aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2014-01-08Randomize the password on Heimdal principal creationRuss Allbery
When creating new principals in a Heimdal KDC, generate a long, random password as the temporary password of the disabled principal before randomizing keys. This is necessary if password quality is being enforced on create calls. Since the principal is always inactive until the keys have been randomized, the password should not need to be secure (and indeed is not cryptographically random). Change-Id: If519a82475bb0d387a19d16ef1e024b0da64779a Reviewed-on: https://gerrit.stanford.edu/1374 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add changelog for cherry-picked test fixdebian/1.0-4Russ Allbery
2014-01-06Fix test skip count in the verifier-ldap-attr testRuss Allbery
When the correct Kerberos tickets aren't available, this test skipped the wrong number of tests. Change-Id: Icf27178fe88027f38764285bb671560e051f9105 Reviewed-on: https://gerrit.stanford.edu/1373 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Fix test skip count in the verifier-ldap-attr testRuss Allbery
When the correct Kerberos tickets aren't available, this test skipped the wrong number of tests. Change-Id: Icf27178fe88027f38764285bb671560e051f9105 Reviewed-on: https://gerrit.stanford.edu/1373 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add additional dependencies for the test suiteRuss Allbery
* Add libauthen-sasl-perl and libnet-ldap-perl to Build-Depends for the test suite.
2014-01-06Add changelog for cherry-picked wallet-rekey fixRuss Allbery
2014-01-06Fix wallet-rekey on keytabs containing multiple principalsRuss Allbery
Fix wallet-rekey on keytabs containing multiple principals. Previous versions assumed one could concatenate keytab files together to make a valid keytab file, which doesn't work with some Kerberos libraries. This caused new keys downloaded for principals after the first to be discarded. As a side effect of this fix, wallet-rekey always appends new keys directly to the existing keytab file, and never creates a backup copy of that file. Change-Id: I5f863239ce4ebba66b35ff09454f2897367bd359 Reviewed-on: https://gerrit.stanford.edu/1369 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add additional stopwords for POD spelling testsRuss Allbery
Change-Id: I7eefcb5eab2e35e8d45baa6e868f1f00867c6b62 Reviewed-on: https://gerrit.stanford.edu/1372 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Update Test::RRA modules from the current rra-c-utilRuss Allbery
Further documentation of the changes will come later when the rest of rra-c-util files have been updated and the package makes more use of these modules, but this fixes a spelling error test failure. Change-Id: Ia885c4ab103235a1f6a2bf2b86d5a32c93751d89 Reviewed-on: https://gerrit.stanford.edu/1371 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Add AM_PROG_AR to configure.ac for newer AutomakeRuss Allbery
Change-Id: I422a014c3a2611324c2cdebd364d81f2e91aadd7 Reviewed-on: https://gerrit.stanford.edu/1370 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2014-01-06Fix wallet-rekey on keytabs containing multiple principalsRuss Allbery
Fix wallet-rekey on keytabs containing multiple principals. Previous versions assumed one could concatenate keytab files together to make a valid keytab file, which doesn't work with some Kerberos libraries. This caused new keys downloaded for principals after the first to be discarded. As a side effect of this fix, wallet-rekey always appends new keys directly to the existing keytab file, and never creates a backup copy of that file. Change-Id: I5f863239ce4ebba66b35ff09454f2897367bd359 Reviewed-on: https://gerrit.stanford.edu/1369 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-11-05Finalize changes for 1.0-3debian/1.0-3Russ Allbery
Change-Id: I5b10208b0b164e39242cf20ed4bd57398a3b9898
2013-11-05Depend on the DateTime::Format::* modulesRuss Allbery
* Move the DateTime::Format::* Perl modules for various databases to Depends from Recommends and add the Pg and MySQL versions as alternatives. Change-Id: I39ea83bb2dc2d2042ba539895738e0fd9b362254
2013-11-05Add changelog for upstream cherry-picksRuss Allbery
Change-Id: I8f4b7b7798ee34271c5bfc1b46733a3649064192
2013-11-05Fix several bugs in Wallet::Object::Keytab enctype handlingRuss Allbery
There was a missing resultset() call in one place and the wrong resultset used in a different place, causing the enctype management code to not work. Change-Id: I796169c5968ec164f90f3cd75541dd346dd50fdf Reviewed-on: https://gerrit.stanford.edu/1070 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-11-05ACL.pm: Fix a place where the acl history was getting raw timestampJon Robertson
