aboutsummaryrefslogtreecommitdiff
path: root/NEWS
AgeCommit message (Collapse)Author
2010-07-29Add NEWS and remove TODO for wallet-rekeyRuss Allbery
2010-07-07Add NEWS entry for krb5-regexRuss Allbery
2010-07-07Add a help command to wallet-reportRuss Allbery
Add a help command to wallet-report, which returns a summary of all available commands.
2010-05-18Add acls duplicate reportRuss Allbery
Add an acls duplicate report to wallet-report and Wallet::Report, returning sets of ACLs that have exactly the same entries.
2010-05-12Add a report of all objects that have never been downloadedRuss Allbery
Add a objects unused report to wallet-report and Wallet::Report, returning all objects that have never been downloaded (in other words, have never been the target of a get command).
2010-03-08Release 0.11release/0.11Russ Allbery
2010-03-08Add an ACL name audit to wallet-report and Wallet::ReportRuss Allbery
Parallel to objects name, add an acls name audit that returns all ACLs that do not follow the site naming standard.
2010-03-05Allow naming policy enforcement for ACL namesRuss Allbery
Wallet::Config now supports an additional local function, verify_acl_name, which can be used to enforce ACL naming policies. If set, it is called for any ACL creation or rename and can reject the new ACL name.
2010-03-05Add a report of unused ACLsRuss Allbery
Add the acls unused report to wallet-report and Wallet::Report, returning all ACLs not referenced by any database objects.
2010-03-03Add auditing for names that violate the naming policyRuss Allbery
Add an audit command to wallet-report and one audit: objects name, which returns all objects that do not pass the local naming policy. The corresponding Wallet::Report method is audit(). Wallet::Config::verify_name may now be called with an undefined third argument (normally the user attempting to create an object). This calling convention is used when auditing, and the local policy function should select the correct policy to apply for useful audit results.
2010-03-03Verify that an ACL to be deleted is not referencedRuss Allbery
When deleting an ACL on the server, verify that the ACL is not referenced by any object first. Database referential integrity should also catch this, but not all database backends may enforce referential integrity. This also allows us to return a better error message naming an object that's still using that ACL.
2010-03-03Fix krb5_free_error_message portabilityRuss Allbery
Fix portability to older Kerberos libraries without krb5_free_error_message.
2010-02-20Release 0.10Russ Allbery
2010-02-20Update documentation for support for storing nul dataRuss Allbery
Update the wallet client, wallet-backend, and Wallet::Object::File documentation for the support for storing data containing nul characters using the new stdin support in remctld. Add this to NEWS.
2010-02-19Refactor reporting into a separate module and scriptRuss Allbery
Move all reporting from Wallet::Admin to Wallet::Report and simplify the method names since they're now part of a dedicated reporting class. Similarly, create a new wallet-report script to wrap Wallet::Report, moving all reporting commands to it from wallet-admin, and simplify the commands since they're for a dedicated reporting script. Remove the contrib script wallet-report to wallet-summary so that it doesn't conflict with the new reporting backend script.
2010-02-09Update to C TAP Harness 1.1 and rra-c-util 3.0 testsRuss Allbery
* Update portable and util tests for C TAP Harness 1.1. * Remove the need for Autoconf substitution in test programs. * Support running a single test program with runtests -o. * Properly handle test cases that are skipped in their entirety. * Much improved C TAP library more closely matching Test::More. Rewrite client/basic-t to use the new test library functions and my current test case coding style.
2010-02-09Update util code and import Kerberos portability glueRuss Allbery
Use the Kerberos portability layer from rra-c-util 3.0 and avoid Kerberos API calls deprecated on Heimdal. Break util/util.h into separate header files and update all source files accordingly. The test suite is not yet updated. That will come in subsequent commits.
2010-02-09Update portability code to rra-c-util 3.0Russ Allbery
Add replacements for mkstemp and setenv, since we now use them when obtaining credentials in the client. Fix the bool type with Sun Studio 12 on Solaris 10.
2010-02-09Update the Autoconf code to rra-c-util 3.0Russ Allbery
* Sanity-check the results of krb5-config before proceeding. * Fall back on manual probing if krb5-config results don't work. * Add --with-krb5-include and --with-krb5-lib configure options. * Add --with-remctl-include and --with-remctl-lib configure options. * Add --with-gssapi-include and --with-gssapi-lib configure options. * Don't break if the user clobbers CPPFLAGS at build time. * Suppress error output from krb5-config probes. * Prefer KRB5_CONFIG over a path constructed from --with-*. * Update GSS-API probes for Solaris 10's native implementation. * Change AC_TRY_* to AC_*_IFELSE as recommended by Autoconf. Also strip out more outdated AFS kaserver instructions from README.
2010-02-09Use a temporary disk cache in the wallet client instead of memoryRuss Allbery
The wallet client now uses a temporary disk ticket cache when obtaining tickets with the -u option rather than an in-memory cache, allowing for a libremctl built against a different Kerberos implementation than the wallet client. This primarily helps with testing.
