Allow afs/* principals in the Stanford naming policy

Change-Id: I59db1e8638a602d9c118ac01da17280c9ed7d005
Reviewed-on: https://gerrit.stanford.edu/1067
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>

1 files changed, 4 insertions, 0 deletions

diff --git a/perl/Wallet/Policy/Stanford.pm b/perl/Wallet/Policy/Stanford.pm
index 4386594..72abd09 100644
--- a/perl/Wallet/Policy/Stanford.pm
+++ b/perl/Wallet/Policy/Stanford.pm
@@ -266,6 +266,10 @@ sub verify_name {
             if ($instance !~ /^[a-z0-9-]+\.[a-z0-9.-]+$/) {
                 return "host name $instance is not fully qualified";
             }
+        } elsif ($principal eq 'afs') {
+            if ($instance !~ /^[a-z0-9-]+\.[a-z0-9.-]+$/) {
+                return "AFS cell name $instance is not fully qualified";
+            }
         } elsif ($principal eq 'service') {
             if ($instance !~ /^[a-z0-9-]+$/) {
                 return "invalid service principal name $name";