diff options
Diffstat (limited to 'TODO')
| -rw-r--r-- | TODO | 66 |
1 files changed, 58 insertions, 8 deletions
@@ -27,6 +27,10 @@ Client: stored on the server is different than what's on disk. This will require server support as well for returning the checksum of a file. + * WALLET-80: Incorporate the wallet-rekey-periodic script (currently in + contrib) into the package and teach it how to ignore foreign + credentials. + Server Interface: * WALLET-13: Provide a way to get history for deleted objects and ACLs. @@ -67,6 +71,33 @@ Server Interface: keytab (maybe). Or, alternately, maybe we allow get of any keytab? Requires more thought. + * WALLET-69: "owner" should print the name as well as the number of the + ACL. Also check "getacl". + + * WALLET-70: Add command to list available types and schemes. + + * WALLET-72: Add a mechanism to automate owner updates based on + default_owner. + + * WALLET-79: Partially merge create and autocreate. create and autocreate + should do the same thing provided there is an autocreation configuration + available. If not, autocreate should fail and create should fall back on + checking for ADMIN privileges. + + * WALLET-83: Support file object renaming. + + * Rewrite server backends to use Net::Remctl::Backend. + + * Merge the Wallet::Logger support written by Commerzbank AG: create a + new class that handles logging, probably based on Log::Log4perl, and + add logging points to all of the core classes. + + * Support an authorization hook to determine whether or not to permit + autocreate. One requested example feature is to limit autocreate of + keytab objects to certain hosts involved in deployment. It should be + possible to write a hook that takes the information about what object + is being autocreated and can accept or decline. + ACLs: * WALLET-23: Error messages from ACL operations should refer to the ACLs @@ -93,6 +124,17 @@ ACLs: * WALLET-29: Investigate how best to support client authentication using anonymous PKINIT for things like initial system keying. + * WALLET-68: Generalize the current NetDB ACL type to allow a generic + remctl query for whether a particular user is authorized to create + host-based objects for a particular host. + + * WALLET-71: Add ldap-group ACL scheme. + + * WALLET-75: Provide a root-instance version of the ldap-attr (and + possibly the ldap-group) ACL schemes. + + * WALLET-81: Add a comment field to ACLs. + Database: * WALLET-30: Fix case-insensitivity bug in unique keys with MySQL for @@ -107,10 +149,6 @@ Objects: keytabs and allow the name to contain the realm if the Kerberos type is Heimdal. - * WALLET-4: Write a WebAuth keyring object store. It should support - attributes saying how long to keep old keys and how far in advance to - create new keys and update the keyring as needed on object download. - * WALLET-33: Use the Perl Authen::Krb5::Admin module instead of rolling our own kadmin code with Expect now that MIT Kerberos has made the kadmin API public. @@ -131,7 +169,8 @@ Objects: * WALLET-36: Implement an X.509 CA so that you can get certificate objects without storing them first. Need to resolve naming conventions if you want to run multiple CAs on the same wallet server (but why?). - Should this be a different type than stored certificates? + Should this be a different type than stored certificates? Consider + using hxtool as the underlying CA mechanism. * WALLET-37: Support returning the checksum of a file object stored in wallet so that one can determine whether the version stored on disk is @@ -145,6 +184,9 @@ Objects: for a particular host, allowing cleanup of all of those host's objects after retiring the host. + * WALLET-76: Support setting the disallow-svr flag on created principals. + In general, support setting arbitrary principal flags. + Reports: * WALLET-38: Add audit for references to unknown ACLs, possibly @@ -169,6 +211,9 @@ Reports: possibly use the notification service, although a version that sends mail directly would be useful external to Stanford. + * Merge the Commerzbank AG work to dump all the object history, applying + various search criteria to it, or clear parts of the object history. + Administrative Interface: * WALLET-42: Add a function to wallet-admin to purge expired entries. @@ -196,6 +241,8 @@ Documentation: * WALLET-46: Document all diagnostics for all wallet APIs. + * Document configuration with an Oracle database. + Code Style and Cleanup: * WALLET-47: There is a lot of duplicate code in wallet-backend. Convert @@ -215,8 +262,10 @@ Code Style and Cleanup: better internal API to reference the variables in it. * WALLET-52: Consider using Class::Accessor to get rid of the scaffolding - code to access object data, and a Wallet::Base class to handle things - like the error() method common to many classes. + code to access object data. Alternately, consider using Moose. + + * Rewrite the error handling to use exceptions instead of the C-style + return value and separate error call. Test Suite: @@ -233,7 +282,8 @@ Test Suite: use of shared code so that it can be broken into function components. * WALLET-57: Refactor the test suite for the wallet backend to try to - reduce the duplicated code. + reduce the duplicated code. Using a real mock infrastructure should + make this test suite much easier to write. * WALLET-58: Pull common test suite code into a Perl library that can be reused. |