1 /*
2 // Copyright (c) 2018 Intel Corporation
3 //
4 // Licensed under the Apache License, Version 2.0 (the "License");
5 // you may not use this file except in compliance with the License.
6 // You may obtain a copy of the License at
7 //
8 //      http://www.apache.org/licenses/LICENSE-2.0
9 //
10 // Unless required by applicable law or agreed to in writing, software
11 // distributed under the License is distributed on an "AS IS" BASIS,
12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 // See the License for the specific language governing permissions and
14 // limitations under the License.
15 */
16 #pragma once
17 
18 #include "app.hpp"
19 #include "dbus_utility.hpp"
20 #include "error_messages.hpp"
21 #include "generated/enums/account_service.hpp"
22 #include "openbmc_dbus_rest.hpp"
23 #include "persistent_data.hpp"
24 #include "query.hpp"
25 #include "registries/privilege_registry.hpp"
26 #include "utils/dbus_utils.hpp"
27 #include "utils/json_utils.hpp"
28 
29 #include <sdbusplus/asio/property.hpp>
30 #include <sdbusplus/unpack_properties.hpp>
31 
32 #include <array>
33 #include <optional>
34 #include <string>
35 #include <string_view>
36 #include <vector>
37 
38 namespace redfish
39 {
40 
41 constexpr const char* ldapConfigObjectName =
42     "/xyz/openbmc_project/user/ldap/openldap";
43 constexpr const char* adConfigObject =
44     "/xyz/openbmc_project/user/ldap/active_directory";
45 
46 constexpr const char* rootUserDbusPath = "/xyz/openbmc_project/user/";
47 constexpr const char* ldapRootObject = "/xyz/openbmc_project/user/ldap";
48 constexpr const char* ldapDbusService = "xyz.openbmc_project.Ldap.Config";
49 constexpr const char* ldapConfigInterface =
50     "xyz.openbmc_project.User.Ldap.Config";
51 constexpr const char* ldapCreateInterface =
52     "xyz.openbmc_project.User.Ldap.Create";
53 constexpr const char* ldapEnableInterface = "xyz.openbmc_project.Object.Enable";
54 constexpr const char* ldapPrivMapperInterface =
55     "xyz.openbmc_project.User.PrivilegeMapper";
56 
57 struct LDAPRoleMapData
58 {
59     std::string groupName;
60     std::string privilege;
61 };
62 
63 struct LDAPConfigData
64 {
65     std::string uri{};
66     std::string bindDN{};
67     std::string baseDN{};
68     std::string searchScope{};
69     std::string serverType{};
70     bool serviceEnabled = false;
71     std::string userNameAttribute{};
72     std::string groupAttribute{};
73     std::vector<std::pair<std::string, LDAPRoleMapData>> groupRoleList;
74 };
75 
76 inline std::string getRoleIdFromPrivilege(std::string_view role)
77 {
78     if (role == "priv-admin")
79     {
80         return "Administrator";
81     }
82     if (role == "priv-user")
83     {
84         return "ReadOnly";
85     }
86     if (role == "priv-operator")
87     {
88         return "Operator";
89     }
90     return "";
91 }
92 inline std::string getPrivilegeFromRoleId(std::string_view role)
93 {
94     if (role == "Administrator")
95     {
96         return "priv-admin";
97     }
98     if (role == "ReadOnly")
99     {
100         return "priv-user";
101     }
102     if (role == "Operator")
103     {
104         return "priv-operator";
105     }
106     return "";
107 }
108 
109 /**
110  * @brief Maps user group names retrieved from D-Bus object to
111  * Account Types.
112  *
113  * @param[in] userGroups List of User groups
114  * @param[out] res AccountTypes populated
115  *
116  * @return true in case of success, false if UserGroups contains
117  * invalid group name(s).
118  */
119 inline bool translateUserGroup(const std::vector<std::string>& userGroups,
120                                crow::Response& res)
121 {
122     std::vector<std::string> accountTypes;
123     for (const auto& userGroup : userGroups)
124     {
125         if (userGroup == "redfish")
126         {
127             accountTypes.emplace_back("Redfish");
128             accountTypes.emplace_back("WebUI");
129         }
130         else if (userGroup == "ipmi")
131         {
132             accountTypes.emplace_back("IPMI");
133         }
134         else if (userGroup == "ssh")
135         {
136             accountTypes.emplace_back("ManagerConsole");
137         }
138         else if (userGroup == "hostconsole")
139         {
140             // The hostconsole group controls who can access the host console
141             // port via ssh and websocket.
142             accountTypes.emplace_back("HostConsole");
143         }
144         else if (userGroup == "web")
145         {
146             // 'web' is one of the valid groups in the UserGroups property of
147             // the user account in the D-Bus object. This group is currently not
148             // doing anything, and is considered to be equivalent to 'redfish'.
149             // 'redfish' user group is mapped to 'Redfish'and 'WebUI'
150             // AccountTypes, so do nothing here...
151         }
152         else
153         {
154             // Invalid user group name. Caller throws an excption.
155             return false;
156         }
157     }
158 
159     res.jsonValue["AccountTypes"] = std::move(accountTypes);
160     return true;
161 }
162 
163 /**
164  * @brief Builds User Groups from the Account Types
165  *
166  * @param[in] asyncResp Async Response
167  * @param[in] accountTypes List of Account Types
168  * @param[out] userGroups List of User Groups mapped from Account Types
169  *
170  * @return true if Account Types mapped to User Groups, false otherwise.
171  */
172 inline bool
173     getUserGroupFromAccountType(crow::Response& res,
174                                 const std::vector<std::string>& accountTypes,
175                                 std::vector<std::string>& userGroups)
176 {
177     // Need both Redfish and WebUI Account Types to map to 'redfish' User Group
178     bool redfishType = false;
179     bool webUIType = false;
180 
181     for (const auto& accountType : accountTypes)
182     {
183         if (accountType == "Redfish")
184         {
185             redfishType = true;
186         }
187         else if (accountType == "WebUI")
188         {
189             webUIType = true;
190         }
191         else if (accountType == "IPMI")
192         {
193             userGroups.emplace_back("ipmi");
194         }
195         else if (accountType == "HostConsole")
196         {
197             userGroups.emplace_back("hostconsole");
198         }
199         else if (accountType == "ManagerConsole")
200         {
201             userGroups.emplace_back("ssh");
202         }
203         else
204         {
205             // Invalid Account Type
206             messages::propertyValueNotInList(res, "AccountTypes", accountType);
207             return false;
208         }
209     }
210 
211     // Both  Redfish and WebUI Account Types are needed to PATCH
212     if (redfishType ^ webUIType)
213     {
214         BMCWEB_LOG_ERROR
215             << "Missing Redfish or WebUI Account Type to set redfish User Group";
216         messages::strictAccountTypes(res, "AccountTypes");
217         return false;
218     }
219 
220     if (redfishType && webUIType)
221     {
222         userGroups.emplace_back("redfish");
223     }
224 
225     return true;
226 }
227 
228 /**
229  * @brief Sets UserGroups property of the user based on the Account Types
230  *
231  * @param[in] accountTypes List of User Account Types
232  * @param[in] asyncResp Async Response
233  * @param[in] dbusObjectPath D-Bus Object Path
234  * @param[in] userSelf true if User is updating OWN Account Types
235  */
236 inline void
237     patchAccountTypes(const std::vector<std::string>& accountTypes,
238                       const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
239                       const std::string& dbusObjectPath, bool userSelf)
240 {
241     // Check if User is disabling own Redfish Account Type
242     if (userSelf &&
243         (accountTypes.cend() ==
244          std::find(accountTypes.cbegin(), accountTypes.cend(), "Redfish")))
245     {
246         BMCWEB_LOG_ERROR
247             << "User disabling OWN Redfish Account Type is not allowed";
248         messages::strictAccountTypes(asyncResp->res, "AccountTypes");
249         return;
250     }
251 
252     std::vector<std::string> updatedUserGroups;
253     if (!getUserGroupFromAccountType(asyncResp->res, accountTypes,
254                                      updatedUserGroups))
255     {
256         // Problem in mapping Account Types to User Groups, Error already
257         // logged.
258         return;
259     }
260 
261     sdbusplus::asio::setProperty(
262         *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
263         dbusObjectPath, "xyz.openbmc_project.User.Attributes", "UserGroups",
264         updatedUserGroups, [asyncResp](const boost::system::error_code& ec) {
265             if (ec)
266             {
267                 BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
268                 messages::internalError(asyncResp->res);
269                 return;
270             }
271             messages::success(asyncResp->res);
272         });
273 }
274 
275 inline void userErrorMessageHandler(
276     const sd_bus_error* e, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
277     const std::string& newUser, const std::string& username)
278 {
279     if (e == nullptr)
280     {
281         messages::internalError(asyncResp->res);
282         return;
283     }
284 
285     const char* errorMessage = e->name;
286     if (strcmp(errorMessage,
287                "xyz.openbmc_project.User.Common.Error.UserNameExists") == 0)
288     {
289         messages::resourceAlreadyExists(asyncResp->res, "ManagerAccount",
290                                         "UserName", newUser);
291     }
292     else if (strcmp(errorMessage, "xyz.openbmc_project.User.Common.Error."
