API Guide

Table 1. Redfish authentication and authorization (continued)
Redfish actions Authentication required Authorization required
View OData service document No No
View message registry No No
View Redfish version URI No No
View JSONSchemaFile resource URI No No
View JSON schemas URI No No
The Redfish service provides access to Redfish URLs by using the following methods:
● Basic authentication: In this method, user name and password are provided for each Redfish API request.
● Session-based authentication: This method is used while issuing multiple Redfish operation requests.
○ Session login is initiated by accessing the Create session URI. The response for this request includes an X-Auth-Token
header with a session token. Authentication for subsequent requests is made using the X-Auth-Token header.
○ Session logout is performed by issuing a DELETE of the Session resource provided by the Login operation including the
X-Auth-Token header.
NOTE: The iDRAC firmware incorporates the concept of application sessions for various existing interfaces such as
the web interface, WSMan, and RACADM. With the introduction of Redfish-specific sessions, Redfish inherits the
characteristics of web server sessions and the property Session Timeout inherits the web server session timeout value.
NOTE: To ensure a secure connection, Dell recommends using TLS 1.1 or later.
Roles and privileges
To allow different levels of access to Redfish services, you can create user accounts with specific roles. The following table lists
the roles and the privileges assigned to them:
Table 2. Roles and privileges
Role Assigned privileges OEM privileges
Administrator
● Login
● ConfigureComponents
● ConfigureManager
● ConfigureSelf
● ConfigureUsers
● ClearLogs
● AccessVirtualConsole
● AccessVirtualMedia
● TestAlerts
● ExecuteDebugCommands
Operator
● Login
● ConfigureComponents
● ConfigureSelf
-
ReadOnly
● Login
-
iDRAC licensing
Redfish support is included in all license types of iDRAC. However, some of the iDRAC features require specific licenses. If a
required license is not present, certain Redfish APIs may not be accessible and return an HTTP 403 status code. 403 implies
that there is no sufficient privileges. In other cases, some of the properties in certain resource may not be returned in a
response. The service may also return errors when such properties are modified. For information of specific license requirements
for the resources, see Redfish resources on page 17.
Redfish-based systems management
11