From 23a6b180f975c24c8ee4190467c74b78fde0d084 Mon Sep 17 00:00:00 2001
From: Russ Allbery <eagle@eyrie.org>
Date: Sun, 3 Jan 2016 19:29:20 -0800
Subject: Add Wallet::ACL::External ACL type

A new ACL type, external (Wallet::ACL::External), is now supported.
This ACL runs an external command to check if access is allowed, and
passes the principal and the ACL identifier to that command.  To
enable this ACL type for an existing wallet database, use wallet-admin
to register the new verifier.

Change-Id: I21b72b4373eefc92985aca1505e2d1a1ec699602
---
 docs/design-acl | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'docs/design-acl')

diff --git a/docs/design-acl b/docs/design-acl
index 32ac508..b8bb8b3 100644
--- a/docs/design-acl
+++ b/docs/design-acl
@@ -50,6 +50,12 @@ Semantics
 
 ACL Schemes
 
+  external
+
+    The <identifier> is arguments to an external command.  Access is
+    granted if the external command returns success.  The standard remctl
+    environment variables are exposed to the external command.
+
   krb5
 
     The <identifier> is a fully-qualified Kerberos principal.  Access is
-- 
cgit v1.2.3