonValue[serverType]["RemoteRoleMapping"];
363 remoteRoleJson.push_back(
364 {{"LocalRole", *localRole},
365 {"RemoteGroup", *remoteGroup}});
366 },
367 ldapDbusService, dbusObjectPath, ldapPrivMapperInterface,
368 "Create", std::move(*remoteGroup),
369 getPrivilegeFromRoleId(std::move(*localRole)));
370 }
371 }
372 }
373}
374
375/**
Ratan Gupta6973a582018-12-13 18:25:44 +0530376 * Function that retrieves all properties for LDAP config object
377 * into JSON
378 */
379template <typename CallbackFunc>
380inline void getLDAPConfigData(const std::string& ldapType,
381 CallbackFunc&& callback)
382{
Ratan Guptaab828d72019-04-22 14:18:33 +0530383
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600384 const std::array<const char*, 2> interfaces = {ldapEnableInterface,
Ratan Gupta6973a582018-12-13 18:25:44 +0530385 ldapConfigInterface};
386
387 crow::connections::systemBus->async_method_call(
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600388 [callback, ldapType](const boost::system::error_code ec,
389 const GetObjectType& resp) {
390 LDAPConfigData confData{};
391 if (ec || resp.empty())
392 {
393 BMCWEB_LOG_ERROR << "DBUS response error during getting of "
394 "service name: "
395 << ec;
396 callback(false, confData, ldapType);
397 return;
398 }
399 std::string service = resp.begin()->first;
400 crow::connections::systemBus->async_method_call(
401 [callback, ldapType](const boost::system::error_code error_code,
402 const ManagedObjectType& ldapObjects) {
403 LDAPConfigData confData{};
404 if (error_code)
405 {
406 callback(false, confData, ldapType);
407 BMCWEB_LOG_ERROR << "D-Bus responses error: "
408 << error_code;
409 return;
410 }
411
412 std::string ldapDbusType;
413 std::string searchString;
414
415 if (ldapType == "LDAP")
416 {
417 ldapDbusType = "xyz.openbmc_project.User.Ldap.Config."
418 "Type.OpenLdap";
419 searchString = "openldap";
420 }
421 else if (ldapType == "ActiveDirectory")
422 {
423 ldapDbusType =
424 "xyz.openbmc_project.User.Ldap.Config.Type."
425 "ActiveDirectory";
426 searchString = "active_directory";
427 }
428 else
429 {
430 BMCWEB_LOG_ERROR
431 << "Can't get the DbusType for the given type="
432 << ldapType;
433 callback(false, confData, ldapType);
434 return;
435 }
436
437 std::string ldapEnableInterfaceStr = ldapEnableInterface;
438 std::string ldapConfigInterfaceStr = ldapConfigInterface;
439
440 for (const auto& object : ldapObjects)
441 {
442 // let's find the object whose ldap type is equal to the
443 // given type
444 if (object.first.str.find(searchString) ==
445 std::string::npos)
446 {
447 continue;
448 }
449
450 for (const auto& interface : object.second)
451 {
452 if (interface.first == ldapEnableInterfaceStr)
453 {
454 // rest of the properties are string.
455 for (const auto& property : interface.second)
456 {
457 if (property.first == "Enabled")
458 {
459 const bool* value =
460 std::get_if<bool>(&property.second);
461 if (value == nullptr)
462 {
463 continue;
464 }
465 confData.serviceEnabled = *value;
466 break;
467 }
468 }
469 }
470 else if (interface.first == ldapConfigInterfaceStr)
471 {
472
473 for (const auto& property : interface.second)
474 {
Ed Tanous271584a2019-07-09 16:24:22 -0700475 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600476 std::get_if<std::string>(
477 &property.second);
Ed Tanous271584a2019-07-09 16:24:22 -0700478 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600479 {
480 continue;
481 }
482 if (property.first == "LDAPServerURI")
483 {
Ed Tanous271584a2019-07-09 16:24:22 -0700484 confData.uri = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600485 }
486 else if (property.first == "LDAPBindDN")
487 {
Ed Tanous271584a2019-07-09 16:24:22 -0700488 confData.bindDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600489 }
490 else if (property.first == "LDAPBaseDN")
491 {
Ed Tanous271584a2019-07-09 16:24:22 -0700492 confData.baseDN = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600493 }
494 else if (property.first ==
495 "LDAPSearchScope")
496 {
Ed Tanous271584a2019-07-09 16:24:22 -0700497 confData.searchScope = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600498 }
499 else if (property.first ==
500 "GroupNameAttribute")
501 {
Ed Tanous271584a2019-07-09 16:24:22 -0700502 confData.groupAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600503 }
504 else if (property.first ==
505 "UserNameAttribute")
506 {
Ed Tanous271584a2019-07-09 16:24:22 -0700507 confData.userNameAttribute = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600508 }
509 else if (property.first == "LDAPType")
510 {
Ed Tanous271584a2019-07-09 16:24:22 -0700511 confData.serverType = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600512 }
513 }
514 }
515 else if (interface.first ==
516 "xyz.openbmc_project.User."
517 "PrivilegeMapperEntry")
518 {
519 LDAPRoleMapData roleMapData{};
520 for (const auto& property : interface.second)
521 {
Ed Tanous271584a2019-07-09 16:24:22 -0700522 const std::string* strValue =
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600523 std::get_if<std::string>(
524 &property.second);
525
Ed Tanous271584a2019-07-09 16:24:22 -0700526 if (strValue == nullptr)
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600527 {
528 continue;
529 }
530
531 if (property.first == "GroupName")
532 {
Ed Tanous271584a2019-07-09 16:24:22 -0700533 roleMapData.groupName = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600534 }
535 else if (property.first == "Privilege")
536 {
Ed Tanous271584a2019-07-09 16:24:22 -0700537 roleMapData.privilege = *strValue;
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600538 }
539 }
540
Ed Tanous0f0353b2019-10-24 11:37:51 -0700541 confData.groupRoleList.emplace_back(
542 object.first.str, roleMapData);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -0600543 }
544 }
545 }
546 callback(true, confData, ldapType);
547 },
548 service, ldapRootObject, dbusObjManagerIntf,
549 "GetManagedObjects");
550 },
551 mapperBusName, mapperObjectPath, mapperIntf, "GetObject",
552 ldapConfigObject, interfaces);
Ratan Gupta6973a582018-12-13 18:25:44 +0530553}
554
Ed Tanous1abe55e2018-09-05 08:30:59 -0700555class AccountService : public Node
556{
557 public:
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100558 AccountService(CrowApp& app) :
559 Node(app, "/redfish/v1/AccountService/"), app(app)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700560 {
Ed Tanous1abe55e2018-09-05 08:30:59 -0700561 entityPrivileges = {
Gunnar Mills3c5a3762020-01-29 15:21:30 -0600562 {boost::beast::http::verb::get, {{"Login"}}},
Ed Tanous1abe55e2018-09-05 08:30:59 -0700563 {boost::beast::http::verb::head, {{"Login"}}},
564 {boost::beast::http::verb::patch, {{"ConfigureUsers"}}},
565 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
566 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
567 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
568 }
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +0100569
Ed Tanous1abe55e2018-09-05 08:30:59 -0700570 private:
Ratan Gupta8a07d282019-03-16 08:33:47 +0530571 /**
572 * @brief parses the authentication section under the LDAP
573 * @param input JSON data
574 * @param asyncResp pointer to the JSON response
575 * @param userName userName to be filled from the given JSON.
576 * @param password password to be filled from the given JSON.
