jane
Minnow
Posts: 4
|
Post by jane on Aug 18, 2022 11:54:48 GMT
Hello, In other thread I saw discussion about accounts and groups property there. redfishforum.com/thread/219/account-groups-propertyI also need an ability to create and manage groups. In addtion, I noticed that ManagerAccount, Roles, etc. schemas doesn't meet other requirements for my system. Would it be correct to not use AccountService and related entities at all and create OemAccountService, OemManagerAccount, etc? |
|
|
|
Post by mraineri on Aug 18, 2022 12:32:45 GMT
If there are functions you need to expose that are not part of the standard, but they are common concepts that you think might be applicable beyond your product, it may be worth proposing the additions here so we can discuss them in the working group to see if there's a chance they can be standardized. However, in the meantime, you'd need to use OEM extensions. I wouldn't create OEM variants of the AccountService and ManagerAccount resources, but rather use the "Oem" object inside of those resources to extend it as you need. For example, for the AccountService resource:
{
"@odata.id": "/redfish/v1/AccountService",
"@odata.type": "#AccountService.v1_11_0.AccountService",
"Id": "AccountService",
"Name": "Account Service",
"Accounts": {
"@odata.id": "/redfish/v1/AccountService/Accounts"
},
"Roles": {
"@odata.id": "/redfish/v1/AccountService/Roles"
},
... <Other standard properties>
"Oem": {
"<My company name>": {
"@odata.type": "#<My company name>AccountService.v1_0_0.AccountService",
<OEM extensions for the account service>
}
}
}
|
|
jane
Minnow
Posts: 4
|
Post by jane on Aug 18, 2022 12:51:38 GMT
ManagerAccount has requirement for properties:
"requiredOnCreate": [
"Password",
"UserName",
"RoleId"
]
But I can't use RoleId, because in my case user doesn't have Role. In my case user is in some group/groups and that group defines users privileges.
The same thing with ldap-users and groups. They should be added/removed to/from local groups.
|
|
|
|
Post by michaeldu on Aug 23, 2022 3:02:45 GMT
I think you may use group as the RoleId. From your description, the group defines users privileges, the RoleId does the same.
|
|
|
|
Post by mraineri on Aug 23, 2022 13:09:32 GMT
I think you may use group as the RoleId. From your description, the group defines users privileges, the RoleId does the same. That's a good approach; this keeps client expectations for properties required on create. |
|
