1 /* 2 // Copyright (c) 2018 Intel Corporation 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 */ 16 #pragma once 17 18 #include "error_messages.hpp" 19 #include "node.hpp" 20 #include "persistent_data.hpp" 21 22 namespace redfish 23 { 24 25 class SessionCollection; 26 27 class Sessions : public Node 28 { 29 public: 30 Sessions(App& app) : 31 Node(app, "/redfish/v1/SessionService/Sessions/<str>/", std::string()) 32 { 33 entityPrivileges = { 34 {boost::beast::http::verb::get, {{"Login"}}}, 35 {boost::beast::http::verb::head, {{"Login"}}}, 36 {boost::beast::http::verb::patch, {{"ConfigureManager"}}}, 37 {boost::beast::http::verb::put, {{"ConfigureManager"}}}, 38 {boost::beast::http::verb::delete_, 39 {{"ConfigureManager"}, {"ConfigureSelf"}}}, 40 {boost::beast::http::verb::post, {{"ConfigureManager"}}}}; 41 } 42 43 private: 44 void doGet(crow::Response& res, const crow::Request&, 45 const std::vector<std::string>& params) override 46 { 47 // Note that control also reaches here via doPost and doDelete. 48 auto session = 49 persistent_data::SessionStore::getInstance().getSessionByUid( 50 params[0]); 51 52 if (session == nullptr) 53 { 54 messages::resourceNotFound(res, "Session", params[0]); 55 res.end(); 56 return; 57 } 58 59 res.jsonValue["Id"] = session->uniqueId; 60 res.jsonValue["UserName"] = session->username; 61 res.jsonValue["@odata.id"] = 62 "/redfish/v1/SessionService/Sessions/" + session->uniqueId; 63 res.jsonValue["@odata.type"] = "#Session.v1_0_2.Session"; 64 res.jsonValue["Name"] = "User Session"; 65 res.jsonValue["Description"] = "Manager User Session"; 66 res.jsonValue["Oem"]["OpenBMC"]["@odata.type"] = 67 "#OemSession.v1_0_0.Session"; 68 #ifdef BMCWEB_ENABLE_IBM_MANAGEMENT_CONSOLE 69 res.jsonValue["Oem"]["OpenBMC"]["ClientID"] = session->clientId; 70 #endif 71 res.jsonValue["Oem"]["OpenBMC"]["ClientOriginIP"] = session->clientIp; 72 res.end(); 73 } 74 75 void doDelete(crow::Response& res, const crow::Request& req, 76 const std::vector<std::string>& params) override 77 { 78 // Need only 1 param which should be id of session to be deleted 79 if (params.size() != 1) 80 { 81 // This should be handled by crow and never happen 82 BMCWEB_LOG_ERROR << "Session DELETE has been called with invalid " 83 "number of params"; 84 85 messages::generalError(res); 86 res.end(); 87 return; 88 } 89 90 auto session = 91 persistent_data::SessionStore::getInstance().getSessionByUid( 92 params[0]); 93 94 if (session == nullptr) 95 { 96 messages::resourceNotFound(res, "Session", params[0]); 97 res.end(); 98 return; 99 } 100 101 // Perform a proper ConfigureSelf authority check. If a 102 // session is being used to DELETE some other user's session, 103 // then the ConfigureSelf privilege does not apply. In that 104 // case, perform the authority check again without the user's 105 // ConfigureSelf privilege. 106 if (session->username != req.session->username) 107 { 108 if (!isAllowedWithoutConfigureSelf(req)) 109 { 110 BMCWEB_LOG_WARNING << "DELETE Session denied access"; 111 messages::insufficientPrivilege(res); 112 res.end(); 113 return; 114 } 115 } 116 117 // DELETE should return representation of object that will be removed 118 doGet(res, req, params); 119 120 persistent_data::SessionStore::getInstance().removeSession(session); 121 } 122 123 /** 124 * This allows SessionCollection to reuse this class' doGet method, to 125 * maintain consistency of returned data, as Collection's doPost should 126 * return data for created member which should match member's doGet 127 * result in 100% 128 */ 129 friend SessionCollection; 130 }; 131 132 class SessionCollection : public Node 133 { 134 public: 135 SessionCollection(App& app) : 136 Node(app, "/redfish/v1/SessionService/Sessions/"), memberSession(app) 137 { 138 entityPrivileges = { 139 {boost::beast::http::verb::get, {{"Login"}}}, 140 {boost::beast::http::verb::head, {{"Login"}}}, 141 {boost::beast::http::verb::patch, {{"ConfigureManager"}}}, 142 {boost::beast::http::verb::put, {{"ConfigureManager"}}}, 143 {boost::beast::http::verb::delete_, {{"ConfigureManager"}}}, 144 {boost::beast::http::verb::post, {}}}; 145 } 146 147 private: 148 void doGet(crow::Response& res, const crow::Request&, 149 const std::vector<std::string>&) override 150 { 151 std::vector<const std::string*> sessionIds = 152 