Comments (8)
It is expected
What are you basing this on? Is this a Redfish requirement? To my reading, this is sounding like a feature you're looking for. If it's not a bug, please feel free to discuss with the community on discord or the mailing list. Opening bugs is not how we manage features, as the templates suggest.
from bmcweb.
It is not new feature but security issue from my point of view. I don't find any requirement for Redfish on this topic but let consider situation when users still work why administrator makes change on his account, even deleting it.
I opened this ticket to discuss more about above cases and how we can fix them. If you think email is better, I can send email for more discussion about what should be fixed and how.
from bmcweb.
There were already some discussions on this topic in Discord in March. Linking the start of the conversation here as a reference:
https://discord.com/channels/775381525260664832/1005215504417435668/1085438478893981776
I think this is only a bug if you can point to a readily available / widely accepted standard that suggests the current behavior is wrong from a security posture. Ed has previously asked for that and nobody has pointed to one.
from bmcweb.
I think this is only a bug if...
That's not to say it wouldn't be good for someone to make this better. Just a matter of someone deciding to contribute it.
from bmcweb.
I think this is only a bug if...
That's not to say it wouldn't be good for someone to make this better. Just a matter of someone deciding to contribute it.
+1. If this is something you're interested in tackling, it seems fairly straightforward in code. Please just send patches to that effect, including the widely accepted standard @williamspatrick mentions.
from bmcweb.
There were already some discussions on this topic in Discord in March. Linking the start of the conversation here as a reference:
https://discord.com/channels/775381525260664832/1005215504417435668/1085438478893981776
I think this is only a bug if you can point to a readily available / widely accepted standard that suggests the current behavior is wrong from a security posture. Ed has previously asked for that and nobody has pointed to one.
Can't still find any specification for it also. Just feel like it should be so I would like to open to discuss
from bmcweb.
I think this is only a bug if...
That's not to say it wouldn't be good for someone to make this better. Just a matter of someone deciding to contribute it.
+1. If this is something you're interested in tackling, it seems fairly straightforward in code. Please just send patches to that effect, including the widely accepted standard @williamspatrick mentions.
Thanks for your comments. We will submit a patch to handle privilege change. Still no idea for account locked and password change (and wonder if it is needed for these cases).
from bmcweb.
Closing, as discussion seems complete, and any further discussion should happen on the appropriate discussion channels.
from bmcweb.
Related Issues (20)
- Can not start bmcweb locally HOT 1
- MetricReportDefinitions POST failed HOT 7
- How do I test the security of the web HOT 2
- IPAddresses have field's value 0.0.0.0 HOT 10
- URL arg number assert should contain 5 HOT 6
- Json content-type "application/json;charset=utf-8" without space separator is not allowed HOT 4
- Task Monitor URL doesn't match the DMTF redfish specification format. HOT 1
- Webui pages intermittently not loading, "0x0 Failed to capture connection" logged HOT 14
- can not print log in lamba HOT 2
- `Roles` should be exposed in Redfish Session object (introduced in v1.7.0) HOT 4
- Test User Account HOT 6
- $metadata returns 401 if no authentication is provided
- Redfish Protocol Validator fails for SSE request HOT 2
- Login Web Cant redirect HOT 1
- Redfish SessionService/Sessions POST returns empty string for Role HOT 2
- How to implement SimpleUpdate HTTP Pull for D-Bus interface flow? HOT 5
- bmcweb service core-dump when GET /EventService/SSE HOT 6
- Fan Health Incorrectly Set to "OK" When Unable to Read Property HOT 4
- Operator" Privilege Role Allowed to Configure Network Settings HOT 5
- Bug about redfish return long time HOT 14
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from bmcweb.