summaryrefslogtreecommitdiff
path: root/docs
AgeCommit message (Collapse)Author
2013-09-14Clarify use of the tivoli-key file type in Stanford policyRuss Allbery
tivoli-key used to always contain the entirety of the TSM.PWD file, but it's more useful to store only the encryption key in password form. Change-Id: Id770691fb756b7675ec0fe2eee1308a8974c9c3f Reviewed-on: https://gerrit.stanford.edu/1309 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-04-12Further clarify the ssl-key Stanford naming policyRuss Allbery
Adam requested some clarification on whether the name of the object should be fully-qualified or not (since we didn't in the legacy naming scheme). Change-Id: I52fcab71e54aee38f0c03eff774f927c5836ad03 Reviewed-on: https://gerrit.stanford.edu/1054 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Add NEWS entry and doc reference to Wallet::Policy::StanfordRuss Allbery
Change-Id: If833e4a6434362e04e738274a6f7fb276a9efe51 Reviewed-on: https://gerrit.stanford.edu/988 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-03-27Allow owners of objects to destroy them by defaultRuss Allbery
Owners of wallet objects are now allowed to destroy them. In previous versions, a special destroy ACL had to be set and the owner ACL wasn't used for destroy actions, but operational experience at Stanford has shown that letting owners destroy their own objects is a better model. Change-Id: I0e97d7a000e62cf5321add7b44140db6edc6769f Reviewed-on: https://gerrit.stanford.edu/973 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-02-27Add license statements to all textual documentation in docsRuss Allbery
Change-Id: Id5af9714e3d4f516cf7391c869eff89521e145c5 Reviewed-on: https://gerrit.stanford.edu/849 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-02-13Add ssl-keypair to Stanford naming policyRuss Allbery
Used currently by MDM to store both the certificate and the key in the same file for convenience. Change-Id: I38901ac93fe3022c2e00f735a0f995500841d709 Reviewed-on: https://gerrit.stanford.edu/784 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-02-05Add another case to the Stanford ssl-key naming conventionRuss Allbery
If there are multiple SSL private keys for the same host-based CN, an application name can be added as an additional component of the name. Change-Id: I06e25359b291a77a7dbca1a7f3db84afb2b16ddd Reviewed-on: https://gerrit.stanford.edu/754 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-01-18Further Stanford naming convention changesRuss Allbery
Remove the group for host-based file object names. Move the group to the second component for non-host-based names so that the first component is always the object type. Add some additional object types and clarify wording based on feedback from Adam. Change-Id: I5db7b23d2b004c69afb869df5624d455b751c0d5 Reviewed-on: https://gerrit.stanford.edu/724 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2013-01-17Significant revision of the Stanford naming schemeRuss Allbery
Recommend slash-separated names by default. Remove some obsolete bits and update a lot of the recommendations and wording. Change-Id: I44cbf8116e7529b00a61261248ff9daecacdb910 Reviewed-on: https://gerrit.stanford.edu/723 Reviewed-by: Russ Allbery <rra@stanford.edu> Tested-by: Russ Allbery <rra@stanford.edu>
2012-07-16Add objects-and-schemes to EXTRA_DIST, renameRuss Allbery
2012-07-16Add documentation of existing wallet objects and ACL schemesRuss Allbery
2012-03-29Fix incorrect wallet.conf path in the setup documentationRuss Allbery
2011-03-23Add -ssl-keystore to the Stanford naming conventionsRuss Allbery
2010-04-14Update Stanford naming for Tivoli keysRuss Allbery
The previous wording implied that <group>-<server>-tivoli-key was only used for encryption keys. Allow for either passwords or encryption keys, and remove the note that it should be base64-encoded since wallet now supports binary files.
2010-02-20wallet-backend gets the third store argument from stdin if missingRuss Allbery
If there is no third argument to store, read it from standard input instead. This is the preferred way of running wallet-backend, using stdin=last support from remctl 2.14 and later. Receiving the third argument as a regular argument continues to be supported for backward compatibility.
2010-01-13Add Tivoli encryption keys to the Stanford naming guideRuss Allbery
2009-08-15Add a naming convention for general config filesRuss Allbery
We have some general configuration files that contain database passwords. Add a general naming convention to avoid creating new ones with each new type of config file.