293                                   "UserNameDoesNotExist") == 0)
294     {
295         messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
296     }
297     else if ((strcmp(errorMessage,
298                      "xyz.openbmc_project.Common.Error.InvalidArgument") ==
299               0) ||
300              (strcmp(
301                   errorMessage,
302                   "xyz.openbmc_project.User.Common.Error.UserNameGroupFail") ==
303               0))
304     {
305         messages::propertyValueFormatError(asyncResp->res, newUser, "UserName");
306     }
307     else if (strcmp(errorMessage,
308                     "xyz.openbmc_project.User.Common.Error.NoResource") == 0)
309     {
310         messages::createLimitReachedForResource(asyncResp->res);
311     }
312     else
313     {
314         messages::internalError(asyncResp->res);
315     }
316 }
317 
318 inline void parseLDAPConfigData(nlohmann::json& jsonResponse,
319                                 const LDAPConfigData& confData,
320                                 const std::string& ldapType)
321 {
322     std::string service = (ldapType == "LDAP") ? "LDAPService"
323                                                : "ActiveDirectoryService";
324 
325     nlohmann::json& ldap = jsonResponse[ldapType];
326 
327     ldap["ServiceEnabled"] = confData.serviceEnabled;
328     ldap["ServiceAddresses"] = nlohmann::json::array({confData.uri});
329     ldap["Authentication"]["AuthenticationType"] =
330         account_service::AuthenticationTypes::UsernameAndPassword;
331     ldap["Authentication"]["Username"] = confData.bindDN;
332     ldap["Authentication"]["Password"] = nullptr;
333 
334     ldap["LDAPService"]["SearchSettings"]["BaseDistinguishedNames"] =
335         nlohmann::json::array({confData.baseDN});
336     ldap["LDAPService"]["SearchSettings"]["UsernameAttribute"] =
337         confData.userNameAttribute;
338     ldap["LDAPService"]["SearchSettings"]["GroupsAttribute"] =
339         confData.groupAttribute;
340 
341     nlohmann::json& roleMapArray = ldap["RemoteRoleMapping"];
342     roleMapArray = nlohmann::json::array();
343     for (const auto& obj : confData.groupRoleList)
344     {
345         BMCWEB_LOG_DEBUG << "Pushing the data groupName="
346                          << obj.second.groupName << "\n";
347 
348         nlohmann::json::object_t remoteGroup;
349         remoteGroup["RemoteGroup"] = obj.second.groupName;
350         remoteGroup["LocalRole"] = getRoleIdFromPrivilege(obj.second.privilege);
351         roleMapArray.emplace_back(std::move(remoteGroup));
352     }
353 }
354 
355 /**
356  *  @brief validates given JSON input and then calls appropriate method to
357  * create, to delete or to set Rolemapping object based on the given input.
358  *
359  */
360 inline void handleRoleMapPatch(
361     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
362     const std::vector<std::pair<std::string, LDAPRoleMapData>>& roleMapObjData,
363     const std::string& serverType, const std::vector<nlohmann::json>& input)
364 {
365     for (size_t index = 0; index < input.size(); index++)
366     {
367         const nlohmann::json& thisJson = input[index];
368 
369         if (thisJson.is_null())
370         {
371             // delete the existing object
372             if (index < roleMapObjData.size())
373             {
374                 crow::connections::systemBus->async_method_call(
375                     [asyncResp, roleMapObjData, serverType,
376                      index](const boost::system::error_code& ec) {
377                     if (ec)
378                     {
379                         BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
380                         messages::internalError(asyncResp->res);
381                         return;
382                     }
383                     asyncResp->res.jsonValue[serverType]["RemoteRoleMapping"]
384                                             [index] = nullptr;
385                     },
386                     ldapDbusService, roleMapObjData[index].first,
387                     "xyz.openbmc_project.Object.Delete", "Delete");
388             }
389             else
390             {
391                 BMCWEB_LOG_ERROR << "Can't delete the object";
392                 messages::propertyValueTypeError(asyncResp->res, thisJson,
393                                                  "RemoteRoleMapping/" +
394                                                      std::to_string(index));
395                 return;
396             }
397         }
398         else if (thisJson.empty())
399         {
400             // Don't do anything for the empty objects,parse next json
401             // eg {"RemoteRoleMapping",[{}]}
402         }
403         else
404         {
405             // update/create the object
406             std::optional<std::string> remoteGroup;
407             std::optional<std::string> localRole;
408 
409             // This is a copy, but it's required in this case because of how
410             // readJson is structured
411             nlohmann::json thisJsonCopy = thisJson;
412             if (!json_util::readJson(thisJsonCopy, asyncResp->res,
413                                      "RemoteGroup", remoteGroup, "LocalRole",
414                                      localRole))
415             {
416                 continue;
417             }
418 
419             // Update existing RoleMapping Object
420             if (index < roleMapObjData.size())
421             {
422                 BMCWEB_LOG_DEBUG << "Update Role Map Object";
423                 // If "RemoteGroup" info is provided
424                 if (remoteGroup)
425                 {
426                     sdbusplus::asio::setProperty(
427                         *crow::connections::systemBus, ldapDbusService,
428                         roleMapObjData[index].first,
429                         "xyz.openbmc_project.User.PrivilegeMapperEntry",
430                         "GroupName", *remoteGroup,
431                         [asyncResp, roleMapObjData, serverType, index,
432                          remoteGroup](const boost::system::error_code& ec,
433                                       const sdbusplus::message_t& msg) {
434                         if (ec)
435                         {
436                             const sd_bus_error* dbusError = msg.get_error();
437                             if ((dbusError != nullptr) &&
438                                 (dbusError->name ==
439                                  std::string_view(
440                                      "xyz.openbmc_project.Common.Error.InvalidArgument")))
441                             {
442                                 BMCWEB_LOG_WARNING << "DBUS response error: "
443                                                    << ec;
444                                 messages::propertyValueIncorrect(asyncResp->res,
445                                                                  "RemoteGroup",
446                                                                  *remoteGroup);
447                                 return;
448                             }
449                             messages::internalError(asyncResp->res);
450                             return;
451                         }
452                         asyncResp->res
453                             .jsonValue[serverType]["RemoteRoleMapping"][index]
454                                       ["RemoteGroup"] = *remoteGroup;
455                         });
456                 }
457 
458                 // If "LocalRole" info is provided
459                 if (localRole)
460                 {
461                     sdbusplus::asio::setProperty(
462                         *crow::connections::systemBus, ldapDbusService,
463                         roleMapObjData[index].first,
464                         "xyz.openbmc_project.User.PrivilegeMapperEntry",
465                         "Privilege", *localRole,
466                         [asyncResp, roleMapObjData, serverType, index,
467                          localRole](const boost::system::error_code& ec,
468                                     const sdbusplus::message_t& msg) {
469                         if (ec)
470                         {
471                             const sd_bus_error* dbusError = msg.get_error();
472                             if ((dbusError != nullptr) &&
473                                 (dbusError->name ==
474                                  std::string_view(
475                                      "xyz.openbmc_project.Common.Error.InvalidArgument")))
476                             {
477                                 BMCWEB_LOG_WARNING << "DBUS response error: "
478                                                    << ec;
479                                 messages::propertyValueIncorrect(
480                                     asyncResp->res, "LocalRole", *localRole);
481                                 return;
482                             }
483                             messages::internalError(asyncResp->res);
484                             return;
485                         }
486                         asyncResp->res
487                             .jsonValue[serverType]["RemoteRoleMapping"][index]
488                                       ["LocalRole"] = *localRole;
489                         });
490                 }
491             }
492             // Create a new RoleMapping Object.
493             else
494             {
495                 BMCWEB_LOG_DEBUG
496                     << "setRoleMappingProperties: Creating new Object";
497                 std::string pathString = "RemoteRoleMapping/" +
498                                          std::to_string(index);
499 
500                 if (!localRole)
501                 {
502                     messages::propertyMissing(asyncResp->res,
503                                               pathString + "/LocalRole");
504                     continue;
505                 }
506                 if (!remoteGroup)
507                 {
508                     messages::propertyMissing(asyncResp->res,
509                                               pathString + "/RemoteGroup");
510                     continue;
511                 }
512 
513                 std::string dbusObjectPath;
514                 if (serverType == "ActiveDirectory")
515                 {
516                     dbusObjectPath = adConfigObject;
517                 }
518                 else if (serverType == "LDAP")
519                 {
520                     dbusObjectPath = ldapConfigObjectName;
521                 }
522 
523                 BMCWEB_LOG_DEBUG << "Remote Group=" << *remoteGroup
524                                  << ",LocalRole=" << *localRole;
525 
526                 crow::connections::systemBus->async_method_call(
527                     [asyncResp, serverType, localRole,
528                      remoteGroup](const boost::system::error_code& ec) {
529                     if (ec)
530                     {
531                         BMCWEB_LOG_ERROR << "DBUS response error: " << ec;
532                         messages::internalError(asyncResp->res);
533                         return;
534                     }
535                     nlohmann::json& remoteRoleJson =
536                         asyncResp->res
537                             .jsonValue[serverType]["RemoteRoleMapping"];
538                     nlohmann::json::object_t roleMapEntry;
539                     roleMapEntry["LocalRole"] = *localRole;
540                     roleMapEntry["RemoteGroup"] = *remoteGroup;
541                     remoteRoleJson.emplace_back(std::move(roleMapEntry));
542                     },
543                     ldapDbusService, dbusObjectPath, ldapPrivMapperInterface,
544                     "Create", *remoteGroup,
545                     getPrivilegeFromRoleId(std::move(*localRole)));
546             }
547         }
548     }
549 }
550 
551 /**
552  * Function that retrieves all properties for LDAP config object
553  * into JSON
554  */
555 template <typename CallbackFunc>
556 inline void getLDAPConfigData(const std::string& ldapType,
557                               CallbackFunc&& callback)
558 {
559     constexpr std::array<std::string_view, 2> interfaces = {
560         ldapEnableInterface, ldapConfigInterface};
561 
562     dbus::utility::getDbusObject(
563         ldapConfigObjectName, interfaces,
564         [callback, ldapType](const boost::system::error_code& ec,
565                              const dbus::utility::MapperGetObject& resp) {
566         if (ec || resp.empty())
567         {
568             BMCWEB_LOG_ERROR
569                 << "DBUS response error during getting of service name: " << ec;
570             LDAPConfigData empty{};
571             callback(false, empty, ldapType);
572             return;
573         }
574         std::string service = resp.begin()->first;
575         sdbusplus::message::object_path path(ldapRootObject);
576         dbus::utility::getManagedObjects(
577             service, path,
578             [callback,
579              ldapType](const boost::system::error_code& ec2,
580                        const dbus::utility::ManagedObjectType& ldapObjects) {
581             LDAPConfigData confData{};
582             if (ec2)
583             {
584                 callback(false, confData, ldapType);
585                 BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec2;
586                 return;
587             }
588 
589             std::string ldapDbusType;
590             std::string searchString;
591 
592             if (ldapType == "LDAP")
593             {
594                 ldapDbusType =
595                     "xyz.openbmc_project.User.Ldap.Config.Type.OpenLdap";
596                 searchString = "openldap";
597             }
598             else if (ldapType == "ActiveDirectory")
599             {
600                 ldapDbusType =
601                     "xyz.openbmc_project.User.Ldap.Config.Type.ActiveDirectory";
602                 searchString = "active_directory";
603             }
604             else
605             {
606                 BMCWEB_LOG_ERROR << "Can't get the DbusType for the given type="
607                                  << ldapType;
608                 callback(false, confData, ldapType);
609                 return;
610             }
611 
612             std::string ldapEnableInterfaceStr = ldapEnableInterface;
613             std::string ldapConfigInterfaceStr = ldapConfigInterface;
614 
615             for (const auto& object : ldapObjects)
616             {
617                 // let's find the object whose ldap type is equal to the
618                 // given type
619                 if (object.first.str.find(searchString) == std::string::npos)
620                 {
621                     continue;
622                 }
623 
624                 for (const auto& interface : object.second)
625                 {
626                     if (interface.first == ldapEnableInterfaceStr)
627                     {
628                         // rest of the properties are string.