577 */
578 void
579 parseLDAPAuthenticationJson(nlohmann::json input,
580 const std::shared_ptr<AsyncResp>& asyncResp,
581 std::optional<std::string>& username,
582 std::optional<std::string>& password)
583 {
584 std::optional<std::string> authType;
585
586 if (!json_util::readJson(input, asyncResp->res, "AuthenticationType",
587 authType, "Username", username, "Password",
588 password))
589 {
590 return;
591 }
592 if (!authType)
593 {
594 return;
595 }
596 if (*authType != "UsernameAndPassword")
597 {
598 messages::propertyValueNotInList(asyncResp->res, *authType,
599 "AuthenticationType");
600 return;
601 }
602 }
603 /**
604 * @brief parses the LDAPService section under the LDAP
605 * @param input JSON data
606 * @param asyncResp pointer to the JSON response
607 * @param baseDNList baseDN to be filled from the given JSON.
608 * @param userNameAttribute userName to be filled from the given JSON.
609 * @param groupaAttribute password to be filled from the given JSON.
610 */
611
612 void parseLDAPServiceJson(
613 nlohmann::json input, const std::shared_ptr<AsyncResp>& asyncResp,
614 std::optional<std::vector<std::string>>& baseDNList,
615 std::optional<std::string>& userNameAttribute,
616 std::optional<std::string>& groupsAttribute)
617 {
618 std::optional<nlohmann::json> searchSettings;
619
620 if (!json_util::readJson(input, asyncResp->res, "SearchSettings",
621 searchSettings))
622 {
623 return;
624 }
625 if (!searchSettings)
626 {
627 return;
628 }
629 if (!json_util::readJson(*searchSettings, asyncResp->res,
630 "BaseDistinguishedNames", baseDNList,
631 "UsernameAttribute", userNameAttribute,
632 "GroupsAttribute", groupsAttribute))
633 {
634 return;
635 }
636 }
637 /**
638 * @brief updates the LDAP server address and updates the
639 json response with the new value.
640 * @param serviceAddressList address to be updated.
641 * @param asyncResp pointer to the JSON response
642 * @param ldapServerElementName Type of LDAP
643 server(openLDAP/ActiveDirectory)
644 */
645
646 void handleServiceAddressPatch(
647 const std::vector<std::string>& serviceAddressList,
648 const std::shared_ptr<AsyncResp>& asyncResp,
649 const std::string& ldapServerElementName,
650 const std::string& ldapConfigObject)
651 {
652 crow::connections::systemBus->async_method_call(
653 [asyncResp, ldapServerElementName,
654 serviceAddressList](const boost::system::error_code ec) {
655 if (ec)
656 {
657 BMCWEB_LOG_DEBUG
658 << "Error Occured in updating the service address";
659 messages::internalError(asyncResp->res);
660 return;
661 }
662 std::vector<std::string> modifiedserviceAddressList = {
663 serviceAddressList.front()};
664 asyncResp->res
665 .jsonValue[ldapServerElementName]["ServiceAddresses"] =
666 modifiedserviceAddressList;
667 if ((serviceAddressList).size() > 1)
668 {
669 messages::propertyValueModified(asyncResp->res,
670 "ServiceAddresses",
671 serviceAddressList.front());
672 }
673 BMCWEB_LOG_DEBUG << "Updated the service address";
674 },
675 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
676 ldapConfigInterface, "LDAPServerURI",
677 std::variant<std::string>(serviceAddressList.front()));
678 }
679 /**
680 * @brief updates the LDAP Bind DN and updates the
681 json response with the new value.
682 * @param username name of the user which needs to be updated.
683 * @param asyncResp pointer to the JSON response
684 * @param ldapServerElementName Type of LDAP
685 server(openLDAP/ActiveDirectory)
686 */
687
688 void handleUserNamePatch(const std::string& username,
689 const std::shared_ptr<AsyncResp>& asyncResp,
690 const std::string& ldapServerElementName,
691 const std::string& ldapConfigObject)
692 {
693 crow::connections::systemBus->async_method_call(
694 [asyncResp, username,
695 ldapServerElementName](const boost::system::error_code ec) {
696 if (ec)
697 {
698 BMCWEB_LOG_DEBUG
699 << "Error occured in updating the username";
700 messages::internalError(asyncResp->res);
701 return;
702 }
703 asyncResp->res.jsonValue[ldapServerElementName]
704 ["Authentication"]["Username"] =
705 username;
706 BMCWEB_LOG_DEBUG << "Updated the username";
707 },
708 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
709 ldapConfigInterface, "LDAPBindDN",
710 std::variant<std::string>(username));
711 }
712
713 /**
714 * @brief updates the LDAP password
715 * @param password : ldap password which needs to be updated.
716 * @param asyncResp pointer to the JSON response
717 * @param ldapServerElementName Type of LDAP
718 * server(openLDAP/ActiveDirectory)
719 */
720
721 void handlePasswordPatch(const std::string& password,
722 const std::shared_ptr<AsyncResp>& asyncResp,
723 const std::string& ldapServerElementName,
724 const std::string& ldapConfigObject)
725 {
726 crow::connections::systemBus->async_method_call(
727 [asyncResp, password,
728 ldapServerElementName](const boost::system::error_code ec) {
729 if (ec)
730 {
731 BMCWEB_LOG_DEBUG
732 << "Error occured in updating the password";
733 messages::internalError(asyncResp->res);
734 return;
735 }
736 asyncResp->res.jsonValue[ldapServerElementName]
737 ["Authentication"]["Password"] = "";
738 BMCWEB_LOG_DEBUG << "Updated the password";
739 },
740 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
741 ldapConfigInterface, "LDAPBindDNPassword",
742 std::variant<std::string>(password));
743 }
744
745 /**
746 * @brief updates the LDAP BaseDN and updates the
747 json response with the new value.
748 * @param baseDNList baseDN list which needs to be updated.
749 * @param asyncResp pointer to the JSON response
750 * @param ldapServerElementName Type of LDAP
751 server(openLDAP/ActiveDirectory)
752 */
753
754 void handleBaseDNPatch(const std::vector<std::string>& baseDNList,
755 const std::shared_ptr<AsyncResp>& asyncResp,
756 const std::string& ldapServerElementName,
757 const std::string& ldapConfigObject)
758 {
759 crow::connections::systemBus->async_method_call(
760 [asyncResp, baseDNList,
761 ldapServerElementName](const boost::system::error_code ec) {
762 if (ec)
763 {
764 BMCWEB_LOG_DEBUG << "Error Occured in Updating the base DN";
765 messages::internalError(asyncResp->res);
766 return;
767 }
768 auto& serverTypeJson =
769 asyncResp->res.jsonValue[ldapServerElementName];
770 auto& searchSettingsJson =
771 serverTypeJson["LDAPService"]["SearchSettings"];
772 std::vector<std::string> modifiedBaseDNList = {
773 baseDNList.front()};
774 searchSettingsJson["BaseDistinguishedNames"] =
775 modifiedBaseDNList;
776 if (baseDNList.size() > 1)
777 {
778 messages::propertyValueModified(asyncResp->res,
779 "BaseDistinguishedNames",
780 baseDNList.front());
781 }
782 BMCWEB_LOG_DEBUG << "Updated the base DN";
783 },
784 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
785 ldapConfigInterface, "LDAPBaseDN",
786 std::variant<std::string>(baseDNList.front()));
787 }
788 /**
789 * @brief updates the LDAP user name attribute and updates the
790 json response with the new value.
791 * @param userNameAttribute attribute to be updated.
