From df8d76d414c4fbb2ea15499cc80395895064c7f7 Mon Sep 17 00:00:00 2001
From: Jon Robertson <jonrober@stanford.edu>
Date: Wed, 16 Oct 2013 22:35:34 -0700
Subject: Changed postgres schema file to remove reference

The reference from object_history to the objects table needed to be
removed.  We still want the relationship in the DBIx::Class files, but
we don't want the relationship enforced as we want to keep history
entries for deleted objects.

Change-Id: Id927404b996fe171a8f5fc0747ccb0abddcbe1f2
Reviewed-on: https://gerrit.stanford.edu/1324
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
---
 perl/sql/Wallet-Schema-0.08-PostgreSQL.sql | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'perl/sql')

diff --git a/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
index a5de23d..296909f 100644
--- a/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
@@ -1,4 +1,4 @@
--- 
+--
 -- Created by SQL::Translator::Producer::PostgreSQL
 -- Created on Fri Jan 25 14:12:02 2013
 --
@@ -23,7 +23,7 @@
 -- CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 -- TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 -- SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- 
+--
 --
 -- Table: acl_history
 --
@@ -218,6 +218,6 @@ ALTER TABLE "objects" ADD FOREIGN KEY ("ob_acl_store")
 ALTER TABLE "objects" ADD FOREIGN KEY ("ob_type")
   REFERENCES "types" ("ty_name") DEFERRABLE;
 
-ALTER TABLE "object_history" ADD FOREIGN KEY ("oh_type", "oh_name")
-  REFERENCES "objects" ("ob_type", "ob_name") DEFERRABLE;
+--ALTER TABLE "object_history" ADD FOREIGN KEY ("oh_type", "oh_name")
+--  REFERENCES "objects" ("ob_type", "ob_name") DEFERRABLE;
 
-- 
cgit v1.2.3


From 26927d5b7bda7d2892e460fdb2867b6bcd55c8ad Mon Sep 17 00:00:00 2001
From: Russ Allbery <eagle@eyrie.org>
Date: Fri, 11 Jul 2014 17:19:59 -0700
Subject: Add new object type for Duo integrations

A new object type, duo (Wallet::Object::Duo), is now supported.  This
creates an integration with the Duo Security cloud multifactor
authentication service and allows retrieval of the integration key,
secret key, and admin hostname.  Currently, only UNIX integration
types are supported.  The Net::Duo Perl module is required to use this
object type.  New configuration settings are required as well; see
Wallet::Config for more information.  To enable this object type for
an existing wallet database, use wallet-admin to register the new
object.

Change-Id: I2c0dac75e81f526b34d6b509c4bdaecb43dd4a9d
Reviewed-on: https://gerrit.stanford.edu/1516
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
---
 Makefile.am                                     |  40 +--
 NEWS                                            |  10 +
 README                                          |  32 ++-
 docs/objects-and-schemes                        |  14 +-
 perl/Wallet/Config.pm                           |  47 +++-
 perl/Wallet/Object/Duo.pm                       | 331 ++++++++++++++++++++++++
 perl/Wallet/Schema.pm                           |  17 +-
 perl/Wallet/Schema/Result/Duo.pm                |  53 ++++
 perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql      |  17 ++
 perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql |  12 +
 perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql     |  11 +
 perl/sql/Wallet-Schema-0.09-MySQL.sql           | 204 +++++++++++++++
 perl/sql/Wallet-Schema-0.09-PostgreSQL.sql      | 208 +++++++++++++++
 perl/sql/Wallet-Schema-0.09-SQLite.sql          | 212 +++++++++++++++
 perl/t/data/duo/integration.json                |  11 +
 perl/t/data/duo/keys.json                       |   5 +
 perl/t/duo.t                                    | 157 +++++++++++
 tests/server/admin-t                            |   6 +-
 18 files changed, 1348 insertions(+), 39 deletions(-)
 create mode 100644 perl/Wallet/Object/Duo.pm
 create mode 100644 perl/Wallet/Schema/Result/Duo.pm
 create mode 100644 perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
 create mode 100644 perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
 create mode 100644 perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
 create mode 100644 perl/sql/Wallet-Schema-0.09-MySQL.sql
 create mode 100644 perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
 create mode 100644 perl/sql/Wallet-Schema-0.09-SQLite.sql
 create mode 100644 perl/t/data/duo/integration.json
 create mode 100644 perl/t/data/duo/keys.json
 create mode 100755 perl/t/duo.t

(limited to 'perl/sql')

diff --git a/Makefile.am b/Makefile.am
index 2a9fbd3..dba1f94 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,7 +1,7 @@
 # Automake makefile for wallet.
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2006, 2007, 2008, 2010, 2013
+# Copyright 2006, 2007, 2008, 2010, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # See LICENSE for licensing terms.
@@ -16,14 +16,15 @@ PERL_FILES = perl/Wallet/ACL.pm perl/Wallet/ACL/Base.pm			    \
 	perl/Wallet/ACL/NetDB/Root.pm perl/Wallet/Admin.pm		    \
 	perl/Wallet/Config.pm perl/Wallet/Database.pm perl/Wallet/Kadmin.pm \
 	perl/Wallet/Kadmin/Heimdal.pm perl/Wallet/Kadmin/MIT.pm		    \
-	perl/Wallet/Object/Base.pm perl/Wallet/Object/File.pm		    \
-	perl/Wallet/Object/Keytab.pm perl/Wallet/Object/WAKeyring.pm	    \
-	perl/Wallet/Policy/Stanford.pm perl/Wallet/Report.pm		    \
-	perl/Wallet/Schema.pm perl/Wallet/Server.pm			    \
+	perl/Wallet/Object/Base.pm perl/Wallet/Object/Duo.pm		    \
+	perl/Wallet/Object/File.pm perl/Wallet/Object/Keytab.pm		    \
+	perl/Wallet/Object/WAKeyring.pm perl/Wallet/Policy/Stanford.pm	    \
+	perl/Wallet/Report.pm perl/Wallet/Schema.pm perl/Wallet/Server.pm   \
 	perl/Wallet/Schema/Result/Acl.pm				    \
 	perl/Wallet/Schema/Result/AclEntry.pm				    \
 	perl/Wallet/Schema/Result/AclHistory.pm				    \
 	perl/Wallet/Schema/Result/AclScheme.pm				    \
+	perl/Wallet/Schema/Result/Duo.pm				    \
 	perl/Wallet/Schema/Result/Enctype.pm				    \
 	perl/Wallet/Schema/Result/Flag.pm				    \
 	perl/Wallet/Schema/Result/KeytabEnctype.pm			    \
@@ -31,19 +32,14 @@ PERL_FILES = perl/Wallet/ACL.pm perl/Wallet/ACL/Base.pm			    \
 	perl/Wallet/Schema/Result/Object.pm				    \
 	perl/Wallet/Schema/Result/ObjectHistory.pm			    \
 	perl/Wallet/Schema/Result/SyncTarget.pm				    \
-	perl/Wallet/Schema/Result/Type.pm				    \
-	perl/sql/Wallet-Schema-0.07-0.08-MySQL.sql			    \
-	perl/sql/Wallet-Schema-0.07-0.08-SQLite.sql			    \
-	perl/sql/Wallet-Schema-0.07-MySQL.sql				    \
-	perl/sql/Wallet-Schema-0.07-SQLite.sql				    \
-	perl/sql/Wallet-Schema-0.08-MySQL.sql				    \
-	perl/sql/Wallet-Schema-0.08-PostgreSQL.sql			    \
-	perl/sql/Wallet-Schema-0.08-SQLite.sql perl/t/acl.t perl/t/admin.t  \
-	perl/t/config.t perl/t/data/README perl/t/data/keytab-fake	    \
-	perl/t/data/keytab.conf perl/t/data/netdb.conf			    \
-	perl/t/data/netdb-fake perl/t/file.t perl/t/init.t perl/t/kadmin.t  \
-	perl/t/keytab.t perl/t/lib/Util.pm perl/t/object.t		    \
-	perl/t/pod-spelling.t perl/t/pod.t perl/t/report.t perl/t/server.t  \
+	perl/Wallet/Schema/Result/Type.pm perl/sql perl/t/acl.t		    \
+	perl/t/admin.t perl/t/config.t perl/t/data/README		    \
+	perl/t/data/duo/integration.json perl/t/data/duo/keys.json	    \
+	perl/t/data/keytab-fake perl/t/data/keytab.conf			    \
+	perl/t/data/netdb.conf perl/t/data/netdb-fake perl/t/duo.t	    \
+	perl/t/file.t perl/t/init.t perl/t/kadmin.t perl/t/keytab.t	    \
+	perl/t/lib/Util.pm perl/t/object.t perl/t/pod-spelling.t	    \
+	perl/t/pod.t perl/t/report.t perl/t/server.t			    \
 	perl/t/stanford-naming.t perl/t/verifier-ldap-attr.t		    \
 	perl/t/verifier-netdb.t perl/t/verifier.t perl/t/wa-keyring.t
 
