Add log warning for cases when the ResourceEntity doesn't exist in the policy.
If we have a new BMC but old authz policy, this should give a good log on explaining why a request was unauthorized.
This happens when you query a resource whose entity dosent exist in the privilege registry. This resource will return no privileges which by default has unauthorized behavior.
PiperOrigin-RevId: 781114669
Change-Id: I959a4e571e3f10a4b7c562141fa937050d0a3504
diff --git a/redfish_authorization/redfish_authorizer.cc b/redfish_authorization/redfish_authorizer.cc
index 84e0808..3a5377e 100644
--- a/redfish_authorization/redfish_authorizer.cc
+++ b/redfish_authorization/redfish_authorizer.cc
@@ -696,6 +696,15 @@
std::vector<RedfishPrivileges> required_privilege_sets =
GetRequiredPrivileges(entity, operation);
+
+ if (required_privilege_sets.empty()) {
+ LOG(WARNING) << "No required privileges found for "
+ << ResourceEntityToString(entity) << " and operation "
+ << OperationToString(operation)
+ << ". This most likely means that you are using an outdated "
+ "redfish authz policy.";
+ }
+
for (const RedfishPrivileges& privileges : required_privilege_sets) {
// NOTE: there won't be an empty required privilege set ever; otherwise,
// we skip this required privilege set.