792 * @param asyncResp pointer to the JSON response
793 * @param ldapServerElementName Type of LDAP
794 server(openLDAP/ActiveDirectory)
795 */
796
797 void handleUserNameAttrPatch(const std::string& userNameAttribute,
798 const std::shared_ptr<AsyncResp>& asyncResp,
799 const std::string& ldapServerElementName,
800 const std::string& ldapConfigObject)
801 {
802 crow::connections::systemBus->async_method_call(
803 [asyncResp, userNameAttribute,
804 ldapServerElementName](const boost::system::error_code ec) {
805 if (ec)
806 {
807 BMCWEB_LOG_DEBUG << "Error Occured in Updating the "
808 "username attribute";
809 messages::internalError(asyncResp->res);
810 return;
811 }
812 auto& serverTypeJson =
813 asyncResp->res.jsonValue[ldapServerElementName];
814 auto& searchSettingsJson =
815 serverTypeJson["LDAPService"]["SearchSettings"];
816 searchSettingsJson["UsernameAttribute"] = userNameAttribute;
817 BMCWEB_LOG_DEBUG << "Updated the user name attr.";
818 },
819 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
820 ldapConfigInterface, "UserNameAttribute",
821 std::variant<std::string>(userNameAttribute));
822 }
823 /**
824 * @brief updates the LDAP group attribute and updates the
825 json response with the new value.
826 * @param groupsAttribute attribute to be updated.
827 * @param asyncResp pointer to the JSON response
828 * @param ldapServerElementName Type of LDAP
829 server(openLDAP/ActiveDirectory)
830 */
831
832 void handleGroupNameAttrPatch(const std::string& groupsAttribute,
833 const std::shared_ptr<AsyncResp>& asyncResp,
834 const std::string& ldapServerElementName,
835 const std::string& ldapConfigObject)
836 {
837 crow::connections::systemBus->async_method_call(
838 [asyncResp, groupsAttribute,
839 ldapServerElementName](const boost::system::error_code ec) {
840 if (ec)
841 {
842 BMCWEB_LOG_DEBUG << "Error Occured in Updating the "
843 "groupname attribute";
844 messages::internalError(asyncResp->res);
845 return;
846 }
847 auto& serverTypeJson =
848 asyncResp->res.jsonValue[ldapServerElementName];
849 auto& searchSettingsJson =
850 serverTypeJson["LDAPService"]["SearchSettings"];
851 searchSettingsJson["GroupsAttribute"] = groupsAttribute;
852 BMCWEB_LOG_DEBUG << "Updated the groupname attr";
853 },
854 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
855 ldapConfigInterface, "GroupNameAttribute",
856 std::variant<std::string>(groupsAttribute));
857 }
858 /**
859 * @brief updates the LDAP service enable and updates the
860 json response with the new value.
861 * @param input JSON data.
862 * @param asyncResp pointer to the JSON response
863 * @param ldapServerElementName Type of LDAP
864 server(openLDAP/ActiveDirectory)
865 */
866
867 void handleServiceEnablePatch(bool serviceEnabled,
868 const std::shared_ptr<AsyncResp>& asyncResp,
869 const std::string& ldapServerElementName,
870 const std::string& ldapConfigObject)
871 {
872 crow::connections::systemBus->async_method_call(
873 [asyncResp, serviceEnabled,
874 ldapServerElementName](const boost::system::error_code ec) {
875 if (ec)
876 {
877 BMCWEB_LOG_DEBUG
878 << "Error Occured in Updating the service enable";
879 messages::internalError(asyncResp->res);
880 return;
881 }
882 asyncResp->res
883 .jsonValue[ldapServerElementName]["ServiceEnabled"] =
884 serviceEnabled;
885 BMCWEB_LOG_DEBUG << "Updated Service enable = "
886 << serviceEnabled;
887 },
888 ldapDbusService, ldapConfigObject, propertyInterface, "Set",
889 ldapEnableInterface, "Enabled", std::variant<bool>(serviceEnabled));
890 }
891
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100892 void handleAuthMethodsPatch(nlohmann::json& input,
893 const std::shared_ptr<AsyncResp>& asyncResp)
894 {
895 std::optional<bool> basicAuth;
896 std::optional<bool> cookie;
897 std::optional<bool> sessionToken;
898 std::optional<bool> xToken;
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200899 std::optional<bool> tls;
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100900
901 if (!json_util::readJson(input, asyncResp->res, "BasicAuth", basicAuth,
902 "Cookie", cookie, "SessionToken", sessionToken,
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200903 "XToken", xToken, "TLS", tls))
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100904 {
905 BMCWEB_LOG_ERROR << "Cannot read values from AuthMethod tag";
906 return;
907 }
908
909 // Make a copy of methods configuration
910 crow::persistent_data::AuthConfigMethods authMethodsConfig =
911 crow::persistent_data::SessionStore::getInstance()
912 .getAuthMethodsConfig();
913
914 if (basicAuth)
915 {
916 authMethodsConfig.basic = *basicAuth;
917 }
918
919 if (cookie)
920 {
921 authMethodsConfig.cookie = *cookie;
922 }
923
924 if (sessionToken)
925 {
926 authMethodsConfig.sessionToken = *sessionToken;
927 }
928
929 if (xToken)
930 {
931 authMethodsConfig.xtoken = *xToken;
932 }
933
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200934 if (tls)
935 {
936 authMethodsConfig.tls = *tls;
937 }
938
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100939 if (!authMethodsConfig.basic && !authMethodsConfig.cookie &&
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +0200940 !authMethodsConfig.sessionToken && !authMethodsConfig.xtoken &&
941 !authMethodsConfig.tls)
Zbigniew Kurzynski78158632019-11-05 12:57:37 +0100942 {
943 // Do not allow user to disable everything
944 messages::actionNotSupported(asyncResp->res,
945 "of disabling all available methods");
946 return;
947 }
948
949 crow::persistent_data::SessionStore::getInstance()
950 .updateAuthMethodsConfig(authMethodsConfig);
951 // Save configuration immediately
952 app.template getMiddleware<crow::persistent_data::Middleware>()
953 .writeData();
954
955 messages::success(asyncResp->res);
956 }
957
Ratan Gupta8a07d282019-03-16 08:33:47 +0530958 /**
959 * @brief Get the required values from the given JSON, validates the
960 * value and create the LDAP config object.