@@ -110,9 +106,15 @@ dist_pkgdata_DATA = perl/sql/Wallet-Schema-0.07-0.08-MySQL.sql	\
 	perl/sql/Wallet-Schema-0.07-0.08-SQLite.sql		\
 	perl/sql/Wallet-Schema-0.07-MySQL.sql			\
 	perl/sql/Wallet-Schema-0.07-SQLite.sql			\
+	perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql		\
+	perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql		\
+	perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql		\
 	perl/sql/Wallet-Schema-0.08-MySQL.sql			\
 	perl/sql/Wallet-Schema-0.08-PostgreSQL.sql		\
-	perl/sql/Wallet-Schema-0.08-SQLite.sql
+	perl/sql/Wallet-Schema-0.08-SQLite.sql			\
+	perl/sql/Wallet-Schema-0.09-MySQL.sql			\
+	perl/sql/Wallet-Schema-0.09-PostgreSQL.sql		\
+	perl/sql/Wallet-Schema-0.09-SQLite.sql
 
 # A set of flags for warnings.  Add -O because gcc won't find some warnings
 # without optimization turned on.  Desirable warnings that can't be turned
diff --git a/NEWS b/NEWS
index c79b999..a7cab7e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,16 @@
 
 wallet 1.1 (unreleased)
 
+    A new object type, duo (Wallet::Object::Duo), is now supported.  This
+    creates an integration with the Duo Security cloud multifactor
+    authentication service and allows retrieval of the integration key,
+    secret key, and admin hostname.  Currently, only UNIX integration
+    types are supported.  The Net::Duo Perl module is required to use this
+    object type.  New configuration settings are required as well; see
+    Wallet::Config for more information.  To enable this object type for
+    an existing wallet database, use wallet-admin to register the new
+    object.
+
     Fix wallet-rekey on keytabs containing multiple principals.  Previous
     versions assumed one could concatenate keytab files together to make a
     valid keytab file, which doesn't work with some Kerberos libraries.
diff --git a/README b/README
index 6781ff8..85a6299 100644
--- a/README
+++ b/README
@@ -3,10 +3,10 @@
 
                 Written by Russ Allbery <eagle@eyrie.org>
 
-  Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2013 The Board of Trustees
-  of the Leland Stanford Junior University.  This software is distributed
-  under a BSD-style license.  Please see the section LICENSE below for
-  more information.
+  Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2013, 2014 The Board of
+  Trustees of the Leland Stanford Junior University.  This software is
+  distributed under a BSD-style license.  Please see the section LICENSE
+  below for more information.
 
 BLURB
 
@@ -43,15 +43,16 @@ DESCRIPTION
   regexes matching Kerberos principal names, and LDAP attribute checks.
 
   Currently, the object types supported are simple files, Kerberos
-  keytabs, and WebAuth keyrings.  By default, whenever a Kerberos keytab
-  object is retrieved from the wallet, the key is changed in the Kerberos
-  KDC and the wallet returns a keytab for the new key.  However, a keytab
-  object can also be configured to preserve the existing keys when
-  retrieved.  Included in the wallet distribution is a script that can be
-  run via remctl on an MIT Kerberos KDC to extract the existing key for a
-  principal, and the wallet system will use that interface to retrieve the
-  current key if the unchanging flag is set on a Kerberos keytab object
-  for MIT Kerberos.  (Heimdal doesn't require any special support.)
+  keytabs, WebAuth keyrings, and Duo integrations.  By default, whenever a
+  Kerberos keytab object is retrieved from the wallet, the key is changed
+  in the Kerberos KDC and the wallet returns a keytab for the new key.
+  However, a keytab object can also be configured to preserve the existing
+  keys when retrieved.  Included in the wallet distribution is a script
+  that can be run via remctl on an MIT Kerberos KDC to extract the
+  existing key for a principal, and the wallet system will use that
+  interface to retrieve the current key if the unchanging flag is set on a
+  Kerberos keytab object for MIT Kerberos.  (Heimdal doesn't require any
+  special support.)
 
 REQUIREMENTS
 
@@ -104,6 +105,9 @@ REQUIREMENTS
   The WebAuth keyring object support in the wallet server requires the
   WebAuth Perl module from WebAuth 4.4.0 or later.
 
