<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 2/10/2020 12:21 PM, Richard Hanley
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAH1kD+aMerQJmUox1sDtuRFNAFUchyum3w1sbbfyKYfOon_P2A@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<br>
<div dir="ltr">
<div>One possible compromise is to make the account collection
discoverable, but only put the users account into the response
(unless it is an admin user).</div>
<div><br>
</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Mon, Feb 10, 2020 at 9:36
AM Joseph Reynolds <<a href="mailto:jrey@linux.ibm.com"
moz-do-not-send="true">jrey@linux.ibm.com</a>> wrote:<br>
<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">The
Redfish spec recently changed to allow users with the Login <br>
privilege to enumerate all BMC users. Previously only the
admin user <br>
could do this. I disagree with this change and believe it is
an <br>
unnecessary information exposure. Details are in the Redfish
forum post.<br>
<br>
<a
href="https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://redfishforum.com/thread/281/manageraccountcollection-change-allows-account-enumeration</a><br>
<br>
<br>
OpenBMC has the corresponding implementation change pending
here:<br>
<a
href="https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/28881"
rel="noreferrer" target="_blank" moz-do-not-send="true">https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/28881</a><br>
<br>
<br>
</blockquote>
</div>
</blockquote>
<p>This was discussed in the Redfish call today. Redfish will update
the documentation and registry to make clear only the current
account will be shown in the AccountCollection if the user lacks
the ConfigureUsers privilege (Richard's suggestion). A response in
the thread explains the same.<br>
<br>
Thanks, <br>
Gunnar<br>
</p>
<p><br>
</p>
</body>
</html>