Post by AMI_alvin on Jan 17, 2020 10:22:34 GMT
Hi all,
As the definitation of Redfish Spec, POST a new session to Sessions Service should not be authenticated. But Redfish_1.0.3_PrivilegeRegistry.json defines the privilege for "SessionCollection", only "ConfigureManager" can POST to Session Service.
So my question is : Is this a conflict between Redfish Spec and PrivilegeRegistry ?
Here is the description from Redfish Spec v1.8.0 - 13.3.1. HTTP header security :
• All write requests to Redfish objects shall be authenticated, i.e., POST, PUT/PATCH, and DELETE, except for
◦ The POST operation to the Sessions service/object needed for authentication
And here is the SessionService part of Redfish_1.0.3_PrivilegeRegistry.json :
Thank you,
Alvin
As the definitation of Redfish Spec, POST a new session to Sessions Service should not be authenticated. But Redfish_1.0.3_PrivilegeRegistry.json defines the privilege for "SessionCollection", only "ConfigureManager" can POST to Session Service.
So my question is : Is this a conflict between Redfish Spec and PrivilegeRegistry ?
Here is the description from Redfish Spec v1.8.0 - 13.3.1. HTTP header security :
• All write requests to Redfish objects shall be authenticated, i.e., POST, PUT/PATCH, and DELETE, except for
◦ The POST operation to the Sessions service/object needed for authentication
And here is the SessionService part of Redfish_1.0.3_PrivilegeRegistry.json :
Entity: "SessionService",
OperationMap: {
....
POST: [
{
Privilege: [
"ConfigureManager"
]
}
....
OperationMap: {
....
POST: [
{
Privilege: [
"ConfigureManager"
]
}
....
Thank you,
Alvin