629                         for (const auto& property : interface.second)
630                         {
631                             if (property.first == "Enabled")
632                             {
633                                 const bool* value =
634                                     std::get_if<bool>(&property.second);
635                                 if (value == nullptr)
636                                 {
637                                     continue;
638                                 }
639                                 confData.serviceEnabled = *value;
640                                 break;
641                             }
642                         }
643                     }
644                     else if (interface.first == ldapConfigInterfaceStr)
645                     {
646                         for (const auto& property : interface.second)
647                         {
648                             const std::string* strValue =
649                                 std::get_if<std::string>(&property.second);
650                             if (strValue == nullptr)
651                             {
652                                 continue;
653                             }
654                             if (property.first == "LDAPServerURI")
655                             {
656                                 confData.uri = *strValue;
657                             }
658                             else if (property.first == "LDAPBindDN")
659                             {
660                                 confData.bindDN = *strValue;
661                             }
662                             else if (property.first == "LDAPBaseDN")
663                             {
664                                 confData.baseDN = *strValue;
665                             }
666                             else if (property.first == "LDAPSearchScope")
667                             {
668                                 confData.searchScope = *strValue;
669                             }
670                             else if (property.first == "GroupNameAttribute")
671                             {
672                                 confData.groupAttribute = *strValue;
673                             }
674                             else if (property.first == "UserNameAttribute")
675                             {
676                                 confData.userNameAttribute = *strValue;
677                             }
678                             else if (property.first == "LDAPType")
679                             {
680                                 confData.serverType = *strValue;
681                             }
682                         }
683                     }
684                     else if (interface.first ==
685                              "xyz.openbmc_project.User.PrivilegeMapperEntry")
686                     {
687                         LDAPRoleMapData roleMapData{};
688                         for (const auto& property : interface.second)
689                         {
690                             const std::string* strValue =
691                                 std::get_if<std::string>(&property.second);
692 
693                             if (strValue == nullptr)
694                             {
695                                 continue;
696                             }
697 
698                             if (property.first == "GroupName")
699                             {
700                                 roleMapData.groupName = *strValue;
701                             }
702                             else if (property.first == "Privilege")
703                             {
704                                 roleMapData.privilege = *strValue;
705                             }
706                         }
707 
708                         confData.groupRoleList.emplace_back(object.first.str,
709                                                             roleMapData);
710                     }
711                 }
712             }
713             callback(true, confData, ldapType);
714             });
715         });
716 }
717 
718 /**
719  * @brief parses the authentication section under the LDAP
720  * @param input JSON data
721  * @param asyncResp pointer to the JSON response
722  * @param userName  userName to be filled from the given JSON.
723  * @param password  password to be filled from the given JSON.
724  */
725 inline void parseLDAPAuthenticationJson(
726     nlohmann::json input, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
727     std::optional<std::string>& username, std::optional<std::string>& password)
728 {
729     std::optional<std::string> authType;
730 
731     if (!json_util::readJson(input, asyncResp->res, "AuthenticationType",
732                              authType, "Username", username, "Password",
733                              password))
734     {
735         return;
736     }
737     if (!authType)
738     {
739         return;
740     }
741     if (*authType != "UsernameAndPassword")
742     {
743         messages::propertyValueNotInList(asyncResp->res, *authType,
744                                          "AuthenticationType");
745         return;
746     }
747 }
748 /**
749  * @brief parses the LDAPService section under the LDAP
750  * @param input JSON data
751  * @param asyncResp pointer to the JSON response
752  * @param baseDNList baseDN to be filled from the given JSON.
753  * @param userNameAttribute  userName to be filled from the given JSON.
754  * @param groupaAttribute  password to be filled from the given JSON.
755  */
756 
757 inline void
758     parseLDAPServiceJson(nlohmann::json input,
759                          const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
760                          std::optional<std::vector<std::string>>& baseDNList,
761                          std::optional<std::string>& userNameAttribute,
762                          std::optional<std::string>& groupsAttribute)
763 {
764     std::optional<nlohmann::json> searchSettings;
765 
766     if (!json_util::readJson(input, asyncResp->res, "SearchSettings",
767                              searchSettings))
768     {
769         return;
770     }
771     if (!searchSettings)
772     {
773         return;
774     }
775     if (!json_util::readJson(*searchSettings, asyncResp->res,
776                              "BaseDistinguishedNames", baseDNList,
777                              "UsernameAttribute", userNameAttribute,
778                              "GroupsAttribute", groupsAttribute))
779     {
780         return;
781     }
782 }
783 /**
784  * @brief updates the LDAP server address and updates the
785           json response with the new value.
786  * @param serviceAddressList address to be updated.
787  * @param asyncResp pointer to the JSON response
788  * @param ldapServerElementName Type of LDAP
789  server(openLDAP/ActiveDirectory)
790  */
791 
792 inline void handleServiceAddressPatch(
793     const std::vector<std::string>& serviceAddressList,
794     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
795     const std::string& ldapServerElementName,
796     const std::string& ldapConfigObject)
797 {
798     sdbusplus::asio::setProperty(
799         *crow::connections::systemBus, ldapDbusService, ldapConfigObject,
800         ldapConfigInterface, "LDAPServerURI", serviceAddressList.front(),
801         [asyncResp, ldapServerElementName, serviceAddressList](
802             const boost::system::error_code& ec, sdbusplus::message_t& msg) {
803         if (ec)
804         {
805             const sd_bus_error* dbusError = msg.get_error();
806             if ((dbusError != nullptr) &&
807                 (dbusError->name ==
808                  std::string_view(
809                      "xyz.openbmc_project.Common.Error.InvalidArgument")))
810             {
811                 BMCWEB_LOG_WARNING
812                     << "Error Occurred in updating the service address";
813                 messages::propertyValueIncorrect(asyncResp->res,
814                                                  "ServiceAddresses",
815                                                  serviceAddressList.front());
816                 return;
817             }
818             messages::internalError(asyncResp->res);
819             return;
820         }
821         std::vector<std::string> modifiedserviceAddressList = {
822             serviceAddressList.front()};
823         asyncResp->res.jsonValue[ldapServerElementName]["ServiceAddresses"] =
824             modifiedserviceAddressList;
825         if ((serviceAddressList).size() > 1)
826         {
827             messages::propertyValueModified(asyncResp->res, "ServiceAddresses",
828                                             serviceAddressList.front());
829         }
830         BMCWEB_LOG_DEBUG << "Updated the service address";
831         });
832 }
833 /**
834  * @brief updates the LDAP Bind DN and updates the
835           json response with the new value.
836  * @param username name of the user which needs to be updated.
837  * @param asyncResp pointer to the JSON response
838  * @param ldapServerElementName Type of LDAP
839  server(openLDAP/ActiveDirectory)
840  */
841 
842 inline void
843     handleUserNamePatch(const std::string& username,
844                         const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
845                         const std::string& ldapServerElementName,
846                         const std::string& ldapConfigObject)
847 {
848     sdbusplus::asio::setProperty(*crow::connections::systemBus, ldapDbusService,
849                                  ldapConfigObject, ldapConfigInterface,
850                                  "LDAPBindDN", username,
851                                  [asyncResp, username, ldapServerElementName](
852                                      const boost::system::error_code& ec) {
853         if (ec)
854         {
855             BMCWEB_LOG_DEBUG << "Error occurred in updating the username";
856             messages::internalError(asyncResp->res);
857             return;
858         }
859         asyncResp->res.jsonValue[ldapServerElementName]["Authentication"]
860                                 ["Username"] = username;
861         BMCWEB_LOG_DEBUG << "Updated the username";
862     });
863 }
864 
865 /**
866  * @brief updates the LDAP password
867  * @param password : ldap password which needs to be updated.
868  * @param asyncResp pointer to the JSON response
869  * @param ldapServerElementName Type of LDAP
870  *        server(openLDAP/ActiveDirectory)
871  */
872 
873 inline void
874     handlePasswordPatch(const std::string& password,
875                         const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
876                         const std::string& ldapServerElementName,
877                         const std::string& ldapConfigObject)
878 {
879     sdbusplus::asio::setProperty(*crow::connections::systemBus, ldapDbusService,
880                                  ldapConfigObject, ldapConfigInterface,
881                                  "LDAPBindDNPassword", password,
882                                  [asyncResp, password, ldapServerElementName](
883                                      const boost::system::error_code& ec) {
884         if (ec)
885         {
886             BMCWEB_LOG_DEBUG << "Error occurred in updating the password";
887             messages::internalError(asyncResp->res);
888             return;
889         }
890         asyncResp->res.jsonValue[ldapServerElementName]["Authentication"]
891                                 ["Password"] = "";
892         BMCWEB_LOG_DEBUG << "Updated the password";
893     });
894 }
895 
896 /**
897  * @brief updates the LDAP BaseDN and updates the
898           json response with the new value.
899  * @param baseDNList baseDN list which needs to be updated.
