xref: /openbmc/bmcweb/features/redfish/lib/redfish_sessions.hpp (revision ef4c65b741724d724452a3a0efe8dff0d450514a) 
1 /*
2 // Copyright (c) 2018 Intel Corporation
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 */
16 #pragma once
17 
18 #include "app.hpp"
19 #include "error_messages.hpp"
20 #include "http/utility.hpp"
21 #include "persistent_data.hpp"
22 #include "query.hpp"
23 #include "registries/privilege_registry.hpp"
24 #include "utils/json_utils.hpp"
25 
26 #include <boost/url/format.hpp>
27 
28 namespace redfish
29 {
30 
31 inline void fillSessionObject(crow::Response& res,
32                               const persistent_data::UserSession& session)
33 {
34     res.jsonValue["Id"] = session.uniqueId;
35     res.jsonValue["UserName"] = session.username;
36     res.jsonValue["@odata.id"] = boost::urls::format(
37         "/redfish/v1/SessionService/Sessions/{}", session.uniqueId);
38     res.jsonValue["@odata.type"] = "#Session.v1_5_0.Session";
39     res.jsonValue["Name"] = "User Session";
40     res.jsonValue["Description"] = "Manager User Session";
41     res.jsonValue["ClientOriginIPAddress"] = session.clientIp;
42     if (session.clientId)
43     {
44         res.jsonValue["Context"] = *session.clientId;
45     }
46 }
47 
48 inline void
49     handleSessionHead(crow::App& app, const crow::Request& req,
50                       const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
51                       const std::string& /*sessionId*/)
52 {
53     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
54     {
55         return;
56     }
57     asyncResp->res.addHeader(
58         boost::beast::http::field::link,
59         "</redfish/v1/JsonSchemas/Session/Session.json>; rel=describedby");
60 }
61 
62 inline void
63     handleSessionGet(crow::App& app, const crow::Request& req,
64                      const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
65                      const std::string& sessionId)
66 {
67     handleSessionHead(app, req, asyncResp, sessionId);
68 
69     // Note that control also reaches here via doPost and doDelete.
70     auto session =
71         persistent_data::SessionStore::getInstance().getSessionByUid(sessionId);
72 
73     if (session == nullptr)
74     {
75         messages::resourceNotFound(asyncResp->res, "Session", sessionId);
76         return;
77     }
78 
79     fillSessionObject(asyncResp->res, *session);
80 }
81 
82 inline void
83     handleSessionDelete(crow::App& app, const crow::Request& req,
84                         const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
85                         const std::string& sessionId)
86 {
87     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
88     {
89         return;
90     }
91     auto session =
92         persistent_data::SessionStore::getInstance().getSessionByUid(sessionId);
93 
94     if (session == nullptr)
95     {
96         messages::resourceNotFound(asyncResp->res, "Session", sessionId);
97         return;
98     }
99 
100     // Perform a proper ConfigureSelf authority check.  If a
101     // session is being used to DELETE some other user's session,
102     // then the ConfigureSelf privilege does not apply.  In that
103     // case, perform the authority check again without the user's
104     // ConfigureSelf privilege.
