Post by striker on Jun 5, 2024 16:02:55 GMT
Hi.
Let's say there are several BMC users. For some of them, I would like to specify which interfaces they are allowed to access (Redfish, IPMI, KVM, Virtual Media, etc.).
How would I implement this? I see several options here:
2) Using Redfish privileges.
---
Let's say we have:
- BMC with a host console implemented and accessible via SSH on a specific port;
- multiple local users;
- multiple remote users (for example, an LDAP user group).
In this case, what would the implementation of restricting access to the host console for local and remote users in Redfish look like?
I have a few questions about access control in Redfish.
Let's say there are several BMC users. For some of them, I would like to specify which interfaces they are allowed to access (Redfish, IPMI, KVM, Virtual Media, etc.).
How would I implement this? I see several options here:
1) Use Redfish property AccountTypes (ManagerAccount schema).
And it seems that this particular property is intended for this purpose. But I see that the AccountTypes property exists only for local accounts.
So, in this case, how can I manage such access for remote users?2) Using Redfish privileges.
Both local and remote users have privileges (Role property for local, RemoteRoleMapping for remote users).
Theoretically, we can create privileges for each type of interface and use them to restrict access to local and remote users.
What I don't like here:
It seems that Redfish privileges are intended to restrict access only to the resources of the Redfish service. Then using them to restrict access to Non-Redfish services looks incorrect.
It seems that Redfish privileges are intended to restrict access only to the resources of the Redfish service. Then using them to restrict access to Non-Redfish services looks incorrect.
Is this statement true?
---
Example:
Let's say we have:
- BMC with a host console implemented and accessible via SSH on a specific port;
- multiple local users;
- multiple remote users (for example, an LDAP user group).
In this case, what would the implementation of restricting access to the host console for local and remote users in Redfish look like?
