aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-07-15Also drop the new duo table when destroying the databaseRuss Allbery
In Wallet::Admin, add duo to the list of tables to drop when either destroying or reinitializing the database. Change-Id: I78790927f7d53b8d596e6ccb7c2340a341e404ae Reviewed-on: https://gerrit.stanford.edu/1549 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Document enctype reference table population in NEWSRuss Allbery
Change-Id: I3b3a035817e7e8f1c0e9709505490ce0ec299f3d Reviewed-on: https://gerrit.stanford.edu/1548 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-15Add contrib wallet-rekey-periodic scriptRuss Allbery
Add a new contrib script, wallet-rekey-periodic, which is used at Stanford to periodically rekey hosts from cron. Change-Id: Ic1f515da44e55623f7d6864f9a3cebf24c08e13b Reviewed-on: https://gerrit.stanford.edu/1547 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Test for Perl strict and minimum versionRuss Allbery
Fix strictness issues across the whole code base, and ensure that all Perl scripts enable warnings. (Hopefully enabling warnings won't cause problems for the server.) Change-Id: I4dee49f7a6bcbeeee21d74bf61a1fd26514f832c Reviewed-on: https://gerrit.stanford.edu/1532 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Update Perl POD tests to rra-c-util 5.5Russ Allbery
Now that the Perl directory has been reorganized, it's easier to synchronize with the standard rra-c-util tests. Change-Id: I97a03d06ff964edcc85ab8788af281b7bc321235 Reviewed-on: https://gerrit.stanford.edu/1531 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Switch to Module::Build for the Perl moduleRuss Allbery
The wallet server now requires Perl 5.8 or later (instead of 5.006 in previous versions) and is now built with Module::Build instead of ExtUtils::MakeMaker. This should be transparent to anyone not working with the source code, since Perl 5.8 was released in 2002, but Module::Build is now required to build the wallet server. It is included in some versions of Perl, or can be installed separately from CPAN, distribution packages, or other sources. Also reorganize the test suite to use subdirectories. Change-Id: Id06120ba2bad1ebbfee3d8a48ca2f25869463165 Reviewed-on: https://gerrit.stanford.edu/1530 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Update to rra-c-util 5.5 and C TAP Harness 3.1Russ Allbery
Update to rra-c-util 5.5: * Use Lancaster Consensus environment variables to control tests. * Use calloc or reallocarray for protection against integer overflows. * Suppress warnings from Kerberos headers in non-system paths. * Assume calloc initializes pointers to NULL. * Assume free(NULL) is properly ignored. * Improve error handling in xasprintf and xvasprintf. * Check the return status of snprintf and vsnprintf properly. * Preserve errno if snprintf fails in vasprintf replacement. Update to C TAP Harness 3.1: * Reopen standard input to /dev/null when running a test list. * Don't leak extraneous file descriptors to tests. * Suppress lazy plans and test summaries if the test failed with bail. * runtests now treats the command line as a list of tests by default. * The full test executable path can now be passed to runtests -o. * Improved harness output for tests with lazy plans. * Improved harness output to a terminal for some abort cases. * Flush harness output after each test even when not on a terminal. Change-Id: I05161eb3d3be49a98f7762e876cb114da0c84e9a Reviewed-on: https://gerrit.stanford.edu/1529 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Show the error message if verifier-netdb creation failsRuss Allbery
Change-Id: I1acd7894316fc96943b9eda5e3a9abb9d229646c Reviewed-on: https://gerrit.stanford.edu/1528 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11List all SQL files separately in Makefile.amRuss Allbery
Otherwise, they won't be copied properly to the perl directory when building out of tree. Change-Id: Id178d1b58d14a3595f372e25744dbdc61a81ff34 Reviewed-on: https://gerrit.stanford.edu/1527 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Clean up foreign keys and indices for history tablesRuss Allbery
Previous versions had erroneous foreign key constraints between the object history table and the objects table. Remove those constraints, and an incorrect linkage in the schema for the ACL history, and add indices for the object type, name, and ACL instead. Change-Id: Ie0ff2448caa82c7a533a1b9ff5c13029bb6ae4ef Reviewed-on: https://gerrit.stanford.edu/1526 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix test cleanup code to run during global destructionRuss Allbery