105     if (req.session != nullptr && !session->username.empty() &&
106         session->username != req.session->username)
107     {
108         Privileges effectiveUserPrivileges =
109             redfish::getUserPrivileges(req.userRole);
110 
111         if (!effectiveUserPrivileges.isSupersetOf({"ConfigureUsers"}))
112         {
113             messages::insufficientPrivilege(asyncResp->res);
114             return;
115         }
116     }
117 
118     persistent_data::SessionStore::getInstance().removeSession(session);
119     messages::success(asyncResp->res);
120 }
121 
122 inline nlohmann::json getSessionCollectionMembers()
123 {
124     std::vector<const std::string*> sessionIds =
125         persistent_data::SessionStore::getInstance().getUniqueIds(
126             false, persistent_data::PersistenceType::TIMEOUT);
127     nlohmann::json ret = nlohmann::json::array();
128     for (const std::string* uid : sessionIds)
129     {
130         nlohmann::json::object_t session;
131         session["@odata.id"] =
132             boost::urls::format("/redfish/v1/SessionService/Sessions/{}", *uid);
133         ret.emplace_back(std::move(session));
134     }
135     return ret;
136 }
137 
138 inline void handleSessionCollectionHead(
139     crow::App& app, const crow::Request& req,
140     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
141 {
142     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
143     {
144         return;
145     }
146     asyncResp->res.addHeader(
147         boost::beast::http::field::link,
148         "</redfish/v1/JsonSchemas/SessionCollection.json>; rel=describedby");
149 }
150 
151 inline void handleSessionCollectionGet(
152     crow::App& app, const crow::Request& req,
153     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
154 {
155     handleSessionCollectionHead(app, req, asyncResp);
156     asyncResp->res.jsonValue["Members"] = getSessionCollectionMembers();
157     asyncResp->res.jsonValue["Members@odata.count"] =
158         asyncResp->res.jsonValue["Members"].size();
159     asyncResp->res.jsonValue["@odata.type"] =
160         "#SessionCollection.SessionCollection";
161     asyncResp->res.jsonValue["@odata.id"] =
162         "/redfish/v1/SessionService/Sessions/";
163     asyncResp->res.jsonValue["Name"] = "Session Collection";
164     asyncResp->res.jsonValue["Description"] = "Session Collection";
165 }
166 
167 inline void handleSessionCollectionMembersGet(
168     crow::App& app, const crow::Request& req,
169     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
170 {
171     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
172     {
173         return;
174     }
175     asyncResp->res.jsonValue = getSessionCollectionMembers();
176 }
177 
178 inline void handleSessionCollectionPost(
179     crow::App& app, const crow::Request& req,
180     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
181 {
182     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
183     {
184         return;
185     }
186     std::string username;
187     std::string password;
188     std::optional<std::string> clientId;
189     if (!json_util::readJsonPatch(req, asyncResp->res, "UserName", username,
190                                   "Password", password, "Context", clientId))
191     {
192         return;
193     }
194 
195     if (password.empty() || username.empty() ||
196         asyncResp->res.result() != boost::beast::http::status::ok)
197     {
198         if (username.empty())
199         {
200             messages::propertyMissing(asyncResp->res, "UserName");
201         }
202 
203         if (password.empty())
204         {
205             messages::propertyMissing(asyncResp->res, "Password");
206         }
207 
208         return;
209     }
210 
211     int pamrc = pamAuthenticateUser(username, password);
212     bool isConfigureSelfOnly = pamrc == PAM_NEW_AUTHTOK_REQD;
213     if ((pamrc != PAM_SUCCESS) && !isConfigureSelfOnly)
214     {
215         messages::resourceAtUriUnauthorized(asyncResp->res, req.url(),
216                                             "Invalid username or password");
217         return;
218     }
219 
220     // User is authenticated - create session
221     std::shared_ptr<persistent_data::UserSession> session =
222         persistent_data::SessionStore::getInstance().generateUserSession(
223             username, req.ipAddress, clientId,
224             persistent_data::PersistenceType::TIMEOUT, isConfigureSelfOnly);
225     if (session == nullptr)
226     {
227         messages::internalError(asyncResp->res);
228         return;
229     }
230 
231     asyncResp->res.addHeader("X-Auth-Token", session->sessionToken);
232     asyncResp->res.addHeader(
233         "Location", "/redfish/v1/SessionService/Sessions/" + session->uniqueId);
234     asyncResp->res.result(boost::beast::http::status::created);
235     if (session->isConfigureSelfOnly)
236     {
237         messages::passwordChangeRequired(
238             asyncResp->res,
239             boost::urls::format("/redfish/v1/AccountService/Accounts/{}",
240                                 session->username));
241     }
242 
243     fillSessionObject(asyncResp->res, *session);
244 }
245 inline void handleSessionServiceHead(
246     crow::App& app, const crow::Request& req,
247     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
248 {
249     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
250     {
251         return;
252     }
253     asyncResp->res.addHeader(
254         boost::beast::http::field::link,