900  * @param asyncResp pointer to the JSON response
901  * @param ldapServerElementName Type of LDAP
902  server(openLDAP/ActiveDirectory)
903  */
904 
905 inline void
906     handleBaseDNPatch(const std::vector<std::string>& baseDNList,
907                       const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
908                       const std::string& ldapServerElementName,
909                       const std::string& ldapConfigObject)
910 {
911     sdbusplus::asio::setProperty(*crow::connections::systemBus, ldapDbusService,
912                                  ldapConfigObject, ldapConfigInterface,
913                                  "LDAPBaseDN", baseDNList.front(),
914                                  [asyncResp, baseDNList, ldapServerElementName](
915                                      const boost::system::error_code& ec,
916                                      const sdbusplus::message_t& msg) {
917         if (ec)
918         {
919             BMCWEB_LOG_DEBUG << "Error Occurred in Updating the base DN";
920             const sd_bus_error* dbusError = msg.get_error();
921             if ((dbusError != nullptr) &&
922                 (dbusError->name ==
923                  std::string_view(
924                      "xyz.openbmc_project.Common.Error.InvalidArgument")))
925             {
926                 messages::propertyValueIncorrect(asyncResp->res,
927                                                  "BaseDistinguishedNames",
928                                                  baseDNList.front());
929                 return;
930             }
931             messages::internalError(asyncResp->res);
932             return;
933         }
934         auto& serverTypeJson = asyncResp->res.jsonValue[ldapServerElementName];
935         auto& searchSettingsJson =
936             serverTypeJson["LDAPService"]["SearchSettings"];
937         std::vector<std::string> modifiedBaseDNList = {baseDNList.front()};
938         searchSettingsJson["BaseDistinguishedNames"] = modifiedBaseDNList;
939         if (baseDNList.size() > 1)
940         {
941             messages::propertyValueModified(
942                 asyncResp->res, "BaseDistinguishedNames", baseDNList.front());
943         }
944         BMCWEB_LOG_DEBUG << "Updated the base DN";
945     });
946 }
947 /**
948  * @brief updates the LDAP user name attribute and updates the
949           json response with the new value.
950  * @param userNameAttribute attribute to be updated.
951  * @param asyncResp pointer to the JSON response
952  * @param ldapServerElementName Type of LDAP
953  server(openLDAP/ActiveDirectory)
954  */
955 
956 inline void
957     handleUserNameAttrPatch(const std::string& userNameAttribute,
958                             const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
959                             const std::string& ldapServerElementName,
960                             const std::string& ldapConfigObject)
961 {
962     sdbusplus::asio::setProperty(
963         *crow::connections::systemBus, ldapDbusService, ldapConfigObject,
964         ldapConfigInterface, "UserNameAttribute", userNameAttribute,
965         [asyncResp, userNameAttribute,
966          ldapServerElementName](const boost::system::error_code& ec) {
967         if (ec)
968         {
969             BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
970                                 "username attribute";
971             messages::internalError(asyncResp->res);
972             return;
973         }
974         auto& serverTypeJson = asyncResp->res.jsonValue[ldapServerElementName];
975         auto& searchSettingsJson =
976             serverTypeJson["LDAPService"]["SearchSettings"];
977         searchSettingsJson["UsernameAttribute"] = userNameAttribute;
978         BMCWEB_LOG_DEBUG << "Updated the user name attr.";
979         });
980 }
981 /**
982  * @brief updates the LDAP group attribute and updates the
983           json response with the new value.
984  * @param groupsAttribute attribute to be updated.
985  * @param asyncResp pointer to the JSON response
986  * @param ldapServerElementName Type of LDAP
987  server(openLDAP/ActiveDirectory)
988  */
989 
990 inline void handleGroupNameAttrPatch(
991     const std::string& groupsAttribute,
992     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
993     const std::string& ldapServerElementName,
994     const std::string& ldapConfigObject)
995 {
996     sdbusplus::asio::setProperty(
997         *crow::connections::systemBus, ldapDbusService, ldapConfigObject,
998         ldapConfigInterface, "GroupNameAttribute", groupsAttribute,
999         [asyncResp, groupsAttribute,
1000          ldapServerElementName](const boost::system::error_code& ec) {
1001         if (ec)
1002         {
1003             BMCWEB_LOG_DEBUG << "Error Occurred in Updating the "
1004                                 "groupname attribute";
1005             messages::internalError(asyncResp->res);
1006             return;
1007         }
1008         auto& serverTypeJson = asyncResp->res.jsonValue[ldapServerElementName];
1009         auto& searchSettingsJson =
1010             serverTypeJson["LDAPService"]["SearchSettings"];
1011         searchSettingsJson["GroupsAttribute"] = groupsAttribute;
1012         BMCWEB_LOG_DEBUG << "Updated the groupname attr";
1013         });
1014 }
1015 /**
1016  * @brief updates the LDAP service enable and updates the
1017           json response with the new value.
1018  * @param input JSON data.
1019  * @param asyncResp pointer to the JSON response
1020  * @param ldapServerElementName Type of LDAP
1021  server(openLDAP/ActiveDirectory)
1022  */
1023 
1024 inline void handleServiceEnablePatch(
1025     bool serviceEnabled, const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1026     const std::string& ldapServerElementName,
1027     const std::string& ldapConfigObject)
1028 {
1029     sdbusplus::asio::setProperty(
1030         *crow::connections::systemBus, ldapDbusService, ldapConfigObject,
1031         ldapEnableInterface, "Enabled", serviceEnabled,
1032         [asyncResp, serviceEnabled,
1033          ldapServerElementName](const boost::system::error_code& ec) {
1034         if (ec)
1035         {
1036             BMCWEB_LOG_DEBUG << "Error Occurred in Updating the service enable";
1037             messages::internalError(asyncResp->res);
1038             return;
1039         }
1040         asyncResp->res.jsonValue[ldapServerElementName]["ServiceEnabled"] =
1041             serviceEnabled;
1042         BMCWEB_LOG_DEBUG << "Updated Service enable = " << serviceEnabled;
1043         });
1044 }
1045 
1046 inline void
1047     handleAuthMethodsPatch(nlohmann::json& input,
1048                            const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1049 {
1050     std::optional<bool> basicAuth;
1051     std::optional<bool> cookie;
1052     std::optional<bool> sessionToken;
1053     std::optional<bool> xToken;
1054     std::optional<bool> tls;
1055 
1056     if (!json_util::readJson(input, asyncResp->res, "BasicAuth", basicAuth,
1057                              "Cookie", cookie, "SessionToken", sessionToken,
1058                              "XToken", xToken, "TLS", tls))
1059     {
1060         BMCWEB_LOG_ERROR << "Cannot read values from AuthMethod tag";
1061         return;
1062     }
1063 
1064     // Make a copy of methods configuration
1065     persistent_data::AuthConfigMethods authMethodsConfig =
1066         persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
1067 
1068     if (basicAuth)
1069     {
1070 #ifndef BMCWEB_ENABLE_BASIC_AUTHENTICATION
1071         messages::actionNotSupported(
1072             asyncResp->res,
1073             "Setting BasicAuth when basic-auth feature is disabled");
1074         return;
1075 #endif
1076         authMethodsConfig.basic = *basicAuth;
1077     }
1078 
1079     if (cookie)
1080     {
1081 #ifndef BMCWEB_ENABLE_COOKIE_AUTHENTICATION
1082         messages::actionNotSupported(
1083             asyncResp->res,
1084             "Setting Cookie when cookie-auth feature is disabled");
1085         return;
1086 #endif
1087         authMethodsConfig.cookie = *cookie;
1088     }
1089 
1090     if (sessionToken)
1091     {
1092 #ifndef BMCWEB_ENABLE_SESSION_AUTHENTICATION
1093         messages::actionNotSupported(
1094             asyncResp->res,
1095             "Setting SessionToken when session-auth feature is disabled");
1096         return;
1097 #endif
1098         authMethodsConfig.sessionToken = *sessionToken;
1099     }
1100 
1101     if (xToken)
1102     {
1103 #ifndef BMCWEB_ENABLE_XTOKEN_AUTHENTICATION
1104         messages::actionNotSupported(
1105             asyncResp->res,
1106             "Setting XToken when xtoken-auth feature is disabled");
1107         return;
1108 #endif
1109         authMethodsConfig.xtoken = *xToken;
1110     }
1111 
1112     if (tls)
1113     {
1114 #ifndef BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION
1115         messages::actionNotSupported(
1116             asyncResp->res,
1117             "Setting TLS when mutual-tls-auth feature is disabled");
1118         return;
1119 #endif
1120         authMethodsConfig.tls = *tls;
1121     }
1122 
1123     if (!authMethodsConfig.basic && !authMethodsConfig.cookie &&
1124         !authMethodsConfig.sessionToken && !authMethodsConfig.xtoken &&
1125         !authMethodsConfig.tls)
1126     {
1127         // Do not allow user to disable everything
1128         messages::actionNotSupported(asyncResp->res,
1129                                      "of disabling all available methods");
1130         return;
1131     }
1132 
1133     persistent_data::SessionStore::getInstance().updateAuthMethodsConfig(
1134         authMethodsConfig);
1135     // Save configuration immediately
1136     persistent_data::getConfig().writeData();
1137 
1138     messages::success(asyncResp->res);
1139 }
1140 
1141 /**
1142  * @brief Get the required values from the given JSON, validates the
1143  *        value and create the LDAP config object.
1144  * @param input JSON data
1145  * @param asyncResp pointer to the JSON response
1146  * @param serverType Type of LDAP server(openLDAP/ActiveDirectory)
1147  */
1148 
1149 inline void handleLDAPPatch(nlohmann::json& input,
1150                             const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1151                             const std::string& serverType)
1152 {
1153     std::string dbusObjectPath;
1154     if (serverType == "ActiveDirectory")
1155     {
1156         dbusObjectPath = adConfigObject;
1157     }
1158     else if (serverType == "LDAP")
1159     {
1160         dbusObjectPath = ldapConfigObjectName;
1161     }
1162     else
1163     {
1164         return;
1165     }
1166 
1167     std::optional<nlohmann::json> authentication;
1168     std::optional<nlohmann::json> ldapService;
1169     std::optional<std::vector<std::string>> serviceAddressList;
1170     std::optional<bool> serviceEnabled;
1171     std::optional<std::vector<std::string>> baseDNList;
1172     std::optional<std::string> userNameAttribute;
1173     std::optional<std::string> groupsAttribute;
1174     std::optional<std::string> userName;
1175     std::optional<std::string> password;
1176     std::optional<std::vector<nlohmann::json>> remoteRoleMapData;
1177 
1178     if (!json_util::readJson(input, asyncResp->res, "Authentication",
1179                              authentication, "LDAPService", ldapService,
1180                              "ServiceAddresses", serviceAddressList,
1181                              "ServiceEnabled", serviceEnabled,
1182                              "RemoteRoleMapping", remoteRoleMapData))
1183     {
1184         return;
1185     }
1186 
1187     if (authentication)
1188     {
1189         parseLDAPAuthenticationJson(*authentication, asyncResp, userName,
1190                                     password);
1191     }
1192     if (ldapService)
1193     {
1194         parseLDAPServiceJson(*ldapService, asyncResp, baseDNList,
1195                              userNameAttribute, groupsAttribute);
1196     }
1197     if (serviceAddressList)
1198     {
1199         if (serviceAddressList->empty())
1200         {
1201             messages::propertyValueNotInList(
1202                 asyncResp->res, *serviceAddressList, "ServiceAddress");
1203             return;
1204         }
1205     }
1206     if (baseDNList)
1207     {
1208         if (baseDNList->empty())
1209         {
1210             messages::propertyValueNotInList(asyncResp->res, *baseDNList,
1211                                              "BaseDistinguishedNames");
1212             return;
1213         }
1214     }
1215 
1216     // nothing to update, then return
1217     if (!userName && !password && !serviceAddressList && !baseDNList &&
1218         !userNameAttribute && !groupsAttribute && !serviceEnabled &&
1219         !remoteRoleMapData)
1220     {
1221         return;
1222     }
1223 
1224     // Get the existing resource first then keep modifying
1225     // whenever any property gets updated.