+  The Duo integration object support in the wallet server requires the
+  Net::Duo Perl module.
+
   To support the LDAP attribute ACL verifier, the Authen::SASL and
   Net::LDAP Perl modules must be installed on the server.  This verifier
   only works with LDAP servers that support GSS-API binds.
@@ -323,7 +327,7 @@ LICENSE
   The wallet distribution as a whole is covered by the following copyright
   statement and license:
 
-    Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2013
+    Copyright 2006, 2007, 2008, 2009, 2010, 2012, 2013, 2014
         The Board of Trustees of the Leland Stanford Junior University
 
     Permission is hereby granted, free of charge, to any person obtaining
diff --git a/docs/objects-and-schemes b/docs/objects-and-schemes
index 57c2f9f..97e6289 100644
--- a/docs/objects-and-schemes
+++ b/docs/objects-and-schemes
@@ -10,6 +10,18 @@ Introduction
 
 Object Types
 
+  duo
+
+    Stores the configuration for a Duo Security integration.  Duo is a
+    cloud provider of multifactor authentication services.  A Duo
+    integration consists of some local configuration and a secret key that
+    permits verification of a second factor using the Duo cloud service.
+    Currently, only UNIX integrations are supported.  In the future, this
+    object type will likely be split into several object types
+    corresponding to the supported types of Duo integrations.
+
+    Implemented via Wallet::Object::Duo.
+
   file
 
     Stores an arbitrary file and allows retrieval of that file.  The file
@@ -91,7 +103,7 @@ ACL Schemes
 
 License
 
-    Copyright 2012, 2013
+    Copyright 2012, 2013, 2014
         The Board of Trustees of the Leland Stanford Junior University
 
     Copying and distribution of this file, with or without modification,
diff --git a/perl/Wallet/Config.pm b/perl/Wallet/Config.pm
index 0d9d506..ed3dded 100644
--- a/perl/Wallet/Config.pm
+++ b/perl/Wallet/Config.pm
@@ -1,7 +1,7 @@
 # Wallet::Config -- Configuration handling for the wallet server.
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2007, 2008, 2010, 2013
+# Copyright 2007, 2008, 2010, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # See LICENSE for licensing terms.
@@ -181,6 +181,51 @@ our $DB_PASSWORD;
 
 =back
 
+=head1 DUO OBJECT CONFIGURATION
+
+These configuration variables only need to be set if you intend to use the
+C<duo> object type (the Wallet::Object::Duo class).
+
+=over 4
+
+=item DUO_AGENT
+
+If this configuration variable is set, its value should be an object that
+is call-compatible with LWP::UserAgent.  This object will be used instead
+of LWP::UserAgent to make API calls to Duo.  This is primarily useful for
+testing, allowing replacement of the user agent with a mock implementation
+so that a test can run without needing a Duo account.
+
+=cut
+
+our $DUO_AGENT;
+
+=item DUO_KEY_FILE
+
+The path to a file in JSON format that contains the key and hostname data
+for the Duo Admin API integration used to manage integrations via wallet.
+This file should be in the format expected by the C<key_file> parameter
+to the Net::Duo::Admin constructor.  See L<Net::Duo::Admin> for more
+information.
+
+DUO_KEY_FILE must be set to use Duo objects.
+
+=cut
+
+our $DUO_KEY_FILE;
+
+=item DUO_TYPE
+
+The type of integration to create.  Currently, only one type of integration
+can be created by one wallet configuration.  This restriction may be relaxed
+in the future.  The default value is C<unix> to create UNIX integrations.
+
+=cut
+
+our $DUO_TYPE = 'unix';
+
+=back
+
 =head1 FILE OBJECT CONFIGURATION
 
