summaryrefslogtreecommitdiffstats
path: root/module/obmc
Commit message (Collapse)AuthorAgeFilesLines
* LDAP config: don't log bind passwordDeepak Kodihalli2018-10-161-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Add a way to prevent json body logging for routes with sensitive data such as passwords. This is basically done via a list of URLs. Add the LDAP create config URL to this list. Tested: Before: phosphor-gevent[1481]: <BMC IP> user:root POST http://127.0.0.1:8081/xyz/openbmc_project/user/ldap/action/CreateConfig json:{u'data': [False, u'ldap://<LDAP server IP>/', u'cn=Sivas,cn=Users,dc=Corp,dc=ibm,dc=com', u'cn=Users,dc=Corp,dc=ibm,dc=com', u'<password>', u'xyz.openbmc_project.User.Ldap.Create.SearchScope.sub', u'xyz.openbmc_project.User.Ldap.Create.Type.ActiveDirectory']} 200 OK After: phosphor-gevent[1710]: <BMC IP> user:root POST http://127.0.0.1:8081/xyz/openbmc_project/user/ldap/action/CreateConfig json:None 200 OK Change-Id: I99979e5e373784c7eabb55861dae70bb283859a4 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* certificate handler: fixup return codeDeepak Kodihalli2018-10-031-1/+1
| | | | | | | | Map a certificate install fail to a 400. This is likely due to an invalid certificate. Change-Id: Ie451aa356e4a708889aa7475f10a1c122253e859 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Implement certificate deleteDeepak Kodihalli2018-10-021-22/+30
| | | | | | | | Implement the DELETE verb on certificate endpoints. This calls the D-Bus delete interface on corresponding D-Bus objects. Change-Id: Id829f9064474edd2324ce3c4a66148041b70a95b Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* certificate handler: use mapperDeepak Kodihalli2018-10-021-10/+13
| | | | | | | | Use mapper to retrieve a D-Bus busname, instead of assuming a well-known busname. Change-Id: I668f750ab098b847bf3a662abdf6614170471c41 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Upload and activate new certificate file.Dhruvaraj Subhashchandran2018-09-281-0/+70
| | | | | | | Handle the rest interface to activate new certificate. Change-Id: Ida636a129a042eaa03c754f57fe1bb134446e086 Signed-off-by: Dhruvaraj Subhashchandran <dhruvaraj@in.ibm.com>
* Purge semicolonsDeepak Kodihalli2018-09-131-3/+3
| | | | | Change-Id: Ibca457d0721cce4a76152c2095026adc1bdcdfea Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Log requests only if setting is enabledDeepak Kodihalli2018-09-071-0/+41
| | | | | | | | | | | | | Log requests only if corresponding setting is turned on. The Logging plug-in reads the D-Bus setting and caches the value. It updates the value if the D-Bus property changes. The D-Bus setting object is at /xyz/openbmc_project/logging/rest_api_logs. Change-Id: If4afcbfd3898d09c6ef31cc7c79a058cb5017769 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Log requests and responsesDeepak Kodihalli2018-09-041-0/+56
| | | | | | | | | | | Enable logging for audit purposes - logs are emitted only for PUT, POST, PATCH and DELETE, not for GET. A log would be emitted in this format : <client IP> user:<user> <verb> <url> json:<json-body, if it exists> <response> Change-Id: I2d31ef8feacef79c7f488d826e0262a9cc852246 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Explicitly convert dbus.Booleans to boolsMatt Spinler2018-08-281-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | | | | | The dbus.Boolean data type that the dbus python module uses for booleans is based on an int, so the JSON encoder class serializes it to a 1 and 0 instead of the native JSON bool presentation of true and false. Though the encoder module does allow for custom serialization functions, it only does so for data types that it doesn't recognize, and it does recognize a dbus.Boolean though it thinks it's an int. To get around this limitation, walk the response dictionary object and convert all dbus.Booleans to bools before encoding the response. The only time that data is copied is when a boolean is in a dbus.Struct, which is an immutable tuple, so it will be made into a list during revision before converting it back when complete. There is a slight performance penalty to pay for this. Measurements showed enumerating the whole /xyz/openbmc_project tree take about 1 second longer. Resolves openbmc/openbmc#3154 Tested: Lots of REST calls and output inspection. Change-Id: I591f010798a80aeafd02289e3d35c335540f6562 Signed-off-by: Matt Spinler <spinler@us.ibm.com>