1226     getLDAPConfigData(
1227         serverType,
1228         [asyncResp, userName, password, baseDNList, userNameAttribute,
1229          groupsAttribute, serviceAddressList, serviceEnabled, dbusObjectPath,
1230          remoteRoleMapData](bool success, const LDAPConfigData& confData,
1231                             const std::string& serverT) {
1232         if (!success)
1233         {
1234             messages::internalError(asyncResp->res);
1235             return;
1236         }
1237         parseLDAPConfigData(asyncResp->res.jsonValue, confData, serverT);
1238         if (confData.serviceEnabled)
1239         {
1240             // Disable the service first and update the rest of
1241             // the properties.
1242             handleServiceEnablePatch(false, asyncResp, serverT, dbusObjectPath);
1243         }
1244 
1245         if (serviceAddressList)
1246         {
1247             handleServiceAddressPatch(*serviceAddressList, asyncResp, serverT,
1248                                       dbusObjectPath);
1249         }
1250         if (userName)
1251         {
1252             handleUserNamePatch(*userName, asyncResp, serverT, dbusObjectPath);
1253         }
1254         if (password)
1255         {
1256             handlePasswordPatch(*password, asyncResp, serverT, dbusObjectPath);
1257         }
1258 
1259         if (baseDNList)
1260         {
1261             handleBaseDNPatch(*baseDNList, asyncResp, serverT, dbusObjectPath);
1262         }
1263         if (userNameAttribute)
1264         {
1265             handleUserNameAttrPatch(*userNameAttribute, asyncResp, serverT,
1266                                     dbusObjectPath);
1267         }
1268         if (groupsAttribute)
1269         {
1270             handleGroupNameAttrPatch(*groupsAttribute, asyncResp, serverT,
1271                                      dbusObjectPath);
1272         }
1273         if (serviceEnabled)
1274         {
1275             // if user has given the value as true then enable
1276             // the service. if user has given false then no-op
1277             // as service is already stopped.
1278             if (*serviceEnabled)
1279             {
1280                 handleServiceEnablePatch(*serviceEnabled, asyncResp, serverT,
1281                                          dbusObjectPath);
1282             }
1283         }
1284         else
1285         {
1286             // if user has not given the service enabled value
1287             // then revert it to the same state as it was
1288             // before.
1289             handleServiceEnablePatch(confData.serviceEnabled, asyncResp,
1290                                      serverT, dbusObjectPath);
1291         }
1292 
1293         if (remoteRoleMapData)
1294         {
1295             handleRoleMapPatch(asyncResp, confData.groupRoleList, serverT,
1296                                *remoteRoleMapData);
1297         }
1298         });
1299 }
1300 
1301 inline void updateUserProperties(
1302     std::shared_ptr<bmcweb::AsyncResp> asyncResp, const std::string& username,
1303     const std::optional<std::string>& password,
1304     const std::optional<bool>& enabled,
1305     const std::optional<std::string>& roleId, const std::optional<bool>& locked,
1306     std::optional<std::vector<std::string>> accountTypes, bool userSelf)
1307 {
1308     sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
1309     tempObjPath /= username;
1310     std::string dbusObjectPath(tempObjPath);
1311 
1312     dbus::utility::checkDbusPathExists(
1313         dbusObjectPath, [dbusObjectPath, username, password, roleId, enabled,
1314                          locked, accountTypes(std::move(accountTypes)),
1315                          userSelf, asyncResp{std::move(asyncResp)}](int rc) {
1316             if (rc <= 0)
1317             {
1318                 messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1319                                            username);
1320                 return;
1321             }
1322 
1323             if (password)
1324             {
1325                 int retval = pamUpdatePassword(username, *password);
1326 
1327                 if (retval == PAM_USER_UNKNOWN)
1328                 {
1329                     messages::resourceNotFound(asyncResp->res, "ManagerAccount",
1330                                                username);
1331                 }
1332                 else if (retval == PAM_AUTHTOK_ERR)
1333                 {
1334                     // If password is invalid
1335                     messages::propertyValueFormatError(asyncResp->res,
1336                                                        *password, "Password");
1337                     BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1338                 }
1339                 else if (retval != PAM_SUCCESS)
1340                 {
1341                     messages::internalError(asyncResp->res);
1342                     return;
1343                 }
1344                 else
1345                 {
1346                     messages::success(asyncResp->res);
1347                 }
1348             }
1349 
1350             if (enabled)
1351             {
1352                 sdbusplus::asio::setProperty(
1353                     *crow::connections::systemBus,
1354                     "xyz.openbmc_project.User.Manager", dbusObjectPath,
1355                     "xyz.openbmc_project.User.Attributes", "UserEnabled",
1356                     *enabled, [asyncResp](const boost::system::error_code& ec) {
1357                         if (ec)
1358                         {
1359                             BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1360                             messages::internalError(asyncResp->res);
1361                             return;
1362                         }
1363                         messages::success(asyncResp->res);
1364                     });
1365             }
1366 
1367             if (roleId)
1368             {
1369                 std::string priv = getPrivilegeFromRoleId(*roleId);
1370                 if (priv.empty())
1371                 {
1372                     messages::propertyValueNotInList(asyncResp->res, true,
1373                                                      "Locked");
1374                     return;
1375                 }
1376 
1377                 sdbusplus::asio::setProperty(
1378                     *crow::connections::systemBus,
1379                     "xyz.openbmc_project.User.Manager", dbusObjectPath,
1380                     "xyz.openbmc_project.User.Attributes", "UserPrivilege",
1381                     priv, [asyncResp](const boost::system::error_code& ec) {
1382                         if (ec)
1383                         {
1384                             BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1385                             messages::internalError(asyncResp->res);
1386                             return;
1387                         }
1388                         messages::success(asyncResp->res);
1389                     });
1390             }
1391 
1392             if (locked)
1393             {
1394                 // admin can unlock the account which is locked by
1395                 // successive authentication failures but admin should
1396                 // not be allowed to lock an account.
1397                 if (*locked)
1398                 {
1399                     messages::propertyValueNotInList(asyncResp->res, "true",
1400                                                      "Locked");
1401                     return;
1402                 }
1403 
1404                 sdbusplus::asio::setProperty(
1405                     *crow::connections::systemBus,
1406                     "xyz.openbmc_project.User.Manager", dbusObjectPath,
1407                     "xyz.openbmc_project.User.Attributes",
1408                     "UserLockedForFailedAttempt", *locked,
1409                     [asyncResp](const boost::system::error_code& ec) {
1410                 if (ec)
1411                 {
1412                     BMCWEB_LOG_ERROR << "D-Bus responses error: " << ec;
1413                     messages::internalError(asyncResp->res);
1414                     return;
1415                 }
1416                 messages::success(asyncResp->res);
1417                     });
1418             }
1419 
1420             if (accountTypes)
1421             {
1422                 patchAccountTypes(*accountTypes, asyncResp, dbusObjectPath,
1423                                   userSelf);
1424             }
1425         });
1426 }
1427 
1428 inline void handleAccountServiceHead(
1429     App& app, const crow::Request& req,
1430     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1431 {
1432     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1433     {
1434         return;
1435     }
1436     asyncResp->res.addHeader(
1437         boost::beast::http::field::link,
1438         "</redfish/v1/JsonSchemas/AccountService/AccountService.json>; rel=describedby");
1439 }
1440 
1441 inline void
1442     handleAccountServiceGet(App& app, const crow::Request& req,
1443                             const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1444 {
1445     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1446     {
1447         return;
1448     }
1449 
1450     if (req.session == nullptr)
1451     {
1452         messages::internalError(asyncResp->res);
1453         return;
1454     }
1455 
1456     asyncResp->res.addHeader(
1457         boost::beast::http::field::link,
1458         "</redfish/v1/JsonSchemas/AccountService/AccountService.json>; rel=describedby");
1459 
1460     const persistent_data::AuthConfigMethods& authMethodsConfig =
1461         persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
1462 
1463     nlohmann::json& json = asyncResp->res.jsonValue;
1464     json["@odata.id"] = "/redfish/v1/AccountService";
1465     json["@odata.type"] = "#AccountService."