If we don't run the code to delete the wallet database very late, destruction of the SQLite objects may recreate the database file. Move the unlink to an END block to avoid this problem. Change-Id: Ib5ec2cbd08ba24c99f3dfa1daa01488931c5958f Reviewed-on: https://gerrit.stanford.edu/1525 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Add some missing stopwords in POD documentationRuss Allbery
Change-Id: Ieb29af8a3bcf61cdebb1d8b7b2a5b8868a3586dc Reviewed-on: https://gerrit.stanford.edu/1524 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Undo email address change for verifier testRuss Allbery
The global replacement of my email address broke this test as well since I was using my address as part of the test. Revert to the previous email address, since it's just example data. Change-Id: Iaebcf4b4556308d5a69fbe2c8b59b05304dfbf66 Reviewed-on: https://gerrit.stanford.edu/1523 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix verifier-netdb test for Heimdal, email addressRuss Allbery
Undo the email address renaming for verifier-netdb as well, since this has to use rra@stanford.edu for right now. Adjust so that the test is not skipped with Heimdal Kerberos user space. Change-Id: I0a0e16e1044fe6057a310cc419477a34052ffcda Reviewed-on: https://gerrit.stanford.edu/1522 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Fix verifier-ldap-attr test from email address changeRuss Allbery
This has to use rra@stanford.edu to work at all (and badly needs some sort of mock LDAP environment rather than what it's doing now). Change-Id: I0961c7f97633eb7e29e391804a6803195564d74b Reviewed-on: https://gerrit.stanford.edu/1521 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust Heimdal keytab object tests to not compare keytabsRuss Allbery
For some reason, two keytabs are comparing inequal even after masking the timestamp but both keytabs work for authentication. Stop doing a data comparison and instead attempt authentications with both keytabs as a more reliable test. Change-Id: I4bd0712d492b78f09e95ffbed3461d97613d9d0a Reviewed-on: https://gerrit.stanford.edu/1520 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust Wallet::Admin test for new schema versionRuss Allbery
We now have a 0.09 schema, so test upgrading from 0.07 to 0.09 in two steps. Change-Id: I0e7af4371ba78aa69a9b7be59239f10c86e1fade Reviewed-on: https://gerrit.stanford.edu/1519 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust ACL test for new SQLite autoincrement behaviorRuss Allbery
Similar to server, the ID of the last ACL created may vary depending on whether SQLite reuses the last autoincrement key when the highest-numbered record is deleted. Accept either possibility. Change-Id: I2dd3b3cbbdf32931820ff799ca06f751c37a4cbd Reviewed-on: https://gerrit.stanford.edu/1518 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Adjust server test for new SQLite autoincrement behaviorRuss Allbery
SQLite now, when the highest-numbered record with an autoincrement key is deleted, will reuse that number instead of incrementing further. Adjust the test suite so that this ambiguity is never encountered, since it's not part of what we're testing. Change-Id: I08c0c1c3fae82556d0f016b95db2992bdded1775 Reviewed-on: https://gerrit.stanford.edu/1517 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Add new object type for Duo integrationsRuss Allbery
A new object type, duo (Wallet::Object::Duo), is now supported. This creates an integration with the Duo Security cloud multifactor authentication service and allows retrieval of the integration key, secret key, and admin hostname. Currently, only UNIX integration types are supported. The Net::Duo Perl module is required to use this object type. New configuration settings are required as well; see Wallet::Config for more information. To enable this object type for an existing wallet database, use wallet-admin to register the new object. Change-Id: I2c0dac75e81f526b34d6b509c4bdaecb43dd4a9d Reviewed-on: https://gerrit.stanford.edu/1516 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-07-11Ignore new Perl MYMETA.json fileRuss Allbery
Change-Id: I64dcd9fc393edba60f3a8d17ff2b59f8d51e131f Reviewed-on: https://gerrit.stanford.edu/1515 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-05-27Added /cron principals to Stanford policy and summaryJon Robertson
cron principals were being rejected due to not being a part of the Stanford Policy module. Change-Id: Ic67a8e2bce8474431163b74d97c2bf1fb184a4b7 Reviewed-on: https://gerrit.stanford.edu/1488 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-04-13Change my email address to eagle@eyrie.orgRuss Allbery
Change-Id: I4c2b5d7c807d6c27dd18a3b92eef66d21287d21e Reviewed-on: https://gerrit.stanford.edu/1481 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-08Randomize the password on Heimdal principal creationRuss Allbery
