phosphor-ldap-conf: handle "InterfaceAdded" signal on the ca-cert object

When ever a new ca-cert file is installed/changed(re-installed),
the certificate manager sends a Signal, which is caught by t

phosphor-ldap-conf: handle "InterfaceAdded" signal on the ca-cert object

When ever a new ca-cert file is installed/changed(re-installed),
the certificate manager sends a Signal, which is caught by the
phosphor-user-manager and the nslcd deamon will be restarted with
the appropriate ca-certfile.

TestedBy:
Installed a new ca-certificate using busctl command, and verified if the
phosphor-user-manager captured the InterfaceAdded signal there by updating
the nslcd configuration accordingly.

Signed-off-by: manojkiraneda <manojkiran.eda@gmail.com>
Change-Id: Iffc9b70435d819f6bdaee57970edc65f555ff42d

show more ...

UserMgr: Fix ldap config persistance issue

With exiting implementation during restart of the
phosphor-ldap-conf creates the default object and
restore the config data from the persistent path.
Due t

UserMgr: Fix ldap config persistance issue

With exiting implementation during restart of the
phosphor-ldap-conf creates the default object and
restore the config data from the persistent path.
Due to a bug while creating a default object it overrides
the persistent file and fails to load the configuration.
This commit fixes that issue.

Tested by:
1.Created LDAP config for openldap and AD
and verified config persisted after reboot

Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>
Change-Id: I88d1d7a38aec9adc3336d14d14dbe9fbce79eac0

show more ...

phosphor-ldap-conf: handle "PropertiesChanged" signal on the ldap cert object

When LDAP client certificate is changed through Replace method on the cert object.
Object would emit the signal "Prope

phosphor-ldap-conf: handle "PropertiesChanged" signal on the ldap cert object

When LDAP client certificate is changed through Replace method on the cert object.
Object would emit the signal "PropertiesChanged". Upon receiving the
signal, config file would be updated with below given info if
secure ldap is enabled:
tls_cert <path client certificate file>
tls_key <path to client certificate file>

Tested By: Unit Tested

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I5347b13e0bf76742d39dc7a26c96ec5d4dd5a2c6

show more ...

phosphor-ldap-conf: handle "InterfaceAdded" signal on the ldap cert object

When LDAP client certificate is uploaded through install method on the
cert object, Object would emit the signal "Interface

phosphor-ldap-conf: handle "InterfaceAdded" signal on the ldap cert object

When LDAP client certificate is uploaded through install method on the
cert object, Object would emit the signal "InterfaceAdded".
Upon receiving the signal, Config file would be updated with
below given info if secure ldap is enabled:
tls_cert <path client certificate file>
tls_key <path to client certificate file>

Tested By: Unit Tested

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I54b3e116af1b8a9057d91797d4074d39efc65bb0

show more ...

User Mgr: Update GetUserInfo to read ldap user privilege

Without this fix privilege mapping was fetched from the standalone
mapper application. Now with the recent changes privilege
mapping is part

User Mgr: Update GetUserInfo to read ldap user privilege

Without this fix privilege mapping was fetched from the standalone
mapper application. Now with the recent changes privilege
mapping is part of the config object itself.

This fix is to address that change.

TestedBy:
1.Added privilege mapper for ldap user and
then GetUserInfo for ldap user and verified
if privilege is correct.
2.Created local user and verified local user info
through GetUserInfo and check privilege.

Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>
Change-Id: Ie149cc1ef46370a899aa8312ce17448b6c00c0e9

show more ...

Adding unit test for priv mapping

Now privilege mapping is under the config object so adding the
unit test wrt to config.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I00f03c

Adding unit test for priv mapping

Now privilege mapping is under the config object so adding the
unit test wrt to config.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I00f03c9d54b4953e1665539b5cd2053ef82b0d51

show more ...

Create role mapping under ldap config object

Each ldap config object should be have its own
mapping object.