1466                           "v1_10_0.AccountService";
1467     json["Id"] = "AccountService";
1468     json["Name"] = "Account Service";
1469     json["Description"] = "Account Service";
1470     json["ServiceEnabled"] = true;
1471     json["MaxPasswordLength"] = 20;
1472     json["Accounts"]["@odata.id"] = "/redfish/v1/AccountService/Accounts";
1473     json["Roles"]["@odata.id"] = "/redfish/v1/AccountService/Roles";
1474     json["Oem"]["OpenBMC"]["@odata.type"] =
1475         "#OpenBMCAccountService.v1_0_0.AccountService";
1476     json["Oem"]["OpenBMC"]["@odata.id"] =
1477         "/redfish/v1/AccountService#/Oem/OpenBMC";
1478     json["Oem"]["OpenBMC"]["AuthMethods"]["BasicAuth"] =
1479         authMethodsConfig.basic;
1480     json["Oem"]["OpenBMC"]["AuthMethods"]["SessionToken"] =
1481         authMethodsConfig.sessionToken;
1482     json["Oem"]["OpenBMC"]["AuthMethods"]["XToken"] = authMethodsConfig.xtoken;
1483     json["Oem"]["OpenBMC"]["AuthMethods"]["Cookie"] = authMethodsConfig.cookie;
1484     json["Oem"]["OpenBMC"]["AuthMethods"]["TLS"] = authMethodsConfig.tls;
1485 
1486     // /redfish/v1/AccountService/LDAP/Certificates is something only
1487     // ConfigureManager can access then only display when the user has
1488     // permissions ConfigureManager
1489     Privileges effectiveUserPrivileges =
1490         redfish::getUserPrivileges(*req.session);
1491 
1492     if (isOperationAllowedWithPrivileges({{"ConfigureManager"}},
1493                                          effectiveUserPrivileges))
1494     {
1495         asyncResp->res.jsonValue["LDAP"]["Certificates"]["@odata.id"] =
1496             "/redfish/v1/AccountService/LDAP/Certificates";
1497     }
1498     sdbusplus::asio::getAllProperties(
1499         *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1500         "/xyz/openbmc_project/user", "xyz.openbmc_project.User.AccountPolicy",
1501         [asyncResp](const boost::system::error_code& ec,
1502                     const dbus::utility::DBusPropertiesMap& propertiesList) {
1503         if (ec)
1504         {
1505             messages::internalError(asyncResp->res);
1506             return;
1507         }
1508 
1509         BMCWEB_LOG_DEBUG << "Got " << propertiesList.size()
1510                          << "properties for AccountService";
1511 
1512         const uint8_t* minPasswordLength = nullptr;
1513         const uint32_t* accountUnlockTimeout = nullptr;
1514         const uint16_t* maxLoginAttemptBeforeLockout = nullptr;
1515 
1516         const bool success = sdbusplus::unpackPropertiesNoThrow(
1517             dbus_utils::UnpackErrorPrinter(), propertiesList,
1518             "MinPasswordLength", minPasswordLength, "AccountUnlockTimeout",
1519             accountUnlockTimeout, "MaxLoginAttemptBeforeLockout",
1520             maxLoginAttemptBeforeLockout);
1521 
1522         if (!success)
1523         {
1524             messages::internalError(asyncResp->res);
1525             return;
1526         }
1527 
1528         if (minPasswordLength != nullptr)
1529         {
1530             asyncResp->res.jsonValue["MinPasswordLength"] = *minPasswordLength;
1531         }
1532 
1533         if (accountUnlockTimeout != nullptr)
1534         {
1535             asyncResp->res.jsonValue["AccountLockoutDuration"] =
1536                 *accountUnlockTimeout;
1537         }
1538 
1539         if (maxLoginAttemptBeforeLockout != nullptr)
1540         {
1541             asyncResp->res.jsonValue["AccountLockoutThreshold"] =
1542                 *maxLoginAttemptBeforeLockout;
1543         }
1544         });
1545 
1546     auto callback = [asyncResp](bool success, const LDAPConfigData& confData,
1547                                 const std::string& ldapType) {
1548         if (!success)
1549         {
1550             return;
1551         }
1552         parseLDAPConfigData(asyncResp->res.jsonValue, confData, ldapType);
1553     };
1554 
1555     getLDAPConfigData("LDAP", callback);
1556     getLDAPConfigData("ActiveDirectory", callback);
1557 }
1558 
1559 inline void handleAccountServicePatch(
1560     App& app, const crow::Request& req,
1561     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1562 {
1563     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1564     {
1565         return;
1566     }
1567     std::optional<uint32_t> unlockTimeout;
1568     std::optional<uint16_t> lockoutThreshold;
1569     std::optional<uint8_t> minPasswordLength;
1570     std::optional<uint16_t> maxPasswordLength;
1571     std::optional<nlohmann::json> ldapObject;
1572     std::optional<nlohmann::json> activeDirectoryObject;
1573     std::optional<nlohmann::json> oemObject;
1574 
1575     if (!json_util::readJsonPatch(
1576             req, asyncResp->res, "AccountLockoutDuration", unlockTimeout,
1577             "AccountLockoutThreshold", lockoutThreshold, "MaxPasswordLength",
1578             maxPasswordLength, "MinPasswordLength", minPasswordLength, "LDAP",
1579             ldapObject, "ActiveDirectory", activeDirectoryObject, "Oem",
1580             oemObject))
1581     {
1582         return;
1583     }
1584 
1585     if (minPasswordLength)
1586     {
1587         sdbusplus::asio::setProperty(
1588             *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1589             "/xyz/openbmc_project/user",
1590             "xyz.openbmc_project.User.AccountPolicy", "MinPasswordLength",
1591             *minPasswordLength,
1592             [asyncResp](const boost::system::error_code& ec) {
1593             if (ec)
1594             {
1595                 messages::internalError(asyncResp->res);
1596                 return;
1597             }
1598             messages::success(asyncResp->res);
1599             });
1600     }
1601 
1602     if (maxPasswordLength)
1603     {
1604         messages::propertyNotWritable(asyncResp->res, "MaxPasswordLength");
1605     }
1606 
1607     if (ldapObject)
1608     {
1609         handleLDAPPatch(*ldapObject, asyncResp, "LDAP");
1610     }
1611 
1612     if (std::optional<nlohmann::json> oemOpenBMCObject;
1613         oemObject && json_util::readJson(*oemObject, asyncResp->res, "OpenBMC",
1614                                          oemOpenBMCObject))
1615     {
1616         if (std::optional<nlohmann::json> authMethodsObject;
1617             oemOpenBMCObject &&
1618             json_util::readJson(*oemOpenBMCObject, asyncResp->res,
1619                                 "AuthMethods", authMethodsObject))
1620         {
1621             if (authMethodsObject)
1622             {
1623                 handleAuthMethodsPatch(*authMethodsObject, asyncResp);
1624             }
1625         }
1626     }
1627 
1628     if (activeDirectoryObject)
1629     {
1630         handleLDAPPatch(*activeDirectoryObject, asyncResp, "ActiveDirectory");
1631     }
1632 
1633     if (unlockTimeout)
1634     {
1635         sdbusplus::asio::setProperty(
1636             *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1637             "/xyz/openbmc_project/user",
1638             "xyz.openbmc_project.User.AccountPolicy", "AccountUnlockTimeout",
1639             *unlockTimeout, [asyncResp](const boost::system::error_code& ec) {
1640                 if (ec)
1641                 {
1642                     messages::internalError(asyncResp->res);
1643                     return;
1644                 }
1645                 messages::success(asyncResp->res);
1646             });
1647     }
1648     if (lockoutThreshold)
1649     {
1650         sdbusplus::asio::setProperty(
1651             *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1652             "/xyz/openbmc_project/user",
1653             "xyz.openbmc_project.User.AccountPolicy",
1654             "MaxLoginAttemptBeforeLockout", *lockoutThreshold,
1655             [asyncResp](const boost::system::error_code& ec) {
1656             if (ec)
1657             {
1658                 messages::internalError(asyncResp->res);
1659                 return;
1660             }
1661             messages::success(asyncResp->res);
1662             });
1663     }
1664 }
1665 
1666 inline void handleAccountCollectionHead(
1667     App& app, const crow::Request& req,
1668     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1669 {
1670     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1671     {
1672         return;
1673     }
1674     asyncResp->res.addHeader(
1675         boost::beast::http::field::link,
1676         "</redfish/v1/JsonSchemas/ManagerAccountCollection.json>; rel=describedby");
1677 }
1678 
1679 inline void handleAccountCollectionGet(
1680     App& app, const crow::Request& req,
1681     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1682 {
1683     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1684     {
1685         return;
1686     }
1687 
1688     if (req.session == nullptr)
1689     {
1690         messages::internalError(asyncResp->res);
1691         return;
1692     }
1693 
1694     asyncResp->res.addHeader(
1695         boost::beast::http::field::link,
1696         "</redfish/v1/JsonSchemas/ManagerAccountCollection.json>; rel=describedby");
1697 
1698     asyncResp->res.jsonValue["@odata.id"] =
1699         "/redfish/v1/AccountService/Accounts";
1700     asyncResp->res.jsonValue["@odata.type"] = "#ManagerAccountCollection."
1701                                               "ManagerAccountCollection";
1702     asyncResp->res.jsonValue["Name"] = "Accounts Collection";
1703     asyncResp->res.jsonValue["Description"] = "BMC User Accounts";
1704 
1705     Privileges effectiveUserPrivileges =
1706         redfish::getUserPrivileges(*req.session);
1707 
1708     std::string thisUser;
1709     if (req.session)
1710     {
1711         thisUser = req.session->username;
1712     }
1713     sdbusplus::message::object_path path("/xyz/openbmc_project/user");
1714     dbus::utility::getManagedObjects(
1715         "xyz.openbmc_project.User.Manager", path,
1716         [asyncResp, thisUser, effectiveUserPrivileges](
1717             const boost::system::error_code& ec,
1718             const dbus::utility::ManagedObjectType& users) {
1719         if (ec)
1720         {
1721             messages::internalError(asyncResp->res);
1722             return;
1723         }
1724 
1725         bool userCanSeeAllAccounts =
1726             effectiveUserPrivileges.isSupersetOf({"ConfigureUsers"});
1727 
1728         bool userCanSeeSelf =
1729             effectiveUserPrivileges.isSupersetOf({"ConfigureSelf"});
1730 
1731         nlohmann::json& memberArray = asyncResp->res.jsonValue["Members"];
1732         memberArray = nlohmann::json::array();
1733 
1734         for (const auto& userpath : users)
1735         {
1736             std::string user = userpath.first.filename();
1737             if (user.empty())
1738             {
1739                 messages::internalError(asyncResp->res);
1740                 BMCWEB_LOG_ERROR << "Invalid firmware ID";
1741 
1742                 return;
1743             }
1744 
1745             // As clarified by Redfish here:
1746             // https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration
1747             // Users without ConfigureUsers, only see their own
1748             // account. Users with ConfigureUsers, see all
1749             // accounts.