* rest_dbus: Add read-only property errorAdriana Kobylak2018-08-231-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | There is now support in sdbusplus to mark a property as read-only, so that a REST request to modify it would return org.freedesktop.DBus.Error.PropertyReadOnly. Add support for this error to provide a more useful and compact error instead of the default 500 Internal Error with the traceback. Tested: Instead of a 500 error with traceback, a compact 403 error is displayed: $ curl b cjar -k -H "Content-Type: application/json" -X PUT -d '{"data": 50}' https://${bmc}/xyz/openbmc_project/control/power_supply/attr/DeratingFactor { "data": { "description": "org.freedesktop.DBus.Error.PropertyReadOnly: Property 'DeratingFactor' is not writable." }, "message": "403 Forbidden", "status": "error" } Change-Id: I5648a99c7656a6f9d9a8ca967418fabd64b080c6 Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* Revert "Provide the infrastructure to whitelist given URL from REST server"Gunnar Mills2018-07-251-32/+0
| | | | | | | | | | This reverts commit 0cf702c3948487089723d539efc59275b958bf34. This commit broke accessing the Web UI. Reverting until this can be fixed. Change-Id: Ie49bbcd51561cca5d587bd161ec51f3b6d22ffd0 Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Fix error message in do_put()Lei YU2018-07-121-2/+6
| | | | | | | | | | | | | | | | | | do_put() always reports "Failed to convert to type" when it gets exception during retry. This is not wrong because it may gets the real error from Dbus instead of convert_type(). Fix it by using try-except for both convert_type() and self.do_put() to correctly report the error. Resolves: openbmc/openbmc#3301 Tested: Setting host time when time config does not allow this, and verify the correct error is reported. Change-Id: Ic46cedb7ea20d91d94b45568af9acd55af9caf56 Signed-off-by: Lei YU <mine260309@gmail.com>
* Provide the infrastructure to whitelist given URL from REST serverNagaraju Goruganti2018-06-211-0/+32
| | | | | | | | | | | | | Added a plug-in which runs on each request and checks if the requested URL consists of whitelisted URL, if so, allows the access, otherwise fails with an error message. It gets whitelisted URL info from json file. Resolves openbmc/openbmc#2378 Change-Id: I95e5fd080e03616a1cba2b86d951414669338b08 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* Avoid closing of web socket during the idle timeJayashankar Padath2018-06-041-13/+19
| | | | | | | | | | | | | | | | "/subscribe" route of web socket is getting closed if it remains idle for more than 60 seconds. Once web socket get closed, it can't handle further event notifications. To avoid this, send a ping to wake it up during constant intervals. Resolves: Part of openbmc/openbmc#3102 Tested: Running GUI locally and verified the command line and web gui power on/off operations. Also could not see web socket getting closed during idle time. Change-Id: Ic3da0d30b99d1c3ac5ce4311204e6f6b09b8c1f0 Signed-off-by: Jayashankar Padath <jayashankar.padath@in.ibm.com>
* Prevent users from logging in while BMC is not yet ready.Alexander Filippov2018-05-301-0/+32
| | | | | | | | | | | | | | | | | | | | | | | | Reject user logins while BMC_READY state has not been reached yet, and report the reason in response. Resolves: openbmc/openbmc#2974 This behavior may be enabled by appending `--with-bmc-check` to command line arguments. When it is enabled it maybe temporary disabled by sending `force` flag with the login request: ``` { "data": [ "username", "password" ], "force": true } ``` Tested: When trying to login in REST receiving response with code 503 while BMC is booting. Change-Id: I04fce09de2b7a3074b5253346a87773641fd57d0 Signed-off-by: Alexander Filippov <a.filippov@yadro.com>
* Don't fail on missing Delete interfacesMatt Spinler2018-05-241-9/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | On the DELETE HTTP request, don't immediately fail if the specified bus does't provide the delete interface on the specified path, just skip it instead. Only return the 403 error if nothing at all ended up being deleted on the request. This allows multiple services to host the same object path while only requiring one to support the delete interface. The others will just listen for the interfaces removed signal to remove their objects. Resolves openbmc/openbmc#3181 Tested: * Issue a -X DELETE with curl on a path provided by multiple services where only 1 provides the delete interface. * Issue a -X POST .../action/delete with curl with the same test setup. * Issue a -X DELETE with curl on a path without a delete interface and get a 403 back. Change-Id: Ib76c80081361160e617ddfe8b48e3e4588abce67 Signed-off-by: Matt Spinler <spinler@us.ibm.com>