2010-02-09Remove kaserver synchronization support from the wallet clientRuss Allbery
The wallet client no longer enables kaserver synchronization when a srvtab is requested with -S. Instead, it just extracts the DES key from the keytab and writes it to a srvtab. It no longer forces the kvno of the srvtab to 0 (a Stanford-specific action) and instead preserves the kvno from the key in the keytab. This should now do the right thing for sites that use a KDC that serves both Kerberos v4 and Kerberos v5 from the same database.
2010-02-09Remove the kasetkey client for setting keys in an AFS kaserverRuss Allbery
2010-02-09Document and make case-insensitive KEYTAB_KRBTYPERuss Allbery
KEYTAB_KRBTYPE wasn't documented in Wallet::Config. Add it and the variable declaration. Also document the new mandatory setting in NEWS and add the Heimdal::Kadm5 requirement to README. Remove some of the language in README that implies that only MIT Kerberos is supported. Make the setting case-insensitive and improve the error message from Wallet::Kadmin if it isn't set.
2010-02-09Remove kaserver synchronization support from the wallet backendRuss Allbery
Remove kaserver synchronization support. It is no longer tested, and retaining the code was increasing the complexity of wallet, and some specific requirements (such as different realm names between kaserver and Kerberos v5 and the kvno handling) were Stanford-specific. Rather than using this support, AFS sites running kaserver will probably find deploying Heimdal with its internal kaserver compatibility is probably an easier transition approach.
2010-01-19Update NEWS and TODO for recent changesRuss Allbery
2009-06-09Add owners reportRuss Allbery
Add a new report owners command to wallet-admin and corresponding report_owners() method to Wallet::Admin, which returns all ACL lines on owner ACLs for matching objects.
2008-08-14Fix logging in wallet-backend and the remctl configuration to not logRuss Allbery
the data passed to store.
2008-08-13Correctly handle storing of data that begins with a dash and don'tRuss Allbery
parse it as an argument to wallet-backend.
2008-04-24First pass at builddir != srcdir support.Russ Allbery
2008-04-24Release 0.9.Russ Allbery
2008-04-24The wallet command-line client now reads the data for store from aRuss Allbery
file (using -f) or from standard input (if -f wasn't given) when the data isn't specified on the command line. The data still must not contain nul characters.
2008-04-24Include Stanford's wallet.conf as an example (examples/stanford.conf).Russ Allbery
2008-04-24Perl 5.8 is required to run the test suite, but IO::String is not.Russ Allbery
2008-04-24Major coding style cleanup. Updated all shared code from my otherRuss Allbery
projects. The configure option requesting AFS kaserver support (and thus building kasetkey) is now --with-kaserver instead of --with-afs. If KRB5_CONFIG was explicitly set in the environment, don't use a different krb5-config based on --with-krb4 or --with-krb5. If krb5-config isn't executable, don't use it. This allows one to force library probing by setting KRB5_CONFIG to point to a nonexistent file. Sanity-check the results of krb5-config before proceeding and error out in configure if they don't work. Stop setting Stanford-specific compile-time defaults for the wallet server and port.
2008-04-20Fix Autoconf syntax error when probing for libkrb5support. Thanks,Russ Allbery
Mike Garrison. Also update to the latest version of all of the Kerberos Autoconf probes.
2008-04-07Add support for enabling and disabling principals (clearing or settingRuss Allbery
the NOTGS flag) and examining principals to kasetkey. This functionality isn't used by wallet (and probably won't be) but is convenient for other users of kasetkey such as kadmin-remctl.
2008-02-20Report the correct error message when addprinc fails while creating aRuss Allbery
keytab object.
2008-02-13Release 0.8.Russ Allbery
2008-02-13Remove the restriction that all object implementations must have classRuss Allbery
names of Wallet::Object::* and all ACL verifier implementations must have class names of Wallet::ACL::*.
2008-02-13Update the design documentation to reflect the current protocol andRuss Allbery
implementation.
2008-02-13wallet-admin now supports registering new object or ACL verifierRuss Allbery
implementations in the database.
2008-02-12wallet-backend now supports a -q flag, which disables syslog logging.Russ Allbery
2008-02-12Correctly handle get of an empty object in the wallet client. TheRuss Allbery
empty string is valid object content. Add a full end-to-end test suite to catch protocol mismatches between the client and server, such as the one fixed in this release.
2008-02-09Add file object support to the wallet server.Russ Allbery
2008-02-08Wallet::Config and hence the wallet server now checks for theRuss Allbery
environment variable WALLET_CONFIG and loads configuration from the file specified there instead of /etc/wallet/wallet.conf if it is set.
2008-02-08Fix the wallet client to use check instead of exists.Russ Allbery
2008-02-08Release 0.7.Russ Allbery
2008-02-07Include news message for previous commit.Russ Allbery
2008-02-07Correctly enable syslog logging in wallet-backend.Russ Allbery
2008-02-07The current version of Net::Remctl can't handle explicit undef or theRuss Allbery
empty string as a principal argument. Be careful not to provide a principal argument if no principal was set. This workaround can be removed once we depend on a later version of Net::Remctl.
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-06 04:07:37 +0000