 These configuration variables only need to be set if you intend to use the
diff --git a/perl/Wallet/Object/Duo.pm b/perl/Wallet/Object/Duo.pm
new file mode 100644
index 0000000..af2dfab
--- /dev/null
+++ b/perl/Wallet/Object/Duo.pm
@@ -0,0 +1,331 @@
+# Wallet::Object::Duo -- Duo integration object implementation for the wallet.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+##############################################################################
+# Modules and declarations
+##############################################################################
+
+package Wallet::Object::Duo;
+require 5.006;
+
+use strict;
+use vars qw(@ISA $VERSION);
+
+use JSON;
+use Net::Duo::Admin;
+use Net::Duo::Admin::Integration;
+use Perl6::Slurp qw(slurp);
+use Wallet::Config ();
+use Wallet::Object::Base;
+
+@ISA = qw(Wallet::Object::Base);
+
+# This version should be increased on any code change to this module.  Always
+# use two digits for the minor version with a leading zero if necessary so
+# that it will sort properly.
+$VERSION = '0.01';
+
+##############################################################################
+# Core methods
+##############################################################################
+
+# Override attr_show to display the Duo integration key attribute.
+sub attr_show {
+    my ($self) = @_;
+    my $output = '';
+    my $key;
+    eval {
+        my %search = (du_name => $self->{name});
+        my $row = $self->{schema}->resultset ('Duo')->find (\%search);
+        $key = $row->get_column ('du_key');
+    };
+    if ($@) {
+        $self->error ($@);
+        return;
+    }
+    return sprintf ("%15s: %s\n", 'Duo key', $key);
+}
+
+# Override new to start by creating a Net::Duo::Admin object for subsequent
+# calls.
+sub new {
+    my ($class, $type, $name, $schema) = @_;
+
+    # We have to have a Duo integration key file set.
+    if (not $Wallet::Config::DUO_KEY_FILE) {
+        die "duo object implementation not configured\n";
+    }
+    my $key_file = $Wallet::Config::DUO_KEY_FILE;
+    my $agent    = $Wallet::Config::DUO_AGENT;
+
+    # Construct the Net::Duo::Admin object.
+    require Net::Duo::Admin;
+    my $duo = Net::Duo::Admin->new (
+        {
+            key_file   => $key_file,
+            user_agent => $agent,
+        }
+    );
+
+    # Construct the object.
+    my $self = $class->SUPER::new ($type, $name, $schema);
+    $self->{duo} = $duo;
+    return $self;
+}
+
+# Override create to start by creating a new integration in Duo, and only
+# create the entry in the database if that succeeds.  Error handling isn't
+# great here since we don't have a way to communicate the error back to the
+# caller.
+sub create {
+    my ($class, $type, $name, $schema, $creator, $host, $time) = @_;
+
+    # We have to have a Duo integration key file set.
+    if (not $Wallet::Config::DUO_KEY_FILE) {
+        die "duo object implementation not configured\n";
+    }
+    my $key_file = $Wallet::Config::DUO_KEY_FILE;
+    my $agent    = $Wallet::Config::DUO_AGENT;
+
+    # Construct the Net::Duo::Admin object.
+    require Net::Duo::Admin;
+    my $duo = Net::Duo::Admin->new (
+        {
+            key_file   => $key_file,
+            user_agent => $agent,
+        }
+    );
+
+    # Create the object in Duo.
+    require Net::Duo::Admin::Integration;
+    my %data = (
+        name  => $name,
+        notes => 'Managed by wallet',
+        type  => $Wallet::Config::DUO_TYPE,
+    );
+    my $integration = Net::Duo::Admin::Integration->create ($duo, \%data);
+
+    # Create the object in wallet.
+    my @trace = ($creator, $host, $time);
+    my $self = $class->SUPER::create ($type, $name, $schema, @trace);
+    $self->{duo} = $duo;
+
+    # Add the integration key to the object metadata.
+    my $guard = $self->{schema}->txn_scope_guard;
+    eval {
+        my %record = (
+            du_name => $name,
+            du_key  => $integration->integration_key,
+        );
+        $self->{schema}->resultset ('Duo')->create (\%record);
+        $guard->commit;
+    };
+    if ($@) {
+        my $id = $self->{type} . ':' . $self->{name};
+        $self->error ("cannot set Duo key for $id: $@");
+        return;
+    }
+
+    # Done.  Return the object.
+    return $self;
+}
+
+# Override destroy to delete the integration out of Duo as well.
+sub destroy {
+    my ($self, $user, $host, $time) = @_;
+    my $id = $self->{type} . ':' . $self->{name};
+    if ($self->flag_check ('locked')) {
+        $self->error ("cannot destroy $id: object is locked");
+        return;
+    }
+    my $schema = $self->{schema};
+    my $guard = $schema->txn_scope_guard;
+    eval {
+        my %search = (du_name => $self->{name});
+        my $row = $schema->resultset ('Duo')->find (\%search);
+        my $key = $row->get_column ('du_key');
+        my $int = Net::Duo::Admin::Integration->new ($self->{duo}, $key);
+        $int->delete;
+        $row->delete;
+        $guard->commit;
+    };
+    if ($@) {
+        $self->error ($@);
+        return;
+    }
+    return $self->SUPER::destroy ($user, $host, $time);
+}
+
+# Our get implementation.  Retrieve the integration information from Duo and
+# construct the configuration file expected by the Duo PAM module.
+sub get {
+    my ($self, $user, $host, $time) = @_;
+    $time ||= time;
+
+    # Check that the object isn't locked.
+    my $id = $self->{type} . ':' . $self->{name};
+    if ($self->flag_check ('locked')) {
+        $self->error ("cannot get $id: object is locked");
+        return;
+    }
+
+    # Retrieve the integration from Duo.
+    my $key;
+    eval {
+        my %search = (du_name => $self->{name});
+        my $row = $self->{schema}->resultset ('Duo')->find (\%search);
+        $key = $row->get_column ('du_key');
+    };
+    if ($@) {
+        $self->error ($@);
+        return;
+    }
+    my $integration = Net::Duo::Admin::Integration->new ($self->{duo}, $key);
+
+    # We also need the admin server name, which we can get from the Duo object
+    # configuration with a bit of JSON decoding.
+    my $json = JSON->new->utf8 (1);
+    my $config = $json->decode (scalar slurp $Wallet::Config::DUO_KEY_FILE);
+
+    # Construct the returned file.
+    my $output = "[duo]\n";
+    $output .= "ikey = $key\n";
+    $output .= 'skey = ' . $integration->secret_key . "\n";
+    $output .= "host = $config->{api_hostname}\n";
+
+    # Log the action and return.
+    $self->log_action ('get', $user, $host, $time);
+    return $output;
+}
+
+1;
+__END__
+
+##############################################################################
+# Documentation
+##############################################################################
+
+=for stopwords
+Allbery Duo integration
+
+=head1 NAME
+
+Wallet::Object::Duo - Duo integration object implementation for wallet
+
+=head1 SYNOPSIS
+
+    my @name = qw(duo host.example.com);
+    my @trace = ($user, $host, time);
+    my $object = Wallet::Object::Duo->create (@name, $schema, @trace);
+    my $config = $object->get (@trace);
+    $object->destroy (@trace);
+
+=head1 DESCRIPTION
+
+Wallet::Object::Duo is a representation of Duo integrations the wallet.
+It implements the wallet object API and provides the necessary glue to
+create a Duo integration, return a configuration file containing the key
+and API information for that integration, and delete the integration from
+Duo when the wallet object is destroyed.
+
+Currently, only one configured integration type can be managed by the
+wallet, and the integration information is always returned in the
+configuration file format expected by the Duo UNIX integration.  The
+results of retrieving this object will be text, suitable for putting in
+the UNIX integration configuration file, containing the integration key,
+secret key, and admin hostname for that integration.
+
+This object can be retrieved repeatedly without changing the secret key,
+matching Duo's native behavior with integrations.  To change the keys of
+the integration, delete it and recreate it.
+
+To use this object, at least one configuration parameter must be set.  See
+L<Wallet::Config> for details on supported configuration parameters and
+information about how to set wallet configuration.
+
+=head1 METHODS
+
+This object mostly inherits from Wallet::Object::Base.  See the
+documentation for that class for all generic methods.  Below are only
+those methods that are overridden or behave specially for this
+implementation.
+
+=over 4
+
+=item create(TYPE, NAME, DBH, PRINCIPAL, HOSTNAME [, DATETIME])
+
+This is a class method and should be called on the Wallet::Object::Duo
+class.  It creates a new object with the given TYPE and NAME (TYPE is
+normally C<duo> and must be for the rest of the wallet system to use the
+right class, but this module doesn't check for ease of subclassing), using
+DBH as the handle to the wallet metadata database.  PRINCIPAL, HOSTNAME,
+and DATETIME are stored as history information.  PRINCIPAL should be the
+user who is creating the object.  If DATETIME isn't given, the current
+time is used.
+
+When a new Duo integration object is created, a new integration will be
+created in the configured Duo account and the integration key will be
+stored in the wallet object.  If the integration already exists, create()
+will fail.  The new integration's type is controlled by the DUO_TYPE
+configuration variable, which defaults to C<unix>.  See L<Wallet::Config>
+for more information.
+
+If create() fails, it throws an exception.
+
+=item destroy(PRINCIPAL, HOSTNAME [, DATETIME])
+
+Destroys a Duo integration object by removing it from the database and
+deleting the integration from Duo.  If deleting the Duo integration fails,
+destroy() fails.  Returns true on success and false on failure.  The
+caller should call error() to get the error message after a failure.
+PRINCIPAL, HOSTNAME, and DATETIME are stored as history information.
+PRINCIPAL should be the user who is destroying the object.  If DATETIME
+isn't given, the current time is used.
+
+=item get(PRINCIPAL, HOSTNAME [, DATETIME])
+
+Retrieves the configuration information for the Duo integration and
+returns that information in the format expected by the configuration file
+for the Duo UNIX integration.  Returns undef on failure.  The caller
+should call error() to get the error message if get() returns undef.
+
+The returned configuration look look like:
+
+    [duo]
+    ikey = <integration-key>
+    skey = <secret-key>
+    host = <api-hostname>
+
+The C<host> parameter will be taken from the configuration file pointed
+to by the DUO_KEY_FILE configuration variable.
+
+PRINCIPAL, HOSTNAME, and DATETIME are stored as history information.
+PRINCIPAL should be the user who is downloading the keytab.  If DATETIME
+isn't given, the current time is used.
+
+=back
+
+=head1 LIMITATIONS
+
+Only one Duo account is supported for a given wallet implementation.
+Currently, only one Duo integration type is supported as well.  Further
+development should expand the available integration types, possibly as
+additional wallet object types.
+
+=head1 SEE ALSO
+
+Net::Duo(3), Wallet::Config(3), Wallet::Object::Base(3), wallet-backend(8)
+
+This module is part of the wallet system.  The current version is
+available from L<http://www.eyrie.org/~eagle/software/wallet/>.
+
+=head1 AUTHOR
+
+Russ Allbery <eagle@eyrie.org>
+
+=cut
diff --git a/perl/Wallet/Schema.pm b/perl/Wallet/Schema.pm
index 2176cab..74b4c99 100644
--- a/perl/Wallet/Schema.pm
+++ b/perl/Wallet/Schema.pm
@@ -18,7 +18,7 @@ use base 'DBIx::Class::Schema';
 # This version should be increased on any code change to this module.  Always
 # use two digits for the minor version with a leading zero if necessary so
 # that it will sort properly.
-our $VERSION = '0.08';
+our $VERSION = '0.09';
 
 __PACKAGE__->load_namespaces;
 __PACKAGE__->load_components (qw/Schema::Versioned/);
@@ -272,6 +272,21 @@ oh_by stores the authenticated identity that made the change, oh_from
 stores the host from which they made the change, and oh_on stores the time
 the change was made.
 