961 * @param input JSON data
962 * @param asyncResp pointer to the JSON response
963 * @param serverType Type of LDAP server(openLDAP/ActiveDirectory)
964 */
965
966 void handleLDAPPatch(nlohmann::json& input,
967 const std::shared_ptr<AsyncResp>& asyncResp,
968 const crow::Request& req,
969 const std::vector<std::string>& params,
970 const std::string& serverType)
971 {
Ratan Guptaeb2bbe52019-04-22 14:27:01 +0530972 std::string dbusObjectPath;
973 if (serverType == "ActiveDirectory")
974 {
975 dbusObjectPath = ADConfigObject;
976 }
977 else if (serverType == "LDAP")
978 {
979 dbusObjectPath = ldapConfigObject;
980 }
981
Ratan Gupta8a07d282019-03-16 08:33:47 +0530982 std::optional<nlohmann::json> authentication;
983 std::optional<nlohmann::json> ldapService;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530984 std::optional<std::vector<std::string>> serviceAddressList;
985 std::optional<bool> serviceEnabled;
986 std::optional<std::vector<std::string>> baseDNList;
987 std::optional<std::string> userNameAttribute;
988 std::optional<std::string> groupsAttribute;
989 std::optional<std::string> userName;
990 std::optional<std::string> password;
Ratan Gupta06785242019-07-26 22:30:16 +0530991 std::optional<std::vector<nlohmann::json>> remoteRoleMapData;
Ratan Gupta8a07d282019-03-16 08:33:47 +0530992
993 if (!json_util::readJson(input, asyncResp->res, "Authentication",
994 authentication, "LDAPService", ldapService,
995 "ServiceAddresses", serviceAddressList,
Ratan Gupta06785242019-07-26 22:30:16 +0530996 "ServiceEnabled", serviceEnabled,
997 "RemoteRoleMapping", remoteRoleMapData))
Ratan Gupta8a07d282019-03-16 08:33:47 +0530998 {
999 return;
1000 }
1001
1002 if (authentication)
1003 {
1004 parseLDAPAuthenticationJson(*authentication, asyncResp, userName,
1005 password);
1006 }
1007 if (ldapService)
1008 {
1009 parseLDAPServiceJson(*ldapService, asyncResp, baseDNList,
1010 userNameAttribute, groupsAttribute);
1011 }
Ratan Gupta8a07d282019-03-16 08:33:47 +05301012 if (serviceAddressList)
1013 {
1014 if ((*serviceAddressList).size() == 0)
1015 {
1016 messages::propertyValueNotInList(asyncResp->res, "[]",
1017 "ServiceAddress");
1018 return;
1019 }
1020 }
1021 if (baseDNList)
1022 {
1023 if ((*baseDNList).size() == 0)
1024 {
1025 messages::propertyValueNotInList(asyncResp->res, "[]",
1026 "BaseDistinguishedNames");
1027 return;
1028 }
1029 }
1030
1031 // nothing to update, then return
1032 if (!userName && !password && !serviceAddressList && !baseDNList &&
Ratan Gupta06785242019-07-26 22:30:16 +05301033 !userNameAttribute && !groupsAttribute && !serviceEnabled &&
1034 !remoteRoleMapData)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301035 {
1036 return;
1037 }
1038
1039 // Get the existing resource first then keep modifying
1040 // whenever any property gets updated.
Ratan Guptaab828d72019-04-22 14:18:33 +05301041 getLDAPConfigData(serverType, [this, asyncResp, userName, password,
1042 baseDNList, userNameAttribute,
Gunnar Millsba9dd4a2020-02-20 10:40:18 -06001043 groupsAttribute, serviceAddressList,
1044 serviceEnabled, dbusObjectPath,
1045 remoteRoleMapData](
Ratan Guptaab828d72019-04-22 14:18:33 +05301046 bool success, LDAPConfigData confData,
1047 const std::string& serverType) {
1048 if (!success)
1049 {
1050 messages::internalError(asyncResp->res);
1051 return;
1052 }
1053 parseLDAPConfigData(asyncResp->res.jsonValue, confData, serverType);
1054 if (confData.serviceEnabled)
1055 {
1056 // Disable the service first and update the rest of
1057 // the properties.
1058 handleServiceEnablePatch(false, asyncResp, serverType,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301059 dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301060 }
Ratan Gupta8a07d282019-03-16 08:33:47 +05301061
Ratan Guptaab828d72019-04-22 14:18:33 +05301062 if (serviceAddressList)
1063 {
1064 handleServiceAddressPatch(*serviceAddressList, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301065 serverType, dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301066 }
1067 if (userName)
1068 {
1069 handleUserNamePatch(*userName, asyncResp, serverType,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301070 dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301071 }
1072 if (password)
1073 {
1074 handlePasswordPatch(*password, asyncResp, serverType,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301075 dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301076 }
Ratan Gupta8a07d282019-03-16 08:33:47 +05301077
Ratan Guptaab828d72019-04-22 14:18:33 +05301078 if (baseDNList)
1079 {
1080 handleBaseDNPatch(*baseDNList, asyncResp, serverType,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301081 dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301082 }
1083 if (userNameAttribute)
1084 {
1085 handleUserNameAttrPatch(*userNameAttribute, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301086 serverType, dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301087 }
1088 if (groupsAttribute)
1089 {
1090 handleGroupNameAttrPatch(*groupsAttribute, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301091 serverType, dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301092 }
1093 if (serviceEnabled)
1094 {
1095 // if user has given the value as true then enable
1096 // the service. if user has given false then no-op
1097 // as service is already stopped.
1098 if (*serviceEnabled)
Ratan Gupta8a07d282019-03-16 08:33:47 +05301099 {
Ratan Guptaab828d72019-04-22 14:18:33 +05301100 handleServiceEnablePatch(*serviceEnabled, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301101 serverType, dbusObjectPath);
Ratan Gupta8a07d282019-03-16 08:33:47 +05301102 }
Ratan Guptaab828d72019-04-22 14:18:33 +05301103 }
1104 else
1105 {
1106 // if user has not given the service enabled value
1107 // then revert it to the same state as it was
1108 // before.
1109 handleServiceEnablePatch(confData.serviceEnabled, asyncResp,
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301110 serverType, dbusObjectPath);
Ratan Guptaab828d72019-04-22 14:18:33 +05301111 }
Ratan Gupta06785242019-07-26 22:30:16 +05301112
1113 if (remoteRoleMapData)
1114 {
1115 std::vector<nlohmann::json> remoteRoleMap =
1116 std::move(*remoteRoleMapData);
1117
1118 handleRoleMapPatch(asyncResp, confData.groupRoleList,
1119 serverType, remoteRoleMap);
1120 }
Ratan Guptaab828d72019-04-22 14:18:33 +05301121 });
Ratan Gupta8a07d282019-03-16 08:33:47 +05301122 }
Ed Tanousd4b54432019-07-17 22:51:55 +00001123
Ed Tanous1abe55e2018-09-05 08:30:59 -07001124 void doGet(crow::Response& res, const crow::Request& req,
1125 const std::vector<std::string>& params) override
1126 {
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001127 const crow::persistent_data::AuthConfigMethods& authMethodsConfig =
1128 crow::persistent_data::SessionStore::getInstance()
1129 .getAuthMethodsConfig();
1130
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301131 auto asyncResp = std::make_shared<AsyncResp>(res);
1132 res.jsonValue = {
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301133 {"@odata.id", "/redfish/v1/AccountService"},
1134 {"@odata.type", "#AccountService."
