xref: /openbmc/bmcweb/features/redfish/lib/redfish_sessions.hpp (revision 41d61c8281ed9af50630c78f0a646e726139fb25)

/*
// Copyright (c) 2018 Intel Corporation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
*/
#pragma once

#include "error_messages.hpp"
#include "persistent_data.hpp"

#include <app.hpp>
#include <registries/privilege_registry.hpp>

namespace redfish
{

class SessionCollection;

inline void fillSessionObject(crow::Response& res,
                              const persistent_data::UserSession& session)
{
    res.jsonValue["Id"] = session.uniqueId;
    res.jsonValue["UserName"] = session.username;
    res.jsonValue["@odata.id"] =
        "/redfish/v1/SessionService/Sessions/" + session.uniqueId;
    res.jsonValue["@odata.type"] = "#Session.v1_3_0.Session";
    res.jsonValue["Name"] = "User Session";
    res.jsonValue["Description"] = "Manager User Session";
    res.jsonValue["ClientOriginIPAddress"] = session.clientIp;
#ifdef BMCWEB_ENABLE_IBM_MANAGEMENT_CONSOLE
    res.jsonValue["Oem"]["OpenBMC"]["@odata.type"] =
        "#OemSession.v1_0_0.Session";
    res.jsonValue["Oem"]["OpenBMC"]["ClientID"] = session.clientId;
#endif
}

inline void requestRoutesSession(App& app)
{
    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/<str>/")
        .privileges(redfish::privileges::getSession)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request& /*req*/,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
               const std::string& sessionId) -> void {
                // Note that control also reaches here via doPost and doDelete.
                auto session = persistent_data::SessionStore::getInstance()
                                   .getSessionByUid(sessionId);

                if (session == nullptr)
                {
                    messages::resourceNotFound(asyncResp->res, "Session",
                                               sessionId);
                    return;
                }

                fillSessionObject(asyncResp->res, *session);
            });

    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/<str>/")
        .privileges(redfish::privileges::deleteSession)
        .methods(boost::beast::http::verb::delete_)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
               const std::string& sessionId) -> void {
                auto session = persistent_data::SessionStore::getInstance()
                                   .getSessionByUid(sessionId);

                if (session == nullptr)
                {
                    messages::resourceNotFound(asyncResp->res, "Session",
                                               sessionId);
                    return;
                }

                // Perform a proper ConfigureSelf authority check.  If a
                // session is being used to DELETE some other user's session,
                // then the ConfigureSelf privilege does not apply.  In that
                // case, perform the authority check again without the user's
                // ConfigureSelf privilege.
                if (session->username != req.session->username)
                {
                    Privileges effectiveUserPrivileges =
                        redfish::getUserPrivileges(req.userRole);

                    if (!effectiveUserPrivileges.isSupersetOf(
                            {"ConfigureUsers"}))
                    {
                        messages::insufficientPrivilege(asyncResp->res);
                        return;
                    }
                }

                persistent_data::SessionStore::getInstance().removeSession(
                    session);
                messages::success(asyncResp->res);
            });

    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/")
        .privileges(redfish::privileges::getSessionCollection)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request& /*req*/,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) -> void {
                std::vector<const std::string*> sessionIds =
                    persistent_data::SessionStore::getInstance().getUniqueIds(
                        false, persistent_data::PersistenceType::TIMEOUT);

                asyncResp->res.jsonValue["Members@odata.count"] =
                    sessionIds.size();
                asyncResp->res.jsonValue["Members"] = nlohmann::json::array();
                for (const std::string* uid : sessionIds)
                {
                    asyncResp->res.jsonValue["Members"].push_back(
                        {{"@odata.id",
                          "/redfish/v1/SessionService/Sessions/" + *uid}});
                }
                asyncResp->res.jsonValue["Members@odata.count"] =
                    sessionIds.size();
                asyncResp->res.jsonValue["@odata.type"] =
                    "#SessionCollection.SessionCollection";
                asyncResp->res.jsonValue["@odata.id"] =
                    "/redfish/v1/SessionService/Sessions/";
                asyncResp->res.jsonValue["Name"] = "Session Collection";
                asyncResp->res.jsonValue["Description"] = "Session Collection";
            });

