summaryrefslogtreecommitdiffstats
path: root/include/token_authorization_middleware.hpp
Commit message (Collapse)AuthorAgeFilesLines
* Remove IBM specific variable nameEd Tanous2020-02-031-5/+7
| | | | | | | | | | | | Considering that the webui is no longer an "IBM" specific entity, and is now the standard for the project, there's no need for this variable to call it out explicitly. Update comment and variable name to be more correct. Tested: No functional change, only comments. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I2169876c38ccd558a3cfcfc61637720bd290b3ee
* Enhance return value from pamAuthenticateUserJoseph Reynolds2020-01-301-2/+2
| | | | | | | | | | | | | | | | This enhances the return value from the pamAuthenticateUser function so callers can articulate PAM error codes like PAM_NEW_AUTHTOK_REQD which means the credentials are correct, but the password must be changed. Tested: Yes, scenarios via both Redfish login and Basic Auth: - correct username and password, password is not expired - correct username and password, password is expired - correct username and incorrect password, password is not expired - correct username and incorrect password, password is expired - non-existent user (passsword is not relevant) Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net> Change-Id: I1114d6c9cc591fb0a1853cb4edea32ad22f7b015
* Remove unused wildcard capturesEd Tanous2019-11-191-2/+2
| | | | | | | | | | | | | Considering that wild card captures are now known to be difficult to maintain, remove a couple instances of them from app. They are no longer used as a capture, so can be safely removed with no effect. It's likely the compiler is doing this already. Tested: No functional change. Code compiles. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I252344a4608f7e107bcb273d725b5a484eb7a17d
* Implement constant time string compare for tokenEd Tanous2019-11-181-1/+7
| | | | | | | | | | | | | | | | | The sessions implementation previously used operator== for session comparisons. While unlikely to be attackable in the current implementation, due to the time smearing in a number of cases, modern security practices recommend using constant time comparison. Tested By: Logged into the webui, and observed no change to login flows. Logged into redfish using Token Auth, and observed no changes. Closed a previous session, then reopened with the new session information to verify user sessions are restored properly and still work. Change-Id: Ie759e4da67ba004fd8c327f177951ac756ea6799 Signed-off-by: Ed Tanous <ed.tanous@intel.com> Signed-off-by: James Feist <james.feist@linux.intel.com>
* Auth methods configurationZbigniew Kurzynski2019-11-071-4/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | Added Oem extension for AccountService allowing user to configure which authentication methods should be enabled. User is now able to turn on and off authentication methods like BasicAuth, XToken, etc. User is not allowed to turn off all of the methods at once - at least one method has to be active to prevent lock-out. This configuration is persistent, will be saved on file-system and will be loaded on bmcweb's restart. Tested: No regression found in manual testing. By default everything works as before, and disabling auth method prevents user to authenticate by it. Tested that user is not allowed to disable all the methods - either in one PATCH or by disabling them one at a time. ServiceValidator run with success. This change is a fix for this request: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/23590/18 which was revert here: https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/26869 Signed-off-by: Zbigniew Kurzynski <zbigniew.kurzynski@intel.com> Change-Id: I66b5ad423746f1992070a14f2983a07b1320190e
* Revert "Auth methods configuration"James Feist2019-11-041-13/+4
| | | | | | | | | This reverts commit 0ff64dc2cd3a15b4204a477ad2eb5219d66e6110. Reason for revert: <breaks redfish validator, <edmx:Reference Uri="/redfish/v1/schema/OemAccountService_v1.xml"> but the file name unversioned static/redfish/v1/schema/OemAccountService.xml> Change-Id: I696dd09bf519e364f5f529a674e047a8eeead578 Signed-off-by: James Feist <james.feist@linux.intel.com>
* Auth methods configurationKowalski, Kamil2019-10-311-4/+13