persistent_data::SessionStore::getInstance().getUniqueIds( 153 false, persistent_data::PersistenceType::TIMEOUT); 154 155 res.jsonValue["Members@odata.count"] = sessionIds.size(); 156 res.jsonValue["Members"] = nlohmann::json::array(); 157 for (const std::string* uid : sessionIds) 158 { 159 res.jsonValue["Members"].push_back( 160 {{"@odata.id", "/redfish/v1/SessionService/Sessions/" + *uid}}); 161 } 162 res.jsonValue["Members@odata.count"] = sessionIds.size(); 163 res.jsonValue["@odata.type"] = "#SessionCollection.SessionCollection"; 164 res.jsonValue["@odata.id"] = "/redfish/v1/SessionService/Sessions/"; 165 res.jsonValue["Name"] = "Session Collection"; 166 res.jsonValue["Description"] = "Session Collection"; 167 res.end(); 168 } 169 170 void doPost(crow::Response& res, const crow::Request& req, 171 const std::vector<std::string>&) override 172 { 173 std::string username; 174 std::string password; 175 std::optional<nlohmann::json> oemObject; 176 std::string clientId; 177 std::string clientIp; 178 if (!json_util::readJson(req, res, "UserName", username, "Password", 179 password, "Oem", oemObject)) 180 { 181 res.end(); 182 return; 183 } 184 185 if (password.empty() || username.empty() || 186 res.result() != boost::beast::http::status::ok) 187 { 188 if (username.empty()) 189 { 190 messages::propertyMissing(res, "UserName"); 191 } 192 193 if (password.empty()) 194 { 195 messages::propertyMissing(res, "Password"); 196 } 197 res.end(); 198 199 return; 200 } 201 202 int pamrc = pamAuthenticateUser(username, password); 203 bool isConfigureSelfOnly = pamrc == PAM_NEW_AUTHTOK_REQD; 204 if ((pamrc != PAM_SUCCESS) && !isConfigureSelfOnly) 205 { 206 messages::resourceAtUriUnauthorized(res, std::string(req.url), 207 "Invalid username or password"); 208 res.end(); 209 210 return; 211 } 212 #ifdef BMCWEB_ENABLE_IBM_MANAGEMENT_CONSOLE 213 if (oemObject) 214 { 215 std::optional<nlohmann::json> bmcOem; 216 if (!json_util::readJson(*oemObject, res, "OpenBMC", bmcOem)) 217 { 218 res.end(); 219 return; 220 } 221 if (!json_util::readJson(*bmcOem, res, "ClientID", clientId)) 222 { 223 BMCWEB_LOG_ERROR << "Could not read ClientId"; 224 res.end(); 225 return; 226 } 227 } 228 #endif 229 230 // User is authenticated - create session 231 std::shared_ptr<persistent_data::UserSession> session = 232 persistent_data::SessionStore::getInstance().generateUserSession( 233 username, persistent_data::PersistenceType::TIMEOUT, 234 isConfigureSelfOnly, clientId, clientIp); 235 res.addHeader("X-Auth-Token", session->sessionToken); 236 res.addHeader("Location", "/redfish/v1/SessionService/Sessions/" + 237 session->uniqueId); 238 res.result(boost::beast::http::status::created); 239 if (session->isConfigureSelfOnly) 240 { 241 messages::passwordChangeRequired( 242 res, 243 "/redfish/v1/AccountService/Accounts/" + session->username); 244 } 245 memberSession.doGet(res, req, {session->uniqueId}); 246 } 247 248 /** 249 * Member session to ensure consistency between collection's doPost and 250 * member's doGet, as they should return 100% matching data 251 */ 252 Sessions memberSession; 253 }; 254 255 class SessionService : public Node 256 { 257 public: 258 SessionService(App& app) : Node(app, "/redfish/v1/SessionService/") 259 { 260 261 entityPrivileges = { 262 {boost::beast::http::verb::get, {{"Login"}}}, 263 {boost::beast::http::verb::head, {{"Login"}}}, 264 {boost::beast::http::verb::patch, {{"ConfigureManager"}}}, 265 {boost::beast::http::verb::put, {{"ConfigureManager"}}}, 266 {boost::beast::http::verb::delete_, {{"ConfigureManager"}}}, 267 {boost::beast::http::verb::post, {{"ConfigureManager"}}}}; 268 } 269 270 private: 271 void doGet(crow::Response& res, const crow::Request&, 272 const std::vector<std::string>&) override 273 { 274 res.jsonValue["@odata.type"] = "#SessionService.v1_0_2.SessionService"; 275 res.jsonValue["@odata.id"] = "/redfish/v1/SessionService/"; 276 res.jsonValue["Name"] = "Session Service"; 277 res.jsonValue["Id"] = "SessionService"; 278 res.jsonValue["Description"] = "Session Service"; 279 res.jsonValue["SessionTimeout"] = 280 persistent_data::SessionStore::getInstance().getTimeoutInSeconds(); 281 res.jsonValue["ServiceEnabled"] = true; 282 283 res.jsonValue["Sessions"] = { 284 {"@odata.id", "/redfish/v1/SessionService/Sessions"}}; 285 286 res.end(); 287 } 288 }; 289 290 } // namespace redfish 291