* Question of ipmi command "Set User Access" in phosphor-host-ipmid
@ 2020-05-25 7:28 Tony Lee (李文富)
2020-05-25 16:28 ` Thomaiyar, Richard Marian
0 siblings, 1 reply; 5+ messages in thread
From: Tony Lee (李文富) @ 2020-05-25 7:28 UTC (permalink / raw)
To: Thomaiyar, Richard Marian; +Cc: openbmc
Hi Richard,
In the process of creating an user,
I used the ipmi command "ipmitool priv <user id> <privilege level> [<channel number>]".
The "UserPrivilege" of the user I created in dbus is empty. Because my LAN channel number is not 1.
https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_channel/user_mgmt.cpp#L878
Why did it need to check the request channel number before setting the dbus?
I can't find the related restriction of it in "Set User Access Command" in IPMI SPEC.
Thanks
Best Regards,
Tony
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Question of ipmi command "Set User Access" in phosphor-host-ipmid
2020-05-25 7:28 Question of ipmi command "Set User Access" in phosphor-host-ipmid Tony Lee (李文富)
@ 2020-05-25 16:28 ` Thomaiyar, Richard Marian
2020-05-28 8:09 ` Tony Lee (李文富)
2020-06-01 18:56 ` Joseph Reynolds
0 siblings, 2 replies; 5+ messages in thread
From: Thomaiyar, Richard Marian @ 2020-05-25 16:28 UTC (permalink / raw)
To: Tony Lee (李文富); +Cc: openbmc
Hi Tony,
Only IPMI offers channel based user level privilege as of now, Redfish
uses single privilege across all channels. OpenBMC user management is
designed to have single user level privilege. IPMI is designed to bind
one of the channel privilege user to the user management, and rest
maintain in it's own database. LAN 1 is used for that sync.
Note: Discussion started in Redfish forum to have a channel based
restriction, but it's not yet materialized and requires more takers.
Regards,
Richard
On 5/25/2020 12:58 PM, Tony Lee (李文富) wrote:
> In the process of creating an user,
> I used the ipmi command "ipmitool priv <user id> <privilege level> [<channel number>]".
> The "UserPrivilege" of the user I created in dbus is empty. Because my LAN channel number is not 1.
>
> https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_channel/user_mgmt.cpp#L878
>
> Why did it need to check the request channel number before setting the dbus?
> I can't find the related restriction of it in "Set User Access Command" in IPMI SPEC.
>
> Thanks
> Best Regards,
> Tony
^ permalink raw reply [flat|nested] 5+ messages in thread
* RE: Question of ipmi command "Set User Access" in phosphor-host-ipmid
2020-05-25 16:28 ` Thomaiyar, Richard Marian
@ 2020-05-28 8:09 ` Tony Lee (李文富)
2020-05-28 10:21 ` Thomaiyar, Richard Marian
2020-06-01 18:56 ` Joseph Reynolds
1 sibling, 1 reply; 5+ messages in thread
From: Tony Lee (李文富) @ 2020-05-28 8:09 UTC (permalink / raw)
To: Thomaiyar, Richard Marian; +Cc: openbmc
Hi Richard,
So, it need to check the request channel number before setting the dbus
because it has to be in sync with system user privilege level.
Since my LAN1 and the request channel number are both 2.
Once we can get LAN1 channel number dynamically
https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_channel/user_mgmt.cpp#L512
This issue will be solved right?
> From: Thomaiyar, Richard Marian <richard.marian.thomaiyar@linux.intel.com>
> Sent: Tuesday, May 26, 2020 12:28 AM
> To: Tony Lee (李文富) <Tony.Lee@quantatw.com>
> Cc: openbmc@lists.ozlabs.org
> Subject: Re: Question of ipmi command "Set User Access" in
> phosphor-host-ipmid
>
> Hi Tony,
>
> Only IPMI offers channel based user level privilege as of now, Redfish uses
> single privilege across all channels. OpenBMC user management is designed to
> have single user level privilege. IPMI is designed to bind one of the channel
> privilege user to the user management, and rest maintain in it's own database.
> LAN 1 is used for that sync.
>
> Note: Discussion started in Redfish forum to have a channel based restriction,
> but it's not yet materialized and requires more takers.
>
> Regards,
>
> Richard
>
> On 5/25/2020 12:58 PM, Tony Lee (李文富) wrote:
> > In the process of creating an user,
> > I used the ipmi command "ipmitool priv <user id> <privilege level>
> [<channel number>]".
> > The "UserPrivilege" of the user I created in dbus is empty. Because my LAN
> channel number is not 1.
> >
> >
> https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_chann
> e
> > l/user_mgmt.cpp#L878
> >
> > Why did it need to check the request channel number before setting the
> dbus?
> > I can't find the related restriction of it in "Set User Access Command" in IPMI
> SPEC.