The acl_history table needed to get the DateTime object rather than the raw epoch timestamp in one place. This was causing errors adding new lines to the history. Change-Id: I9c971819484cd0b26cb2561549246c284afc55a1 Reviewed-on: https://gerrit.stanford.edu/1325 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-11-05Changed postgres schema file to remove referenceJon Robertson
The reference from object_history to the objects table needed to be removed. We still want the relationship in the DBIx::Class files, but we don't want the relationship enforced as we want to keep history entries for deleted objects. Change-Id: Id927404b996fe171a8f5fc0747ccb0abddcbe1f2 Reviewed-on: https://gerrit.stanford.edu/1324 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-11-01Flesh out TODO with lots more workRuss Allbery
Change-Id: I8f63cfd9692039f37ecfd46ab6072aa2f71c344d Reviewed-on: https://gerrit.stanford.edu/1328 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-10-29ACL.pm: Fix a place where the acl history was getting raw timestampJon Robertson
The acl_history table needed to get the DateTime object rather than the raw epoch timestamp in one place. This was causing errors adding new lines to the history. Change-Id: I9c971819484cd0b26cb2561549246c284afc55a1 Reviewed-on: https://gerrit.stanford.edu/1325 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-10-29Changed postgres schema file to remove referenceJon Robertson
The reference from object_history to the objects table needed to be removed. We still want the relationship in the DBIx::Class files, but we don't want the relationship enforced as we want to keep history entries for deleted objects. Change-Id: Id927404b996fe171a8f5fc0747ccb0abddcbe1f2 Reviewed-on: https://gerrit.stanford.edu/1324 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-09-14Clarify use of the tivoli-key file type in Stanford policyRuss Allbery
tivoli-key used to always contain the entirety of the TSM.PWD file, but it's more useful to store only the encryption key in password form. Change-Id: Id770691fb756b7675ec0fe2eee1308a8974c9c3f Reviewed-on: https://gerrit.stanford.edu/1309 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-05-28Add use Wallet::Config to Wallet::ACL::LDAP::AttributeRuss Allbery
Normally this will already be loaded, but since we use it directly, make sure it is loaded. Change-Id: Ibc4ca874b659f316268957cbf77ead9d49bc3ca0 Reviewed-on: https://gerrit.stanford.edu/1205 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-05-28Fix documentation of ldap_map_principal hookRuss Allbery
Fix the Wallet::Config documentation for the ldap-attr verifier to reference an ldap_map_principal hook, not ldap_map_attribute, matching the implementation. Change-Id: I258edcf69d4dcb3d2ec8dc66db4b768d91645fc4 Reviewed-on: https://gerrit.stanford.edu/1204 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Fix several bugs in Wallet::Object::Keytab enctype handlingRuss Allbery
There was a missing resultset() call in one place and the wrong resultset used in a different place, causing the enctype management code to not work. Change-Id: I796169c5968ec164f90f3cd75541dd346dd50fdf Reviewed-on: https://gerrit.stanford.edu/1070 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Improve the keytab enctype test suiteRuss Allbery
Fix recognition of the syntax error from Heimdal's klist -ke, which doesn't exit with status 1. Assume that if we didn't see any known enctypes, we're dealing with Heimdal. Remove the code to populate the enctype table, since we do that in Wallet::Admin now. Show the error if adding an enctype fails. Change-Id: I40da967ef6868e5cd51a1238e1c6324386468134 Reviewed-on: https://gerrit.stanford.edu/1069 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-16Populate the enctype table by default on new installRuss Allbery
We actually know the enctypes that are in most common use, so rather than making the user poke them into the database manually, save them a step and put them in. We still need some mechanism to remove the DES enctype and add new ones, though. Change-Id: I2eda7e29897ec16a04a10f0c7289878c853b7531 Reviewed-on: https://gerrit.stanford.edu/1068 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-15Allow afs/* principals in the Stanford naming policyRuss Allbery
Change-Id: I59db1e8638a602d9c118ac01da17280c9ed7d005 Reviewed-on: https://gerrit.stanford.edu/1067 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-12Further clarify the ssl-key Stanford naming policyRuss Allbery
Adam requested some clarification on whether the name of the object should be fully-qualified or not (since we didn't in the legacy naming scheme). Change-Id: I52fcab71e54aee38f0c03eff774f927c5836ad03 Reviewed-on: https://gerrit.stanford.edu/1054 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update stanford.conf example to use Wallet::Policy::StanfordRuss Allbery