1750             if (userCanSeeAllAccounts || (thisUser == user && userCanSeeSelf))
1751             {
1752                 nlohmann::json::object_t member;
1753                 member["@odata.id"] = "/redfish/v1/AccountService/Accounts/" +
1754                                       user;
1755                 memberArray.emplace_back(std::move(member));
1756             }
1757         }
1758         asyncResp->res.jsonValue["Members@odata.count"] = memberArray.size();
1759         });
1760 }
1761 
1762 inline void processAfterCreateUser(
1763     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1764     const std::string& username, const std::string& password,
1765     const boost::system::error_code& ec, sdbusplus::message_t& m)
1766 {
1767     if (ec)
1768     {
1769         userErrorMessageHandler(m.get_error(), asyncResp, username, "");
1770         return;
1771     }
1772 
1773     if (pamUpdatePassword(username, password) != PAM_SUCCESS)
1774     {
1775         // At this point we have a user that's been
1776         // created, but the password set
1777         // failed.Something is wrong, so delete the user
1778         // that we've already created
1779         sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
1780         tempObjPath /= username;
1781         const std::string userPath(tempObjPath);
1782 
1783         crow::connections::systemBus->async_method_call(
1784             [asyncResp, password](const boost::system::error_code& ec3) {
1785             if (ec3)
1786             {
1787                 messages::internalError(asyncResp->res);
1788                 return;
1789             }
1790 
1791             // If password is invalid
1792             messages::propertyValueFormatError(asyncResp->res, password,
1793                                                "Password");
1794             },
1795             "xyz.openbmc_project.User.Manager", userPath,
1796             "xyz.openbmc_project.Object.Delete", "Delete");
1797 
1798         BMCWEB_LOG_ERROR << "pamUpdatePassword Failed";
1799         return;
1800     }
1801 
1802     messages::created(asyncResp->res);
1803     asyncResp->res.addHeader("Location",
1804                              "/redfish/v1/AccountService/Accounts/" + username);
1805 }
1806 
1807 inline void processAfterGetAllGroups(
1808     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1809     const std::string& username, const std::string& password,
1810     const std::optional<std::string>& roleId, std::optional<bool> enabled,
1811     std::optional<std::vector<std::string>> accountTypes,
1812     const std::vector<std::string>& allGroupsList)
1813 {
1814     std::vector<std::string> userGroups;
1815     std::vector<std::string> accountTypeUserGroups;
1816 
1817     // If user specified account types then convert them to unix user groups
1818     if (accountTypes)
1819     {
1820         if (!getUserGroupFromAccountType(asyncResp->res, *accountTypes,
1821                                          accountTypeUserGroups))
1822         {
1823             // Problem in mapping Account Types to User Groups, Error already
1824             // logged.
1825             return;
1826         }
1827     }
1828 
1829     for (const auto& grp : allGroupsList)
1830     {
1831         // If user specified the account type then only accept groups which are
1832         // in the account types group list.
1833         if (!accountTypeUserGroups.empty())
1834         {
1835             bool found = false;
1836             for (const auto& grp1 : accountTypeUserGroups)
1837             {
1838                 if (grp == grp1)
1839                 {
1840                     found = true;
1841                     break;
1842                 }
1843             }
1844             if (!found)
1845             {
1846                 continue;
1847             }
1848         }
1849 
1850         // Console access is provided to the user who is a member of
1851         // hostconsole group and has a administrator role. So, set
1852         // hostconsole group only for the administrator.
1853         if ((grp == "hostconsole") && (roleId != "priv-admin"))
1854         {
1855             if (!accountTypeUserGroups.empty())
1856             {
1857                 BMCWEB_LOG_ERROR
1858                     << "Only administrator can get HostConsole access";
1859                 asyncResp->res.result(boost::beast::http::status::bad_request);
1860                 return;
1861             }
1862             continue;
1863         }
1864         userGroups.emplace_back(grp);
1865     }
1866 
1867     // Make sure user specified groups are valid. This is internal error because
1868     // it some inconsistencies between user manager and bmcweb.
1869     if (!accountTypeUserGroups.empty() &&
1870         accountTypeUserGroups.size() != userGroups.size())
1871     {
1872         messages::internalError(asyncResp->res);
1873         return;
1874     }
1875 
1876     crow::connections::systemBus->async_method_call(
1877         [asyncResp, username, password](const boost::system::error_code& ec2,
1878                                         sdbusplus::message_t& m) {
1879         processAfterCreateUser(asyncResp, username, password, ec2, m);
1880         },
1881         "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
1882         "xyz.openbmc_project.User.Manager", "CreateUser", username, userGroups,
1883         *roleId, *enabled);
1884 }
1885 
1886 inline void handleAccountCollectionPost(
1887     App& app, const crow::Request& req,
1888     const std::shared_ptr<bmcweb::AsyncResp>& asyncResp)
1889 {
1890     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1891     {
1892         return;
1893     }
1894     std::string username;
1895     std::string password;
1896     std::optional<std::string> roleId("User");
1897     std::optional<bool> enabled = true;
1898     std::optional<std::vector<std::string>> accountTypes;
1899     if (!json_util::readJsonPatch(
1900             req, asyncResp->res, "UserName", username, "Password", password,
1901             "RoleId", roleId, "Enabled", enabled, "AccountTypes", accountTypes))
1902     {
1903         return;
1904     }
1905 
1906     std::string priv = getPrivilegeFromRoleId(*roleId);
1907     if (priv.empty())
1908     {
1909         messages::propertyValueNotInList(asyncResp->res, *roleId, "RoleId");
1910         return;
1911     }
1912     roleId = priv;
1913 
1914     // Reading AllGroups property
1915     sdbusplus::asio::getProperty<std::vector<std::string>>(
1916         *crow::connections::systemBus, "xyz.openbmc_project.User.Manager",
1917         "/xyz/openbmc_project/user", "xyz.openbmc_project.User.Manager",
1918         "AllGroups",
1919         [asyncResp, username, password{std::move(password)}, roleId, enabled,
1920          accountTypes](const boost::system::error_code& ec,
1921                        const std::vector<std::string>& allGroupsList) {
1922         if (ec)
1923         {
1924             BMCWEB_LOG_DEBUG << "ERROR with async_method_call";
1925             messages::internalError(asyncResp->res);
1926             return;
1927         }
1928 
1929         if (allGroupsList.empty())
1930         {
1931             messages::internalError(asyncResp->res);
1932             return;
1933         }
1934 
1935         processAfterGetAllGroups(asyncResp, username, password, roleId, enabled,
1936                                  accountTypes, allGroupsList);
1937         });
1938 }
1939 
1940 inline void
1941     handleAccountHead(App& app, const crow::Request& req,
1942                       const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1943                       const std::string& /*accountName*/)
1944 {
1945     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1946     {
1947         return;
1948     }
1949     asyncResp->res.addHeader(
1950         boost::beast::http::field::link,
1951         "</redfish/v1/JsonSchemas/ManagerAccount/ManagerAccount.json>; rel=describedby");
1952 }
1953 
1954 inline void
1955     handleAccountGet(App& app, const crow::Request& req,
1956                      const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
1957                      const std::string& accountName)
1958 {
1959     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
1960     {
1961         return;
1962     }
1963     asyncResp->res.addHeader(
1964         boost::beast::http::field::link,
1965         "</redfish/v1/JsonSchemas/ManagerAccount/ManagerAccount.json>; rel=describedby");
1966 
1967 #ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1968     // If authentication is disabled, there are no user accounts
1969     messages::resourceNotFound(asyncResp->res, "ManagerAccount", accountName);
1970     return;
1971 #endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
1972 
1973     if (req.session == nullptr)
1974     {
1975         messages::internalError(asyncResp->res);
1976         return;
1977     }
1978     if (req.session->username != accountName)
1979     {
1980         // At this point we've determined that the user is trying to
1981         // modify a user that isn't them.  We need to verify that they
1982         // have permissions to modify other users, so re-run the auth
1983         // check with the same permissions, minus ConfigureSelf.