This is to align with the redfish.
https://redfish.dmtf.org/schemas/AccountService.v1_4_0

Create role mapping under ldap config object

Each ldap config object should be have its own
mapping object.

This is to align with the redfish.
https://redfish.dmtf.org/schemas/AccountService.v1_4_0.json

As per redfish, Each config will have it's own
"RemoteRoleMapping".

Mapping object should be persisted and restores
when the phosphor-ldap-conf restarts.

TestedBy:
Unit Tested.
Creation of privilege mapping.
Persist the priv-mapping.
Restores the priv-mapping.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I5ab4aeffae61f9cc57c1338f94784d0fe5607cd3

show more ...

Copying the files from the mapper to the config

It was needed as in the next commit we would be
generating the ldap priv mapping object under the
ldap config object.

This is to align with the redfi

Copying the files from the mapper to the config

It was needed as in the next commit we would be
generating the ldap priv mapping object under the
ldap config object.

This is to align with the redfish.
https://redfish.dmtf.org/schemas/AccountService.v1_4_0.json

As per redfish, Each config will have it's own
"RemoteRoleMapping".

TestedBy: Unit-tested
All existing test cases gets passed.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: Ibec2c0b809ce15e71bd3ed84a2d0efdad24f1d17

show more ...

Conditional enable the ldap configuration

If any of the existing ldap config(openldap/AD) is
already enabled,The other ldap configuration can't be
enabled.

TestedBy: Unit-Tested

Tested t

Conditional enable the ldap configuration

If any of the existing ldap config(openldap/AD) is
already enabled,The other ldap configuration can't be
enabled.

TestedBy: Unit-Tested

Tested the above behaviour.It throws the
error back if try to enable the configuration
when there is already active configuration.

If there is no active configuration then it
allows to enable the configuration.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I5b6008036152cd36e5422bb372a05c8a3ec3d24b

show more ...

Serialize the config objects

This commit serializes the config object into cereal
path and restores the config object when the phosphor-ldap-conf
restarts.

TestedBy: Unit tested
Serialize

Serialize the config objects

This commit serializes the config object into cereal
path and restores the config object when the phosphor-ldap-conf
restarts.

TestedBy: Unit tested
Serialize the object
Restart the phosphor-ldap-conf restores the object.
Ldap/Local authentication works fine.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: Ie6e940ddd6851085dc4213677dfb20e3afa0964f

show more ...

Write the config data into the nslcd.conf file

In Config object we have the property enabled, when
it is true then write that config object into nslcd.conf

TestedBy: Unit tested

Signed-off-by: Rat

Write the config data into the nslcd.conf file

In Config object we have the property enabled, when
it is true then write that config object into nslcd.conf

TestedBy: Unit tested

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I0c7bcf0f6557adb9314c94768b1adac39459fbe4

show more ...

Don't allow to delete the config object

User should not be able to delete the default objects
which are AD and openpldap.

TestedBy: Unit tested.
Make sure that delete function is not ther

Don't allow to delete the config object

User should not be able to delete the default objects
which are AD and openpldap.

TestedBy: Unit tested.
Make sure that delete function is not there in the default objects.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I51f11792e842fe964740123c40f9301a3b444786

show more ...

Implement unit test for getUserInfo function
in phosphor-user-manager

added testcases
1.unit test for ldap entry does not exist
2.unit test for local user.
3.unit test for ldap user with privilege m

Implement unit test for getUserInfo function
in phosphor-user-manager

added testcases
1.unit test for ldap entry does not exist
2.unit test for local user.
3.unit test for ldap user with privilege mapper entry
4.unit test for ldap user without privilege mapper entry

gerrit link for getUserInfo function
https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-user-manager/+/18132/

Change-Id: Idfd7e1ffeb8acfebab590c8c5fd6adc9bcf218dc
Signed-off-by: Ravi Teja <raviteja28031990@gmail.com>

show more ...

Create the default object for openldap and AD.

