diff options
| author | Russ Allbery <eagle@eyrie.org> | 2016-01-03 19:29:20 -0800 |
|---|---|---|
| committer | Russ Allbery <eagle@eyrie.org> | 2016-01-03 19:29:20 -0800 |
| commit | 23a6b180f975c24c8ee4190467c74b78fde0d084 (patch) | |
| tree | a729417aa495ad72256d567b04cf8a0601bfa95f /docs/design-acl | |
| parent | 99c718eff041657704a50589486bde2f9e4391f7 (diff) | |
Add Wallet::ACL::External ACL type
A new ACL type, external (Wallet::ACL::External), is now supported.
This ACL runs an external command to check if access is allowed, and
passes the principal and the ACL identifier to that command. To
enable this ACL type for an existing wallet database, use wallet-admin
to register the new verifier.
Change-Id: I21b72b4373eefc92985aca1505e2d1a1ec699602
Diffstat (limited to 'docs/design-acl')
| -rw-r--r-- | docs/design-acl | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/docs/design-acl b/docs/design-acl index 32ac508..b8bb8b3 100644 --- a/docs/design-acl +++ b/docs/design-acl @@ -50,6 +50,12 @@ Semantics ACL Schemes + external + + The <identifier> is arguments to an external command. Access is + granted if the external command returns success. The standard remctl + environment variables are exposed to the external command. + krb5 The <identifier> is a fully-qualified Kerberos principal. Access is |