    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/")
        // Note, this technically doesn't match the privilege registry given the
        // way login mechanisms work.  The base privilege registry lists this
        // endpoint as requiring login privilege, but because this is the
        // endpoint responsible for giving the login privilege, and it is itself
        // its own route, it needs to not require Login
        .privileges({})
        .methods(boost::beast::http::verb::post)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) -> void {
                std::string username;
                std::string password;
                std::optional<nlohmann::json> oemObject;
                std::string clientId;
                if (!json_util::readJson(req, asyncResp->res, "UserName",
                                         username, "Password", password, "Oem",
                                         oemObject))
                {
                    return;
                }

                if (password.empty() || username.empty() ||
                    asyncResp->res.result() != boost::beast::http::status::ok)
                {
                    if (username.empty())
                    {
                        messages::propertyMissing(asyncResp->res, "UserName");
                    }

                    if (password.empty())
                    {
                        messages::propertyMissing(asyncResp->res, "Password");
                    }

                    return;
                }

                int pamrc = pamAuthenticateUser(username, password);
                bool isConfigureSelfOnly = pamrc == PAM_NEW_AUTHTOK_REQD;
                if ((pamrc != PAM_SUCCESS) && !isConfigureSelfOnly)
                {
                    messages::resourceAtUriUnauthorized(
                        asyncResp->res, std::string(req.url),
                        "Invalid username or password");
                    return;
                }
#ifdef BMCWEB_ENABLE_IBM_MANAGEMENT_CONSOLE
                if (oemObject)
                {
                    std::optional<nlohmann::json> bmcOem;
                    if (!json_util::readJson(*oemObject, asyncResp->res,
                                             "OpenBMC", bmcOem))
                    {
                        return;
                    }
                    if (!json_util::readJson(*bmcOem, asyncResp->res,
                                             "ClientID", clientId))
                    {
                        BMCWEB_LOG_ERROR << "Could not read ClientId";
                        return;
                    }
                }
#endif

                // User is authenticated - create session
                std::shared_ptr<persistent_data::UserSession> session =
                    persistent_data::SessionStore::getInstance()
                        .generateUserSession(
                            username, req.ipAddress, clientId,
                            persistent_data::PersistenceType::TIMEOUT,
                            isConfigureSelfOnly);
                asyncResp->res.addHeader("X-Auth-Token", session->sessionToken);
                asyncResp->res.addHeader(
                    "Location",
                    "/redfish/v1/SessionService/Sessions/" + session->uniqueId);
                asyncResp->res.result(boost::beast::http::status::created);
                if (session->isConfigureSelfOnly)
                {
                    messages::passwordChangeRequired(
                        asyncResp->res, "/redfish/v1/AccountService/Accounts/" +
                                            session->username);
                }

                fillSessionObject(asyncResp->res, *session);
            });

    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
        .privileges(redfish::privileges::getSessionService)
        .methods(boost::beast::http::verb::get)(
            [](const crow::Request& /* req */,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) -> void {
                asyncResp->res.jsonValue["@odata.type"] =
                    "#SessionService.v1_0_2.SessionService";
                asyncResp->res.jsonValue["@odata.id"] =
                    "/redfish/v1/SessionService/";
                asyncResp->res.jsonValue["Name"] = "Session Service";
                asyncResp->res.jsonValue["Id"] = "SessionService";
                asyncResp->res.jsonValue["Description"] = "Session Service";
                asyncResp->res.jsonValue["SessionTimeout"] =
                    persistent_data::SessionStore::getInstance()
                        .getTimeoutInSeconds();
                asyncResp->res.jsonValue["ServiceEnabled"] = true;

                asyncResp->res.jsonValue["Sessions"] = {
                    {"@odata.id", "/redfish/v1/SessionService/Sessions"}};
            });

    BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
        .privileges(redfish::privileges::patchSessionService)
        .methods(boost::beast::http::verb::patch)(
            [](const crow::Request& req,
               const std::shared_ptr<bmcweb::AsyncResp>& asyncResp) -> void {
                std::optional<int64_t> sessionTimeout;
                if (!json_util::readJson(req, asyncResp->res, "SessionTimeout",
                                         sessionTimeout))
                {
                    return;
                }

                if (sessionTimeout)
                {
                    // The mininum & maximum allowed values for session timeout
                    // are 30 seconds and 86400 seconds respectively as per the
                    // session service schema mentioned at
                    // https://redfish.dmtf.org/schemas/v1/SessionService.v1_1_7.json

                    if (*sessionTimeout <= 86400 && *sessionTimeout >= 30)
                    {
                        std::chrono::seconds sessionTimeoutInseconds(
                            *sessionTimeout);
                        persistent_data::SessionStore::getInstance()
                            .updateSessionTimeout(sessionTimeoutInseconds);
                        messages::propertyValueModified(
                            asyncResp->res, "SessionTimeOut",
                            std::to_string(*sessionTimeout));
                    }
                    else
                    {
                        messages::propertyValueNotInList(
                            asyncResp->res, std::to_string(*sessionTimeout),
                            "SessionTimeOut");
                    }
                }
            });
}

} // namespace redfish