2009-08-07Update Stanford naming documentation for puppet.confRuss Allbery
Add a naming convention for puppet.conf files containing secure data and reorganize the naming convention documentation to group all service objects together.
2009-03-25Add the shibboleth.xml object naming convention.Russ Allbery
2009-02-27Add htpasswd convention.Russ Allbery
2008-12-15Add ssh key naming to the Stanford naming guide.Russ Allbery
2008-10-06Add additional Stanford naming conventions.Russ Allbery
2008-09-17Clarify database password object naming and add PAM configuration objectRuss Allbery
naming.
2008-07-07Initial Stanford naming conventions.Russ Allbery
2008-02-13Update the design documentation to reflect the current protocol andRuss Allbery
implementation.
2008-01-24Add a wallet-admin program which can initialize and destroy theRuss Allbery
database and list all objects and ACLs in the database.
2007-12-01Move wallet.conf to /etc/wallet since we're going to want to put otherRuss Allbery
things in that directory as well.
2007-10-09Initial implementation of enctype restriction with a basic test suite.Russ Allbery
Still needs a more comprehensive test suite. Remove all attributes for a keytab object when it is destroyed so that when the object is recreated, it doesn't inherit attributes from its previous self. Add a test case for that for the sync attribute.
2007-09-26Include the synchronization configuration in show() output. Provide aRuss Allbery
new object method that subclasses can override to add attribute information to show() and remove the documentation about overriding show().
2007-09-20Update the documentation to get rid of the stupid error return fromRuss Allbery
attr and instead tell the caller to call error() on an empty return to see if there was a problem.
2007-09-19Add generic attribute support to the object layer and update the APIRuss Allbery
documentation to talk about overriding it. Update some other bits of the API documentation to include more hints about how to handle overridden methods.
2007-09-18Document the locked flag in the server backend and client man pages.Russ Allbery
Document locked flag issues when implementing a new object type.
2007-09-18Note cases where one might want to override flag_set() or flag_clear().Russ Allbery
2007-09-01Finish revising the design documentation to bring it up to date.Russ Allbery
2007-09-01Note that you may need to change the path to wallet-backend.Russ Allbery
2007-09-01Update and rewrite from the perspective of someone extending the walletRuss Allbery
system, taking out all the documentation of the object API that's now covered in the Wallet::Object::Base documentation.
2007-09-01Update for the current state of the world, remove some stuff that weRuss Allbery
aren't going to do, and flesh out some of the thoughts.
2007-09-01Flesh out the setup instructions.Russ Allbery
2007-08-31Remove the ACL API, which is now in the Wallet::ACL documentation, andRuss Allbery
rework the introduction a little.
2007-08-29Convert the schema documentation into a Perl class that contains the sameRuss Allbery
information but can also return the SQL commands or apply them to a database.
2007-08-28Throw exceptions for failure of object new() and create() functionsRuss Allbery
rather than returning undef so that we can save the error message.
2007-08-28Use acl_entries, not acl_entry, for the ACL table to match theRuss Allbery
pluralization of other table names. Add indexes and uniqueness constraints and fix the object_history primary key.
2007-08-28Standardize on terminology. Each component of an ACL is called an entry.Russ Allbery
2007-08-28Remove the default ACL thing from the object API. That was a bad idea.Russ Allbery
I'll do something different with a policy framework. Added some more information about what this file documents. Added the ACL API, although that's shortly going to move out of this file into documentation.
2007-08-28No need to pass a database handle into the ACL constructors any more.Russ Allbery
I was only going to use that for the krb5-group ACL, which I won't be implementing.
2007-08-28Remove krb5-group, which I won't be implementing. Clarify the netdb ACLRuss Allbery
type since I found a good way of integrating it well with the rest of the ACL system.
2007-08-28Update for the correct arguments, add trace arguments to more methods,Russ Allbery
and add the destroy method.
2007-08-27Rename delete to destroy in the API and MySQL fields to avoid the PerlRuss Allbery
delete keyword.
2007-08-27Add the history tables and remove the krb5-group ACL tables, since I won'tRuss Allbery
be implementing that ACL type. Add names to the ACL table. Various other fixes from the design review.
2007-08-27Initial brief notes on database setup.Russ Allbery
generated by cgit v1.2.3 (git 2.39.1) at 2025-02-06 18:05:27 +0000