From 008e6a737030146a344af429e755a2ee2480cee6 Mon Sep 17 00:00:00 2001 From: cmjishnu <112371532+cmjishnu@users.noreply.github.com> Date: Fri, 6 Mar 2026 00:34:17 +0530 Subject: [PATCH 1/2] Update GenerateSecretKeyRequired response_code (#1410) GenerateSecretKeyRequired should behave similar to PasswordChangeRequired. Expecting 201 status code instead of 403. Tested by curl --insecure -X POST -D headers.txt https://${bmc}/redfish/v1/SessionService/ Sessions -H "Content-Type: application/json" -d '{"UserName":"MFAUser", "Password":"0penBmc0"}' -I HTTP/1.1 201 Created Allow: GET, HEAD, POST OData-Version: 4.0 X-Auth-Token: PwGj0UUtSefbWsczZC2C Location: /redfish/v1/SessionService/Sessions/OZvC3sXnEU Strict-Transport-Security: max-age=31536000; includeSubdomains Pragma: no-cache Cache-Control: no-store, max-age=0 X-Content-Type-Options: nosniff Content-Type: application/json Date: Tue, 03 Mar 2026 12:35:22 GMT Content-Length: 1493 Signed-off-by: cmjishnu Co-authored-by: cmjishnu --- redfish-core/src/error_messages.cpp | 2 +- scripts/parse_registries.py | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/redfish-core/src/error_messages.cpp b/redfish-core/src/error_messages.cpp index 3db050ae6..07813d7d3 100644 --- a/redfish-core/src/error_messages.cpp +++ b/redfish-core/src/error_messages.cpp @@ -2331,7 +2331,7 @@ void generateSecretKeyRequired(crow::Response& res, const boost::urls::url_view_base& arg1) { res.result(boost::beast::http::status::forbidden); - addMessageToErrorJson(res.jsonValue, generateSecretKeyRequired(arg1)); + addMessageToJsonRoot(res.jsonValue, generateSecretKeyRequired(arg1)); } } // namespace messages diff --git a/scripts/parse_registries.py b/scripts/parse_registries.py index 82148fd6f..08d741b77 100755 --- a/scripts/parse_registries.py +++ b/scripts/parse_registries.py @@ -417,6 +417,7 @@ def make_error_function( "Created", "Success", "PasswordChangeRequired", + "GenerateSecretKeyRequired", ] if entry_id in addMessageToJson: From 74fb39280ddedf572196854dc8f01803ecc795d7 Mon Sep 17 00:00:00 2001 From: Jishnu CM Date: Wed, 18 Feb 2026 23:37:53 -0600 Subject: [PATCH 2/2] Update GenerateSecretKeyRequired response_code Currently, GenerateSecretKeyRequired is treated as 403 Forbidden, which would incorrectly imply the session was not created, when it should be treated as an informational message accompanying a successful session creation (with 201 response code), exactly like PasswordChangeRequired. According to the Redfish spec [1], page 202, 203 (Section 13.5.5): * "Shall allow a session login without the Token property and include the @Message.ExtendedInfo in the response containing the GenerateSecretKeyRequired message. This indicates to the client that their session is restricted to performing only the GenerateSecretKey action on their ManagerAccount resource before access is granted." * "Shall allow a POST operation on the VerifyTimeBasedOneTimePassword" action on the ManagerAccount resource associated with the account." * "Shall allow a DELETE operation on Session resources representing open sessions associated with the account." * "May allow GET operations on unauthenticated resources, such as the ServiceRoot resource." * "For all other operations, the service shall respond with the HTTP 403 Forbidden status code and an error response with the GenerateSecretKeyRequired message from the Base Message Registry." Reference: [1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0266_1.24.0.pdf#page=202&zoom=100,0,789 Tested By: * Enabled Multi-Factor Authentication (system-wide option) * When user tries to login with username and password, session is created (201 is returned), with GenerateSecretKeyRequired message in "@Message.ExtendedInfo" * Any operations on restricted resources returned GenerateSecretKeyRequired with 403 Forbidden error code. Change-Id: Iec6c925f04584b2cdd93aec743b04d6a8dbde4bc Signed-off-by: Jishnu CM --- redfish-core/src/error_messages.cpp | 1 - scripts/parse_registries.py | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/redfish-core/src/error_messages.cpp b/redfish-core/src/error_messages.cpp index 07813d7d3..819dc10b4 100644 --- a/redfish-core/src/error_messages.cpp +++ b/redfish-core/src/error_messages.cpp @@ -2330,7 +2330,6 @@ nlohmann::json::object_t generateSecretKeyRequired( void generateSecretKeyRequired(crow::Response& res, const boost::urls::url_view_base& arg1) { - res.result(boost::beast::http::status::forbidden); addMessageToJsonRoot(res.jsonValue, generateSecretKeyRequired(arg1)); } diff --git a/scripts/parse_registries.py b/scripts/parse_registries.py index 08d741b77..09c193c84 100755 --- a/scripts/parse_registries.py +++ b/scripts/parse_registries.py @@ -232,7 +232,7 @@ def get_response_code(entry_id: str) -> str | None: "Created": "created", "EventSubscriptionLimitExceeded": "service_unavailable", "GeneralError": "internal_server_error", - "GenerateSecretKeyRequired": "forbidden", + "GenerateSecretKeyRequired": None, "InsufficientPrivilege": "forbidden", "InsufficientStorage": "insufficient_storage", "InstallFailed": "internal_server_error",