+=head2 Duo Backend Data
+
+Duo integration objects store some additional metadata about the
+integration to aid in synchronization with Duo.
+
+  create table duo
+     (du_name             varchar(255)
+          not null references objects(ob_name),
+      du_key              varchar(255) not null);
+  create index du_key on duo (du_key);
+
+du_key holds the Duo integration key, which is the unique name of the
+integration within Duo.  Additional data may be added later to represent
+the other possible settings within Duo.
+
 =head2 Keytab Backend Data
 
 The keytab backend has stub support for synchronizing keys with an
diff --git a/perl/Wallet/Schema/Result/Duo.pm b/perl/Wallet/Schema/Result/Duo.pm
new file mode 100644
index 0000000..80a71dc
--- /dev/null
+++ b/perl/Wallet/Schema/Result/Duo.pm
@@ -0,0 +1,53 @@
+# Wallet schema for Duo metadata.
+#
+# Written by Jon Robertson <jonrober@stanford.edu>
+# Copyright 2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+package Wallet::Schema::Result::Duo;
+
+use strict;
+use warnings;
+
+use base 'DBIx::Class::Core';
+
+=for stopwords
+keytab enctype
+
+=head1 NAME
+
+Wallet::Schema::Result::Duo - Wallet schema for Duo metadata
+
+=head1 DESCRIPTION
+
+=cut
+
+__PACKAGE__->table("duo");
+
+=head1 ACCESSORS
+
+=head2 du_name
+
+  data_type: 'varchar'
+  is_nullable: 0
+  size: 255
+
+=head2 du_key
+
+  data_type: 'varchar'
+  is_nullable: 0
+  size: 255
+
+=cut
+
+__PACKAGE__->add_columns(
+  "du_name",
+  { data_type => "varchar", is_nullable => 0, size => 255 },
+  "du_key",
+  { data_type => "varchar", is_nullable => 0, size => 255 },
+);
+__PACKAGE__->set_primary_key("du_name");
+
+1;
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
new file mode 100644
index 0000000..acc517e
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
@@ -0,0 +1,17 @@
+-- Convert schema 'sql/Wallet-Schema-0.08-MySQL.sql' to 'Wallet::Schema v0.09':;
+
+BEGIN;
+
+SET foreign_key_checks=0;
+
+CREATE TABLE `duo` (
+  `du_name` varchar(255) NOT NULL,
+  `du_key` varchar(255) NOT NULL,
+  PRIMARY KEY (`du_name`)
+);
+
+SET foreign_key_checks=1;
+
+
+COMMIT;
+
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
new file mode 100644
index 0000000..0384f67
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
@@ -0,0 +1,12 @@
+-- Convert schema 'sql/Wallet-Schema-0.08-PostgreSQL.sql' to 'sql/Wallet-Schema-0.09-PostgreSQL.sql':;
+
+BEGIN;
+
+CREATE TABLE "duo" (
+  "du_name" character varying(255) NOT NULL,
+  "du_key" character varying(255) NOT NULL,
+  PRIMARY KEY ("du_name")
+);
+
+COMMIT;
+
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
new file mode 100644
index 0000000..9964a17
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
@@ -0,0 +1,11 @@
+-- Convert schema 'sql/Wallet-Schema-0.08-SQLite.sql' to 'sql/Wallet-Schema-0.09-SQLite.sql':;
+
+BEGIN;
+
+CREATE TABLE duo (
+  du_name varchar(255) NOT NULL,
+  du_key varchar(255) NOT NULL,
+  PRIMARY KEY (du_name)
+);
+
+COMMIT;
diff --git a/perl/sql/Wallet-Schema-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.09-MySQL.sql
new file mode 100644
index 0000000..eb582e5
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.09-MySQL.sql
@@ -0,0 +1,204 @@
+-- 
+-- Created by SQL::Translator::Producer::MySQL
+-- Created on Fri Jul 11 16:33:47 2014
+-- 
+SET foreign_key_checks=0;
+
+DROP TABLE IF EXISTS `acl_history`;
+
+--
+-- Table: `acl_history`
+--
+CREATE TABLE `acl_history` (
+  `ah_id` integer NOT NULL auto_increment,
+  `ah_acl` integer NOT NULL,
+  `ah_action` varchar(16) NOT NULL,
+  `ah_scheme` varchar(32) NULL,
+  `ah_identifier` varchar(255) NULL,
+  `ah_by` varchar(255) NOT NULL,
+  `ah_from` varchar(255) NOT NULL,
+  `ah_on` datetime NOT NULL,
+  PRIMARY KEY (`ah_id`)
+);
+
+DROP TABLE IF EXISTS `acl_schemes`;
+
+--
+-- Table: `acl_schemes`
+--
+CREATE TABLE `acl_schemes` (
+  `as_name` varchar(32) NOT NULL,
+  `as_class` varchar(64) NULL,
+  PRIMARY KEY (`as_name`)
+) ENGINE=InnoDB;
+
+DROP TABLE IF EXISTS `acls`;
+
+--
+-- Table: `acls`
+--
+CREATE TABLE `acls` (
+  `ac_id` integer NOT NULL auto_increment,
+  `ac_name` varchar(255) NOT NULL,
+  PRIMARY KEY (`ac_id`),
+  UNIQUE `ac_name` (`ac_name`)
+) ENGINE=InnoDB;
+
+DROP TABLE IF EXISTS `duo`;
+
+--
+-- Table: `duo`
+--
+CREATE TABLE `duo` (
+  `du_name` varchar(255) NOT NULL,
+  `du_key` varchar(255) NOT NULL,
+  PRIMARY KEY (`du_name`)
+);
+
+DROP TABLE IF EXISTS `enctypes`;
+
+--
+-- Table: `enctypes`
+--
+CREATE TABLE `enctypes` (
+  `en_name` varchar(255) NOT NULL,
+  PRIMARY KEY (`en_name`)
+);
+
+DROP TABLE IF EXISTS `flags`;
+
+--
+-- Table: `flags`
+--
+CREATE TABLE `flags` (
+  `fl_type` varchar(16) NOT NULL,
+  `fl_name` varchar(255) NOT NULL,
+  `fl_flag` enum('locked', 'unchanging') NOT NULL,
+  PRIMARY KEY (`fl_type`, `fl_name`, `fl_flag`)
+);
+
+DROP TABLE IF EXISTS `keytab_enctypes`;
+
+--
+-- Table: `keytab_enctypes`
+--
+CREATE TABLE `keytab_enctypes` (
+  `ke_name` varchar(255) NOT NULL,
