blob: 39171c9a307f075ac2de3ff6ffbd6138202d6a83 [file] [log] [blame]
*** Settings ***
Documentation Test Redfish user account.
Resource ../../lib/resource.robot
Resource ../../lib/bmc_redfish_resource.robot
Resource ../../lib/openbmc_ffdc.robot
Resource ../../lib/bmc_redfish_utils.robot
Library SSHLibrary
Test Setup Redfish.Login
Test Teardown Test Teardown Execution
*** Variables ***
${account_lockout_duration} ${30}
${account_lockout_threshold} ${3}
** Test Cases **
Verify AccountService Available
[Documentation] Verify Redfish account service is available.
[Tags] Verify_AccountService_Available
${resp} = Redfish_utils.Get Attribute /redfish/v1/AccountService ServiceEnabled
Should Be Equal As Strings ${resp} ${True}
Verify Redfish Admin User Persistence After Reboot
[Documentation] Verify Redfish admin user persistence after reboot.
[Tags] Verify_Redfish_Admin_User_Persistence_After_Reboot
[Setup] Run Keywords Redfish.Login AND
... Redfish Create User admin_user TestPwd123 Administrator ${True}
[Teardown] Run Keywords Redfish.Delete /redfish/v1/AccountService/Accounts/admin_user
... AND Test Teardown Execution
# Reboot BMC.
Redfish OBMC Reboot (off) stack_mode=normal
# Verify users after reboot.
Redfish Verify User admin_user TestPwd123 Administrator ${True}
Verify Redfish Operator User Persistence After Reboot
[Documentation] Verify Redfish operator user persistence after reboot.
[Tags] Verify_Redfish_Operator_User_Persistence_After_Reboot
[Setup] Run Keywords Redfish.Login AND
... Redfish Create User operator_user TestPwd123 Operator ${True}
[Teardown] Run Keywords Redfish.Delete /redfish/v1/AccountService/Accounts/operator_user
... AND Test Teardown Execution
# Reboot BMC.
Redfish OBMC Reboot (off) stack_mode=normal
# Verify users after reboot.
Redfish Verify User operator_user TestPwd123 Operator ${True}
Verify Redfish Readonly User Persistence After Reboot
[Documentation] Verify Redfish readonly user persistence after reboot.
[Tags] Verify_Redfish_Readonly_User_Persistence_After_Reboot
[Setup] Run Keywords Redfish.Login AND
... Redfish Create User readonly_user TestPwd123 ReadOnly ${True}
[Teardown] Run Keywords Redfish.Delete /redfish/v1/AccountService/Accounts/readonly_user
... AND Test Teardown Execution
# Reboot BMC.
Redfish OBMC Reboot (off) stack_mode=normal
# Verify users after reboot.
Redfish Verify User readonly_user TestPwd123 ReadOnly ${True}
Redfish Create and Verify Admin User
[Documentation] Create a Redfish user with administrator role and verify.
[Tags] Redfish_Create_and_Verify_Admin_User
[Template] Redfish Create And Verify User
#username password role_id enabled
admin_user TestPwd123 Administrator ${True}
Redfish Create and Verify Operator User
[Documentation] Create a Redfish user with operator role and verify.
[Tags] Redfish_Create_and_Verify_Operator_User
[Template] Redfish Create And Verify User
#username password role_id enabled
operator_user TestPwd123 Operator ${True}
Redfish Create and Verify Readonly User
[Documentation] Create a Redfish user with readonly role and verify.
[Tags] Redfish_Create_and_Verify_Readonly_User
[Template] Redfish Create And Verify User
#username password role_id enabled
readonly_user TestPwd123 ReadOnly ${True}
Verify Redfish Admin User With Wrong Password
[Documentation] Verify Redfish admin user with wrong password.
[Tags] Verify_Redfish_Admin_User_With_Wrong_Password
[Template] Verify Redfish User with Wrong Password
#username password role_id enabled wrong_password
admin_user TestPwd123 Administrator ${True} alskjhfwurh
Verify Redfish Operator User with Wrong Password
[Documentation] Verify Redfish operator user with wrong password.
[Tags] Verify_Redfish_Operator_User_with_Wrong_Password
[Template] Verify Redfish User with Wrong Password
#username password role_id enabled wrong_password
operator_user TestPwd123 Operator ${True} 12j8a8uakjhdaosiruf024
Verify Redfish Readonly User With Wrong Password
[Documentation] Verify Redfish readonly user with wrong password.
