背景
现网进行客户定制时需要设置密码等敏感信息，设置完成后需要校验敏感信息是否与之前设置的一致。
涉及范围：本地用户密码、VNC密码
要求：仅支持管理员用户调用，需要进行二次鉴权
关联ISSUE
评审点
- 新增用户密码校验redfish接口
/redfish/v1/AccountService/Accounts/:accountid/Actions/Oem/{{OemIdentifier}}/ManagerAccount.VerifyPassword - 新增VNC密码校验redfish接口
/redfish/v1/Managers/:managerid/VncService/Actions/VncService.VerifyPassword - 资源协作接口
bmc.kepler.AccountService.ManagerAccount新增方法VerifyPassword
详细描述
评审点1：新增用户密码校验redfish接口
资源URI ：/redfish/v1/AccountService/Accounts/:accountid/Actions/Oem/{{OemIdentifier}}/ManagerAccount.VerifyPassword
资源版本 ：openUBMCManagerAccount.v1_11_0
命令类型：POST
变化类型：新增接口
操作权限 ：UserMgmt
应用场景：管理员校验用户密码
请求参数 ：
| 属性名 | 类型 | 示例/取值约束 | readonly | 易变属性 | 实现patch | 操作权限 | 描述 |
|---|---|---|---|---|---|---|---|
| Password | String | 密码字符串（长度0到512字节） | 否 | 否 | 否 | UserMgmt | 待校验的密码 |
| SessionAccountPassword | String | 当前会话密码字符串（长度0到512字节） | 否 | 否 | 否 | UserMgmt | 当前会话密码，用于二次鉴权 |
ActionInfo： /redfish/v1/AccountService/Accounts/:accountid/VerifyPasswordActionInfo
{
"@odata.context": "/redfish/v1/$metadata#ActionInfo.ActionInfo",
"@odata.id": "/redfish/v1/AccountService/Accounts/${Uri/accountid}/VerifyPasswordActionInfo",
"@odata.type": "#ActionInfo.v1_0_1.ActionInfo",
"Id": "VerifyPasswordActionInfo",
"Name": "Verify Password Action Info",
"Parameters": [{
"Name": "Password",
"Required": true,
"DataType": "string",
"Sensitive": true
"MaxLength": 512
},
{
"Name": "SessionAccountPassword",
"Required": true,
"DataType": "string",
"Sensitive": true,
"MaxLength": 512
}]
}
校验成功响应体：
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "iBMC.1.0.VerifyPasswordSuccess",
"RelatedProperties": [
"#/ManagerAccount.VerifyPassword"
],
"Message": "Password Verify successfully.",
"MessageArgs": [],
"Severity": "OK",
"Resolution": "None"
}
]
}
}
校验密码失败响应体:
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "Base.1.0.ActionParameterValueError",
"Message": "The value for the parameter 'Password' in the action 'VerifyPassword' is invalid.",
"Severity": "Warning",
"Resolution": "Correct the value for the parameter in the request body and resubmit the request if the operation failed.",
"RelatedProperties": ["#/Password"]
}
]
}
}
Schema定义 ：
{
"definitions": {
"VerifyPassword": {
"patternProperties": {
"^([a-zA-Z_][a-zA-Z0-9_]*)?@(odata|Redfish|Message|Privileges)\\.[a-zA-Z_][a-zA-Z0-9_.]+$": {
"type": [
"array",
"boolean",
"number",
"null",
"object",
"string"
],
"description": "This property shall specify a valid odata or Redfish property."
}
},
"type": "object",
"parameters": {
"Password": {
"requiredParameter": true,
"type": "string"
},
"SessionAccountPassword":{
"requiredParameter": true,
"type": "string"
}
},
"additionalProperties": false,
"properties": {
"title": {
"type": "string",
"description": "Friendly action name"
},
"target": {
"type": "string",
"format": "uri",
"description": "Link to invoke action"
},
"@Redfish.ActionInfo": {
"description": "The term can be applied to an action to specify a URI to an ActionInfo resource that describes the parameters supported by this instance of the action.",
"type": "string",
"format": "uri-reference",
"readonly": true
}
},
"description": "This action is used to verify user password.",
"longDescription": "This action is used to verify user password."
},
"{{OemIdentifier}}Actions": {
"type": "object",
"patternProperties": {
"^([a-zA-Z_][a-zA-Z0-9_]*)?@(odata|Redfish|Message|Privileges)\\.[a-zA-Z_][a-zA-Z0-9_.]+$": {
"type": [
"array",
"boolean",
"number",
"null",
"object",
"string"
],
"description": "This property shall specify a valid odata or Redfish property."