+  `ke_enctype` varchar(255) NOT NULL,
+  PRIMARY KEY (`ke_name`, `ke_enctype`)
+);
+
+DROP TABLE IF EXISTS `keytab_sync`;
+
+--
+-- Table: `keytab_sync`
+--
+CREATE TABLE `keytab_sync` (
+  `ks_name` varchar(255) NOT NULL,
+  `ks_target` varchar(255) NOT NULL,
+  PRIMARY KEY (`ks_name`, `ks_target`)
+);
+
+DROP TABLE IF EXISTS `sync_targets`;
+
+--
+-- Table: `sync_targets`
+--
+CREATE TABLE `sync_targets` (
+  `st_name` varchar(255) NOT NULL,
+  PRIMARY KEY (`st_name`)
+);
+
+DROP TABLE IF EXISTS `types`;
+
+--
+-- Table: `types`
+--
+CREATE TABLE `types` (
+  `ty_name` varchar(16) NOT NULL,
+  `ty_class` varchar(64) NULL,
+  PRIMARY KEY (`ty_name`)
+) ENGINE=InnoDB;
+
+DROP TABLE IF EXISTS `acl_entries`;
+
+--
+-- Table: `acl_entries`
+--
+CREATE TABLE `acl_entries` (
+  `ae_id` integer NOT NULL,
+  `ae_scheme` varchar(32) NOT NULL,
+  `ae_identifier` varchar(255) NOT NULL,
+  INDEX `acl_entries_idx_ae_scheme` (`ae_scheme`),
+  INDEX `acl_entries_idx_ae_id` (`ae_id`),
+  PRIMARY KEY (`ae_id`, `ae_scheme`, `ae_identifier`),
+  CONSTRAINT `acl_entries_fk_ae_scheme` FOREIGN KEY (`ae_scheme`) REFERENCES `acl_schemes` (`as_name`),
+  CONSTRAINT `acl_entries_fk_ae_id` FOREIGN KEY (`ae_id`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE
+) ENGINE=InnoDB;
+
+DROP TABLE IF EXISTS `objects`;
+
+--
+-- Table: `objects`
+--
+CREATE TABLE `objects` (
+  `ob_type` varchar(16) NOT NULL,
+  `ob_name` varchar(255) NOT NULL,
+  `ob_owner` integer NULL,
+  `ob_acl_get` integer NULL,
+  `ob_acl_store` integer NULL,
+  `ob_acl_show` integer NULL,
+  `ob_acl_destroy` integer NULL,
+  `ob_acl_flags` integer NULL,
+  `ob_expires` datetime NULL,
+  `ob_created_by` varchar(255) NOT NULL,
+  `ob_created_from` varchar(255) NOT NULL,
+  `ob_created_on` datetime NOT NULL,
+  `ob_stored_by` varchar(255) NULL,
+  `ob_stored_from` varchar(255) NULL,
+  `ob_stored_on` datetime NULL,
+  `ob_downloaded_by` varchar(255) NULL,
+  `ob_downloaded_from` varchar(255) NULL,
+  `ob_downloaded_on` datetime NULL,
+  `ob_comment` varchar(255) NULL,
+  INDEX `objects_idx_ob_acl_destroy` (`ob_acl_destroy`),
+  INDEX `objects_idx_ob_acl_flags` (`ob_acl_flags`),
+  INDEX `objects_idx_ob_acl_get` (`ob_acl_get`),
+  INDEX `objects_idx_ob_owner` (`ob_owner`),
+  INDEX `objects_idx_ob_acl_show` (`ob_acl_show`),
+  INDEX `objects_idx_ob_acl_store` (`ob_acl_store`),
+  INDEX `objects_idx_ob_type` (`ob_type`),
+  PRIMARY KEY (`ob_name`, `ob_type`),
+  CONSTRAINT `objects_fk_ob_acl_destroy` FOREIGN KEY (`ob_acl_destroy`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_acl_flags` FOREIGN KEY (`ob_acl_flags`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_acl_get` FOREIGN KEY (`ob_acl_get`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_owner` FOREIGN KEY (`ob_owner`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_acl_show` FOREIGN KEY (`ob_acl_show`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_acl_store` FOREIGN KEY (`ob_acl_store`) REFERENCES `acls` (`ac_id`) ON DELETE CASCADE ON UPDATE CASCADE,
+  CONSTRAINT `objects_fk_ob_type` FOREIGN KEY (`ob_type`) REFERENCES `types` (`ty_name`)
+) ENGINE=InnoDB;
+
+DROP TABLE IF EXISTS `object_history`;
+
+--
+-- Table: `object_history`
+--
+CREATE TABLE `object_history` (
+  `oh_id` integer NOT NULL auto_increment,
+  `oh_type` varchar(16) NOT NULL,
+  `oh_name` varchar(255) NOT NULL,
+  `oh_action` varchar(16) NOT NULL,
+  `oh_field` varchar(16) NULL,
+  `oh_type_field` varchar(255) NULL,
+  `oh_old` varchar(255) NULL,
+  `oh_new` varchar(255) NULL,
+  `oh_by` varchar(255) NOT NULL,
+  `oh_from` varchar(255) NOT NULL,
+  `oh_on` datetime NOT NULL,
+  INDEX `object_history_idx_oh_type_oh_name` (`oh_type`, `oh_name`),
+  PRIMARY KEY (`oh_id`),
+  CONSTRAINT `object_history_fk_oh_type_oh_name` FOREIGN KEY (`oh_type`, `oh_name`) REFERENCES `objects` (`ob_type`, `ob_name`)
+) ENGINE=InnoDB;
+
+SET foreign_key_checks=1;
+
diff --git a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
new file mode 100644
index 0000000..a7b8881
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
@@ -0,0 +1,208 @@
+-- 
+-- Created by SQL::Translator::Producer::PostgreSQL
+-- Created on Fri Jul 11 16:33:49 2014
+-- 
+--
+-- Table: duo.
+--
+DROP TABLE "duo" CASCADE;
+CREATE TABLE "duo" (
+  "du_name" character varying(255) NOT NULL,
+  "du_key" character varying(255) NOT NULL,
+  PRIMARY KEY ("du_name")
+);
+
+--
+-- Table: acl_history.
+--
+DROP TABLE "acl_history" CASCADE;
+CREATE TABLE "acl_history" (
+  "ah_id" serial NOT NULL,
+  "ah_acl" integer NOT NULL,
+  "ah_action" character varying(16) NOT NULL,
+  "ah_scheme" character varying(32),
+  "ah_identifier" character varying(255),
+  "ah_by" character varying(255) NOT NULL,
+  "ah_from" character varying(255) NOT NULL,
+  "ah_on" timestamp NOT NULL,
+  PRIMARY KEY ("ah_id")
+);
+
+--
+-- Table: acl_schemes.
+--
+DROP TABLE "acl_schemes" CASCADE;
+CREATE TABLE "acl_schemes" (
