From e59e274bb4bb90a051fefc09e2abd32bb4a57c1b Mon Sep 17 00:00:00 2001
From: Jarrod Johnson <jjohnson2@lenovo.com>
Date: Fri, 11 Sep 2026 14:59:54 -0400
Subject: [PATCH] Prepare to accept custom initial user/password

This allows user extension of systems with initial user/passwords that aren't known to the codebase.
---
 confluent_server/confluent/config/attributes.py    | 10 ++++++++++
 .../confluent/discovery/handlers/redfishbmc.py     | 14 ++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/confluent_server/confluent/config/attributes.py b/confluent_server/confluent/config/attributes.py
index b4800757..46168170 100644
--- a/confluent_server/confluent/config/attributes.py
+++ b/confluent_server/confluent/config/attributes.py
@@ -672,6 +672,16 @@ node = {
         'description': ('Password to use when connecting to the hardware '
                         'manager.  Aliases for this attribute include bmcpass and switchpass'),
     },
+    'secret.initialhardwaremanagementuser': {
+        'description': ('The initial username to use when connecting to the hardware '
+                        'manager before any changes are made to the hardware management '
+                        'user configuration'),
+    },
+    'secret.initialhardwaremanagementpassword': {
+        'description': ('The initial password to use when connecting to the hardware '
+                        'manager before any changes are made to the hardware management '
+                        'user configuration'),
+    },
     'ssh.trustnodes': {
         'description': ('Nodes that are allowed to ssh into the node, '
                         'expressed in noderange syntax.  This is used during '
diff --git a/confluent_server/confluent/discovery/handlers/redfishbmc.py b/confluent_server/confluent/discovery/handlers/redfishbmc.py
index a486f68d..c4e4a5af 100644
--- a/confluent_server/confluent/discovery/handlers/redfishbmc.py
+++ b/confluent_server/confluent/discovery/handlers/redfishbmc.py
@@ -22,6 +22,7 @@ import json
 
 import aiohmi.util.webclient as webclient
 
+
 async def get_host_interface_urls(wc, mginfo):
     returls = []
     hifurl = mginfo.get('HostInterfaces', {}).get('@odata.id', None)
@@ -79,7 +80,7 @@ class NodeHandler(generic.NodeHandler):
 
 
     def get_firmware_default_account_info(self):
-        raise Exception('This must be subclassed')
+        raise Exception('secret.initialhardwaremanagementuser and secret.initialhardwaremanagementpassword must be set')
 
     async def scan(self):
         await self.get_https_cert()
@@ -214,12 +215,21 @@ class NodeHandler(generic.NodeHandler):
         creds = self.configmanager.get_node_attributes(
             nodename, ['secret.hardwaremanagementuser',
                        'secret.hardwaremanagementpassword',
+                       'secret.initialhardwaremanagementuser',
+                       'secret.initialhardwaremanagementpassword',
                        'hardwaremanagement.manager',
                        'hardwaremanagement.method',
                        'console.method'],
             True)
         cd = creds.get(nodename, {})
-        defuser, defpass = self.get_firmware_default_account_info()
+        defuser = cd.get('secret.initialhardwaremanagementuser', {}).get('value', None)
+        defpass = cd.get('secret.initialhardwaremanagementpassword', {}).get('value', None)
+        if defuser is None or defpass is None:
+            ndefuser, ndefpass = self.get_firmware_default_account_info()
+            if not defuser:
+                defuser = ndefuser
+            if not defpass:
+                defpass = ndefpass
         user, passwd, _ = self.get_node_credentials(
                 nodename, creds, defuser, defpass)
         user = util.stringify(user)