[Tags] Verify_Redfish_Readonly_User_With_Wrong_Password
[Template] Verify Redfish User with Wrong Password
#username password role_id enabled wrong_password
readonly_user TestPwd123 ReadOnly ${True} 12
Verify Login with Deleted Redfish Admin User
[Documentation] Verify login with deleted Redfish admin user.
[Tags] Verify_Login_with_Deleted_Redfish_Admin_User
[Template] Verify Login with Deleted Redfish User
#username password role_id enabled
admin_user TestPwd123 Administrator ${True}
Verify Login with Deleted Redfish Operator User
[Documentation] Verify login with deleted Redfish operator user.
[Tags] Verify_Login_with_Deleted_Redfish_Operator_User
[Template] Verify Login with Deleted Redfish User
#username password role_id enabled
operator_user TestPwd123 Operator ${True}
Verify Login with Deleted Redfish Readonly User
[Documentation] Verify login with deleted Redfish readonly user.
[Tags] Verify_Login_with_Deleted_Redfish_Readonly_User
[Template] Verify Login with Deleted Redfish User
#username password role_id enabled
readonly_user TestPwd123 ReadOnly ${True}
Verify Admin User Creation Without Enabling It
[Documentation] Verify admin user creation without enabling it.
[Tags] Verify_Admin_User_Creation_Without_Enabling_It
[Template] Verify Create User Without Enabling
#username password role_id enabled
admin_user TestPwd123 Administrator ${False}
Verify Operator User Creation Without Enabling It
[Documentation] Verify operator user creation without enabling it.
[Tags] Verify_Operator_User_Creation_Without_Enabling_It
[Template] Verify Create User Without Enabling
#username password role_id enabled
operator_user TestPwd123 Operator ${False}
Verify Readonly User Creation Without Enabling It
[Documentation] Verify readonly user creation without enabling it.
[Tags] Verify_Readonly_User_Creation_Without_Enabling_It
[Template] Verify Create User Without Enabling
#username password role_id enabled
readonly_user TestPwd123 ReadOnly ${False}
Verify User Creation With Invalid Role Id
[Documentation] Verify user creation with invalid role ID.
[Tags] Verify_User_Creation_With_Invalid_Role_Id
# Make sure the user account in question does not already exist.
Redfish.Delete /redfish/v1/AccountService/Accounts/test_user
... valid_status_codes=[${HTTP_OK}, ${HTTP_NOT_FOUND}]
# Create specified user.
${payload}= Create Dictionary
... UserName=test_user Password=TestPwd123 RoleId=wrongroleid Enabled=${True}
Redfish.Post /redfish/v1/AccountService/Accounts/ body=&{payload}
... valid_status_codes=[${HTTP_BAD_REQUEST}]
Verify Error Upon Creating Same Users With Different Privileges
[Documentation] Verify error upon creating same users with different privileges.
[Tags] Verify_Error_Upon_Creating_Same_Users_With_Different_Privileges
Redfish Create User test_user TestPwd123 Administrator ${True}
# Create specified user.
${payload}= Create Dictionary
... UserName=test_user Password=TestPwd123 RoleId=ReadOnly Enabled=${True}
Redfish.Post /redfish/v1/AccountService/Accounts/ body=&{payload}
... valid_status_codes=[${HTTP_BAD_REQUEST}]
Redfish.Delete /redfish/v1/AccountService/Accounts/test_user
Verify Modifying User Attributes
[Documentation] Verify modifying user attributes.
[Tags] Verify_Modifying_User_Attributes
# Create Redfish users.
Redfish Create User admin_user TestPwd123 Administrator ${True}
Redfish Create User readonly_user TestPwd123 ReadOnly ${True}
# Make sure the new user account does not already exist.
Redfish.Delete /redfish/v1/AccountService/Accounts/newadmin_user
... valid_status_codes=[${HTTP_OK}, ${HTTP_NOT_FOUND}]
# Update admin_user username using Redfish.
${payload}= Create Dictionary UserName=newadmin_user
Redfish.Patch /redfish/v1/AccountService/Accounts/admin_user body=&{payload}
# Update readonly_user role using Redfish.
${payload}= Create Dictionary RoleId=Administrator
Redfish.Patch /redfish/v1/AccountService/Accounts/readonly_user body=&{payload}
# Verify users after updating
Redfish Verify User newadmin_user TestPwd123 Administrator ${True}
Redfish Verify User readonly_user TestPwd123 Administrator ${True}
# Delete created users.
Redfish.Delete /redfish/v1/AccountService/Accounts/newadmin_user
Redfish.Delete /redfish/v1/AccountService/Accounts/readonly_user
Verify Modifying Operator User Attributes
[Documentation] Verify modifying operator user attributes.
