summaryrefslogtreecommitdiffstats
path: root/include/persistent_data_middleware.hpp
Commit message (Collapse)AuthorAgeFilesLines
* Auth methods configurationZbigniew Kurzynski2019-11-071-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | Added Oem extension for AccountService allowing user to configure which authentication methods should be enabled. User is now able to turn on and off authentication methods like BasicAuth, XToken, etc. User is not allowed to turn off all of the methods at once - at least one method has to be active to prevent lock-out. This configuration is persistent, will be saved on file-system and will be loaded on bmcweb's restart. Tested: No regression found in manual testing. By default everything works as before, and disabling auth method prevents user to authenticate by it. Tested that user is not allowed to disable all the methods - either in one PATCH or by disabling them one at a time. ServiceValidator run with success. This change is a fix for this request: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/23590/18 which was revert here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/26869 Signed-off-by: Zbigniew Kurzynski <zbigniew.kurzynski@intel.com> Change-Id: I66b5ad423746f1992070a14f2983a07b1320190e
* Revert "Auth methods configuration"James Feist2019-11-041-7/+0
| | | | | | | | | This reverts commit 0ff64dc2cd3a15b4204a477ad2eb5219d66e6110. Reason for revert: <breaks redfish validator, <edmx:Reference Uri="/redfish/v1/schema/OemAccountService_v1.xml"> but the file name unversioned static/redfish/v1/schema/OemAccountService.xml> Change-Id: I696dd09bf519e364f5f529a674e047a8eeead578 Signed-off-by: James Feist <james.feist@linux.intel.com>
* Auth methods configurationKowalski, Kamil2019-10-311-0/+7
| | | | | | | | | | | | | | | | | | | | | Added Oem extension for AccountService allowing user to configure which authentication methods should be enabled. User is now able to turn on and off authentication methods like BasicAuth, XToken, etc. User is not allowed to turn off all of the methods at once - at least one method has to be active to prevent lock-out. This configuration is persistent, will be saved on file-system and will be loaded on bmcweb's restart. Tested: No regression found in manual testing. By default everything works as before, and disabling auth method prevents user to authenticate by it. Tested that user is not allowed to disable all the methods - either in one PATCH or by disabling them one at a time. ServiceValidator run with success. Change-Id: I3a775d783ac05998d17b8e91800962bffd8cab52 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com> Signed-off-by: Zbigniew Kurzynski <zbigniew.kurzynski@intel.com>
* Make references to crow less obviousEd Tanous2019-10-181-3/+3
| | | | | | | | | | | | | | | | | Recently, a number of people in the community have made the (admittedly easy) mistake that we use a significant portion of crow. Today, we use crow for the router, and the "app" structure, and even those have been significantly modified to meet the bmc needs. All other components have been replaced with Boost beast. This commit removes the crow mentions from the Readme, and moves the crow folder to "http" to camouflage it a little. No code content has changed. Tested: Code compiles. No functional change made to any executable code. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: Iceb57b26306cc8bdcfc77f3874246338864fd118
* Fix a bunch of warningsEd Tanous2019-10-101-2/+2
| | | | | | | | | | | | | | | using the list of warnings from here: https://github.com/lefticus/cppbestpractices/blob/e73393f25a85f83fed7399d8b65cb117d00b2231/02-Use_the_Tools_Available.md#L100 Seems like a good place to start, and would improve things a bit type-wise. This patchset attempts to correct all the issues in one shot. Tested: It builds. Will test various subsystems that have been touched Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I588c26440e5a97f718a0f0ea74cc84107d53aa1e
* Change the permission of the session databaseRatan Gupta2019-08-021-2/+12
| | | | | | | | | | | | | | | | | | | | | | bmcweb_persistent_data.json have all the session info, any user having less privilege can get access to this file which is having sensitive data(user authentication token) This commit fixes this bug by allowing the read write permission to the owner and group and others would not be having either read or write permission. TestedBy: -> Create the redfish session -> check the permission of the file. -> Stop the bmcweb and remove the session file restart the bmcweb and check the permission of the file. -> Create the session again and perfrom the GET request on Manager,AccountService to verify the other operation is working. Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com> Change-Id: I1e69ac147a2cfc3dff150322aee1f430ac552a5a
* Revert "bmcweb: Fix a bunch of warnings"Ed Tanous2019-03-251-2/+2
| | | | | | | | This reverts commit 6ea007a2faec52ad62680015d2a3f00371a1e351. Reason for revert: Reports of bmcweb seg faults. Change-Id: I408f1bb29c2f8e427a6621cdaac8c31b847ebf06
* bmcweb: Fix a bunch of warningsEd Tanous2019-03-221-2/+2
| | | | | | | | | | | | bmcweb classically has not taken a strong opinion on warnings. With this commit, that policy is changing, and bmcweb will invoke the best warnings we are able to enable, and turn on -Werror for all builds. This is intended to reduce the likelihood of hard-to-debug situations that the compiler coulve caught early on. Change-Id: I57474410821e82666b3a108cfd0db7d070e8900a Signed-off-by: Ed Tanous <ed@tanous.net>
* Move to clang-format-6.0Ed Tanous2018-09-051-95/+139
