docs/designs/redfish-authorization.md

33 authenticated Redfish role are sufficient to complete the operation in the
104 To map Redfish role to their assigned Redfish privileges, BMCWeb implements the
143 proper Redfish role and is authorized to access certain resources without
175    - It rejects deletion of OEM Redfish privileges if any OEM Redfish role is
210 representing that a user is a specific Redfish role. BMCWeb then uses a
211 hardcoded table to map Redfish role to Redfish privileges.
214 well with OEM Redfish Roles where a Redfish role maps to a dynamic set of OEM
230 role. OEM redfish roles will get prefix "openbmc-orfr-". "orfr" refers to OEM
231 Redfish role. For example, the base Redfish role "Administrator" will result in
242 **Username to Redfish Role Mapping** Mapping a username to Redfish role becomes
245 **Redfish Role to Redfish Privileges Mapping** Mapping a Redfish Role to Redfish
251 group meaning its Redfish role is "openbmc-orfr-power"; local user
288 The above diagram works for LDAP users as well. A remote role or group can map
290 maps to a single Redfish role stored as local users.
328 POST on the RoleCollection in the AccountService to create an OEM role, with
330 the Role resource.
332 DELETE on the specific Role in the RoleCollection to delete an OEM role.
337 1. Phosphor-user-manager provides DBus APIs to create Redfish role
349 assigned Redfish role.
360 Redfish role which is assigned a new set of OEM Redfish Privileges is mapped out
442 given operation on a given resource and the assigned privileges of a role.