[Tags] Verify_Modifying_Operator_User_Attributes
[Setup] Run Keywords Redfish.Login AND
... Redfish Create User operator_user TestPwd123 Operator ${True}
[Teardown] Run Keywords Redfish.Delete /redfish/v1/AccountService/Accounts/operator_user
... AND Test Teardown Execution
# Update operator_user password using Redfish.
${payload}= Create Dictionary Password=NewTestPwd123
Redfish.Patch /redfish/v1/AccountService/Accounts/operator_user body=&{payload}
# Verify users after updating
Redfish Verify User operator_user NewTestPwd123 Operator ${True}
Verify User Account Locked
[Documentation] Verify user account locked upon trying with invalid password.
[Tags] Verify_User_Account_Locked
Redfish Create User admin_user TestPwd123 Administrator ${True}
${payload}= Create Dictionary AccountLockoutThreshold=${account_lockout_threshold}
... AccountLockoutDuration=${account_lockout_duration}
Redfish.Patch ${REDFISH_ACCOUNTS_SERVICE_URI} body=${payload}
Redfish.Logout
# Make ${account_lockout_threshold} failed login attempts.
Repeat Keyword ${account_lockout_threshold} times
... Run Keyword And Expect Error InvalidCredentialsError* Redfish.Login admin_user abc123
# Verify that legitimate login fails due to lockout.
Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login admin_user TestPwd123
# Wait for lockout duration to expire and then verify that login works.
Sleep ${account_lockout_duration}s
Redfish.Login admin_user TestPwd123
Redfish.Logout
Redfish.Login
Redfish.Delete /redfish/v1/AccountService/Accounts/admin_user
Verify User Account Unlock
[Documentation] Verify manually unlocking the account before lockout time
[Tags] Verify_User_Account_Unlock
[Teardown] Run Keywords Redfish.Logout
... AND Redfish.Login
... AND Redfish.Delete /redfish/v1/AccountService/Accounts/test_user
... AND SSHLibrary.Close All Connections
Redfish Create User test_user TestPwd123 Administrator ${True}
${payload}= Create Dictionary
... AccountLockoutThreshold=${account_lockout_threshold}
... AccountLockoutDuration=${account_lockout_duration}
Redfish.Patch ${REDFISH_ACCOUNTS_SERVICE_URI} body=${payload}
Redfish.Logout
# Make ${account_lockout_threshold} failed login attempts.
Repeat Keyword ${account_lockout_threshold} times
... Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login test_user abc123
# Ensure SSH Login with locked account gets failed
SSHLibrary.Open Connection ${OPENBMC_HOST}
Run Keyword And Expect Error Authentication failed*
... SSHLibrary.Login test_user TestPwd123
# Verify that legitimate login fails due to lockout.
Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login test_user TestPwd123
${payload}= Create Dictionary Locked=${FALSE}
# Manually unlock the account before lockout threshold expires
Redfish.Login
Redfish.Patch ${REDFISH_ACCOUNTS_URI}test_user body=${payload}
Redfish.Logout
# Try redfish login with the recently unlocked account
Redfish.Login test_user TestPwd123
# Try SSH login with the unlocked account
SSHLibrary.Open Connection ${OPENBMC_HOST}
SSHLibrary.Login test_user TestPwd123
Verify Admin User Privilege
[Documentation] Verify admin user privilege.
