1 /* 2 // Copyright (c) 2018 Intel Corporation 3 // 4 // Licensed under the Apache License, Version 2.0 (the "License"); 5 // you may not use this file except in compliance with the License. 6 // You may obtain a copy of the License at 7 // 8 // http://www.apache.org/licenses/LICENSE-2.0 9 // 10 // Unless required by applicable law or agreed to in writing, software 11 // distributed under the License is distributed on an "AS IS" BASIS, 12 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 // See the License for the specific language governing permissions and 14 // limitations under the License. 15 */ 16 #pragma once 17 #include <sdbusplus/bus.hpp> 18 #include <sdbusplus/server/object.hpp> 19 #include <xyz/openbmc_project/User/Manager/server.hpp> 20 #include <xyz/openbmc_project/User/AccountPolicy/server.hpp> 21 #include <unordered_map> 22 #include <variant> 23 #include "users.hpp" 24 25 namespace phosphor 26 { 27 namespace user 28 { 29 30 using UserMgrIface = sdbusplus::xyz::openbmc_project::User::server::Manager; 31 using UserSSHLists = 32 std::pair<std::vector<std::string>, std::vector<std::string>>; 33 using AccountPolicyIface = 34 sdbusplus::xyz::openbmc_project::User::server::AccountPolicy; 35 36 using Ifaces = 37 sdbusplus::server::object::object<UserMgrIface, AccountPolicyIface>; 38 39 using Privilege = std::string; 40 using GroupList = std::vector<std::string>; 41 using UserEnabled = bool; 42 using PropertyName = std::string; 43 using ServiceEnabled = bool; 44 45 using UserInfo = std::variant<Privilege, GroupList, UserEnabled>; 46 using UserInfoMap = std::map<PropertyName, UserInfo>; 47 48 using DbusUserObjPath = sdbusplus::message::object_path; 49 50 using DbusUserPropVariant = 51 sdbusplus::message::variant<Privilege, ServiceEnabled>; 52 53 using DbusUserObjProperties = 54 std::vector<std::pair<PropertyName, DbusUserPropVariant>>; 55 56 using Interface = std::string; 57 58 using DbusUserObjValue = std::map<Interface, DbusUserObjProperties>; 59 60 using DbusUserObj = std::map<DbusUserObjPath, DbusUserObjValue>; 61 62 /** @class UserMgr 63 * @brief Responsible for managing user accounts over the D-Bus interface. 64 */ 65 class UserMgr : public Ifaces 66 { 67 public: 68 UserMgr() = delete; 69 ~UserMgr() = default; 70 UserMgr(const UserMgr &) = delete; 71 UserMgr &operator=(const UserMgr &) = delete; 72 UserMgr(UserMgr &&) = delete; 73 UserMgr &operator=(UserMgr &&) = delete; 74 75 /** @brief Constructs UserMgr object. 76 * 77 * @param[in] bus - sdbusplus handler 78 * @param[in] path - D-Bus path 79 */ 80 UserMgr(sdbusplus::bus::bus &bus, const char *path); 81 82 /** @brief create user method. 83 * This method creates a new user as requested 84 * 85 * @param[in] userName - Name of the user which has to be created 86 * @param[in] groupNames - Group names list, to which user has to be added. 87 * @param[in] priv - Privilege of the user. 88 * @param[in] enabled - State of the user enabled / disabled. 89 */ 90 void createUser(std::string userName, std::vector<std::string> groupNames, 91 std::string priv, bool enabled) override; 92 93 /** @brief rename user method. 94 * This method renames the user as requested 95 * 96 * @param[in] userName - current name of the user 97 * @param[in] newUserName - new user name to which it has to be renamed. 98 */ 99 void renameUser(std::string userName, std::string newUserName) override; 100 101 /** @brief delete user method. 102 * This method deletes the user as requested 103 * 104 * @param[in] userName - Name of the user which has to be deleted 105 */ 106 void deleteUser(std::string userName); 107 108 /** @brief Update user groups & privilege. 109 * This method updates user groups & privilege 110 * 111 * @param[in] userName - user name, for which update is requested 112 * @param[in] groupName - Group to be updated.. 113 * @param[in] priv - Privilege to be updated. 114 */ 115 void updateGroupsAndPriv(const std::string &userName, 116 const std::vector<std::string> &groups, 117 const std::string &priv); 118 119 /** @brief Update user enabled state. 120 * This method enables / disables user 121 * 122 * @param[in] userName - user name, for which update is requested 123 * @param[in] enabled - enable / disable the user 124 */ 125 void userEnable(const std::string &userName, bool enabled); 126 127 /** @brief update minimum password length requirement 128 * 129 * @param[in] val - minimum password length 130 * @return - minimum password length 131 */ 132 uint8_t minPasswordLength(uint8_t val) override; 133 134 /** @brief update old password history count 135 * 136 * @param[in] val - number of times old passwords has to be avoided 137 * @return - number of times old password has to be avoided 138 */ 139 uint8_t rememberOldPasswordTimes(uint8_t val) override; 140 141 /** @brief update maximum number of failed login attempt before locked 142 * out. 143 * 144 * @param[in] val - number of allowed attempt 145 * @return - number of allowed attempt 146 */ 147 uint16_t maxLoginAttemptBeforeLockout(uint16_t val) override; 148 149 /** @brief update timeout to unlock the account 150 * 151 * @param[in] val - value in seconds 152 * @return - value in seconds 153 */ 154 uint32_t accountUnlockTimeout(uint32_t val) override; 155 156 /** @brief lists user locked state for failed attempt 157 * 158 * @param[in] - user name 159 * @return - true / false indicating user locked / un-locked 160 **/ 161 virtual bool userLockedForFailedAttempt(const std::string &userName); 162 163 /** @brief lists user locked state for failed attempt 164 * 165 * @param[in]: user name 166 * @param[in]: value - false -unlock user account, true - no action taken 167 **/ 168 bool userLockedForFailedAttempt(const std::string &userName, 169 const bool &value); 170 171 /** @brief returns user info 172 * Checks if user is local user, then returns map of properties of user. 173 * like user privilege, list of user groups, user enabled state and user 174 * locked state. If its not local user, then it checks if its a ldap user, 175 * then it gets the privilege mapping of the LDAP group. 