| | | | | | | | | | | | | | | | | | | | | Added Oem extension for AccountService allowing user to configure which authentication methods should be enabled. User is now able to turn on and off authentication methods like BasicAuth, XToken, etc. User is not allowed to turn off all of the methods at once - at least one method has to be active to prevent lock-out. This configuration is persistent, will be saved on file-system and will be loaded on bmcweb's restart. Tested: No regression found in manual testing. By default everything works as before, and disabling auth method prevents user to authenticate by it. Tested that user is not allowed to disable all the methods - either in one PATCH or by disabling them one at a time. ServiceValidator run with success. Change-Id: I3a775d783ac05998d17b8e91800962bffd8cab52 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com> Signed-off-by: Zbigniew Kurzynski <zbigniew.kurzynski@intel.com>
* Make references to crow less obviousEd Tanous2019-10-181-4/+4
| | | | | | | | | | | | | | | | | Recently, a number of people in the community have made the (admittedly easy) mistake that we use a significant portion of crow. Today, we use crow for the router, and the "app" structure, and even those have been significantly modified to meet the bmc needs. All other components have been replaced with Boost beast. This commit removes the crow mentions from the Readme, and moves the crow folder to "http" to camouflage it a little. No code content has changed. Tested: Code compiles. No functional change made to any executable code. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: Iceb57b26306cc8bdcfc77f3874246338864fd118
* Ignore charset for /login attemptsEd Tanous2019-08-021-1/+3
| | | | | | | | | | | bmcweb fails when attempting to login with a Content header of application/json; charset=utf8. This is because of an exact string compare. This commit changes the check to only check the begining of the string, and adds some logging to make it more clear when we hit this in the future. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Change-Id: I972a80c174a18295205340271b781c9d6693ee17
* Redfish(Authorization): Map the user role with the Redfish privilegesRatan Gupta2019-07-111-28/+25
| | | | | | | | | This commit gets the role of the user from the session object and map it with the redfish privileges and then allow/reject the asked operation depending on the userprivileges and the entity privileges. Change-Id: I40be06c28e80b47fe76891cacf863f8495bace88 Signed-off-by: Ratan Gupta <ratagupt@linux.vnet.ibm.com>
* bmcweb: Add JSON response to /logoutAnthony Wilson2019-03-181-0/+5
| | | | | | | | | | | | | | | | | | | | | | | When logging out of the API, there was no JSON text response. This implements the requested feature. Tested: Verified appropriate response is generated when /logout is called E.g. curl -c cjar -b cjar -k -X POST \ -H "Content-Type: application/json" \ -H "X-Auth-Token: g3Heq5rYsz1j0iv4MbUp" \ -d '{"data": [ ] }' \ https://${bmc}/logout { "data": "User 'root' logged out", "message": "200 OK", "status": "ok" } Change-Id: I905f5a0855abaa76ae57cf32b8bae758722f6b9f Signed-off-by: Anthony Wilson <wilsonan@us.ibm.com>
* bmcweb: /s/boost::string_view/std::string_view/gEd Tanous2019-03-061-12/+12
| | | | | | | | | | | | | | | | | | | | | | | With boost 1.69, we get the new option, BOOST_BEAST_USE_STD_STRING_VIEW which allows us to use std::string for all beast interfaces, instead of boost string_view. This was originally intended to try to reduce the binary size, but the comparison shows only a minor improvement. boost::string_view: 7420780 bytes std::string_view: 7419948 bytes 832 bytes saved ! ! ! ! ! So instead, we will use the argument that it's more standard and easier for people to grok. Tested By: Pulled down some bmcweb endpoints, and observed no change. Because the two objects are essentially drop in replacements for one another, there should be no change. Change-Id: I001e8cf2a0124de4792a7154bf246e3c35ef3f97 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* bmcweb: support next= url for forwarding loginEd Tanous2018-12-191-1/+2
| | | | | | | | | | Related to patchset here. This patchset implements the bmc side of redirecting the users URL after login correctly. https://gerrit.openbmc-project.xyz/#/c/openbmc/phosphor-webui/+/15925 Change-Id: Idf42f4cecd29fb0c6088721eb5e10fb39e1168e7 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move to clang-format-6.0Ed Tanous2018-09-051-311/+400