[Tags] Verify_Admin_User_Privilege
Redfish Create User admin_user TestPwd123 Administrator ${True}
Redfish Create User readonly_user TestPwd123 ReadOnly ${True}
Redfish.Logout
Redfish.Login admin_user TestPwd123
# Change password of 'readonly' user with admin user.
Redfish.Patch /redfish/v1/AccountService/Accounts/readonly_user body={'Password': 'NewTestPwd123'}
# Verify modified user.
Redfish Verify User readonly_user NewTestPwd123 ReadOnly ${True}
# Note: Delete user would work here because a root login is
# performed as part of "Redfish Verify User" keyword's teardown.
Redfish.Delete /redfish/v1/AccountService/Accounts/admin_user
Redfish.Delete /redfish/v1/AccountService/Accounts/readonly_user
Verify Operator User Role Change Using Admin Privilege User
[Documentation] Verify operator user role change using admin privilege user
[Tags] Verify_Operator_User_Role_Change_Using_Admin_Privilege_User
Redfish Create User admin_user TestPwd123 Administrator ${True}
Redfish Create User operator_user TestPwd123 Operator ${True}
Redfish.Logout
# Change role ID of operator user with admin user.
# Login with admin user.
Redfish.Login admin_user TestPwd123
# Modify Role ID of Operator user.
Redfish.Patch /redfish/v1/AccountService/Accounts/operator_user body={'RoleId': 'Administrator'}
# Verify modified user.
Redfish Verify User operator_user TestPwd123 Administrator ${True}
Redfish.Delete /redfish/v1/AccountService/Accounts/admin_user
Redfish.Delete /redfish/v1/AccountService/Accounts/operator_user
Verify Operator User Privilege
[Documentation] Verify operator user privilege.
[Tags] Verify_Operator_User_Privilege
Redfish Create User admin_user TestPwd123 Administrator ${True}
Redfish Create User operator_user TestPwd123 Operator ${True}
Redfish.Logout
# Login with operator user.
Redfish.Login operator_user TestPwd123
# Verify BMC reset.
Run Keyword And Expect Error ValueError* Redfish BMC Reset Operation
# Attempt to change password of admin user with operator user.
Redfish.Patch /redfish/v1/AccountService/Accounts/admin_user body={'Password': 'NewTestPwd123'}
... valid_status_codes=[${HTTP_FORBIDDEN}]
Redfish.Logout
Redfish.Login
Redfish.Delete /redfish/v1/AccountService/Accounts/admin_user
Redfish.Delete /redfish/v1/AccountService/Accounts/operator_user
Verify ReadOnly User Privilege
[Documentation] Verify ReadOnly user privilege.
[Tags] Verify_ReadOnly_User_Privilege
Redfish Create User readonly_user TestPwd123 ReadOnly ${True}
Redfish.Logout
# Login with read_only user.
Redfish.Login readonly_user TestPwd123
# Read system level data.
${system_model}= Redfish_Utils.Get Attribute
... ${SYSTEM_BASE_URI} Model
Redfish.Logout
Redfish.Login
Redfish.Delete ${REDFISH_ACCOUNTS_URI}readonly_user
Verify Minimum Password Length For Redfish User
[Documentation] Verify minimum password length for new and existing user.
[Tags] Verify_Minimum_Password_Length_For_Redfish_User
${user_name}= Set Variable testUser
# Make sure the user account in question does not already exist.
Redfish.Delete /redfish/v1/AccountService/Accounts/${user_name}
... valid_status_codes=[${HTTP_OK}, ${HTTP_NOT_FOUND}]
# Try to create a user with invalid length password.
${payload}= Create Dictionary
... UserName=${user_name} Password=UserPwd RoleId=Administrator Enabled=${True}
Redfish.Post /redfish/v1/AccountService/Accounts/ body=&{payload}
... valid_status_codes=[${HTTP_BAD_REQUEST}]
# Create specified user with valid length password.
Set To Dictionary ${payload} Password UserPwd1
Redfish.Post /redfish/v1/AccountService/Accounts/ body=&{payload}
... valid_status_codes=[${HTTP_CREATED}]
# Try to change to an invalid password.
Redfish.Patch /redfish/v1/AccountService/Accounts/${user_name} body={'Password': 'UserPwd'}
... valid_status_codes=[${HTTP_BAD_REQUEST}]
# Change to a valid password.
Redfish.Patch /redfish/v1/AccountService/Accounts/${user_name} body={'Password': 'UserPwd1'}
# Verify login.
Redfish.Logout
Redfish.Login ${user_name} UserPwd1
Redfish.Logout
Redfish.Login
Redfish.Delete /redfish/v1/AccountService/Accounts/${user_name}
Verify Standard User Roles Defined By Redfish
[Documentation] Verify standard user roles defined by Redfish.