* Don't check for credentials on the login APIGunnar Mills2018-05-231-4/+0
| | | | | | | | | | | | | The web server should not be checking for credentials on the login API. This allows the GUI to check the old password on a password change. Resolves openbmc/openbmc#3190 Tested: Verfied login still works and tested changing the user password from the GUI. Change-Id: I7c3570d50c011a0327a34f09b447dec5ca42cb9f Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Expose host serial console over a websocketDeepak Kodihalli2018-04-301-0/+83
| | | | | | | | | Expose host serial console over a "/console" route, using a websocket. An authenticated client can access the host serial console via reads/writes to this websocket. Change-Id: I0f63a3844e777d4f4c45194c85a63c9f10a91744 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* rest_dbus: upload: Add version id error codeAdriana Kobylak2018-04-101-1/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If there was no D-Bus object created, it means that either the version already existed, or there was a failure extracting the file. Ideally the REST server would query to see if the version already exists, but it doesn't know the version id to look for, so adding a single error msg for all error cases. It still makes sense to have a 400 (client) error for tar errors since a failure to untar is most likely an invalid or corrupted file that the user would need to address. Tested: Uploading a regular file (that triggers a tar failure) or a version that already exists on the system: Before: { "data": null, "message": "200 OK", "status": "ok" } After: { "data": { "description": "Version already exists or failed to be extracted" }, "message": "400 Bad Request", "status": "error" } Fixes openbmc/openbmc#2939 Change-Id: Ia4be5fe1dac3c2c7ebb5eb2aa28e4d58f9222c7f Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* rest_dbus: upload: Return version idAdriana Kobylak2018-04-101-5/+57
| | | | | | | | | | | | | | | | | | | | | | | | | In the put/post upload handler, subscribe to the signal for InterfacesAdded to the software path and return the version id which is the last item of the path, wait up to 10 seconds for the new software D-Bus object to be created. Tested: https://${bmc}/upload/image method returns the version id: Before: { "data": null, "message": "200 OK", "status": "ok" } After: { "data": "84fb16be", "message": "200 OK", "status": "ok" } Change-Id: I307079f9a3b8f05bc42bc77c89e7976920c668a5 Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* Spelling fixesGunnar Mills2018-04-081-2/+2
| | | | | | | | | Spelling errors found using github.com/lucasdemarchi/codespell A tool to fix common misspellings. This tool is licensed under GNU General Public License, version 2. Change-Id: Ia286ebed549741e15a9661f5797d71e9f93ae83d Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Remove use of deprecated ListMatchBrad Bishop2018-04-041-1/+1
| | | | | | | | | This class was broken with pyphosphor aea38c65. Drop use of the class altogether and just use a lambda. Change-Id: I6f36487c1d6fe2003aa007c2a174fe97abf0267a Tested: Enumerated HTTP root and verified content Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Port to python 3CamVan Nguyen2018-03-141-27/+37
| | | | | | | | | | Port code to python 3 yet remain backward compatible to python 2. This port is in preparation for yocto 2.4 upgrade. Partially resolves openbmc/openbmc#2920 Change-Id: I418395fc7fbda247d702551af69cbedbbdc3a7aa Signed-off-by: CamVan Nguyen <ctnguyen@us.ibm.com>
* Add web UI routing supportMatt Spinler2018-02-121-0/+90
| | | | | | | | | | | | | | | | | | | | | Route the calls that a browser will request when it's pointed at https://<bmc> to the specified files in /usr/share/www, which come from the phosphor-webui repository. This takes over the '/' REST endpoint, but that provides no functionality to the customer anyway. The long term vision is to use a more advanced server like nginx, but this is needed until something else is ready. Tested: Served the phosphor-webui GUI from the BMC with the script. Resolves openbmc/openbmc#2821 Change-Id: Id491f9e0865a445160b91897082eb1c69695f562 Signed-off-by: Matt Spinler <spinler@us.ibm.com>
* Revert "Remove org.openbmc.* from REST server"Lei YU2018-01-261-22/+0
| | | | | | | | This reverts commit 9e2a211304d667756bc4136ec4bd1be27a2b5457, which breaks code update for non-UBIFS bmcs. Change-Id: Iecdad70f4ca9d2b4852addac3c2550e081253366 Signed-off-by: Lei YU <mine260309@gmail.com>
* Remove org.openbmc.* from REST serverNagaraju Goruganti2018-01-231-0/+22