This commit introduces the following functionalities
=> Default AD and openldap config object would always be there.
=> User should not be able to chan

Create the default object for openldap and AD.

This commit introduces the following functionalities
=> Default AD and openldap config object would always be there.
=> User should not be able to change the type of the ldap
once it is created.

This change is to align with redfish sehema
(https://redfish.dmtf.org/schemas/AccountService.v1_4_0.json),
In the schema AD and LDAP is a property which user can PATCH,
Now with the current code which doesn't have the default config
so for the PATCH, We were forcing the user to give all the
properties and then create the object which is against the
PATCH semantics.

TestedBy: Unit tested
Default Object gets created when service starts.
change of ldap type gets the error back.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I0ce951a13ee525df022fb0716f0aea10d1909781

show more ...

Change the name of the files to make it align with other filenames

TestedBy: Unit-Tested

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I657962e8cb06b083877321e27cd0c94644e1ebcb

Create separate file for ConfigMgr class

As the ldap_configuration.cpp was getting long
so it is good to create the seprate file for
ConfigMgr.

TestedBy:
Ran the unit test.

Signed-off-by:

Create separate file for ConfigMgr class

As the ldap_configuration.cpp was getting long
so it is good to create the seprate file for
ConfigMgr.

TestedBy:
Ran the unit test.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I312a9f423d4ab3ca4ebd5f17193f7b02162ded6b

show more ...

LDAP Config: Extend the support to change the BindDNPassword

Before this commit we don't allow the user to change the bind
DN password as our REST API was the mirror of the D-bus API.

Now with the

LDAP Config: Extend the support to change the BindDNPassword

Before this commit we don't allow the user to change the bind
DN password as our REST API was the mirror of the D-bus API.

Now with the introduction of Redfish, where we have to give the
support for changing the bind dn password.

With this fix, set property on the d-bus object would update the
underlying ldap config file but wouldn't update the D-bus object due
to security issue.

Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
Change-Id: I6072820185cd540fe44850b90a4f6c256c44471c

show more ...

LDAP:change default values of GroupNameAttribute and UserNamAttribute

Modify UserNameAttribute default value to "cn" and
GroupNameAttribute default value to "gidNubmer"

create config already enable

LDAP:change default values of GroupNameAttribute and UserNamAttribute

Modify UserNameAttribute default value to "cn" and
GroupNameAttribute default value to "gidNubmer"

create config already enabled to make these attributes
user configurable.these default values are to make sure ldap
config works if user does not configure these attributes.

Tested by:
Configured LDAP without specifying group name and user name
attributes and tested ldap user authentication

Change-Id: I0091389122a384e0966659161566e9e543608628
Signed-off-by: raviteja-b <raviteja28031990@gmail.com>

show more ...

build: install into bin instead of sbin

Installs into bin instead of sbin per guidelines.

Signed-off-by: Patrick Venture <venture@google.com>
Change-Id: Ie3fd4aa21c2644b2673f80a17dee13819b6b546e

Removing unused SetPassword D-Bus API method

Password update is done through pam_chauthtok() API,
and don't use SetPassword. Removing the unused code.

Tested-by:
N/A.

Change-Id: I42a5b7c73bc2cb240

Removing unused SetPassword D-Bus API method

Password update is done through pam_chauthtok() API,
and don't use SetPassword. Removing the unused code.

Tested-by:
N/A.

Change-Id: I42a5b7c73bc2cb2404801df1c1cd057a94a1a924
Signed-off-by: Sumanth Bhat <sumanth.bhat@intel.com>
Signed-off-by: Richard Marian Thomaiyar <richard.marian.thomaiyar@linux.intel.com>

show more ...

LDAP: Add the persistency for the "Enabled" property

This property will control that whether the LDAP service would
be started or not.

We are persisting this property using cereal, other properties

LDAP: Add the persistency for the "Enabled" property

This property will control that whether the LDAP service would
be started or not.