[Tags] Verify_Standard_User_Roles_Defined_By_Redfish
${member_list}= Redfish_Utils.Get Member List
... /redfish/v1/AccountService/Roles
@{roles}= Create List
... /redfish/v1/AccountService/Roles/Administrator
... /redfish/v1/AccountService/Roles/Operator
... /redfish/v1/AccountService/Roles/ReadOnly
List Should Contain Sub List ${member_list} ${roles}
# The standard roles are:
# | Role name | Assigned privileges |
# | Administrator | Login, ConfigureManager, ConfigureUsers, ConfigureComponents, ConfigureSelf |
# | Operator | Login, ConfigureComponents, ConfigureSelf |
# | ReadOnly | Login, ConfigureSelf |
@{admin}= Create List Login ConfigureManager ConfigureUsers ConfigureComponents ConfigureSelf
@{operator}= Create List Login ConfigureComponents ConfigureSelf
@{readOnly}= Create List Login ConfigureSelf
${roles_dict}= create dictionary admin_privileges=${admin} operator_privileges=${operator}
... readOnly_privileges=${readOnly}
${resp}= redfish.Get /redfish/v1/AccountService/Roles/Administrator
List Should Contain Sub List ${resp.dict['AssignedPrivileges']} ${roles_dict['admin_privileges']}
${resp}= redfish.Get /redfish/v1/AccountService/Roles/Operator
List Should Contain Sub List ${resp.dict['AssignedPrivileges']} ${roles_dict['operator_privileges']}
${resp}= redfish.Get /redfish/v1/AccountService/Roles/ReadOnly
List Should Contain Sub List ${resp.dict['AssignedPrivileges']} ${roles_dict['readOnly_privileges']}
Verify Error While Deleting Root User
[Documentation] Verify error while deleting root user.
[Tags] Verify_Error_While_Deleting_Root_User
Redfish.Delete /redfish/v1/AccountService/Accounts/root valid_status_codes=[${HTTP_FORBIDDEN}]
Verify SSH Login Access With Admin User
[Documentation] Verify that admin user does not have SSH login access.
[Tags] Verify_SSH_Login_Access_With_Admin_User
# Create an admin User.
Redfish Create User new_admin TestPwd1 Administrator ${True}
# Attempt SSH login with admin user.
SSHLibrary.Open Connection ${OPENBMC_HOST}
${status}= Run Keyword And Return Status SSHLibrary.Login new_admin TestPwd1
Should Be Equal ${status} ${False}
Redfish.Login
Redfish.Delete /redfish/v1/AccountService/Accounts/new_admin
Verify Configure BasicAuth Enable And Disable
[Documentation] Verify configure basicauth enable and disable
[Tags] Verify_Configure_BasicAuth_Enable_And_Disable
[Template] Template For Configure Auth Methods
# auth_method
BasicAuth
XToken
*** Keywords ***
Test Teardown Execution
[Documentation] Do the post test teardown.
Run Keyword And Ignore Error Redfish.Logout
FFDC On Test Case Fail
Redfish Create User
[Documentation] Redfish create user.
[Arguments] ${username} ${password} ${role_id} ${enabled} ${login_check}=${True}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
# login_check Checks user login for created user.
# (e.g. ${True}, ${False}).
# Make sure the user account in question does not already exist.
Redfish.Delete /redfish/v1/AccountService/Accounts/${userName}
... valid_status_codes=[${HTTP_OK}, ${HTTP_NOT_FOUND}]
# Create specified user.
${payload}= Create Dictionary
... UserName=${username} Password=${password} RoleId=${role_id} Enabled=${enabled}
Redfish.Post /redfish/v1/AccountService/Accounts/ body=&{payload}
... valid_status_codes=[${HTTP_CREATED}]
# Resetting faillock count as a workaround for issue
# openbmc/phosphor-user-manager#4
${cmd}= Catenate test -f /usr/sbin/faillock && /usr/sbin/faillock --user USER --reset
... || /usr/sbin/pam_tally2 -u ${username} --reset
Bmc Execute Command ${cmd}
# Verify login with created user.
${status}= Run Keyword If '${login_check}' == '${True}'
... Verify Redfish User Login ${username} ${password}
Run Keyword If '${login_check}' == '${True}' Should Be Equal ${status} ${enabled}
# Validate Role ID of created user.
${role_config}= Redfish_Utils.Get Attribute
... /redfish/v1/AccountService/Accounts/${username} RoleId
Should Be Equal ${role_id} ${role_config}
Redfish Verify User
[Documentation] Redfish user verification.