1984         Privileges effectiveUserPrivileges =
1985             redfish::getUserPrivileges(*req.session);
1986         Privileges requiredPermissionsToChangeNonSelf = {"ConfigureUsers",
1987                                                          "ConfigureManager"};
1988         if (!effectiveUserPrivileges.isSupersetOf(
1989                 requiredPermissionsToChangeNonSelf))
1990         {
1991             BMCWEB_LOG_DEBUG << "GET Account denied access";
1992             messages::insufficientPrivilege(asyncResp->res);
1993             return;
1994         }
1995     }
1996 
1997     sdbusplus::message::object_path path("/xyz/openbmc_project/user");
1998     dbus::utility::getManagedObjects(
1999         "xyz.openbmc_project.User.Manager", path,
2000         [asyncResp,
2001          accountName](const boost::system::error_code& ec,
2002                       const dbus::utility::ManagedObjectType& users) {
2003         if (ec)
2004         {
2005             messages::internalError(asyncResp->res);
2006             return;
2007         }
2008         const auto userIt = std::find_if(
2009             users.begin(), users.end(),
2010             [accountName](
2011                 const std::pair<sdbusplus::message::object_path,
2012                                 dbus::utility::DBusInteracesMap>& user) {
2013             return accountName == user.first.filename();
2014             });
2015 
2016         if (userIt == users.end())
2017         {
2018             messages::resourceNotFound(asyncResp->res, "ManagerAccount",
2019                                        accountName);
2020             return;
2021         }
2022 
2023         asyncResp->res.jsonValue["@odata.type"] =
2024             "#ManagerAccount.v1_7_0.ManagerAccount";
2025         asyncResp->res.jsonValue["Name"] = "User Account";
2026         asyncResp->res.jsonValue["Description"] = "User Account";
2027         asyncResp->res.jsonValue["Password"] = nullptr;
2028         asyncResp->res.jsonValue["StrictAccountTypes"] = true;
2029 
2030         for (const auto& interface : userIt->second)
2031         {
2032             if (interface.first == "xyz.openbmc_project.User.Attributes")
2033             {
2034                 for (const auto& property : interface.second)
2035                 {
2036                     if (property.first == "UserEnabled")
2037                     {
2038                         const bool* userEnabled =
2039                             std::get_if<bool>(&property.second);
2040                         if (userEnabled == nullptr)
2041                         {
2042                             BMCWEB_LOG_ERROR << "UserEnabled wasn't a bool";
2043                             messages::internalError(asyncResp->res);
2044                             return;
2045                         }
2046                         asyncResp->res.jsonValue["Enabled"] = *userEnabled;
2047                     }
2048                     else if (property.first == "UserLockedForFailedAttempt")
2049                     {
2050                         const bool* userLocked =
2051                             std::get_if<bool>(&property.second);
2052                         if (userLocked == nullptr)
2053                         {
2054                             BMCWEB_LOG_ERROR << "UserLockedForF"
2055                                                 "ailedAttempt "
2056                                                 "wasn't a bool";
2057                             messages::internalError(asyncResp->res);
2058                             return;
2059                         }
2060                         asyncResp->res.jsonValue["Locked"] = *userLocked;
2061                         asyncResp->res
2062                             .jsonValue["Locked@Redfish.AllowableValues"] = {
2063                             "false"}; // can only unlock accounts
2064                     }
2065                     else if (property.first == "UserPrivilege")
2066                     {
2067                         const std::string* userPrivPtr =
2068                             std::get_if<std::string>(&property.second);
2069                         if (userPrivPtr == nullptr)
2070                         {
2071                             BMCWEB_LOG_ERROR << "UserPrivilege wasn't a "
2072                                                 "string";
2073                             messages::internalError(asyncResp->res);
2074                             return;
2075                         }
2076                         std::string role = getRoleIdFromPrivilege(*userPrivPtr);
2077                         if (role.empty())
2078                         {
2079                             BMCWEB_LOG_ERROR << "Invalid user role";
2080                             messages::internalError(asyncResp->res);
2081                             return;
2082                         }
2083                         asyncResp->res.jsonValue["RoleId"] = role;
2084 
2085                         nlohmann::json& roleEntry =
2086                             asyncResp->res.jsonValue["Links"]["Role"];
2087                         roleEntry["@odata.id"] =
2088                             "/redfish/v1/AccountService/Roles/" + role;
2089                     }
2090                     else if (property.first == "UserPasswordExpired")
2091                     {
2092                         const bool* userPasswordExpired =
2093                             std::get_if<bool>(&property.second);
2094                         if (userPasswordExpired == nullptr)
2095                         {
2096                             BMCWEB_LOG_ERROR
2097                                 << "UserPasswordExpired wasn't a bool";
2098                             messages::internalError(asyncResp->res);
2099                             return;
2100                         }
2101                         asyncResp->res.jsonValue["PasswordChangeRequired"] =
2102                             *userPasswordExpired;
2103                     }
2104                     else if (property.first == "UserGroups")
2105                     {
2106                         const std::vector<std::string>* userGroups =
2107                             std::get_if<std::vector<std::string>>(
2108                                 &property.second);
2109                         if (userGroups == nullptr)
2110                         {
2111                             BMCWEB_LOG_ERROR
2112                                 << "userGroups wasn't a string vector";
2113                             messages::internalError(asyncResp->res);
2114                             return;
2115                         }
2116                         if (!translateUserGroup(*userGroups, asyncResp->res))
2117                         {
2118                             BMCWEB_LOG_ERROR << "userGroups mapping failed";
2119                             messages::internalError(asyncResp->res);
2120                             return;
2121                         }
2122                     }
2123                 }
2124             }
2125         }
2126 
2127         asyncResp->res.jsonValue["@odata.id"] =
2128             "/redfish/v1/AccountService/Accounts/" + accountName;
2129         asyncResp->res.jsonValue["Id"] = accountName;
2130         asyncResp->res.jsonValue["UserName"] = accountName;
2131         });
2132 }
2133 
2134 inline void
2135     handleAccountDelete(App& app, const crow::Request& req,
2136                         const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
2137                         const std::string& username)
2138 {
2139     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
2140     {
2141         return;
2142     }
2143 
2144 #ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
2145     // If authentication is disabled, there are no user accounts
2146     messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
2147     return;
2148 
2149 #endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
2150     sdbusplus::message::object_path tempObjPath(rootUserDbusPath);
2151     tempObjPath /= username;
2152     const std::string userPath(tempObjPath);
2153 
2154     crow::connections::systemBus->async_method_call(
2155         [asyncResp, username](const boost::system::error_code& ec) {
2156         if (ec)
2157         {
2158             messages::resourceNotFound(asyncResp->res, "ManagerAccount",
2159                                        username);
2160             return;
2161         }
2162 
2163         messages::accountRemoved(asyncResp->res);
2164         },
2165         "xyz.openbmc_project.User.Manager", userPath,
2166         "xyz.openbmc_project.Object.Delete", "Delete");
2167 }
2168 
2169 inline void
2170     handleAccountPatch(App& app, const crow::Request& req,
2171                        const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
2172                        const std::string& username)
2173 {
2174     if (!redfish::setUpRedfishRoute(app, req, asyncResp))
2175     {
2176         return;
2177     }
2178 #ifdef BMCWEB_INSECURE_DISABLE_AUTHENTICATION
2179     // If authentication is disabled, there are no user accounts
2180     messages::resourceNotFound(asyncResp->res, "ManagerAccount", username);
2181     return;
2182 
2183 #endif // BMCWEB_INSECURE_DISABLE_AUTHENTICATION
2184     std::optional<std::string> newUserName;
2185     std::optional<std::string> password;
2186     std::optional<bool> enabled;
2187     std::optional<std::string> roleId;
2188     std::optional<bool> locked;
2189     std::optional<std::vector<std::string>> accountTypes;
2190 
2191     bool userSelf = (username == req.session->username);
2192 
2193     if (req.session == nullptr)
2194     {
2195         messages::internalError(asyncResp->res);
2196         return;
2197     }
2198 
2199     Privileges effectiveUserPrivileges =
2200         redfish::getUserPrivileges(*req.session);
2201     Privileges configureUsers = {"ConfigureUsers"};
2202     bool userHasConfigureUsers =
2203         effectiveUserPrivileges.isSupersetOf(configureUsers);
2204     if (userHasConfigureUsers)
2205     {
2206         // Users with ConfigureUsers can modify for all users
2207         if (!json_util::readJsonPatch(
2208                 req, asyncResp->res, "UserName", newUserName, "Password",
2209                 password, "RoleId", roleId, "Enabled", enabled, "Locked",
2210                 locked, "AccountTypes", accountTypes))
2211         {
2212             return;
2213         }
2214     }
2215     else
2216     {
2217         // ConfigureSelf accounts can only modify their own account
2218         if (!userSelf)
2219         {
2220             messages::insufficientPrivilege(asyncResp->res);
2221             return;
2222         }
2223 
2224         // ConfigureSelf accounts can only modify their password
2225         if (!json_util::readJsonPatch(req, asyncResp->res, "Password",
2226                                       password))
2227         {
2228             return;
2229         }
2230     }
2231 
2232     // if user name is not provided in the patch method or if it
2233     // matches the user name in the URI, then we are treating it as
2234     // updating user properties other then username. If username
2235     // provided doesn't match the URI, then we are treating this as
2236     // user rename request.
2237     if (!newUserName || (newUserName.value() == username))
2238     {
2239         updateUserProperties(asyncResp, username, password, enabled, roleId,
2240                              locked, accountTypes, userSelf);
2241         return;
2242     }
2243     crow::connections::systemBus->async_method_call(
2244         [asyncResp, username, password(std::move(password)),
2245          roleId(std::move(roleId)), enabled, newUser{std::string(*newUserName)},
2246          locked, userSelf, accountTypes(std::move(accountTypes))](
2247             const boost::system::error_code& ec, sdbusplus::message_t& m) {
2248         if (ec)
2249         {
2250             userErrorMessageHandler(m.get_error(), asyncResp, newUser,
2251                                     username);
2252             return;
2253         }
2254 
2255         updateUserProperties(asyncResp, newUser, password, enabled, roleId,
2256                              locked, accountTypes, userSelf);
2257         },
2258         "xyz.openbmc_project.User.Manager", "/xyz/openbmc_project/user",
2259         "xyz.openbmc_project.User.Manager", "RenameUser", username,
2260         *newUserName);
2261 }
2262 
2263 inline void requestAccountServiceRoutes(App& app)
2264 {
2265     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
2266         .privileges(redfish::privileges::headAccountService)
2267         .methods(boost::beast::http::verb::head)(
2268             std::bind_front(handleAccountServiceHead, std::ref(app)));
2269 
2270     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
2271         .privileges(redfish::privileges::getAccountService)
2272         .methods(boost::beast::http::verb::get)(
2273             std::bind_front(handleAccountServiceGet, std::ref(app)));
2274 
2275     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/")
2276         .privileges(redfish::privileges::patchAccountService)
2277         .methods(boost::beast::http::verb::patch)(
2278             std::bind_front(handleAccountServicePatch, std::ref(app)));
2279 
2280     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
2281         .privileges(redfish::privileges::headManagerAccountCollection)
2282         .methods(boost::beast::http::verb::head)(
2283             std::bind_front(handleAccountCollectionHead, std::ref(app)));
2284 
2285     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
2286         .privileges(redfish::privileges::getManagerAccountCollection)
2287         .methods(boost::beast::http::verb::get)(
2288             std::bind_front(handleAccountCollectionGet, std::ref(app)));
2289 
2290     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/")
2291         .privileges(redfish::privileges::postManagerAccountCollection)
2292         .methods(boost::beast::http::verb::post)(
2293             std::bind_front(handleAccountCollectionPost, std::ref(app)));
2294 
2295     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
2296         .privileges(redfish::privileges::headManagerAccount)
2297         .methods(boost::beast::http::verb::head)(
2298             std::bind_front(handleAccountHead, std::ref(app)));
2299 
2300     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
2301         .privileges(redfish::privileges::getManagerAccount)
2302         .methods(boost::beast::http::verb::get)(
2303             std::bind_front(handleAccountGet, std::ref(app)));
2304 
2305     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
2306         // TODO this privilege should be using the generated endpoints, but
2307         // because of the special handling of ConfigureSelf, it's not able to
2308         // yet
2309         .privileges({{"ConfigureUsers"}, {"ConfigureSelf"}})
2310         .methods(boost::beast::http::verb::patch)(
2311             std::bind_front(handleAccountPatch, std::ref(app)));
2312 
2313     BMCWEB_ROUTE(app, "/redfish/v1/AccountService/Accounts/<str>/")
2314         .privileges(redfish::privileges::deleteManagerAccount)
2315         .methods(boost::beast::http::verb::delete_)(
2316             std::bind_front(handleAccountDelete, std::ref(app)));
2317 }
2318 
2319 } // namespace redfish
2320