255         "</redfish/v1/JsonSchemas/SessionService/SessionService.json>; rel=describedby");
256 }
257 inline void
258     handleSessionServiceGet(crow::App& app, const crow::Request& req,
259                             const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
260 
261 {
262     handleSessionServiceHead(app, req, asyncResp);
263     asyncResp->res.jsonValue["@odata.type"] =
264         "#SessionService.v1_0_2.SessionService";
265     asyncResp->res.jsonValue["@odata.id"] = "/redfish/v1/SessionService/";
266     asyncResp->res.jsonValue["Name"] = "Session Service";
267     asyncResp->res.jsonValue["Id"] = "SessionService";
268     asyncResp->res.jsonValue["Description"] = "Session Service";
269     asyncResp->res.jsonValue["SessionTimeout"] =
270         persistent_data::SessionStore::getInstance().getTimeoutInSeconds();
271     asyncResp->res.jsonValue["ServiceEnabled"] = true;
272 
273     asyncResp->res.jsonValue["Sessions"]["@odata.id"] =
274         "/redfish/v1/SessionService/Sessions";
275 }
276 
277 inline void handleSessionServicePatch(
278     crow::App& app, const crow::Request& req,
279     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
280 {
281     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
282     {
283         return;
284     }
285     std::optional<int64_t> sessionTimeout;
286     if (!json_util::readJsonPatch(req, asyncResp->res, "SessionTimeout",
287                                   sessionTimeout))
288     {
289         return;
290     }
291 
292     if (sessionTimeout)
293     {
294         // The mininum & maximum allowed values for session timeout
295         // are 30 seconds and 86400 seconds respectively as per the
296         // session service schema mentioned at
297         // https://redfish.dmtf.org/schemas/v1/SessionService.v1_1_7.json
298 
299         if (*sessionTimeout <= 86400 && *sessionTimeout >= 30)
300         {
301             std::chrono::seconds sessionTimeoutInseconds(*sessionTimeout);
302             persistent_data::SessionStore::getInstance().updateSessionTimeout(
303                 sessionTimeoutInseconds);
304             messages::propertyValueModified(asyncResp->res, "SessionTimeOut",
305                                             std::to_string(*sessionTimeout));
306         }
307         else
308         {
309             messages::propertyValueNotInList(asyncResp->res,
310                                              std::to_string(*sessionTimeout),
311                                              "SessionTimeOut");
312         }
313     }
314 }
315 
316 inline void requestRoutesSession(App& app)
317 {
318     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/<str>/")
319         .privileges(redfish::privileges::headSession)
320         .methods(boost::beast::http::verb::head)(
321             std::bind_front(handleSessionHead, std::ref(app)));
322 
323     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/<str>/")
324         .privileges(redfish::privileges::getSession)
325         .methods(boost::beast::http::verb::get)(
326             std::bind_front(handleSessionGet, std::ref(app)));
327 
328     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/<str>/")
329         .privileges(redfish::privileges::deleteSession)
330         .methods(boost::beast::http::verb::delete_)(
331             std::bind_front(handleSessionDelete, std::ref(app)));
332 
333     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/")
334         .privileges(redfish::privileges::headSessionCollection)
335         .methods(boost::beast::http::verb::head)(
336             std::bind_front(handleSessionCollectionHead, std::ref(app)));
337 
338     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/")
339         .privileges(redfish::privileges::getSessionCollection)
340         .methods(boost::beast::http::verb::get)(
341             std::bind_front(handleSessionCollectionGet, std::ref(app)));
342 
343     // Note, the next two routes technically don't match the privilege
344     // registry given the way login mechanisms work.  The base privilege
345     // registry lists this endpoint as requiring login privilege, but because
346     // this is the endpoint responsible for giving the login privilege, and it
347     // is itself its own route, it needs to not require Login
348     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/")
349         .privileges({})
350         .methods(boost::beast::http::verb::post)(
351             std::bind_front(handleSessionCollectionPost, std::ref(app)));
352 
353     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/Sessions/Members/")
354         .privileges({})
355         .methods(boost::beast::http::verb::post)(
356             std::bind_front(handleSessionCollectionPost, std::ref(app)));
357 
358     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
359         .privileges(redfish::privileges::headSessionService)
360         .methods(boost::beast::http::verb::head)(
361             std::bind_front(handleSessionServiceHead, std::ref(app)));
362 
363     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
364         .privileges(redfish::privileges::getSessionService)
365         .methods(boost::beast::http::verb::get)(
366             std::bind_front(handleSessionServiceGet, std::ref(app)));
367 
368     BMCWEB_ROUTE(app, "/redfish/v1/SessionService/")
369         .privileges(redfish::privileges::patchSessionService)
370         .methods(boost::beast::http::verb::patch)(
371             std::bind_front(handleSessionServicePatch, std::ref(app)));
372 }
373 
374 } // namespace redfish
375