+  "as_name" character varying(32) NOT NULL,
+  "as_class" character varying(64),
+  PRIMARY KEY ("as_name")
+);
+
+--
+-- Table: acls.
+--
+DROP TABLE "acls" CASCADE;
+CREATE TABLE "acls" (
+  "ac_id" serial NOT NULL,
+  "ac_name" character varying(255) NOT NULL,
+  PRIMARY KEY ("ac_id"),
+  CONSTRAINT "ac_name" UNIQUE ("ac_name")
+);
+
+--
+-- Table: enctypes.
+--
+DROP TABLE "enctypes" CASCADE;
+CREATE TABLE "enctypes" (
+  "en_name" character varying(255) NOT NULL,
+  PRIMARY KEY ("en_name")
+);
+
+--
+-- Table: flags.
+--
+DROP TABLE "flags" CASCADE;
+CREATE TABLE "flags" (
+  "fl_type" character varying(16) NOT NULL,
+  "fl_name" character varying(255) NOT NULL,
+  "fl_flag" character varying NOT NULL,
+  PRIMARY KEY ("fl_type", "fl_name", "fl_flag")
+);
+
+--
+-- Table: keytab_enctypes.
+--
+DROP TABLE "keytab_enctypes" CASCADE;
+CREATE TABLE "keytab_enctypes" (
+  "ke_name" character varying(255) NOT NULL,
+  "ke_enctype" character varying(255) NOT NULL,
+  PRIMARY KEY ("ke_name", "ke_enctype")
+);
+
+--
+-- Table: keytab_sync.
+--
+DROP TABLE "keytab_sync" CASCADE;
+CREATE TABLE "keytab_sync" (
+  "ks_name" character varying(255) NOT NULL,
+  "ks_target" character varying(255) NOT NULL,
+  PRIMARY KEY ("ks_name", "ks_target")
+);
+
+--
+-- Table: sync_targets.
+--
+DROP TABLE "sync_targets" CASCADE;
+CREATE TABLE "sync_targets" (
+  "st_name" character varying(255) NOT NULL,
+  PRIMARY KEY ("st_name")
+);
+
+--
+-- Table: types.
+--
+DROP TABLE "types" CASCADE;
+CREATE TABLE "types" (
+  "ty_name" character varying(16) NOT NULL,
+  "ty_class" character varying(64),
+  PRIMARY KEY ("ty_name")
+);
+
+--
+-- Table: acl_entries.
+--
+DROP TABLE "acl_entries" CASCADE;
+CREATE TABLE "acl_entries" (
+  "ae_id" integer NOT NULL,
+  "ae_scheme" character varying(32) NOT NULL,
+  "ae_identifier" character varying(255) NOT NULL,
+  PRIMARY KEY ("ae_id", "ae_scheme", "ae_identifier")
+);
+CREATE INDEX "acl_entries_idx_ae_scheme" on "acl_entries" ("ae_scheme");
+CREATE INDEX "acl_entries_idx_ae_id" on "acl_entries" ("ae_id");
+
+--
+-- Table: objects.
+--
+DROP TABLE "objects" CASCADE;
+CREATE TABLE "objects" (
+  "ob_type" character varying(16) NOT NULL,
+  "ob_name" character varying(255) NOT NULL,
+  "ob_owner" integer,
+  "ob_acl_get" integer,
+  "ob_acl_store" integer,
+  "ob_acl_show" integer,
+  "ob_acl_destroy" integer,
+  "ob_acl_flags" integer,
+  "ob_expires" timestamp,
+  "ob_created_by" character varying(255) NOT NULL,
+  "ob_created_from" character varying(255) NOT NULL,
+  "ob_created_on" timestamp NOT NULL,
+  "ob_stored_by" character varying(255),
+  "ob_stored_from" character varying(255),
+  "ob_stored_on" timestamp,
+  "ob_downloaded_by" character varying(255),
+  "ob_downloaded_from" character varying(255),
+  "ob_downloaded_on" timestamp,
+  "ob_comment" character varying(255),
+  PRIMARY KEY ("ob_name", "ob_type")
+);
+CREATE INDEX "objects_idx_ob_acl_destroy" on "objects" ("ob_acl_destroy");
+CREATE INDEX "objects_idx_ob_acl_flags" on "objects" ("ob_acl_flags");
+CREATE INDEX "objects_idx_ob_acl_get" on "objects" ("ob_acl_get");
+CREATE INDEX "objects_idx_ob_owner" on "objects" ("ob_owner");
+CREATE INDEX "objects_idx_ob_acl_show" on "objects" ("ob_acl_show");
+CREATE INDEX "objects_idx_ob_acl_store" on "objects" ("ob_acl_store");
+CREATE INDEX "objects_idx_ob_type" on "objects" ("ob_type");
+
+--
+-- Table: object_history.
+--
+DROP TABLE "object_history" CASCADE;
+CREATE TABLE "object_history" (
+  "oh_id" serial NOT NULL,
+  "oh_type" character varying(16) NOT NULL,
+  "oh_name" character varying(255) NOT NULL,
+  "oh_action" character varying(16) NOT NULL,
+  "oh_field" character varying(16),
+  "oh_type_field" character varying(255),
+  "oh_old" character varying(255),
+  "oh_new" character varying(255),
+  "oh_by" character varying(255) NOT NULL,
+  "oh_from" character varying(255) NOT NULL,
+  "oh_on" timestamp NOT NULL,
+  PRIMARY KEY ("oh_id")
+);
+CREATE INDEX "object_history_idx_oh_type_oh_name" on "object_history" ("oh_type", "oh_name");
+
+--
+-- Foreign Key Definitions
+--
+
+ALTER TABLE "acl_entries" ADD CONSTRAINT "acl_entries_fk_ae_scheme" FOREIGN KEY ("ae_scheme")
+  REFERENCES "acl_schemes" ("as_name") DEFERRABLE;
+
+ALTER TABLE "acl_entries" ADD CONSTRAINT "acl_entries_fk_ae_id" FOREIGN KEY ("ae_id")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_acl_destroy" FOREIGN KEY ("ob_acl_destroy")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_acl_flags" FOREIGN KEY ("ob_acl_flags")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_acl_get" FOREIGN KEY ("ob_acl_get")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_owner" FOREIGN KEY ("ob_owner")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_acl_show" FOREIGN KEY ("ob_acl_show")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_acl_store" FOREIGN KEY ("ob_acl_store")
+  REFERENCES "acls" ("ac_id") ON DELETE CASCADE ON UPDATE CASCADE DEFERRABLE;
+
