Manage user password expiration via REST
This change adds user password expiration date time mgmt via REST
API provided by bmcweb. Password expiration date time is managed as
string in 'YYYY-MM-DDTHH:MM:SS±hh:mm' format and internally operates as
Epoch time. When set password expiration date time can be specified in
any format supported by 'dateStringToEpoch' function in
'redfish::time_utils'. Value 'null' is used to make password not to
expire.
Unit tests checking correct password expiration value conversion were
added.
This change depends on corresponding change in phosphor-dbus-interfaces
[1] and in phospor-user-manager [2].
Password expiration management:
- create user with password expiration
```
curl -k -X POST -H 'Content-Type: application/json' \
"https://<bmc>/redfish/v1/AccountService/Accounts" \
-d '{"UserName":"<user>", "Password":"<password>", "RoleId":"<role>", "PasswordExpiration": "<YYYY-MM-DDTHH:MM:SS>"}'
```
- modify user password expiration
```
curl -k -X PATCH -H 'Content-Type: application/json' \
https://<bmc>/redfish/v1/AccountService/Accounts/<user> \
-d '{"PasswordExpiration": "<YYYY-MM-DDTHH:MM:SS>"}'
```
- get user password expiration
```
curl -k -X GET https://<bmc>/redfish/v1/AccountService/Accounts/<user>
```
- modify user password not to expire
```
curl -k -X PATCH -H 'Content-Type: application/json' \
https://<bmc>/redfish/v1/AccountService/Accounts/<user> \
-d '{"PasswordExpiration": null}'
```
Tested:
Functionality of this change was tested via curl utility. Also, it was
checked that proper value was set on dbus for'PasswordExpiration'
attribute of the specified user.
- create user account without password expiration, verify that password
expiration is not set
- create user account with password expiration specified, verify that it
is correct
- create user account with null password expiration which makes password
not to expire, verify that it is correct
- try to create user account with various invalid password expiration
values(incorrect type, invalid format), verify that user is not
created and appropriate error is returned in response
- modify user password expiration to specific time, verify that is is
correct
- make user password not to expiry, verify that it is correct
- try to set password expiration to an invalid value (incorrect type,
invalid format), verify that is does not change and appropriate error
is returned in response
Redfish service validation on /redfish/v1/AccountService/Accounts tree
containing both user accounts with and without password expiration has
passed successfully.
[1] https://gerrit.openbmc.org/c/openbmc/phosphor-dbus-interfaces/+/75236
[2] https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/75237
Change-Id: Idf5e4356eaa8866dd4a10664996117e2cdba0684
Signed-off-by: Ivan Moiseev <moiseev.ivan4w@yandex.com>
Signed-off-by: Ivan Mikhaylov <fr0st61te@gmail.com> I
Ivan Moiseev committed
e80fca94a0cd8c84393015c0d1df0cd5a2e27591
Parent: f917a46
Committed by Ed Tanous <ed@tanous.net>
on 6/29/2026, 7:22:47 PM