SIGN IN SIGN UP

Manage user password expiration via REST

This change adds user password expiration date time mgmt via REST
API provided by bmcweb. Password expiration date time is managed as
string in 'YYYY-MM-DDTHH:MM:SS±hh:mm' format and internally operates as
Epoch time. When set password expiration date time can be specified in
any format supported by 'dateStringToEpoch' function in
'redfish::time_utils'. Value 'null' is used to make password not to
expire.

Unit tests checking correct password expiration value conversion were
added.

This change depends on corresponding change in phosphor-dbus-interfaces
[1] and in phospor-user-manager [2].

Password expiration management:
- create user with password expiration
```
curl -k -X POST -H 'Content-Type: application/json' \
  "https://<bmc>/redfish/v1/AccountService/Accounts" \
  -d '{"UserName":"<user>", "Password":"<password>", "RoleId":"<role>", "PasswordExpiration": "<YYYY-MM-DDTHH:MM:SS>"}'
```

- modify user password expiration
```
curl -k -X PATCH -H 'Content-Type: application/json' \
  https://<bmc>/redfish/v1/AccountService/Accounts/<user> \
  -d '{"PasswordExpiration": "<YYYY-MM-DDTHH:MM:SS>"}'
```

- get user password expiration
```
  curl -k -X GET https://<bmc>/redfish/v1/AccountService/Accounts/<user>
```

- modify user password not to expire
```
curl -k -X PATCH -H 'Content-Type: application/json' \
  https://<bmc>/redfish/v1/AccountService/Accounts/<user> \
  -d '{"PasswordExpiration": null}'
```

Tested:
Functionality of this change was tested via curl utility. Also, it was
checked that proper value was set on dbus for'PasswordExpiration'
attribute of the specified user.
- create user account without password expiration, verify that password
  expiration is not set
- create user account with password expiration specified, verify that it
  is correct
- create user account with null password expiration which makes password
  not to expire, verify that it is correct
- try to create user account with various invalid password expiration
  values(incorrect type, invalid format), verify that user is not
  created and appropriate error is returned in response
- modify user password expiration to specific time, verify that is is
  correct
- make user password not to expiry, verify that it is correct
- try to set password expiration to an invalid value (incorrect type,
  invalid format), verify that is does not change and appropriate error
  is returned in response

Redfish service validation on /redfish/v1/AccountService/Accounts tree
containing both user accounts with and without password expiration has
passed successfully.

[1] https://gerrit.openbmc.org/c/openbmc/phosphor-dbus-interfaces/+/75236
[2] https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/75237

Change-Id: Idf5e4356eaa8866dd4a10664996117e2cdba0684
Signed-off-by: Ivan Moiseev <moiseev.ivan4w@yandex.com>
Signed-off-by: Ivan Mikhaylov <fr0st61te@gmail.com>
I
Ivan Moiseev committed
e80fca94a0cd8c84393015c0d1df0cd5a2e27591
Parent: f917a46
Committed by Ed Tanous <ed@tanous.net> on 6/29/2026, 7:22:47 PM