We are persisting this property using cereal, other properties
is being persisted through nslcd.conf, nslcd doesn't give us
a way to put this property under nslcd.conf.

Tested By:
Test the persistency of enabled property.
Verified that it was getting persisted across restart/reboot.

Change-Id: Id64b23b71865bac15d3be2d79abad615aa576bea
Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>

show more ...

squash the following commits

LDAP: Adding support for extra properties
Implement GetUserInfo function in phosphor-user-manager

Squashing the commits due to phosphor-dbus-interfaces
dependency as th

squash the following commits

LDAP: Adding support for extra properties
Implement GetUserInfo function in phosphor-user-manager

Squashing the commits due to phosphor-dbus-interfaces
dependency as the interface gets merged and it requires implementation
so it is a deadlock for both the commits.

Implement GetUserInfo function in phosphor-user-manager

There was need to have api which return privilege for ldap user.
it was discussed in this commit
https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-dbus-interfaces/+/12027/
and decided to have generic api.

-Checks if user is local user, then returns map of properties of
local user like user privilege,list of user groups,user enabled
state and user locked state.

-If its not local user, then it checks if its a ldap user,
then get the privilege mapping for the LDAP group and returns.

TestedBy: 1) getUserInfo with local user
verify user details.
2) getUserInfo with ldap user having privilege mapper
entry, verify user details.
3) getUserInfo with no existing user.
check for exception UserNameDoesNotExist.

Change-Id: I44af41953db60ff96b39498d72839c2ab64bc8bd
Signed-off-by: raviteja-b <raviteja28031990@gmail.com>

LDAP: Adding support for extra properties

This commit also decouple the ldap service(nslcd) start
with each property update,Now there is a D-bus property
ldap service enabled which controls that whether the LDAP
service will be restarted after each property update,so now user
have an option to disable the ldap service and do multi-
property update and then enable the service again.

TestedBy: 1) Create the config with new added properties
Verify that it was getting reflected on the D-bus object.
2) After making the change restarted the ldap-conf service
Verify that new properties(usernameattr,groupnameattr) are correctly updated.
3) Authenticaton test
Verify that LDAP authentication worked fine.
4) Set the enabled property to true
Verify that it starts the nslcd service
5) Set the enabled property to false
Verify that it stops the nslcd.service
6) Set the enabled property to true and change any other config property
Verify that it starts the nslcd.service
7) Set the enabled property to false which stops the nslcd service
and change any other config property.
Verify that it doesn't start the nslcd service.

Change-Id: Ie3ca04a2adbbb1fe113764199348c4f7ac67f648
Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>

show more ...

Corrected the error log message.

Change-Id: I682dda32c0482e0849289a70d5b3ffa624bb915d
Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>

MAINTAINERS: Remove myself, add Ratan and Richard

I haven't written any code in this project, and I haven't been able
allocate much time to peer review either so it doesn't make any sense
for me to

MAINTAINERS: Remove myself, add Ratan and Richard

I haven't written any code in this project, and I haven't been able
allocate much time to peer review either so it doesn't make any sense
for me to be a maintainer.

Richard and Ratan both have written code in PUM, been active in peer
review, and know a lot about the overall user management implementation
in OpenBMC. Richard and Ratan will both provide timely and quality
feedback to PUM contributors, so it makes a lot of sense for them to
co-maintain PUM in place of Brad.

Change-Id: I72b9c471f2c42b4b962de4ecc040d6c8489ee21f
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>

show more ...

build: pkg anti-pattern: use defaults

Use the defaults in the pkg check where the default error message is
sufficient to identify which package is missing.

Change-Id: I09cf1888ea4f41b5c22d18d72b169

build: pkg anti-pattern: use defaults

Use the defaults in the pkg check where the default error message is
sufficient to identify which package is missing.

Change-Id: I09cf1888ea4f41b5c22d18d72b169d2ca32fc339
Signed-off-by: Patrick Venture <venture@google.com>

show more ...