| | | | | | | | | | | | Added a plug-in which runs on each request and checks if the requested URL consists of /org/openbmc, if so, fails with an error message. So as to ensure the external interfaces are in the /xyz/openbmc_project namespace, and to disallow the old /org/openbmc namespace. Resolves openbmc/openbmc#2378 Change-Id: I4aab5ab716c40a460d7b3c28249e7047d3302a0a Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* Security: Cross Site ScriptingRatan Gupta2018-01-231-0/+8
| | | | | | | | | | This commit fixes the Cross Site scripting attack by adding security headers in response packet. Partially Resolves openbmc/openbmc#2423 Change-Id: Ie0ea05408af3d841a54f528863ed1bf65a8c3ed7 Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com>
* module: pep8 fixesBrad Bishop2018-01-231-2/+2
| | | | | | | A couple pep8 errors found their way in. Change-Id: I31c1de3b2bc92b20a809b9c2638df0d83c2b2ea3 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* rest_dbus.py:Update abort message for do_postNagaraju Goruganti2018-01-041-1/+1
| | | | | | | | | | | | | -When args are in correct format, but are not in accepted range, in this case the current abort message not seems meaningful. -Updated abort message to suite for both cases when the arg type is not correct or arg value is not in accepted range. Fixes openbmc/openbmc#2576 Change-Id: Id35241b05cd193172e2b7b1c905c396d0f9a9b4b Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* rest_dbus.py: Fix UnknownInterface errorAdriana Kobylak2017-12-141-6/+2
| | | | | | | | | | | | | | The string "org.freedesktop.UnknownInterface" is not an existing dbus error string, all errors are of format *.DBus.Error.* so remove it. Also check the dbus name instead of message for this error. The dbus message is the description of the error, like "Unknown interface 'foo'". The dbus name is the actual error string, like "org.freedesktop.DBus.Error.UnknownInterface", Change-Id: Ib54adef852713bc30f3eefc6598e28fcf5be3d29 Signed-off-by: Adriana Kobylak <anoo@us.ibm.com>
* Fix infinite do_put recursive call with retry only onceMarri Devender Rao2017-12-121-6/+6
| | | | | | | | | | | | | | | | For failure in do-put method call REST server computes the argument types based on the signature and makes a recursive call with the modified argument types. Without proper exit clause recursive call is falling into an infinite loop, modified to retry only once. Also fixed do_post which has similar retry logic. Fixes openbmc/openbmc#2653 Change-Id: I150464de5585ebdfab4ae2da2083a62bd63caca1 Signed-off-by: Marri Devender Rao <devenrao@in.ibm.com>
* websocket client_simple example: add login codeDeepak Kodihalli2017-11-191-6/+8
| | | | | Change-Id: Iff44de21e71508d81f7c5bfbe24b5f317fff000d Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Fix missing return value from do_postNagaraju Goruganti2017-11-171-7/+25
| | | | | | | | | | | | - For example user-initiated dump REST request has to respond with dump ID. This is not happening, the dump-manager is returning the ID, but rest-bus is not passing the ID to caller. - These changes will fix the issue. Fixes openbmc/openbmc#2592 Change-Id: I7ff3f24236249a4ca58ac6ce90cc9dec6fbe0341 Signed-off-by: Nagaraju Goruganti <ngorugan@in.ibm.com>
* Don't create Image Dir if not presentGunnar Mills2017-11-161-1/+1
| | | | | | | | | | | | | | Return error if the Image directory is not present. The Upload code should not create the image dir, instead the code update or the inotify code should create it. Even if the Upload code creates the directory, the inotify is not looking for a file in that dir and won't untar it. We saw this with 2544. Although not the root cause of 2544 this change would have let the user know sooner (on upload), that there was a problem. Change-Id: I9f161354e1c3243567efb73b6974e8f52ff4c5db Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Call all instances of an objectPath when executing "POST"Saqib Khan2017-11-081-6/+10
| | | | | | | | | | | - For example "DeleteAll" exists in both bmc updater and host updater. Therefore when a user executes DeleteAll using REST, both the two instances should be called upon. Resolves openbmc/openbmc#2490 Change-Id: Ic38b00de137593bc344ff9d743d3144a48bd5f13 Signed-off-by: Saqib Khan <khansa@us.ibm.com>
* Spelling fixesGunnar Mills2017-10-252-4/+4
| | | | | Change-Id: If4902b7c900f4108f4563a49ee8aca18294b32f7 Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Add websocket client exampleDeepak Kodihalli2017-10-191-0/+59