> >
> > Thanks
> > Best Regards,
> > Tony
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Question of ipmi command "Set User Access" in phosphor-host-ipmid
2020-05-28 8:09 ` Tony Lee (李文富)
@ 2020-05-28 10:21 ` Thomaiyar, Richard Marian
0 siblings, 0 replies; 5+ messages in thread
From: Thomaiyar, Richard Marian @ 2020-05-28 10:21 UTC (permalink / raw)
To: Tony Lee (李文富); +Cc: openbmc
Hi Tony,
Yes, that's correct. We already support channel configuration using
json(channel_config.json under phosphor-ipmi-config), and sync channel
can be identified by the first LAN medium channel number - else we can
add one more configuration as well).
I am ok if you want to go ahead and fix it, else will try to fix the
same in couple of weeks.
Regards,
Richard
On 5/28/2020 1:39 PM, Tony Lee (李文富) wrote:
> Hi Richard,
>
> So, it need to check the request channel number before setting the dbus
> because it has to be in sync with system user privilege level.
>
> Since my LAN1 and the request channel number are both 2.
> Once we can get LAN1 channel number dynamically
> https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_channel/user_mgmt.cpp#L512
>
> This issue will be solved right?
>
>> From: Thomaiyar, Richard Marian <richard.marian.thomaiyar@linux.intel.com>
>> Sent: Tuesday, May 26, 2020 12:28 AM
>> To: Tony Lee (李文富) <Tony.Lee@quantatw.com>
>> Cc: openbmc@lists.ozlabs.org
>> Subject: Re: Question of ipmi command "Set User Access" in
>> phosphor-host-ipmid
>>
>> Hi Tony,
>>
>> Only IPMI offers channel based user level privilege as of now, Redfish uses
>> single privilege across all channels. OpenBMC user management is designed to
>> have single user level privilege. IPMI is designed to bind one of the channel
>> privilege user to the user management, and rest maintain in it's own database.
>> LAN 1 is used for that sync.
>>
>> Note: Discussion started in Redfish forum to have a channel based restriction,
>> but it's not yet materialized and requires more takers.
>>
>> Regards,
>>
>> Richard
>>
>> On 5/25/2020 12:58 PM, Tony Lee (李文富) wrote:
>>> In the process of creating an user,
>>> I used the ipmi command "ipmitool priv <user id> <privilege level>
>> [<channel number>]".
>>> The "UserPrivilege" of the user I created in dbus is empty. Because my LAN
>> channel number is not 1.
>>>
>> https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_chann
>> e
>>> l/user_mgmt.cpp#L878
>>>
>>> Why did it need to check the request channel number before setting the
>> dbus?
>>> I can't find the related restriction of it in "Set User Access Command" in IPMI
>> SPEC.
>>> Thanks
>>> Best Regards,
>>> Tony
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Question of ipmi command "Set User Access" in phosphor-host-ipmid
2020-05-25 16:28 ` Thomaiyar, Richard Marian
2020-05-28 8:09 ` Tony Lee (李文富)
@ 2020-06-01 18:56 ` Joseph Reynolds
1 sibling, 0 replies; 5+ messages in thread
From: Joseph Reynolds @ 2020-06-01 18:56 UTC (permalink / raw)
To: Thomaiyar, Richard Marian, Tony Lee (李文富); +Cc: openbmc
On 5/25/20 11:28 AM, Thomaiyar, Richard Marian wrote:
> Hi Tony,
>
> Only IPMI offers channel based user level privilege as of now, Redfish
> uses single privilege across all channels. OpenBMC user management is
> designed to have single user level privilege. IPMI is designed to bind
> one of the channel privilege user to the user management, and rest
> maintain in it's own database. LAN 1 is used for that sync.
>
> Note: Discussion started in Redfish forum to have a channel based
> restriction, but it's not yet materialized and requires more takers.
here:
https://redfishforum.com/thread/279/channel-privilege-support-direction-redfish
>
> Regards,
>
> Richard
>
> On 5/25/2020 12:58 PM, Tony Lee (李文富) wrote:
>> In the process of creating an user,
>> I used the ipmi command "ipmitool priv <user id> <privilege level>
>> [<channel number>]".
>> The "UserPrivilege" of the user I created in dbus is empty. Because
>> my LAN channel number is not 1.
>>
>> https://github.com/openbmc/phosphor-host-ipmid/blob/master/user_channel/user_mgmt.cpp#L878
>>
>>
>> Why did it need to check the request channel number before setting
>> the dbus?
>> I can't find the related restriction of it in "Set User Access
>> Command" in IPMI SPEC.
>>
>> Thanks
>> Best Regards,
>> Tony
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2020-06-01 18:56 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-25 7:28 Question of ipmi command "Set User Access" in phosphor-host-ipmid Tony Lee (李文富)
2020-05-25 16:28 ` Thomaiyar, Richard Marian
2020-05-28 8:09 ` Tony Lee (李文富)
2020-05-28 10:21 ` Thomaiyar, Richard Marian
2020-06-01 18:56 ` Joseph Reynolds
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.