}
},
"additionalProperties": false,
"properties": {
"#ManagerAccount.VerifyPassword": {
"$ref": "#/definitions/VerifyPassword"
}
},
"readonly": true
}
}
}
评审点2：新增VNC密码校验redfish接口
资源URI ：/redfish/v1/Managers/:managerid/VncService/Actions/VncService.VerifyPassword
资源版本 ：HwVncService.v1_0_0
变化类型：新增接口
命令类型：POST
操作权限 ：UserMgmt
应用场景：管理员校验VNC密码
请求参数 ：
| 属性名 | 类型 | 示例/取值约束 | readonly | 易变属性 | 实现patch | 操作权限 | 描述 |
|---|---|---|---|---|---|---|---|
| Password | String | 密码字符串（长度0到512字节） | 否 | 否 | 否 | UserMgmt | 待校验的密码 |
| SessionAccountPassword | String | 当前会话密码字符串（长度0到512字节） | 否 | 否 | 否 | UserMgmt | 当前会话密码，用于二次鉴权 |
ActionInfo：/redfish/v1/Managers/:managerid/VncService/VerifyPasswordActionInfo
"Type": "GET",
"RspBody": {
"@odata.context": "/redfish/v1/$metadata#ActionInfo.ActionInfo",
"@odata.id": "/redfish/v1/Managers/${Uri/managerid}/VncService/VerifyPasswordActionInfo",
"@odata.type": "#ActionInfo.v1_0_1.ActionInfo",
"Id": "VerifyPasswordActionInfo",
"Name": "Verify VNC Password Action Info",
"Parameters": [{
"Name": "Password",
"Required": true,
"DataType": "string",
"Sensitive": true,
"MaxLength": 8
},
{
"Name": "SessionAccountPassword",
"Required": true,
"DataType": "string",
"Sensitive": true,
"MaxLength": 512
}],
}
校验成功响应体：
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "iBMC.1.0.VerifyPasswordSuccess",
"RelatedProperties": [
"#/VncService.VerifyPassword"
],
"Message": "Password Verify successfully.",
"MessageArgs": [],
"Severity": "OK",
"Resolution": "None"
}
]
}
}
校验密码失败响应体:（与用户密码/BIOS密码校验保持一致）
{
"error": {
"code": "Base.1.0.GeneralError",
"message": "A general error has occurred. See ExtendedInfo for more information.",
"@Message.ExtendedInfo": [
{
"@odata.type": "#Message.v1_0_0.Message",
"MessageId": "Base.1.0.ActionParameterValueError",
"Message": "The value for the parameter 'Password' in the action 'VerifyPassword' is invalid.",
"Severity": "Warning",
"Resolution": "Correct the value for the parameter in the request body and resubmit the request if the operation failed.",
"RelatedProperties": ["#/Password"]
}
]
}
}
Schema定义 ：
{
"definitions": {
"VerifyPassword": {
"patternProperties": {
"^([a-zA-Z_][a-zA-Z0-9_]*)?@(odata|Redfish|Message|Privileges)\\.[a-zA-Z_][a-zA-Z0-9_.]+$": {
"type": [
"array",
"boolean",
"number",
"null",
"object",
"string"
],
"description": "This property shall specify a valid odata or Redfish property."
}
},
"type": "object",
"parameters": {
"Password": {
"requiredParameter": true,
"type": "string"
},
"SessionAccountPassword":{
"requiredParameter": true,
"type": "string"
}
},
"additionalProperties": false,
"properties": {
"title": {
"type": "string",
"description": "Friendly action name"
},
"target": {
"type": "string",
"format": "uri",
"description": "Link to invoke action"
},
"@Redfish.ActionInfo": {
"description": "The term can be applied to an action to specify a URI to an ActionInfo resource that describes the parameters supported by this instance of the action.",
"type": "string",
"format": "uri-reference",
"readonly": true
}
},
"description": "This action is used to verify VNC password.",
"longDescription": "This action is used to verify VNC password."
},
"{{OemIdentifier}}Actions": {
"type": "object",
"patternProperties": {
"^([a-zA-Z_][a-zA-Z0-9_]*)?@(odata|Redfish|Message|Privileges)\\.[a-zA-Z_][a-zA-Z0-9_.]+$": {
"type": [
"array",
"boolean",
"number",
"null",
"object",
"string"
],
"description": "This property shall specify a valid odata or Redfish property."
}
},
"additionalProperties": false,
"properties": {
"#VncService.VerifyPassword": {
"$ref": "#/definitions/VerifyPassword"
}
},
"readonly": true
}
}
}
评审点3 资源协作接口bmc.kepler.AccountService.ManagerAccount新增方法VerifyPassword
资源path： /bmc/kepler/AccountService/Accounts/:ManagerAccountId
资源Interface： bmc.kepler.AccountService.ManagerAccount
变化类型： 新增方法
方法描述：
| 方法名称 | 请求签名 | 请求参数描述 | 响应签名 | 响应参数描述 | 方法描述 | | | 访问权限 |
|---|---|---|---|---|---|---|---|
| VerifyPassword | s | Password: 表示需要校验的密码串 | - | - | 验证用户密码 | - | UserMgmt |
JSON定义：
"bmc.kepler.AccountService.ManagerAccount": {
"VerifyPassword": {
"privilege": ["UserMgmt"],
"req": {
"Password": {
"baseType": "String",
"description": "需要验证的密码"
}
},
"rsp": {},
"description": "提供密码校验能力"
}
}
是否准备好AI预审
是
评审结论
同意新增接口：
- 用户密码校验redfish接口
/redfish/v1/AccountService/Accounts/:accountid/Actions/Oem/{{OemIdentifier}}/ManagerAccount.VerifyPassword
命令类型：POST，操作权限 ：UserMgmt，入参：Password 和 SessionAccountPassword，
新增标准错误码：ActionParameterValueError，用于密码校验错误场景返回 - 新增VNC密码校验redfish接口
/redfish/v1/Managers/:managerid/VncService/Actions/VncService.VerifyPassword
命令类型：POST，操作权限 ：UserMgmt，入参：Password 和 SessionAccountPassword， - 资源协作接口
bmc.kepler.AccountService.ManagerAccount新增方法VerifyPassword
操作权限 ：UserMgmt，入参：Password
遗留问题
SessionAccountPassword描述修改“当前会话密码，用于二次鉴权” – OK
资源协作接口入参长度描述补充 – OK
资源协作接口补充description – OK
资源协作接口去掉斜体 – OK
schema定义补充 – OK
补充错误码描述（400错误码）-- OK