[Arguments] ${username} ${password} ${role_id} ${enabled}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
${status}= Verify Redfish User Login ${username} ${password}
# Doing a check of the returned status.
Should Be Equal ${status} ${enabled}
# Validate Role Id of user.
${role_config}= Redfish_Utils.Get Attribute
... /redfish/v1/AccountService/Accounts/${username} RoleId
Should Be Equal ${role_id} ${role_config}
Verify Redfish User Login
[Documentation] Verify Redfish login with given user id.
[Teardown] Run Keywords Run Keyword And Ignore Error Redfish.Logout AND Redfish.Login
[Arguments] ${username} ${password}
# Description of argument(s):
# username Login username.
# password Login password.
# Logout from current Redfish session.
# We don't really care if the current session is flushed out since we are going to login
# with new credential in next.
Run Keyword And Ignore Error Redfish.Logout
${status}= Run Keyword And Return Status Redfish.Login ${username} ${password}
[Return] ${status}
Redfish Create And Verify User
[Documentation] Redfish create and verify user.
[Arguments] ${username} ${password} ${role_id} ${enabled}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
# Example:
#{
#"@odata.context": "/redfish/v1/$metadata#ManagerAccount.ManagerAccount",
#"@odata.id": "/redfish/v1/AccountService/Accounts/test1",
#"@odata.type": "#ManagerAccount.v1_0_3.ManagerAccount",
#"Description": "User Account",
#"Enabled": true,
#"Id": "test1",
#"Links": {
# "Role": {
# "@odata.id": "/redfish/v1/AccountService/Roles/Administrator"
# }
#},
Redfish Create User ${username} ${password} ${role_id} ${enabled}
Redfish Verify User ${username} ${password} ${role_id} ${enabled}
# Delete Specified User
Redfish.Delete /redfish/v1/AccountService/Accounts/${username}
Verify Redfish User with Wrong Password
[Documentation] Verify Redfish User with Wrong Password.
[Arguments] ${username} ${password} ${role_id} ${enabled} ${wrong_password}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
# wrong_password Any invalid password.
Redfish Create User ${username} ${password} ${role_id} ${enabled}
Redfish.Logout
# Attempt to login with created user with invalid password.
Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login ${username} ${wrong_password}
Redfish.Login
# Delete newly created user.
Redfish.Delete /redfish/v1/AccountService/Accounts/${username}
Verify Login with Deleted Redfish User
[Documentation] Verify Login with Deleted Redfish User.
[Arguments] ${username} ${password} ${role_id} ${enabled}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
Redfish Create User ${username} ${password} ${role_id} ${enabled}
# Delete newly created user.
Redfish.Delete /redfish/v1/AccountService/Accounts/${userName}
Redfish.Logout
# Attempt to login with deleted user account.
Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login ${username} ${password}
Redfish.Login
Verify Create User Without Enabling
[Documentation] Verify Create User Without Enabling.
[Arguments] ${username} ${password} ${role_id} ${enabled}
# Description of argument(s):
# username The username to be created.
# password The password to be assigned.
# role_id The role ID of the user to be created
# (e.g. "Administrator", "Operator", etc.).
# enabled Indicates whether the username being created
# should be enabled (${True}, ${False}).
Redfish Create User ${username} ${password} ${role_id} ${enabled} ${False}
Redfish.Logout
# Login with created user.
Run Keyword And Expect Error InvalidCredentialsError*
... Redfish.Login ${username} ${password}
Redfish.Login
# Delete newly created user.
Redfish.Delete /redfish/v1/AccountService/Accounts/${username}
Template For Configure Auth Methods
[Documentation] Template to configure auth methods.