176 * 177 * @param[in] - user name 178 * @return - map of user properties 179 **/ 180 UserInfoMap getUserInfo(std::string userName) override; 181 182 private: 183 /** @brief sdbusplus handler */ 184 sdbusplus::bus::bus &bus; 185 186 /** @brief object path */ 187 const std::string path; 188 189 /** @brief privilege manager container */ 190 std::vector<std::string> privMgr = {"priv-admin", "priv-operator", 191 "priv-user", "priv-callback", 192 "priv-noaccess"}; 193 194 /** @brief groups manager container */ 195 std::vector<std::string> groupsMgr = {"web", "redfish", "ipmi", "ssh"}; 196 197 /** @brief map container to hold users object */ 198 using UserName = std::string; 199 std::unordered_map<UserName, std::unique_ptr<phosphor::user::Users>> 200 usersList; 201 202 /** @brief get users in group 203 * method to get group user list 204 * 205 * @param[in] groupName - group name 206 * 207 * @return userList - list of users in the group. 208 */ 209 std::vector<std::string> getUsersInGroup(const std::string &groupName); 210 211 /** @brief get user & SSH users list 212 * method to get the users and ssh users list. 213 * 214 *@return - vector of User & SSH user lists 215 */ 216 UserSSHLists getUserAndSshGrpList(void); 217 218 /** @brief check for user presence 219 * method to check for user existence 220 * 221 * @param[in] userName - name of the user 222 * @return -true if user exists and false if not. 223 */ 224 bool isUserExist(const std::string &userName); 225 226 /** @brief check user exists 227 * method to check whether user exist, and throw if not. 228 * 229 * @param[in] userName - name of the user 230 */ 231 void throwForUserDoesNotExist(const std::string &userName); 232 233 /** @brief check user does not exist 234 * method to check whether does not exist, and throw if exists. 235 * 236 * @param[in] userName - name of the user 237 */ 238 void throwForUserExists(const std::string &userName); 239 240 /** @brief check user name constraints 241 * method to check user name constraints and throw if failed. 242 * 243 * @param[in] userName - name of the user 244 * @param[in] groupNames - user groups 245 */ 246 void 247 throwForUserNameConstraints(const std::string &userName, 248 const std::vector<std::string> &groupNames); 249 250 /** @brief check group user count 251 * method to check max group user count, and throw if limit reached 252 * 253 * @param[in] groupNames - group name 254 */ 255 void throwForMaxGrpUserCount(const std::vector<std::string> &groupNames); 256 257 /** @brief check for valid privielge 258 * method to check valid privilege, and throw if invalid 259 * 260 * @param[in] priv - privilege of the user 261 */ 262 void throwForInvalidPrivilege(const std::string &priv); 263 264 /** @brief check for valid groups 265 * method to check valid groups, and throw if invalid 266 * 267 * @param[in] groupNames - user groups 268 */ 269 void throwForInvalidGroups(const std::vector<std::string> &groupName); 270 271 /** @brief get user enabled state 272 * method to get user enabled state. 273 * 274 * @param[in] userName - name of the user 275 * @return - user enabled status (true/false) 276 */ 277 bool isUserEnabled(const std::string &userName); 278 279 /** @brief initialize the user manager objects 280 * method to initialize the user manager objects accordingly 281 * 282 */ 283 void initUserObjects(void); 284 285 /** @brief get IPMI user count 286 * method to get IPMI user count 287 * 288 * @return - returns user count 289 */ 290 size_t getIpmiUsersCount(void); 291 292 /** @brief get pam argument value 293 * method to get argument value from pam configuration 294 * 295 * @param[in] moduleName - name of the module from where arg has to be read 296 * @param[in] argName - argument name 297 * @param[out] argValue - argument value 298 * 299 * @return 0 - success state of the function 300 */ 301 int getPamModuleArgValue(const std::string &moduleName, 302 const std::string &argName, std::string &argValue); 303 304 /** @brief set pam argument value 305 * method to set argument value in pam configuration 306 * 307 * @param[in] moduleName - name of the module in which argument value has 308 * to be set 309 * @param[in] argName - argument name 310 * @param[out] argValue - argument value 311 * 312 * @return 0 - success state of the function 313 */ 314 int setPamModuleArgValue(const std::string &moduleName, 315 const std::string &argName, 316 const std::string &argValue); 317 318 /** @brief get service name 319 * method to get dbus service name 320 * 321 * @param[in] path - object path 322 * @param[in] intf - interface 323 * @return - service name 324 */ 325 std::string getServiceName(std::string &&path, std::string &&intf); 326 327 protected: 328 /** @brief get LDAP group name 329 * method to get LDAP group name for the given LDAP user 330 * 331 * @param[in] - userName 332 * @return - group name 333 */ 334 virtual std::string getLdapGroupName(const std::string &userName); 335 336 /** @brief get privilege mapper object 337 * method to get dbus privilege mapper object 338 * 339 * @return - map of user object 340 */ 341 virtual DbusUserObj getPrivilegeMapperObject(void); 342 343 friend class TestUserMgr; 344 }; 345 346 } // namespace user 347 } // namespace phosphor 348