Proposal for account service schema

The LDAP and ActiveDirectory objects within AccountService are there to deal with the "normal" case of having a single LDAP/AD instance per Redfish Service. Multiple LDAP/AD instances is a rare case - but we wanted to be able to support that.

However, the primary use case here is to support a single LDAP/AD instance, and to make it easy for "bare metal" deployment scripts to configure these settings such that they can perform simple PATCH operations. And that's why the LDAP/AD objects are there. The user can PATCH the AccountService with their LDAP/AD settings on every Redfish service they find using the same script.

If we had left this to a normal Collection method (without creating special cases that would then need to be explained/discovered), a script would need to gather all Collection members to locate the primary LDAP service resource before PATCHing it.

The best way to think of this support, for the vast majority of devices/implementations, is to ignore the "AdditionalExternalAccountProviders" link and collection - pretend it's not there - and just operate on the LDAP/AD objects in AccountService itself. And just know that if there was a case where your device needed to support multiple providers beyond an LDAP and AD instance, there is support for it in the model...

Jeff

The below query is not related to the above one.What should be the redfish implementation behaviour in the GET request of the AccountService.

Suppose the implementation doesn't have any LDAP configuration and user does the GET request on the AccountService, What should the implementation show?

1) LDAP: {} ===> Empty JSON object
2) LDAP : fully bloated object(having all the supported properties with default values) ===> pastebin.com/ibX5nyAc (second test case in the given link).

I am asking as if I return the empty json object(1) then redfish validator doesn't throw any failures and in second case also it doesn't throw any errors.

Hi Jeff,

Can you verify the output for below query ?

curl -k -H "X-Auth-Token: $bmc_token" -X PATCH https://${BMC_IP}/redfish/v1/AccountService/ -D patch.txt -d '{"ActiveDirectory":{"ServiceEnabled":false, "ServiceAddresses": ["ldap://9.194.251.141/"],"Authentication": {"AuthenticationType":"UsernameAndPassword","Username": "cn=dvtuser,cn=Users,dc=Corp,dc=ibm,dc=com","Password": "india@123"}, "LDAPService": {"SearchSettings": {"BaseDistinguishedNames": ["dc=Corp,dc=ibm,dc=com"]}}}}'
{
"ActiveDirectory": {
"AccountProviderType": "ActiveDirectoryService",
"AccountProviderType@Redfish.AllowableValues": [
"ActiveDirectoryService"
],
"Authentication": {
"AuthenticationType": "UsernameAndPassword",
"AuthenticationType@Redfish.AllowableValues": [
"UsernameAndPassword"
],
"Password": "",
"Username": "cn=dvtuser,cn=Users,dc=Corp,dc=ibm,dc=com"
},
"LDAPService": {
"SearchSettings": {
"BaseDistinguishedNames": [
"dc=Corp,dc=ibm,dc=com"
],
"GroupsAttribute": "",
"UsernameAttribute": ""
}
},
"ServiceAddresses": [
"ldap://9.194.251.141/"
],
"ServiceEnabled": false
}

One of the query came that "LDAPService" is coming under Active Directory, Is it correct or not?

Jeff, seems to me that "LDAP" and "ActiveDirectory" objects should be at the same level. Both "LDAP" and "ActiveDirectory" is of type "ExternalAccountProvider"

"ExternalAccountProvider" has property named "LDAPService", which is having further sub property "SearchSettings" which is used to tell that ldapserver/AD to how to do the search?

so seems to me that both "LDAP" and "ActiveDirectory" should have the  "LDAPService".

Also running on  the redfish validator doesn't throw the error.

Can you please take a relook of the  below output?



curl -k -H "X-Auth-Token: $bmc_token" -X GET https://${BMC_IP}/redfish/v1/AccountService/
{
"@odata.context": "/redfish/v1/$metadata#AccountService.AccountService",
"@odata.id": "/redfish/v1/AccountService",
"@odata.type": "#AccountService.v1_3_1.AccountService",
"AccountLockoutDuration": 0,
"AccountLockoutThreshold": 0,
"Accounts": {
"@odata.id": "/redfish/v1/AccountService/Accounts"
},
"ActiveDirectory": {
"AccountProviderType": "ActiveDirectoryService",
"AccountProviderType@Redfish.AllowableValues": [
"ActiveDirectoryService"
],
"Authentication": {
"AuthenticationType": "UsernameAndPassword",
"AuthenticationType@Redfish.AllowableValues": [
"UsernameAndPassword"
],
"Password": null,
"Username": ""
},
"LDAPService": {
"SearchSettings": {
"BaseDistinguishedNames": [
""
],
"GroupsAttribute": "",
"UsernameAttribute": ""
}
},
"ServiceAddresses": [
""
],
"ServiceEnabled": false
},
"Description": "Account Service",
"Id": "AccountService",
"LDAP": {
"AccountProviderType": "LDAPService",
"AccountProviderType@Redfish.AllowableValues": [
"LDAPService"
],
"Authentication": {
"AuthenticationType": "UsernameAndPassword",
"AuthenticationType@Redfish.AllowableValues": [
"UsernameAndPassword"
],
"Password": null,
"Username": "uid=sivasjxp,dc=ldap,dc=com"
},
"LDAPService": {
"SearchSettings": {
"BaseDistinguishedNames": [
"dc=ldap,dc=com"
],
"GroupsAttribute": "gidNumber",
"UsernameAttribute": "cn"
}
},
"ServiceAddresses": [
"ldap://9.126.172.69/"
],
"ServiceEnabled": false
},
"MaxPasswordLength": 20,
"MinPasswordLength": 8,
"Name": "Account Service",
"Roles": {
"@odata.id": "/redfish/v1/AccountService/Roles"
},
"ServiceEnabled": true
}
===============================================================

If you still see that "LDAPService" can not be under "ActiveDirectory", How user can configure the "serachsettings" like rootDN(baseDistinguishedNames) for the LDAP server or groupNameattribute, usernameAttribute.