| | | | | | | | This commit moves the codebase to the lastest clang-format file from upstream, as well as clang-format-6.0. Change-Id: Ice8313468097c0c42317fbb9e10ddf036e8cff4c Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Update whitelistEd Tanous2018-08-151-1/+3
| | | | | | | | | As part of the redfish spec, both /redfish and /redfish/v1/odata need to be allowed without credentials. This adds them to the whitelist, and improves our compliance with the specification. Change-Id: I89d7c20ed497b77cdea83560087c9085747872bf Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Move over to upstream c++ styleEd Tanous2018-07-261-132/+127
| | | | | | | | | | | | | | | | | | This patchset moves bmcweb over to the upstream style naming conventions for variables, classes, and functions, as well as imposes the latest clang-format file. This changeset was mostly built automatically by the included .clang-tidy file, which has the ability to autoformat and auto rename variables. At some point in the future I would like to see this in greater use, but for now, we will impose it on bmcweb, and see how it goes. Tested: Code still compiles, and appears to run, although other issues are possible and likely. Change-Id: If422a2e36df924e897736b3feffa89f411d9dac1 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make SessionStore a proper singletonBorawski.Lukasz2018-07-251-19/+23
| | | | | | | | | | | | | | | - SessionStore class now has a proper singleton structure - session_storage_singleton.hpp is removed - from_json(..) function for SessionStore is changed to a specialized template - minor cosmetic fixes added - Move the template class usages of Crow App over to a non-template parameter Change-Id: Ic9effd5b7bac089a84c80a0caa97bd46d4984416 Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Implement feature selection in bmcwebEd Tanous2018-06-291-1/+2
| | | | | | | | | This patchsets implements feature selection in BMCWEB using compile time macros. This allows certain features, security implementations, and other things to be selected at compile time. Change-Id: Ic14343d36d82830e6cf51311ca886a90749ae6a7 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix issue with basic auth and the bmcwebEd Tanous2018-06-291-6/+28
| | | | | | | | | This fixes a bug where the webserver requests a resource that doesn't exist, which triggers a www-authenticate, and causes the browser to show the wrong thing. Change-Id: I65643a50eb269b0a7c76dcb0c65c4e7db2165c88 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Boost beastEd Tanous2018-06-291-85/+102
| | | | | | | | This commit is the beginings of attempting to transition away from crow, and toward boost::beast. Unit tests are passing, and implementation appears to be slightly faster than crow. Change-Id: Ic8d946dc7a04f514c67b1098f181eee1ced69171
* Move bmcweb over to sdbusplusEd Tanous2018-06-291-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | This patchset moves bmcweb from using boost-dbus over entirely to sdbusplus. This has some nice improvements in performance (about 30% of CPU cycles saved in dbus transactions), as well as makes this project manuver closer to the upstream way of thinking. Changes to bmcweb are largely ceremonial, and fall into a few categories: 1. Moves async_method_call instances to the new format, and deletes any use of the "endpoint" object in leiu of the sdbusplus style interface 2. sdbus object_path object doesn't allow access to the string directly, so code that uses it moves to explicit casts. 3. The mapbox variant, while attempting to recreate boost::variant, misses a T* get<T*>() method implementation, which allows using variant without exceptions. Currently, there is an overload for mapbox::get_ptr implementation which replecates the functionality. Tested by: Booting the bmcweb on a target, iterating through redfish basic phosphor-webui usage, and websockets usage Change-Id: I2d95882908d6eb6dba00b9219a221dd96449ca7b Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Make middleware try other auth types on auth failureEd Tanous2018-04-221-14/+20
| | | | | | | | | | | This commit makes the authentication middleware attempt other auth mechanisms if available from the user. Signed-off-by: Ed Tanous <ed.tanous@intel.com> Tested By: Phosphor webui launches and logs in. Redfish endpoints now work with a cookie present. Change-Id: I7c11d4b5eb3c32c8e2b9ba348b70a55bfb72bd4e
* Change order of authorization typesEd Tanous2018-04-221-20/+20
