tree 08074aa3f4de0d1c6db3a93bd323f4a493eb8bc7
parent 62db08a938e08debb4bc56c155238eb22a5a885c
author RAJESWARAN THILLAIGOVINDAN <rajeswgo@in.ibm.com> 1557306926 -0500
committer Andrew Jeffery <andrew@aj.id.au> 1568095489 +0000

Interface changes in LDAP role mapper

In the existing code, role mapping was global. Hence, we could have one
single config at a time.  Now, with the changed backend, there can be
multiple LDAP configs and the role mapping is tied to the config.

This commit make sure openbmctool ldap configuration options
compatible with both redfish and non-redfish enabled OpenBMC systems.

Tested By:

1. Configuring ldap active directory configuration:
$ python openbmctool.py -U root -P 0penBmc -H $BMC_IP ldap enable -a "ldap://$LDAP_SERVER/" -B "cn=user,cn=Users,dc=Corp,dc=xyz,dc=com" -b "dc=Corp,dc=xyz,dc=com" -p "ldap1" -S sub -t ActiveDirectory
Attempting login...
Role map exists for the server type ActiveDirectory
User root has been logged out

2. View ldap configuration
$ python openbmctool.py -U root -P 0penBmc -H $BMC_IP ldap view-config
Attempting login...
{
  "data": {
    "Enabled": true,
    "GroupNameAttribute": "primaryGroupID",
    "LDAPBaseDN": "dc=Corp,dc=xyz,dc=com",
    "LDAPBindDN": "cn=user,cn=Users,dc=Corp,dc=xyz,dc=com",
    "LDAPBindDNPassword": "",
    "LDAPSearchScope": "xyz.openbmc_project.User.Ldap.Config.SearchScope.sub",
    "LDAPServerURI": "ldap://$LDAP_SERVER/",
    "LDAPType": "xyz.openbmc_project.User.Ldap.Config.Type.ActiveDirectory",
    "UserNameAttribute": "sAMAccountName"
  },
  "message": "200 OK",
  "status": "ok"
}

3.List privilege-mappings
$ python openbmctool.py -U root -P 0penBmc -H $BMC_IP ldap privilege-mapper list
Attempting login...
{
  "data": {
    "/xyz/openbmc_project/user/ldap/active_directory/role_map/1": {
      "GroupName": "G1",
      "Privilege": "priv-admin"
    },
    "/xyz/openbmc_project/user/ldap/active_directory/role_map/2": {
      "GroupName": "G2",
      "Privilege": "priv-operator"
    },
    "/xyz/openbmc_project/user/ldap/active_directory/role_map/3": {
      "GroupName": "G3",
      "Privilege": "priv-user"
    }
  },
  "message": "200 OK",
  "status": "ok"
}
User root has been logged out

4. Disable LDAP
$ python openbmctool.py -U root -P 0penBmc -H $BMC_IP ldap disable
Attempting login...
{
  "data": null,
  "message": "200 OK",
  "status": "ok"
}
User root has been logged out

5. Configure OpenLDAP
$ python openbmctool.py -U root -P 0penBmc -H $BMC_IP ldap enable -a $LDAP_SERVER -B "cn=Administrator,dc=ldap,dc=com" -b "dc=ldap,dc=com" -p "ldap" -S sub -t OpenLDAP
Attempting login...
Server type OpenLDAP has been enabled. Create role map before using it...
User root has been logged out

6. View LDAP configuration
$ python openbmctool.py -U xyzjxp -P abc@123 -H $BMC_IP ldap view-config
Attempting login...
{
  "data": {
    "Enabled": true,
    "GroupNameAttribute": "gidNumber",
    "LDAPBaseDN": "dc=ldap,dc=com",
    "LDAPBindDN": "cn=Administrator,dc=ldap,dc=com",
    "LDAPBindDNPassword": "",
    "LDAPSearchScope": "xyz.openbmc_project.User.Ldap.Config.SearchScope.sub",
    "LDAPServerURI": $LDAP_SERVER,
    "LDAPType": "xyz.openbmc_project.User.Ldap.Config.Type.OpenLdap",
    "UserNameAttribute": "cn"
  },
  "message": "200 OK",
  "status": "ok"
}

7. Create privilege role map
$ python openbmctool.py -H $BMC_IP -U root -P 0penBmc ldap privilege-mapper create -g G3 -p priv-user
Attempting login...
legacy: False
{
  "data": "/xyz/openbmc_project/user/ldap/openldap/role_map/1",
  "message": "200 OK",
  "status": "ok"
}

8. List privilege role mappings
$ python openbmctool.py -U test -P test@123 -H $BMC_IP ldap privilege-mapper list
Attempting login...
{
  "data": {
    "/xyz/openbmc_project/user/ldap/openldap/role_map/1": {
      "GroupName": "G3",
      "Privilege": "priv-user"
    }
  },
  "message": "200 OK",
  "status": "ok"
}

$ python openbmctool.py -U test -P test@123 -H $BMC_IP ldap view-config
Attempting login...
{
  "data": {
    "LDAPBaseDN": "dc=ldap,dc=com",
    "LDAPBindDN": "uid=test,dc=ldap,dc=com",
    "LDAPSearchScope": "xyz.openbmc_project.User.Ldap.Config.SearchScope.sub",
    "LDAPServerURI": $LDAP_SERVER,
    "LDAPType": "xyz.openbmc_project.User.Ldap.Config.Type.OpenLdap"
  },
  "message": "200 OK",
  "status": "ok"
}

Change-Id: I4df361c229d742381fa6edcd77c125ad6556b20e
Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>