Gunnar Millsba9dd4a2020-02-20 10:40:18 -06001135 "v1_5_0.AccountService"},
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301136 {"Id", "AccountService"},
1137 {"Name", "Account Service"},
1138 {"Description", "Account Service"},
1139 {"ServiceEnabled", true},
AppaRao Puli343ff2e2019-03-24 00:42:13 +05301140 {"MaxPasswordLength", 20},
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301141 {"Accounts",
1142 {{"@odata.id", "/redfish/v1/AccountService/Accounts"}}},
Marri Devender Rao37cce912019-02-20 01:05:22 -06001143 {"Roles", {{"@odata.id", "/redfish/v1/AccountService/Roles"}}},
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001144 {"Oem",
1145 {{"OpenBMC",
1146 {{"@odata.type", "#OemAccountService.v1_0_0.AccountService"},
1147 {"AuthMethods",
1148 {
1149 {"BasicAuth", authMethodsConfig.basic},
1150 {"SessionToken", authMethodsConfig.sessionToken},
1151 {"XToken", authMethodsConfig.xtoken},
1152 {"Cookie", authMethodsConfig.cookie},
Zbigniew Kurzynski501f1e52019-10-02 11:22:11 +02001153 {"TLS", authMethodsConfig.tls},
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001154 }}}}}},
Marri Devender Rao37cce912019-02-20 01:05:22 -06001155 {"LDAP",
1156 {{"Certificates",
1157 {{"@odata.id",
1158 "/redfish/v1/AccountService/LDAP/Certificates"}}}}}};
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301159 crow::connections::systemBus->async_method_call(
1160 [asyncResp](
1161 const boost::system::error_code ec,
1162 const std::vector<std::pair<
Ed Tanousabf2add2019-01-22 16:40:12 -08001163 std::string, std::variant<uint32_t, uint16_t, uint8_t>>>&
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301164 propertiesList) {
1165 if (ec)
1166 {
1167 messages::internalError(asyncResp->res);
1168 return;
1169 }
1170 BMCWEB_LOG_DEBUG << "Got " << propertiesList.size()
1171 << "properties for AccountService";
1172 for (const std::pair<std::string,
Ed Tanousabf2add2019-01-22 16:40:12 -08001173 std::variant<uint32_t, uint16_t, uint8_t>>&
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301174 property : propertiesList)
1175 {
1176 if (property.first == "MinPasswordLength")
1177 {
1178 const uint8_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001179 std::get_if<uint8_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301180 if (value != nullptr)
1181 {
1182 asyncResp->res.jsonValue["MinPasswordLength"] =
1183 *value;
1184 }
1185 }
1186 if (property.first == "AccountUnlockTimeout")
1187 {
1188 const uint32_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001189 std::get_if<uint32_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301190 if (value != nullptr)
1191 {
1192 asyncResp->res.jsonValue["AccountLockoutDuration"] =
1193 *value;
1194 }
1195 }
1196 if (property.first == "MaxLoginAttemptBeforeLockout")
1197 {
1198 const uint16_t* value =
Ed Tanousabf2add2019-01-22 16:40:12 -08001199 std::get_if<uint16_t>(&property.second);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301200 if (value != nullptr)
1201 {
1202 asyncResp->res
1203 .jsonValue["AccountLockoutThreshold"] = *value;
1204 }
1205 }
1206 }
1207 },
1208 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1209 "org.freedesktop.DBus.Properties", "GetAll",
1210 "xyz.openbmc_project.User.AccountPolicy");
Ratan Gupta6973a582018-12-13 18:25:44 +05301211
Ratan Guptaab828d72019-04-22 14:18:33 +05301212 auto callback = [asyncResp](bool success, LDAPConfigData& confData,
1213 const std::string& ldapType) {
1214 parseLDAPConfigData(asyncResp->res.jsonValue, confData, ldapType);
1215 };
1216
1217 getLDAPConfigData("LDAP", callback);
1218 getLDAPConfigData("ActiveDirectory", callback);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301219 }
Ratan Gupta6973a582018-12-13 18:25:44 +05301220
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301221 void doPatch(crow::Response& res, const crow::Request& req,
1222 const std::vector<std::string>& params) override
1223 {
1224 auto asyncResp = std::make_shared<AsyncResp>(res);
1225
1226 std::optional<uint32_t> unlockTimeout;
1227 std::optional<uint16_t> lockoutThreshold;
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301228 std::optional<uint16_t> minPasswordLength;
1229 std::optional<uint16_t> maxPasswordLength;
Ratan Gupta8a07d282019-03-16 08:33:47 +05301230 std::optional<nlohmann::json> ldapObject;
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301231 std::optional<nlohmann::json> activeDirectoryObject;
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001232 std::optional<nlohmann::json> oemObject;
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301233
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001234 if (!json_util::readJson(
1235 req, res, "AccountLockoutDuration", unlockTimeout,
1236 "AccountLockoutThreshold", lockoutThreshold,
1237 "MaxPasswordLength", maxPasswordLength, "MinPasswordLength",
1238 minPasswordLength, "LDAP", ldapObject, "ActiveDirectory",
1239 activeDirectoryObject, "Oem", oemObject))
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301240 {
1241 return;
1242 }
Ratan Gupta19fb6e72019-03-04 13:30:50 +05301243
1244 if (minPasswordLength)
1245 {
1246 messages::propertyNotWritable(asyncResp->res, "MinPasswordLength");
1247 }
1248
1249 if (maxPasswordLength)
1250 {
1251 messages::propertyNotWritable(asyncResp->res, "MaxPasswordLength");
1252 }
1253
Ratan Gupta8a07d282019-03-16 08:33:47 +05301254 if (ldapObject)
1255 {
1256 handleLDAPPatch(*ldapObject, asyncResp, req, params, "LDAP");
1257 }
1258
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001259 if (std::optional<nlohmann::json> oemOpenBMCObject;
1260 oemObject &&
1261 json_util::readJson(*oemObject, res, "OpenBMC", oemOpenBMCObject))
1262 {
1263 if (std::optional<nlohmann::json> authMethodsObject;
1264 oemOpenBMCObject &&
1265 json_util::readJson(*oemOpenBMCObject, res, "AuthMethods",
1266 authMethodsObject))
1267 {
1268 if (authMethodsObject)
1269 {
1270 handleAuthMethodsPatch(*authMethodsObject, asyncResp);
1271 }
1272 }
1273 }
1274
Ratan Guptaeb2bbe52019-04-22 14:27:01 +05301275 if (activeDirectoryObject)
1276 {
1277 handleLDAPPatch(*activeDirectoryObject, asyncResp, req, params,
1278 "ActiveDirectory");
1279 }
1280
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301281 if (unlockTimeout)
1282 {
1283 crow::connections::systemBus->async_method_call(
1284 [asyncResp](const boost::system::error_code ec) {
1285 if (ec)
1286 {
1287 messages::internalError(asyncResp->res);
1288 return;
1289 }
Ratan Guptaadd61332019-02-13 20:49:16 +05301290 messages::success(asyncResp->res);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301291 },
1292 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1293 "org.freedesktop.DBus.Properties", "Set",
1294 "xyz.openbmc_project.User.AccountPolicy",
Ed Tanousabf2add2019-01-22 16:40:12 -08001295 "AccountUnlockTimeout", std::variant<uint32_t>(*unlockTimeout));
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301296 }
1297 if (lockoutThreshold)
1298 {
1299 crow::connections::systemBus->async_method_call(
1300 [asyncResp](const boost::system::error_code ec) {
1301 if (ec)
1302 {
1303 messages::internalError(asyncResp->res);
1304 return;
1305 }
Ratan Guptaadd61332019-02-13 20:49:16 +05301306 messages::success(asyncResp->res);
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301307 },
1308 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1309 "org.freedesktop.DBus.Properties", "Set",
1310 "xyz.openbmc_project.User.AccountPolicy",
1311 "MaxLoginAttemptBeforeLockout",
Ed Tanousabf2add2019-01-22 16:40:12 -08001312 std::variant<uint16_t>(*lockoutThreshold));
AppaRao Puli3d958bb2018-12-25 12:45:54 +05301313 }
Ed Tanous1abe55e2018-09-05 08:30:59 -07001314 }
Zbigniew Kurzynski78158632019-11-05 12:57:37 +01001315
1316 CrowApp& app;
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001317};
Tanousf00032d2018-11-05 01:18:10 -03001318
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001319class AccountsCollection : public Node
1320{
1321 public:
1322 AccountsCollection(CrowApp& app) :
1323 Node(app, "/redfish/v1/AccountService/Accounts/")
1324 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001325 entityPrivileges = {
1326 {boost::beast::http::verb::get,
1327 {{"ConfigureUsers"}, {"ConfigureManager"}}},
1328 {boost::beast::http::verb::head, {{"Login"}}},
1329 {boost::beast::http::verb::patch, {{"ConfigureUsers"}}},
1330 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
1331 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
1332 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
1333 }
1334
1335 private:
1336 void doGet(crow::Response& res, const crow::Request& req,
1337 const std::vector<std::string>& params) override
1338 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001339 auto asyncResp = std::make_shared<AsyncResp>(res);
Gunnar Mills94400962020-02-14 11:56:41 -06001340 res.jsonValue = {{"@odata.id", "/redfish/v1/AccountService/Accounts"},
Ed Tanous0f74e642018-11-12 15:17:05 -08001341 {"@odata.type", "#ManagerAccountCollection."