| | | | | | | | Add an example client html/js to denote subscription to BMC events via websockets. Change-Id: I9d07c7f720965de0272af31fc1a84faa49e901f5 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* rest_dbus: implement client subscription APIDeepak Kodihalli2017-10-181-1/+88
| | | | | | | | | | Import gobject for running the d-bus event loop, and gevent for a greenlets support. Resolves openbmc/openbmc#2318. Change-Id: Ieaf2e6badcc22159f7470e3fdf949b358fc3e3fe Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* rest_dbus: add new route for event subscriptionDeepak Kodihalli2017-10-181-0/+31
| | | | | | | | | | | | Add a route, '/subscribe', to be able to receive notifications from the REST server over a websocket. A client is supposed to create a new websocket by pointing to this route in the URL. In this commit, the implementation of the route is to just write a "Connected" message on the websocket. Change-Id: I38a40b2c17eac3ecdccb131d267baefe20b36572 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* phosphor-gevent: enable websocket supportDeepak Kodihalli2017-10-181-1/+1
| | | | | | | | | | Set 'WebSocketHandler' as the handler_class. Websockets are being supported to allow the REST server to be able to "push" events to clients. Change-Id: I4c5536ae9070635c00330bb59fc93d3b4382b461 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* Remove unused intf_matchBrad Bishop2017-09-111-1/+0
| | | | | | | This base class member is unused and appears to be dead code. Remove. Change-Id: Iafdab0e28fdf15bb38f9713ae098d654d05c5b4e Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Change ImageUpload to open file onceGunnar Mills2017-08-301-4/+4
| | | | | | | | | | | When uploading an image via REST without a file name, the image upload code closes the file twice, triggering the inotify twice. Resolves openbmc/openbmc#2174 Change-Id: I24ff920c745b865bb4e25468e1895b38abf4a592 Signed-off-by: Gunnar Mills <gmills@us.ibm.com>
* Change Dump file storage locationJayanth Othayoth2017-08-201-2/+1
| | | | | | | | Changed the dump storage location from /tmp/dumps to /var/lib/phosphor-debug-collector/dumps Change-Id: I792f7661d377cb8fc5d77441a61b640fd5c2daf4 Signed-off-by: Jayanth Othayoth <ojayanth@in.ibm.com>
* Convert value to expected type during POST methodRatan Gupta2017-08-091-0/+41
| | | | | | | | | | | | | | | | | This fix converts the values passed as the method arguments to the expected type during REST POST method Invalid args exception handling. if Invalid args exception occurs,this commit does the following set of operations. =>Get the method signature. =>Convert the value to the expected type. =>re-execute the post method. Resolves openbmc/openbmc#1889 Change-Id: I3fe9feda40187e4b72adf800b6bc4eb46f05a27c Signed-off-by: Ratan Gupta <ratagupt@in.ibm.com>
* Revert "Set content-type to routes that had none set"Brad Bishop2017-07-111-4/+2
| | | | | | | | | | | This reverts commit 0dc67226dd38d5e603c9abc9f443809010ae85ee. No longer needed after 944cd04. Resolves: openbmc/openbmc#1932 Change-Id: I0f0a3fe2462cfd287ea7d7692fa47de685d595ea Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Revert "rest_dbus: run JSON response format plugin conditionally"Brad Bishop2017-07-101-7/+3
| | | | | | | | | This reverts commit 1444fd8c9e9b0807b4f3682236bec7cb3eedeebf. No longer needed after 944cd04. Change-Id: I8b19d6506e8ffb6c51b145e8306498621dd53be0 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Allow json response plugin to be suppressedBrad Bishop2017-07-101-3/+4
| | | | | | | | | Add a static class member suppress_json_resp that when set to True will prevent the JsonApiResp plugin from responding with a json wrapper. Change-Id: I43aadb6b59bb21ef53e5252e4878157c8e13935e Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* pep8 fixesBrad Bishop2017-07-101-1/+1
| | | | | Change-Id: I253b1f23f266a6604e2392d19de25d2d7e7a1ec8 Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
* Set content-type to routes that had none setDeepak Kodihalli2017-07-081-2/+4
| | | | | | | Resolves openbmc/openbmc#1927. Change-Id: I05f0a1e37d8ebc83ebe1ff1d9aecba72ebc3aa39 Signed-off-by: Deepak Kodihalli <dkodihal@in.ibm.com>
* rest_dbus: implement route 'download/dump/<dumpid>Jayanth Othayoth2017-07-071-1/+40
| | | | | | | | | | | | This allows user to download dump file from BMC using dump id. 'curl -O -J -c cjar -b cjar -k -X GET https://<bmc_IP>/download/dump/1' - This will download the dump file on to the Host machine. Resolves openbmc/openbmc#1508 Change-Id: I2821bfe8d68f80340512161c062503b92a7a7466 Signed-off-by: Jayanth Othayoth <ojayanth@in.ibm.com>
OpenPOWER on IntegriCloud