[Arguments] ${auth_method}
[Teardown] Configure AuthMethods ${auth_method}=${initial_value}
# Description of Argument(s):
# authmethods The authmethod setting which needs to be
# set in account service URI.
# valid values BasicAuth, XToken.
Get AuthMethods Default Values ${auth_method}
# Patch basicauth to TRUE
Configure AuthMethods ${auth_method}=${TRUE}
Run Keyword IF "${auth_method}" == "XToken"
... Check XToken Works Fine ${HTTP_OK}
... ELSE
... Check BasicAuth Works Fine ${HTTP_OK}
# Patch basicauth to FALSE
Configure AuthMethods ${auth_method}=${FALSE}
Run Keyword IF "${auth_method}" == "BasicAuth"
... Check BasicAuth Works Fine ${HTTP_UNAUTHORIZED}
... ELSE
... Check XToken Works Fine ${HTTP_UNAUTHORIZED}
Configure AuthMethods
[Documentation] Enable/disable authmethod types.
[Arguments] &{authmethods}
# Description of argument(s):
# authmethods The authmethod setting which needs to be
# set in account service URI.
# Usage Example Configure AuthMethods XToken=${TRUE} BasicAuth=${TRUE}
# This will set the value of "XToken" and "BasicAuth"
# property in accountservice uri to TRUE.
${openbmc}= Create Dictionary AuthMethods=${authmethods}
${oem}= Create Dictionary OpenBMC=${openbmc}
${payload}= Create Dictionary Oem=${oem}
# Setting authmethod properties using Redfish session based auth
${status}= Run Keyword And Return Status
... Redfish.Patch ${REDFISH_BASE_URI}AccountService
... body=${payload} valid_status_codes=[${HTTP_OK},${HTTP_NO_CONTENT}]
# Setting authmethod properties using basic auth incase the former fails
IF ${status}==${FALSE}
# Payload dictionary pre-process to match json formatting
${payload}= Convert To String ${payload}
${payload}= Replace String ${payload} ' "
${payload}= Replace String ${payload} False false
${payload}= Replace String ${payload} True true
# Curl Command Framing for PATCH authmethod
${cmd}= Catenate curl -k -i -u ${OPENBMC_USERNAME}:${OPENBMC_PASSWORD}
... -X PATCH '${AUTH_URI}${REDFISH_ACCOUNTS_SERVICE_URI}'
... -H 'content-type:application/json' -H 'If-Match:*'
... -d '${payload}'
${rc} ${out}= Run And Return Rc And Output ${cmd}
# Check the response of curl command is 200 or 204
${check_no_content}=
... Run Keyword and Return Status Should Contain ${out} 204
${check_ok}=
... Run Keyword and Return Status Should Contain ${out} 200
Pass Execution If ${check_no_content}==${TRUE}
... OR ${check_ok}==${TRUE}
END
Get AuthMethods Default Values
[Documentation] Get enabled/disabled status of all authmethods
... from Redfish account service URI
[Arguments] ${authmethod}
# Description of argument(s):
# authmethod The authmethod property whose value needs to be
# retrieved from account service URI.
# Usage Example Get AuthMethods Default Values BasicAuth
# returns >> ${TRUE}
# Example:
# {
# "@odata.id": "/redfish/v1/AccountService",
# (...)
# "Oem": {
# "OpenBMC": {
# "AuthMethods": {
# "BasicAuth": true,
# "Cookie": true,
# "SessionToken": true,
# "TLS": true,
# "XToken": true
# }
# }
# }
# }
${resp}= Redfish.Get Attribute ${REDFISH_ACCOUNTS_SERVICE_URI} Oem
${authmethods}= Set Variable ${resp['OpenBMC']['AuthMethods']}
${initial_value}= Get From Dictionary ${authmethods} ${authmethod}
Set Test Variable ${initial_value}
Check XToken Works Fine
[Documentation] Verify Xtoken works fine.
[Arguments] ${status_code}
# Description of Argument(s):
# status_code : 200, 401.
# Verify xtoken auth works for xtoken
Redfish.Get ${REDFISH_ACCOUNTS_SERVICE_URI}
... valid_status_codes=[${status_code}]
Check BasicAuth Works Fine
[Documentation] Verify Basic Auth works fine.
[Arguments] ${status_code}
# Description of Argument(s):
# status_code : 200, 401.
# Verify basic auth works based on basic auth.
${cmd}= Catenate curl -k -i -u ${OPENBMC_USERNAME}:${OPENBMC_PASSWORD}
... ${AUTH_URI}/redfish/v1/AccountService
${rc} ${out}= Run And Return Rc And Output ${cmd}
# Check the response of curl command is 200/401
Should Contain ${out} ${status_code}