1342 "ManagerAccountCollection"},
1343 {"Name", "Accounts Collection"},
1344 {"Description", "BMC User Accounts"}};
1345
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001346 crow::connections::systemBus->async_method_call(
1347 [asyncResp](const boost::system::error_code ec,
1348 const ManagedObjectType& users) {
1349 if (ec)
1350 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001351 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001352 return;
1353 }
1354
1355 nlohmann::json& memberArray =
1356 asyncResp->res.jsonValue["Members"];
1357 memberArray = nlohmann::json::array();
1358
1359 asyncResp->res.jsonValue["Members@odata.count"] = users.size();
1360 for (auto& user : users)
1361 {
1362 const std::string& path =
1363 static_cast<const std::string&>(user.first);
1364 std::size_t lastIndex = path.rfind("/");
1365 if (lastIndex == std::string::npos)
1366 {
1367 lastIndex = 0;
1368 }
1369 else
1370 {
1371 lastIndex += 1;
1372 }
1373 memberArray.push_back(
1374 {{"@odata.id", "/redfish/v1/AccountService/Accounts/" +
1375 path.substr(lastIndex)}});
1376 }
1377 },
1378 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1379 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
1380 }
Ed Tanous04ae99e2018-09-20 15:54:36 -07001381 void doPost(crow::Response& res, const crow::Request& req,
1382 const std::vector<std::string>& params) override
1383 {
1384 auto asyncResp = std::make_shared<AsyncResp>(res);
1385
Ed Tanous9712f8a2018-09-21 13:38:49 -07001386 std::string username;
1387 std::string password;
Ed Tanousa24526d2018-12-10 15:17:59 -08001388 std::optional<std::string> roleId("User");
1389 std::optional<bool> enabled = true;
Ed Tanous9712f8a2018-09-21 13:38:49 -07001390 if (!json_util::readJson(req, res, "UserName", username, "Password",
1391 password, "RoleId", roleId, "Enabled",
1392 enabled))
Ed Tanous04ae99e2018-09-20 15:54:36 -07001393 {
1394 return;
1395 }
1396
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001397 std::string priv = getPrivilegeFromRoleId(*roleId);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301398 if (priv.empty())
Ed Tanous04ae99e2018-09-20 15:54:36 -07001399 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001400 messages::propertyValueNotInList(asyncResp->res, *roleId, "RoleId");
Ed Tanous04ae99e2018-09-20 15:54:36 -07001401 return;
1402 }
Ed Tanous9712f8a2018-09-21 13:38:49 -07001403 roleId = priv;
Ed Tanous04ae99e2018-09-20 15:54:36 -07001404
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001405 // Reading AllGroups property
Ed Tanous04ae99e2018-09-20 15:54:36 -07001406 crow::connections::systemBus->async_method_call(
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001407 [asyncResp, username, password{std::move(password)}, roleId,
1408 enabled](const boost::system::error_code ec,
1409 const std::variant<std::vector<std::string>>& allGroups) {
Ed Tanous04ae99e2018-09-20 15:54:36 -07001410 if (ec)
1411 {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001412 BMCWEB_LOG_DEBUG << "ERROR with async_method_call";
1413 messages::internalError(asyncResp->res);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001414 return;
1415 }
1416
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001417 const std::vector<std::string>* allGroupsList =
1418 std::get_if<std::vector<std::string>>(&allGroups);
1419
1420 if (allGroupsList == nullptr || allGroupsList->empty())
Ed Tanous04ae99e2018-09-20 15:54:36 -07001421 {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001422 messages::internalError(asyncResp->res);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001423 return;
1424 }
1425
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001426 crow::connections::systemBus->async_method_call(
1427 [asyncResp, username, password{std::move(password)}](
anil kumar appana0d4197e2019-06-13 15:06:23 +00001428 const boost::system::error_code ec,
1429 sdbusplus::message::message& m) {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001430 if (ec)
1431 {
anil kumar appana0d4197e2019-06-13 15:06:23 +00001432 userErrorMessageHandler(m.get_error(), asyncResp,
1433 username, "");
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001434 return;
1435 }
1436
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001437 if (pamUpdatePassword(username, password) !=
1438 PAM_SUCCESS)
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001439 {
1440 // At this point we have a user that's been created,
1441 // but the password set failed.Something is wrong,
1442 // so delete the user that we've already created
1443 crow::connections::systemBus->async_method_call(
anil kumar appana0d4197e2019-06-13 15:06:23 +00001444 [asyncResp,
1445 password](const boost::system::error_code ec) {
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001446 if (ec)
1447 {
1448 messages::internalError(asyncResp->res);
1449 return;
1450 }
1451
anil kumar appana0d4197e2019-06-13 15:06:23 +00001452 // If password is invalid
1453 messages::propertyValueFormatError(
1454 asyncResp->res, password, "Password");
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001455 },
1456 "xyz.openbmc_project.User.Manager",
1457 "/xyz/openbmc_project/user/" + username,
1458 "xyz.openbmc_project.Object.Delete", "Delete");
1459
1460 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1461 return;
1462 }
1463
1464 messages::created(asyncResp->res);
1465 asyncResp->res.addHeader(
1466 "Location",
1467 "/redfish/v1/AccountService/Accounts/" + username);
1468 },
1469 "xyz.openbmc_project.User.Manager",
1470 "/xyz/openbmc_project/user",
1471 "xyz.openbmc_project.User.Manager", "CreateUser", username,
1472 *allGroupsList, *roleId, *enabled);
Ed Tanous04ae99e2018-09-20 15:54:36 -07001473 },
1474 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
Ayushi Smriti599c71d2019-08-23 17:43:18 +00001475 "org.freedesktop.DBus.Properties", "Get",
1476 "xyz.openbmc_project.User.Manager", "AllGroups");
Ed Tanous04ae99e2018-09-20 15:54:36 -07001477 }
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001478};
1479
1480class ManagerAccount : public Node
1481{
1482 public:
1483 ManagerAccount(CrowApp& app) :
1484 Node(app, "/redfish/v1/AccountService/Accounts/<str>/", std::string())
1485 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001486 entityPrivileges = {
1487 {boost::beast::http::verb::get,
1488 {{"ConfigureUsers"}, {"ConfigureManager"}, {"ConfigureSelf"}}},
1489 {boost::beast::http::verb::head, {{"Login"}}},
Joseph Reynolds900f9492019-11-25 15:37:29 -06001490 {boost::beast::http::verb::patch,
1491 {{"ConfigureUsers"}, {"ConfigureSelf"}}},
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001492 {boost::beast::http::verb::put, {{"ConfigureUsers"}}},
1493 {boost::beast::http::verb::delete_, {{"ConfigureUsers"}}},
1494 {boost::beast::http::verb::post, {{"ConfigureUsers"}}}};
1495 }
1496
1497 private:
1498 void doGet(crow::Response& res, const crow::Request& req,
1499 const std::vector<std::string>& params) override
1500 {
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001501 auto asyncResp = std::make_shared<AsyncResp>(res);
1502
1503 if (params.size() != 1)
1504 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001505 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001506 return;
1507 }
1508
Joseph Reynolds900f9492019-11-25 15:37:29 -06001509 // Perform a proper ConfigureSelf authority check. If the
1510 // user is operating on an account not their own, then their
1511 // ConfigureSelf privilege does not apply. In this case,
1512 // perform the authority check again without the user's
1513 // ConfigureSelf privilege.