Eliminate all the verification code that moved into the policy object. Update coding style and remove some settings that were no longer used at Stanford. Change-Id: I3a098bc318abe4bc9dd82e86186da012e5c2cd27 Reviewed-on: https://gerrit.stanford.edu/1025 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update stanford.conf to latest production versionRuss Allbery
Update the example wallet.conf from Stanford's configuration to our latest production version. Change-Id: Ic652b7a2fadb53a688a0c0c16b5ea7e429cff79e Reviewed-on: https://gerrit.stanford.edu/1024 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-08Update the wallet ACL for its-apps in Stanford policyRuss Allbery
Change-Id: Ie4c0af7b218fcd00fc6f39514967c9e38e12b1be Reviewed-on: https://gerrit.stanford.edu/1023 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-29Add changelog for cherry-picked t/admin.t fixesdebian/1.0-2Russ Allbery
Change-Id: Ic1a9420955614c67cfc4e5e01e0b7f0458569a81
2013-03-29Make t/admin.t test robust against missing sqlite3 binaryRuss Allbery
If we can't find the sqlite3 binary, just skip the upgrade test. Reviewed-on: https://gerrit.stanford.edu/994 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu> (cherry picked from commit 15fea5552df18667b39fce620488ed6c48bd7329) Change-Id: I26cd8148d58368767f39d135afe4c721652b0740
2013-03-29admin.t: Fixed problem with not upgrading from unversioned dbJon Robertson
Since we were reinstalling a fresh database via the same DBIx::Class functions, the database we installed to upgrade from a non-versioned setup was still getting a version table. Switched to delete the database and reload it fresh from the sqlite3 command itself. Reviewed-on: https://gerrit.stanford.edu/993 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu> (cherry picked from commit 2a8fb416b5eb2db697e03ddce930c21656ccbc88) Change-Id: If097c6edff916746e332e04c8d479a858a5773c4
2013-03-29Make t/admin.t test robust against missing sqlite3 binaryRuss Allbery
If we can't find the sqlite3 binary, just skip the upgrade test. Change-Id: I20e9ad1978a189cf059756e15794ea4d954f3867 Reviewed-on: https://gerrit.stanford.edu/994 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-29admin.t: Fixed problem with not upgrading from unversioned dbJon Robertson
Since we were reinstalling a fresh database via the same DBIx::Class functions, the database we installed to upgrade from a non-versioned setup was still getting a version table. Switched to delete the database and reload it fresh from the sqlite3 command itself. Change-Id: Ia09bbc279ab834b5d17453b4282e18dd3a36f857 Reviewed-on: https://gerrit.stanford.edu/993 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Update the comment in README about supported ACL typesRuss Allbery
Change-Id: I171722d03bebc812bb113d1366457d75a94e468a Reviewed-on: https://gerrit.stanford.edu/991 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Really finalize the date of the 1.0-1 releasedebian/1.0-1Russ Allbery
Change-Id: I8a40fcaaa2a5effdea495ecc2f6a03a63543e0b9
2013-03-27Merge tag 'upstream/1.0' into debianRuss Allbery
Upstream version 1.0
2013-03-27Imported Upstream version 1.0upstream/1.0Russ Allbery
2013-03-27Fix return status of Wallet::Schemarelease/1.0Russ Allbery
The module wasn't always returning a true value when loaded. Change-Id: I998ab25509cb9079034cae6aca467024ec6b4949 Reviewed-on: https://gerrit.stanford.edu/990 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Update release date for 1.0-1Russ Allbery
Change-Id: I2e52bb9184bc5939421a93d7a2ef9a9f4716711c
2013-03-27Merge tag 'upstream/1.0' into debianRuss Allbery
Upstream version 1.0
2013-03-27Imported Upstream version 1.0Russ Allbery
2013-03-27Accept any characters in the argument to the comment commandRuss Allbery
It's nice to have spaces and other special characters in comments, so allow any character rather than applying the normal argument filtering. Change-Id: Iec8584f1f6893906db7245fbe571d62ebc60f72a Reviewed-on: https://gerrit.stanford.edu/989 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Check for uninstalled files, install SQL filesRuss Allbery
* Check for any files left uninstalled by dh_install. Also install all the SQL files used for database upgrades into the wallet-server package properly. Change-Id: I18711d26b88cf4bcbae036f20c11f911deb02e4f
2013-03-27Finalize changes for 1.0-1Russ Allbery
Change-Id: I43cf7f76af475d0588df09feb982bc6bbe65061c
2013-03-27Version the Suggests of libwebauth-perlRuss Allbery
Only WebAuth 4.4.0 and later has the APIs that we need. Change-Id: Icf72987f1c79baf607a0bb4aca69d0730423a10a
2013-03-27Merge tag 'upstream/1.0' into debianRuss Allbery
Upstream version 1.0
2013-03-27Imported Upstream version 1.0Russ Allbery
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-21 01:53:18 +0000