| | | | | | | | This commit moves the codebase to the lastest clang-format file from upstream, as well as clang-format-6.0. Change-Id: Ice8313468097c0c42317fbb9e10ddf036e8cff4c Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix merge conflictEd Tanous2018-08-091-6/+5
| | | | | | | | | Got a couple patches that collided in air, and now builds are broken. This resolves the collision by moving the new patches forward to the latest #defines Change-Id: I1fe35d17a68c61ad90752ae73000e2579131bf5d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move over to upstream c++ styleEd Tanous2018-07-261-40/+40
| | | | | | | | | | | | | | | | | | This patchset moves bmcweb over to the upstream style naming conventions for variables, classes, and functions, as well as imposes the latest clang-format file. This changeset was mostly built automatically by the included .clang-tidy file, which has the ability to autoformat and auto rename variables. At some point in the future I would like to see this in greater use, but for now, we will impose it on bmcweb, and see how it goes. Tested: Code still compiles, and appears to run, although other issues are possible and likely. Change-Id: If422a2e36df924e897736b3feffa89f411d9dac1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Refactor session storageEd Tanous2018-07-261-31/+42
| | | | | | | | | | Session storage had a few bugs, and a number of old practices. This moves the session storage closer to the best practices. It enforces the use of a factory function for generating new sessions, as well as using get_ptr when reading the sessions out. Change-Id: Ia252076f21e47b99f8057190349355838fdd787d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make SessionStore a proper singletonBorawski.Lukasz2018-07-251-7/+8
| | | | | | | | | | | | | | | - SessionStore class now has a proper singleton structure - session_storage_singleton.hpp is removed - from_json(..) function for SessionStore is changed to a specialized template - minor cosmetic fixes added - Move the template class usages of Crow App over to a non-template parameter Change-Id: Ic9effd5b7bac089a84c80a0caa97bd46d4984416 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Boost beastEd Tanous2018-06-291-4/+4
| | | | | | | | This commit is the beginings of attempting to transition away from crow, and toward boost::beast. Unit tests are passing, and implementation appears to be slightly faster than crow. Change-Id: Ic8d946dc7a04f514c67b1098f181eee1ced69171
* Reimplement presistent data loading in no-throw wayKowalski, Kamil2018-03-061-4/+30
| | | | | | | | | | | Reimplemented persistent data file loading in no-throw approach to avoid errors during startup when bmcweb_persistent_data.json has been corrupted. Additionally this will allow to turn off all exceptions in the project (removed try-catch). Change-Id: I9bf863ebfd7ce9125d1e7e948f7ac739db94e009 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Session and SessionCollectionKowalski, Kamil2018-02-051-166/+7
| | | | | | | | | | | New Redfish-Core nodes added (removed from redfish_v1.hpp) - Session and SessionCollection. Tested manually on x86 VM and Wolfpass Platform. Behavior almost identical to what was before - differences: - SessionCollection - now only returns TIMEOUT presistence sessions, not SINGLE - Aquiring sessions from session storage now applies timeouts Change-Id: I68bf4fa7fa1c8371216a7d4daa30bbfb653cfa72 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com>
* Middleware prepared for Redfish integrationBorawski.Lukasz2018-01-171-8/+23
| | | | | | | | | | | | | | | | | This is adapted from Lukasz patchset, and fixes minor errors in how basic authentication was processed. Tested by: 1. Logging into the webui, and ensuring that cookie auth completes (by looking at the chrome debugger) 2. Checked that basic auth works by accessing the redfish accounts schema using the following command: wget -d https://localhost:18080/redfish/v1/SessionService/Sessions/ --user=root --password=<password> --no-check-certificate Change-Id: I21920a56c52288a74a2b7d587b7c2d7eeeae8d6f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix include statementBorawski.Lukasz2018-01-171-2/+1
| | | | | Change-Id: Icb92e9df233ebd5a47e458b071bad9e00248a317 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com>
* Fix merge error introduced with base64.hpp deletionEd Tanous2018-01-121-2/+2
| | | | Change-Id: If1e194009cec31c593e4a0f89c875a3e3bd84110
* Refactor session key storageEd Tanous2017-10-271-45/+131
| | | | | | | | | Refactor session key storage to actually have an interface that isn't map, and provide reasonable lookup functions, as well as update the consumers of those functions. This also implements session timeouts. Change-Id: Ica46716805782cfbb7c4ee5569bc7e468c260bc3
* Update WebserverEd Tanous2017-10-241-0/+143
Upate get_routes to use the correct constness for its use case crow to set json_mode if json value is populated Delete std::array bytes API due to major efficiency issues. To be replaced with span API in near future Implement a catch block for handlers that can throw exceptions Implement direct handling of routes that end with / to better support redfish. /foo and /foo/ now invoke the same handler insead of issuing a 301 redirect Update nlohmann to latest version Implement one nlohmann endpoint with exceptions disabled Implement first pass at a IBM style rest-dbus interface Fix pam authentication to call dropbear auth methods Implements first pass at redfish interface. Shemas avaialble pass redfish validation 100% Use response json object rather than request json object. Update authorization middleware to be redfish compliant UPdate random token generation to be more efficient, and not base64 bytes, generate bytes directly Change-Id: I63cc2005c1a21f5c2f5168777a4e09f3c965a34f
OpenPOWER on IntegriCloud