When creating new principals in a Heimdal KDC, generate a long, random password as the temporary password of the disabled principal before randomizing keys. This is necessary if password quality is being enforced on create calls. Since the principal is always inactive until the keys have been randomized, the password should not need to be secure (and indeed is not cryptographically random). Change-Id: If519a82475bb0d387a19d16ef1e024b0da64779a Reviewed-on: https://gerrit.stanford.edu/1374 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Fix test skip count in the verifier-ldap-attr testRuss Allbery
When the correct Kerberos tickets aren't available, this test skipped the wrong number of tests. Change-Id: Icf27178fe88027f38764285bb671560e051f9105 Reviewed-on: https://gerrit.stanford.edu/1373 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add additional stopwords for POD spelling testsRuss Allbery
Change-Id: I7eefcb5eab2e35e8d45baa6e868f1f00867c6b62 Reviewed-on: https://gerrit.stanford.edu/1372 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Update Test::RRA modules from the current rra-c-utilRuss Allbery
Further documentation of the changes will come later when the rest of rra-c-util files have been updated and the package makes more use of these modules, but this fixes a spelling error test failure. Change-Id: Ia885c4ab103235a1f6a2bf2b86d5a32c93751d89 Reviewed-on: https://gerrit.stanford.edu/1371 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add AM_PROG_AR to configure.ac for newer AutomakeRuss Allbery
Change-Id: I422a014c3a2611324c2cdebd364d81f2e91aadd7 Reviewed-on: https://gerrit.stanford.edu/1370 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Fix wallet-rekey on keytabs containing multiple principalsRuss Allbery
Fix wallet-rekey on keytabs containing multiple principals. Previous versions assumed one could concatenate keytab files together to make a valid keytab file, which doesn't work with some Kerberos libraries. This caused new keys downloaded for principals after the first to be discarded. As a side effect of this fix, wallet-rekey always appends new keys directly to the existing keytab file, and never creates a backup copy of that file. Change-Id: I5f863239ce4ebba66b35ff09454f2897367bd359 Reviewed-on: https://gerrit.stanford.edu/1369 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-11-01Flesh out TODO with lots more workRuss Allbery
Change-Id: I8f63cfd9692039f37ecfd46ab6072aa2f71c344d Reviewed-on: https://gerrit.stanford.edu/1328 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-10-29ACL.pm: Fix a place where the acl history was getting raw timestampJon Robertson
The acl_history table needed to get the DateTime object rather than the raw epoch timestamp in one place. This was causing errors adding new lines to the history. Change-Id: I9c971819484cd0b26cb2561549246c284afc55a1 Reviewed-on: https://gerrit.stanford.edu/1325 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-10-29Changed postgres schema file to remove referenceJon Robertson
The reference from object_history to the objects table needed to be removed. We still want the relationship in the DBIx::Class files, but we don't want the relationship enforced as we want to keep history entries for deleted objects. Change-Id: Id927404b996fe171a8f5fc0747ccb0abddcbe1f2 Reviewed-on: https://gerrit.stanford.edu/1324 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-09-14Clarify use of the tivoli-key file type in Stanford policyRuss Allbery
tivoli-key used to always contain the entirety of the TSM.PWD file, but it's more useful to store only the encryption key in password form. Change-Id: Id770691fb756b7675ec0fe2eee1308a8974c9c3f Reviewed-on: https://gerrit.stanford.edu/1309 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-05-28Add use Wallet::Config to Wallet::ACL::LDAP::AttributeRuss Allbery
Normally this will already be loaded, but since we use it directly, make sure it is loaded. Change-Id: Ibc4ca874b659f316268957cbf77ead9d49bc3ca0 Reviewed-on: https://gerrit.stanford.edu/1205 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-05-28Fix documentation of ldap_map_principal hookRuss Allbery
Fix the Wallet::Config documentation for the ldap-attr verifier to reference an ldap_map_principal hook, not ldap_map_attribute, matching the implementation. Change-Id: I258edcf69d4dcb3d2ec8dc66db4b768d91645fc4 Reviewed-on: https://gerrit.stanford.edu/1204 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Fix several bugs in Wallet::Object::Keytab enctype handlingRuss Allbery
There was a missing resultset() call in one place and the wrong resultset used in a different place, causing the enctype management code to not work. Change-Id: I796169c5968ec164f90f3cd75541dd346dd50fdf Reviewed-on: https://gerrit.stanford.edu/1070 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Improve the keytab enctype test suiteRuss Allbery
