Separate ManagerConsole and HostConsole access

[gtmills]

Redfish has both ManagerConsole and HostConsole. OpenBMC only has 1 group for these "ssh"
In https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835/ ssh was mapped to both ManagerConsole and HostConsole.

It makes sense these are different "can log into the BMC console" is different than "can log into the host console" and users could have one and not the other.

We should solve this before https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50965 goes in because switching would change behavior in a breaking way.

In IPMI, these are a difference between operator and admin roles.

https://github.com/openbmc/docs/blob/master/architecture/user-management.md#supported-group-roles

phosphor-user-manager/user_mgr.hpp

Line 201 in f1b69fa

std::vector<std::string> groupsMgr = {"web", "redfish", "ipmi", "ssh"};

[ninadpalsule]

@gtmills @ratagupt @rthomaiy Any plans to separate ssh into userGroup HostConsole and ManagerConsole? I am interested in getting the acountType PATCH support (https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50965) and this is a requite for PATCH. This is where the accountType split is discussed : https://gerrit.openbmc.org/c/openbmc/bmcweb/+/50835. I think it is easiest to add new group named hostConsole and keep managerConsole mapped to ssh.

[joseph-reynolds]

Another wrinkle is that the SSH interface ssh -p 2200 someuser@${BMCIP} currently checks if the user is in the "priv-admin" group, which implicitly means only users who have the "admin" privilege role (aka the Redfish Administrator role) are allowed to SSH to the BMC. Once we have a proper hostconsole group, this could be changed.

And (if desired) to keep the same behavior when new users are created, the default for the Redfish AccountTypes property would be to add the "ssh" and "hostconsole" groups exactly when role=Administrator.
[Edit: shortened hostconsoleaccess to hostconsole.]

[ninadpalsule]

This task is complete with following commits.

• docs: https://gerrit.openbmc.org/c/openbmc/docs/+/60968
• phosphor-user-manager: https://gerrit.openbmc.org/c/openbmc/phosphor-user-manager/+/61583
• openbmc: https://gerrit.openbmc.org/c/openbmc/openbmc/+/61582
• obmc-console: https://gerrit.openbmc.org/c/openbmc/obmc-console/+/61581
• bmcweb: https://gerrit.openbmc.org/c/openbmc/bmcweb/+/61580

[gtmills]

This merged. Thanks @ninadpalsule !
I am going to close this.