| | | | | | | | | | | Basic authentication is very slow by virtue of the fact that it has to call into pam. THis commit rearranges the flow to accomplish 2 things. 1. If a non-basic auth mechanism is provided, prefer that. 2. Check the whitelist first, before attempting to authenticate the user. Change-Id: Icfe5a218c00a2aeb53acd1ab00bb8cc568424d1d Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Remove the last couple uses of json get<>Ed Tanous2018-03-271-17/+22
| | | | | | | ... and replace with the nothrow equivalent of get_ptr Change-Id: I2d2b83f757d06e8b088e62c6474003ca5cd53de5 Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Session and SessionCollectionKowalski, Kamil2018-02-051-46/+31
| | | | | | | | | | | New Redfish-Core nodes added (removed from redfish_v1.hpp) - Session and SessionCollection. Tested manually on x86 VM and Wolfpass Platform. Behavior almost identical to what was before - differences: - SessionCollection - now only returns TIMEOUT presistence sessions, not SINGLE - Aquiring sessions from session storage now applies timeouts Change-Id: I68bf4fa7fa1c8371216a7d4daa30bbfb653cfa72 Signed-off-by: Kowalski, Kamil <kamil.kowalski@intel.com>
* Fix off by one error in cookie authenticationEd Tanous2018-02-051-1/+1
| | | | | | | sizeof(const char*) will include the size of the null terminator at the end. Fix that. Change-Id: Ia7c5ce4788bf0d2a5240d9df9684a2d93f791e58
* Middleware prepared for Redfish integrationBorawski.Lukasz2018-01-171-93/+182
| | | | | | | | | | | | | | | | | This is adapted from Lukasz patchset, and fixes minor errors in how basic authentication was processed. Tested by: 1. Logging into the webui, and ensuring that cookie auth completes (by looking at the chrome debugger) 2. Checked that basic auth works by accessing the redfish accounts schema using the following command: wget -d https://localhost:18080/redfish/v1/SessionService/Sessions/ --user=root --password=<password> --no-check-certificate Change-Id: I21920a56c52288a74a2b7d587b7c2d7eeeae8d6f Signed-off-by: Borawski.Lukasz <lukasz.borawski@intel.com> Signed-off-by: Ed Tanous <ed.tanous@intel.com>
* Fix merge error introduced with base64.hpp deletionEd Tanous2018-01-121-1/+0
| | | | Change-Id: If1e194009cec31c593e4a0f89c875a3e3bd84110
* Refactor session key storageEd Tanous2017-10-271-8/+10
| | | | | | | | | Refactor session key storage to actually have an interface that isn't map, and provide reasonable lookup functions, as well as update the consumers of those functions. This also implements session timeouts. Change-Id: Ica46716805782cfbb7c4ee5569bc7e468c260bc3
* Update WebserverEd Tanous2017-10-241-101/+104
| | | | | | | | | | | | | | | | | | | | | | | | Upate get_routes to use the correct constness for its use case crow to set json_mode if json value is populated Delete std::array bytes API due to major efficiency issues. To be replaced with span API in near future Implement a catch block for handlers that can throw exceptions Implement direct handling of routes that end with / to better support redfish. /foo and /foo/ now invoke the same handler insead of issuing a 301 redirect Update nlohmann to latest version Implement one nlohmann endpoint with exceptions disabled Implement first pass at a IBM style rest-dbus interface Fix pam authentication to call dropbear auth methods Implements first pass at redfish interface. Shemas avaialble pass redfish validation 100% Use response json object rather than request json object. Update authorization middleware to be redfish compliant UPdate random token generation to be more efficient, and not base64 bytes, generate bytes directly Change-Id: I63cc2005c1a21f5c2f5168777a4e09f3c965a34f
* Large updates to webserverEd Tanous2017-10-111-91/+174
| | | | | | Do not merge yet Change-Id: I38c56844c1b0e3e8e5493c2705e62e6db7ee2102
* Lots of updates to webserver.Ed Tanous2017-08-081-24/+20
| | | | | | | | | | | Make ssl keys consistent (and write to the correct location) Make sessions keyed by connection id Clean up logging frameworks Add new static files, and make firmware update work Make sensors work again Add better json handling Change-Id: I531a0fd7d583e049949cf27aa71544808fd7642d
* incrementalEd Tanous2017-06-121-5/+125
|
* incrementalEd Tanous2017-06-061-2/+3
|
* incrementalEd Tanous2017-04-181-5/+3
|
* incrementalEd Tanous2017-04-031-1/+4
|
* incrementalEd Tanous2017-03-241-0/+8
|
* incrementalEd Tanous2017-03-131-6/+3
|
* clang-formatEd Tanous2017-03-031-13/+11
|
* incrementalEd Tanous2017-02-281-0/+23
OpenPOWER on IntegriCloud