1514 if (req.session->username != params[0])
1515 {
1516 if (!isAllowedWithoutConfigureSelf(req))
1517 {
1518 BMCWEB_LOG_DEBUG << "GET Account denied access";
1519 messages::insufficientPrivilege(asyncResp->res);
1520 return;
1521 }
1522 }
1523
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001524 crow::connections::systemBus->async_method_call(
1525 [asyncResp, accountName{std::string(params[0])}](
1526 const boost::system::error_code ec,
1527 const ManagedObjectType& users) {
1528 if (ec)
1529 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001530 messages::internalError(asyncResp->res);
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001531 return;
1532 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301533 auto userIt = users.begin();
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001534
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301535 for (; userIt != users.end(); userIt++)
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001536 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301537 if (boost::ends_with(userIt->first.str, "/" + accountName))
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001538 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301539 break;
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001540 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301541 }
1542 if (userIt == users.end())
1543 {
1544 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1545 accountName);
1546 return;
1547 }
Ayushi Smriti4e68c452019-09-04 14:37:55 +05301548
1549 asyncResp->res.jsonValue = {
Ayushi Smriti4e68c452019-09-04 14:37:55 +05301550 {"@odata.type", "#ManagerAccount.v1_0_3.ManagerAccount"},
1551 {"Name", "User Account"},
1552 {"Description", "User Account"},
1553 {"Password", nullptr}};
1554
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301555 for (const auto& interface : userIt->second)
1556 {
1557 if (interface.first ==
1558 "xyz.openbmc_project.User.Attributes")
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001559 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301560 for (const auto& property : interface.second)
Ed Tanous65b0dc32018-09-19 16:04:03 -07001561 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301562 if (property.first == "UserEnabled")
Ed Tanous65b0dc32018-09-19 16:04:03 -07001563 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301564 const bool* userEnabled =
Ed Tanousabf2add2019-01-22 16:40:12 -08001565 std::get_if<bool>(&property.second);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301566 if (userEnabled == nullptr)
Ed Tanous65b0dc32018-09-19 16:04:03 -07001567 {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301568 BMCWEB_LOG_ERROR
1569 << "UserEnabled wasn't a bool";
1570 messages::internalError(asyncResp->res);
1571 return;
Ed Tanous65b0dc32018-09-19 16:04:03 -07001572 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301573 asyncResp->res.jsonValue["Enabled"] =
1574 *userEnabled;
1575 }
1576 else if (property.first ==
1577 "UserLockedForFailedAttempt")
1578 {
1579 const bool* userLocked =
Ed Tanousabf2add2019-01-22 16:40:12 -08001580 std::get_if<bool>(&property.second);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301581 if (userLocked == nullptr)
1582 {
1583 BMCWEB_LOG_ERROR << "UserLockedForF"
1584 "ailedAttempt "
1585 "wasn't a bool";
1586 messages::internalError(asyncResp->res);
1587 return;
1588 }
1589 asyncResp->res.jsonValue["Locked"] =
1590 *userLocked;
Ratan Gupta24c85422019-01-30 19:41:24 +05301591 asyncResp->res.jsonValue
1592 ["Locked@Redfish.AllowableValues"] = {
Gunnar Mills4d64ce32019-03-29 16:34:56 -05001593 "false"};
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301594 }
1595 else if (property.first == "UserPrivilege")
1596 {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001597 const std::string* userPrivPtr =
Ed Tanousabf2add2019-01-22 16:40:12 -08001598 std::get_if<std::string>(&property.second);
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001599 if (userPrivPtr == nullptr)
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301600 {
1601 BMCWEB_LOG_ERROR
1602 << "UserPrivilege wasn't a "
1603 "string";
1604 messages::internalError(asyncResp->res);
1605 return;
1606 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001607 std::string role =
1608 getRoleIdFromPrivilege(*userPrivPtr);
1609 if (role.empty())
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301610 {
1611 BMCWEB_LOG_ERROR << "Invalid user role";
1612 messages::internalError(asyncResp->res);
1613 return;
1614 }
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001615 asyncResp->res.jsonValue["RoleId"] = role;
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301616
1617 asyncResp->res.jsonValue["Links"]["Role"] = {
1618 {"@odata.id", "/redfish/v1/AccountService/"
1619 "Roles/" +
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001620 role}};
Ed Tanous65b0dc32018-09-19 16:04:03 -07001621 }
1622 }
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001623 }
1624 }
1625
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301626 asyncResp->res.jsonValue["@odata.id"] =
1627 "/redfish/v1/AccountService/Accounts/" + accountName;
1628 asyncResp->res.jsonValue["Id"] = accountName;
1629 asyncResp->res.jsonValue["UserName"] = accountName;
Ed Tanousb9b2e0b2018-09-13 13:47:50 -07001630 },
1631 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1632 "org.freedesktop.DBus.ObjectManager", "GetManagedObjects");
1633 }
Ed Tanousa8408792018-09-05 16:08:38 -07001634
1635 void doPatch(crow::Response& res, const crow::Request& req,
1636 const std::vector<std::string>& params) override
1637 {
1638 auto asyncResp = std::make_shared<AsyncResp>(res);
Ed Tanousa8408792018-09-05 16:08:38 -07001639 if (params.size() != 1)
1640 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001641 messages::internalError(asyncResp->res);
Ed Tanousa8408792018-09-05 16:08:38 -07001642 return;
1643 }
1644
Ed Tanousa24526d2018-12-10 15:17:59 -08001645 std::optional<std::string> newUserName;
1646 std::optional<std::string> password;
1647 std::optional<bool> enabled;
1648 std::optional<std::string> roleId;
Ratan Gupta24c85422019-01-30 19:41:24 +05301649 std::optional<bool> locked;
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301650 if (!json_util::readJson(req, res, "UserName", newUserName, "Password",
Ratan Gupta24c85422019-01-30 19:41:24 +05301651 password, "RoleId", roleId, "Enabled", enabled,
1652 "Locked", locked))
Ed Tanousa8408792018-09-05 16:08:38 -07001653 {
1654 return;
1655 }
1656
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301657 const std::string& username = params[0];
Ed Tanousa8408792018-09-05 16:08:38 -07001658
Joseph Reynolds900f9492019-11-25 15:37:29 -06001659 // Perform a proper ConfigureSelf authority check. If the
1660 // session is being used to PATCH a property other than
1661 // Password, then the ConfigureSelf privilege does not apply.
1662 // If the user is operating on an account not their own, then
1663 // their ConfigureSelf privilege does not apply. In either
1664 // case, perform the authority check again without the user's
1665 // ConfigureSelf privilege.
1666 if ((username != req.session->username) ||
1667 (newUserName || enabled || roleId || locked))
1668 {
1669 if (!isAllowedWithoutConfigureSelf(req))
1670 {
1671 BMCWEB_LOG_WARNING << "PATCH Password denied access";
1672 asyncResp->res.clear();
1673 messages::insufficientPrivilege(asyncResp->res);
1674 return;
1675 }
1676 }
1677
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001678 // if user name is not provided in the patch method or if it
1679 // matches the user name in the URI, then we are treating it as updating
1680 // user properties other then username. If username provided doesn't
1681 // match the URI, then we are treating this as user rename request.