Fix recognition of the syntax error from Heimdal's klist -ke, which doesn't exit with status 1. Assume that if we didn't see any known enctypes, we're dealing with Heimdal. Remove the code to populate the enctype table, since we do that in Wallet::Admin now. Show the error if adding an enctype fails. Change-Id: I40da967ef6868e5cd51a1238e1c6324386468134 Reviewed-on: https://gerrit.stanford.edu/1069 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Populate the enctype table by default on new installRuss Allbery
We actually know the enctypes that are in most common use, so rather than making the user poke them into the database manually, save them a step and put them in. We still need some mechanism to remove the DES enctype and add new ones, though. Change-Id: I2eda7e29897ec16a04a10f0c7289878c853b7531 Reviewed-on: https://gerrit.stanford.edu/1068 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-15Allow afs/* principals in the Stanford naming policyRuss Allbery
Change-Id: I59db1e8638a602d9c118ac01da17280c9ed7d005 Reviewed-on: https://gerrit.stanford.edu/1067 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-12Further clarify the ssl-key Stanford naming policyRuss Allbery
Adam requested some clarification on whether the name of the object should be fully-qualified or not (since we didn't in the legacy naming scheme). Change-Id: I52fcab71e54aee38f0c03eff774f927c5836ad03 Reviewed-on: https://gerrit.stanford.edu/1054 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update stanford.conf example to use Wallet::Policy::StanfordRuss Allbery
Eliminate all the verification code that moved into the policy object. Update coding style and remove some settings that were no longer used at Stanford. Change-Id: I3a098bc318abe4bc9dd82e86186da012e5c2cd27 Reviewed-on: https://gerrit.stanford.edu/1025 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update stanford.conf to latest production versionRuss Allbery
Update the example wallet.conf from Stanford's configuration to our latest production version. Change-Id: Ic652b7a2fadb53a688a0c0c16b5ea7e429cff79e Reviewed-on: https://gerrit.stanford.edu/1024 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update the wallet ACL for its-apps in Stanford policyRuss Allbery
Change-Id: Ie4c0af7b218fcd00fc6f39514967c9e38e12b1be Reviewed-on: https://gerrit.stanford.edu/1023 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-29Make t/admin.t test robust against missing sqlite3 binaryRuss Allbery
If we can't find the sqlite3 binary, just skip the upgrade test. Change-Id: I20e9ad1978a189cf059756e15794ea4d954f3867 Reviewed-on: https://gerrit.stanford.edu/994 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-29admin.t: Fixed problem with not upgrading from unversioned dbJon Robertson
Since we were reinstalling a fresh database via the same DBIx::Class functions, the database we installed to upgrade from a non-versioned setup was still getting a version table. Switched to delete the database and reload it fresh from the sqlite3 command itself. Change-Id: Ia09bbc279ab834b5d17453b4282e18dd3a36f857 Reviewed-on: https://gerrit.stanford.edu/993 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Update the comment in README about supported ACL typesRuss Allbery
Change-Id: I171722d03bebc812bb113d1366457d75a94e468a Reviewed-on: https://gerrit.stanford.edu/991 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Fix return status of Wallet::Schemarelease/1.0Russ Allbery
The module wasn't always returning a true value when loaded. Change-Id: I998ab25509cb9079034cae6aca467024ec6b4949 Reviewed-on: https://gerrit.stanford.edu/990 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Accept any characters in the argument to the comment commandRuss Allbery
It's nice to have spaces and other special characters in comments, so allow any character rather than applying the normal argument filtering. Change-Id: Iec8584f1f6893906db7245fbe571d62ebc60f72a Reviewed-on: https://gerrit.stanford.edu/989 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Add NEWS entry and doc reference to Wallet::Policy::StanfordRuss Allbery
Change-Id: If833e4a6434362e04e738274a6f7fb276a9efe51 Reviewed-on: https://gerrit.stanford.edu/988 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Skip the wa-keyring tests if WebAuth is too oldRuss Allbery
If the WebAuth module is too old, don't just fail the tests. Skip them instead. This will let the Debian package build in unstable. Change-Id: I84c97f23ff7fbf89f2fd797898ebb4ab5e58eee6 Reviewed-on: https://gerrit.stanford.edu/987 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-06 08:04:38 +0000