| Age | Commit message (Collapse) | Author |
|---|
|
valid_principal has been removed from Wallet::Kadmin and
Wallet::Kadmin::Heimdal. An accessor for it in Wallet::Object::Keytab
has also been removed, as have the tests in perl/t/keytab.t for the
function. It still remains within Wallet::Kadmin::MIT and is used there,
but only as a private method for flagging what the kadmin command-line
interface cannot handle.
|
|
Added the new ACL format to perl/t/object.t's idea of what an object's
history was meant to be. This involved switching from acl id to acl
name plus id -- ie: '1' to 'ADMIN (1)'.
|
|
Added documentation for the new object and acl list searches to
perl/Wallet/Admin.pm and server/wallet-admin. Also fixed a POD error
in perl/Wallet/Kadmin.pm's docs.
|
|
Several tests were removed in an earlier edit that should not have been.
As far as I can tell, they were removed completely by accident. These
missing tests were causing the test suite to fail.
|
|
Strip trailing whitespace, convert tabs to spaces, add newlines to
exceptions, and remove a few stray blank lines and a few other minor
coding style oddities. Make the SQL style consistent.
|
|
When listing an object history, ACLs were only shown as the ACL id. This
changes that behavior to show the ACL name as well as ID. Where before
it might say "set owner to 1", now it would say "set owner to ADMIN (1)".
|
|
Added new option to the 'wallet-admin list acls' command, 'empty', which
will only return those ACLs which have no members. This will help
maintenance in the long term by pointing out ACLs in error or no longer
needed.
|
|
randKeyPrincipal was added to the keytab file creation process, in order
to reset a principal to first have all possible enctypes. There is no
way for us to specify that we only want a specific number of fresh enctypes,
so we must reset to have all enctypes first, and then pare down from there
each time we create the keytab.
|
|
Added cases to handle the Wallet::Object::Keytab module using a Heimdal
KDC as well as an MIT KDC. In most cases this is transparent, but some
tests are skipped for Heimdal, and the commands run to test that the
created principals and keytabs are correct are different for Heimdal.
The code now branches based on the value of
$Wallet::Config::KEYTAB_KRBTYPE.
|
|
Added cases to handle the Wallet::Object::Keytab module using a Heimdal
KDC as well as an MIT KDC. In most cases this is transparent, but some
tests are skipped for Heimdal, and the commands run to test that the
created principals and keytabs are correct are different for Heimdal.
The code now branches based on the value of
$Wallet::Config::KEYTAB_KRBTYPE.
|
|
valid_principal used to reside in Wallet::Object::Keytab, but was moved to
the individual Wallet::Kadmin::* modules. This isn't necessary currently
and may not ever be, but it's there just in case we do ever need to
differentiate. To simplify testing, a way to still call it directly from
Wallet::Object::Keytab has been added.
|
|
* Fixed keytab existence check to avoid failures when called by a principal
with permissions only on specific principals.
* Better error cases for non-existant keytabs in several places.
* Skipped limiting keytabs to certain enctypes when no enctypes are given.
|
|
Added support for Heimdal as an alternative to MIT Kerberos. This involved
separating out the kadmin-specific code into its own set of modules, and
changing the existing Wallet::Object::Keytab code to branch based on
which module is loaded.
|
|
wallet-admin's list command now has additional searches added for objects
and acls that match certain specifiers. For objects these include
searching for objects owned by a specific ACL, objects owned by no one,
objects of a specific type, objects with a specific flag, and objects for
which a specific ACL has any privileges at all. For acls, this includes
the ability to search for any ACL with an entry with given type and
identifier.
|
|
Add a new report owners command to wallet-admin and corresponding
report_owners() method to Wallet::Admin, which returns all ACL lines
on owner ACLs for matching objects.
|
|
|
|
|
|
strings.
|
|
$datadir.
|
|
keytab object.
|
|
can run in AFS.
|
|
names of Wallet::Object::* and all ACL verifier implementations must
have class names of Wallet::ACL::*.
|
|
|
|
|
|
empty string is valid object content.
Add a full end-to-end test suite to catch protocol mismatches between
the client and server, such as the one fixed in this release.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
environment variable WALLET_CONFIG and loads configuration from the
file specified there instead of /etc/wallet/wallet.conf if it is set.
|
|
|
|
|
|
empty string as a principal argument. Be careful not to provide a
principal argument if no principal was set. This workaround can be
removed once we depend on a later version of Net::Remctl.
|
|
default ACLs. Remove autocreation support from create, which now
requires that one be on the ADMIN ACL, and from get and store. The
wallet client will soon know how to do the right thing.
|
|
already exists.
|
|
default ACLs to avoid creating and stranding an ACL when the naming
policy check fails.
|
|
|
|
database.
|
|
destruction if the database handle hasn't already been destroyed.
|
|
|
|
|
|
of Wallet::Schema::drop in the test suite.
|
|
|
|
|
|
Wallet::ACL to take Wallet::Database objects instead of database
handles.
|
|
previously in Wallet::Server. Remove all the attribute setting on
database handles in the other classes since Wallet::Database handles that
initialization.
|
|
function in the wallet server configuration file.
|
|
libraries as necessary rather than hard-coding libraries. Building
on systems without strong shared library dependencies and building
against static libraries should now work.
Building kasetkey (for AFS kaserver synchronization) is now optional
and not enabled by default. Pass --with-afs to enable it. This
allows wallet to be easily built in an environment without AFS.
|