1682 if (!newUserName || (newUserName.value() == username))
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301683 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301684 updateUserProperties(asyncResp, username, password, enabled, roleId,
1685 locked);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301686 return;
1687 }
1688 else
1689 {
1690 crow::connections::systemBus->async_method_call(
1691 [this, asyncResp, username, password(std::move(password)),
1692 roleId(std::move(roleId)), enabled(std::move(enabled)),
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001693 newUser{std::string(*newUserName)},
1694 locked(std::move(locked))](const boost::system::error_code ec,
1695 sdbusplus::message::message& m) {
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301696 if (ec)
Ed Tanousa8408792018-09-05 16:08:38 -07001697 {
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001698 userErrorMessageHandler(m.get_error(), asyncResp,
1699 newUser, username);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301700 return;
1701 }
1702
1703 updateUserProperties(asyncResp, newUser, password, enabled,
Ratan Gupta24c85422019-01-30 19:41:24 +05301704 roleId, locked);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301705 },
1706 "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1707 "xyz.openbmc_project.User.Manager", "RenameUser", username,
1708 *newUserName);
1709 }
1710 }
1711
1712 void updateUserProperties(std::shared_ptr<AsyncResp> asyncResp,
1713 const std::string& username,
Ed Tanousa24526d2018-12-10 15:17:59 -08001714 std::optional<std::string> password,
1715 std::optional<bool> enabled,
Ratan Gupta24c85422019-01-30 19:41:24 +05301716 std::optional<std::string> roleId,
1717 std::optional<bool> locked)
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301718 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301719 std::string dbusObjectPath = "/xyz/openbmc_project/user/" + username;
1720 dbus::utility::escapePathForDbus(dbusObjectPath);
1721
Ratan Gupta22c33712019-05-03 21:50:28 +05301722 dbus::utility::checkDbusPathExists(
Ratan Gupta24c85422019-01-30 19:41:24 +05301723 dbusObjectPath,
1724 [dbusObjectPath(std::move(dbusObjectPath)), username,
1725 password(std::move(password)), roleId(std::move(roleId)),
1726 enabled(std::move(enabled)), locked(std::move(locked)),
1727 asyncResp{std::move(asyncResp)}](int rc) {
1728 if (!rc)
1729 {
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001730 messages::resourceNotFound(
1731 asyncResp->res, "#ManagerAccount.v1_0_3.ManagerAccount",
1732 username);
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301733 return;
Ratan Gupta24c85422019-01-30 19:41:24 +05301734 }
jayaprakash Mutyala66b5ca72019-08-07 20:26:37 +00001735
1736 if (password)
1737 {
1738 int retval = pamUpdatePassword(username, *password);
1739
1740 if (retval == PAM_USER_UNKNOWN)
1741 {
1742 messages::resourceNotFound(
1743 asyncResp->res,
1744 "#ManagerAccount.v1_0_3.ManagerAccount", username);
1745 }
1746 else if (retval == PAM_AUTHTOK_ERR)
1747 {
1748 // If password is invalid
1749 messages::propertyValueFormatError(
1750 asyncResp->res, *password, "Password");
1751 BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1752 }
1753 else if (retval != PAM_SUCCESS)
1754 {
1755 messages::internalError(asyncResp->res);
1756 return;
1757 }
1758 }
1759
Ratan Gupta24c85422019-01-30 19:41:24 +05301760 if (enabled)
1761 {
1762 crow::connections::systemBus->async_method_call(
1763 [asyncResp](const boost::system::error_code ec) {
1764 if (ec)
1765 {
1766 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1767 << ec;
1768 messages::internalError(asyncResp->res);
1769 return;
1770 }
1771 messages::success(asyncResp->res);
1772 return;
1773 },
1774 "xyz.openbmc_project.User.Manager",
1775 dbusObjectPath.c_str(),
1776 "org.freedesktop.DBus.Properties", "Set",
1777 "xyz.openbmc_project.User.Attributes", "UserEnabled",
1778 std::variant<bool>{*enabled});
1779 }
Ed Tanous9712f8a2018-09-21 13:38:49 -07001780
Ratan Gupta24c85422019-01-30 19:41:24 +05301781 if (roleId)
1782 {
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001783 std::string priv = getPrivilegeFromRoleId(*roleId);
Ratan Gupta24c85422019-01-30 19:41:24 +05301784 if (priv.empty())
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301785 {
Ratan Gupta24c85422019-01-30 19:41:24 +05301786 messages::propertyValueNotInList(asyncResp->res,
1787 *roleId, "RoleId");
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301788 return;
1789 }
Ratan Gupta24c85422019-01-30 19:41:24 +05301790
1791 crow::connections::systemBus->async_method_call(
1792 [asyncResp](const boost::system::error_code ec) {
1793 if (ec)
1794 {
1795 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1796 << ec;
1797 messages::internalError(asyncResp->res);
1798 return;
1799 }
1800 messages::success(asyncResp->res);
1801 },
1802 "xyz.openbmc_project.User.Manager",
1803 dbusObjectPath.c_str(),
1804 "org.freedesktop.DBus.Properties", "Set",
1805 "xyz.openbmc_project.User.Attributes", "UserPrivilege",
1806 std::variant<std::string>{priv});
1807 }
1808
1809 if (locked)
1810 {
1811 // admin can unlock the account which is locked by
Nagaraju Goruganti54fc5872019-01-30 05:11:00 -06001812 // successive authentication failures but admin should
1813 // not be allowed to lock an account.
Ratan Gupta24c85422019-01-30 19:41:24 +05301814 if (*locked)
1815 {
1816 messages::propertyValueNotInList(asyncResp->res, "true",
1817 "Locked");
1818 return;
1819 }
1820
1821 crow::connections::systemBus->async_method_call(
1822 [asyncResp](const boost::system::error_code ec) {
1823 if (ec)
1824 {
1825 BMCWEB_LOG_ERROR << "D-Bus responses error: "
1826 << ec;
1827 messages::internalError(asyncResp->res);
1828 return;
1829 }
1830 messages::success(asyncResp->res);
1831 return;
1832 },
1833 "xyz.openbmc_project.User.Manager",
1834 dbusObjectPath.c_str(),
1835 "org.freedesktop.DBus.Properties", "Set",
1836 "xyz.openbmc_project.User.Attributes",
1837 "UserLockedForFailedAttempt",
1838 sdbusplus::message::variant<bool>{*locked});
1839 }
1840 });
Ed Tanousa8408792018-09-05 16:08:38 -07001841 }
Ed Tanous06e086d2018-09-19 17:19:52 -07001842
1843 void doDelete(crow::Response& res, const crow::Request& req,
1844 const std::vector<std::string>& params) override
1845 {
1846 auto asyncResp = std::make_shared<AsyncResp>(res);
1847
1848 if (params.size() != 1)
1849 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001850 messages::internalError(asyncResp->res);
Ed Tanous06e086d2018-09-19 17:19:52 -07001851 return;
1852 }
1853
1854 const std::string userPath = "/xyz/openbmc_project/user/" + params[0];
1855
1856 crow::connections::systemBus->async_method_call(
1857 [asyncResp, username{std::move(params[0])}](
1858 const boost::system::error_code ec) {
1859 if (ec)
1860 {
Jason M. Billsf12894f2018-10-09 12:45:45 -07001861 messages::resourceNotFound(
1862 asyncResp->res, "#ManagerAccount.v1_0_3.ManagerAccount",
1863 username);
Ed Tanous06e086d2018-09-19 17:19:52 -07001864 return;
1865 }
1866
Jason M. Billsf12894f2018-10-09 12:45:45 -07001867 messages::accountRemoved(asyncResp->res);
Ed Tanous06e086d2018-09-19 17:19:52 -07001868 },
1869 "xyz.openbmc_project.User.Manager", userPath,
1870 "xyz.openbmc_project.Object.Delete", "Delete");
1871 }
AppaRao Puli84e12cb2018-10-11 01:28:15 +05301872};
Lewanczyk, Dawid88d16c92018-02-02 14:51:09 +01001873
Ed Tanous1abe55e2018-09-05 08:30:59 -07001874} // namespace redfish