+ALTER TABLE "objects" ADD CONSTRAINT "objects_fk_ob_type" FOREIGN KEY ("ob_type")
+  REFERENCES "types" ("ty_name") DEFERRABLE;
+
diff --git a/perl/sql/Wallet-Schema-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.09-SQLite.sql
new file mode 100644
index 0000000..fbde466
--- /dev/null
+++ b/perl/sql/Wallet-Schema-0.09-SQLite.sql
@@ -0,0 +1,212 @@
+-- 
+-- Created by SQL::Translator::Producer::SQLite
+-- Created on Fri Jul 11 16:33:48 2014
+-- 
+
+BEGIN TRANSACTION;
+
+--
+-- Table: duo
+--
+DROP TABLE IF EXISTS duo;
+
+CREATE TABLE duo (
+  du_name varchar(255) NOT NULL,
+  du_key varchar(255) NOT NULL,
+  PRIMARY KEY (du_name)
+);
+
+--
+-- Table: acl_history
+--
+DROP TABLE IF EXISTS acl_history;
+
+CREATE TABLE acl_history (
+  ah_id INTEGER PRIMARY KEY NOT NULL,
+  ah_acl integer NOT NULL,
+  ah_action varchar(16) NOT NULL,
+  ah_scheme varchar(32),
+  ah_identifier varchar(255),
+  ah_by varchar(255) NOT NULL,
+  ah_from varchar(255) NOT NULL,
+  ah_on datetime NOT NULL
+);
+
+--
+-- Table: acl_schemes
+--
+DROP TABLE IF EXISTS acl_schemes;
+
+CREATE TABLE acl_schemes (
+  as_name varchar(32) NOT NULL,
+  as_class varchar(64),
+  PRIMARY KEY (as_name)
+);
+
+--
+-- Table: acls
+--
+DROP TABLE IF EXISTS acls;
+
+CREATE TABLE acls (
+  ac_id INTEGER PRIMARY KEY NOT NULL,
+  ac_name varchar(255) NOT NULL
+);
+
+CREATE UNIQUE INDEX ac_name ON acls (ac_name);
+
+--
+-- Table: enctypes
+--
+DROP TABLE IF EXISTS enctypes;
+
+CREATE TABLE enctypes (
+  en_name varchar(255) NOT NULL,
+  PRIMARY KEY (en_name)
+);
+
+--
+-- Table: flags
+--
+DROP TABLE IF EXISTS flags;
+
+CREATE TABLE flags (
+  fl_type varchar(16) NOT NULL,
+  fl_name varchar(255) NOT NULL,
+  fl_flag enum NOT NULL,
+  PRIMARY KEY (fl_type, fl_name, fl_flag)
+);
+
+--
+-- Table: keytab_enctypes
+--
+DROP TABLE IF EXISTS keytab_enctypes;
+
+CREATE TABLE keytab_enctypes (
+  ke_name varchar(255) NOT NULL,
+  ke_enctype varchar(255) NOT NULL,
+  PRIMARY KEY (ke_name, ke_enctype)
+);
+
+--
+-- Table: keytab_sync
+--
+DROP TABLE IF EXISTS keytab_sync;
+
+CREATE TABLE keytab_sync (
+  ks_name varchar(255) NOT NULL,
+  ks_target varchar(255) NOT NULL,
+  PRIMARY KEY (ks_name, ks_target)
+);
+
+--
+-- Table: sync_targets
+--
+DROP TABLE IF EXISTS sync_targets;
+
+CREATE TABLE sync_targets (
+  st_name varchar(255) NOT NULL,
+  PRIMARY KEY (st_name)
+);
+
+--
+-- Table: types
+--
+DROP TABLE IF EXISTS types;
+
+CREATE TABLE types (
+  ty_name varchar(16) NOT NULL,
+  ty_class varchar(64),
+  PRIMARY KEY (ty_name)
+);
+
+--
+-- Table: acl_entries
+--
+DROP TABLE IF EXISTS acl_entries;
+
+CREATE TABLE acl_entries (
+  ae_id integer NOT NULL,
+  ae_scheme varchar(32) NOT NULL,
+  ae_identifier varchar(255) NOT NULL,
+  PRIMARY KEY (ae_id, ae_scheme, ae_identifier),
+  FOREIGN KEY (ae_scheme) REFERENCES acl_schemes(as_name),
+  FOREIGN KEY (ae_id) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE
+);
+
+CREATE INDEX acl_entries_idx_ae_scheme ON acl_entries (ae_scheme);
+
+CREATE INDEX acl_entries_idx_ae_id ON acl_entries (ae_id);
+
+--
+-- Table: objects
+--
+DROP TABLE IF EXISTS objects;
+
+CREATE TABLE objects (
+  ob_type varchar(16) NOT NULL,
+  ob_name varchar(255) NOT NULL,
+  ob_owner integer,
+  ob_acl_get integer,
+  ob_acl_store integer,
+  ob_acl_show integer,
+  ob_acl_destroy integer,
+  ob_acl_flags integer,
+  ob_expires datetime,
+  ob_created_by varchar(255) NOT NULL,
+  ob_created_from varchar(255) NOT NULL,
+  ob_created_on datetime NOT NULL,
+  ob_stored_by varchar(255),
+  ob_stored_from varchar(255),
+  ob_stored_on datetime,
+  ob_downloaded_by varchar(255),
+  ob_downloaded_from varchar(255),
+  ob_downloaded_on datetime,
+  ob_comment varchar(255),
+  PRIMARY KEY (ob_name, ob_type),
+  FOREIGN KEY (ob_acl_destroy) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_acl_flags) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_acl_get) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_owner) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_acl_show) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_acl_store) REFERENCES acls(ac_id) ON DELETE CASCADE ON UPDATE CASCADE,
+  FOREIGN KEY (ob_type) REFERENCES types(ty_name)
+);
+
+CREATE INDEX objects_idx_ob_acl_destroy ON objects (ob_acl_destroy);
+
+CREATE INDEX objects_idx_ob_acl_flags ON objects (ob_acl_flags);
+
+CREATE INDEX objects_idx_ob_acl_get ON objects (ob_acl_get);
+
+CREATE INDEX objects_idx_ob_owner ON objects (ob_owner);
+
+CREATE INDEX objects_idx_ob_acl_show ON objects (ob_acl_show);
+
+CREATE INDEX objects_idx_ob_acl_store ON objects (ob_acl_store);
+
+CREATE INDEX objects_idx_ob_type ON objects (ob_type);
+
+--
+-- Table: object_history
+--
+DROP TABLE IF EXISTS object_history;
+
+CREATE TABLE object_history (
+  oh_id INTEGER PRIMARY KEY NOT NULL,
+  oh_type varchar(16) NOT NULL,
+  oh_name varchar(255) NOT NULL,
+  oh_action varchar(16) NOT NULL,
+  oh_field varchar(16),
+  oh_type_field varchar(255),
+  oh_old varchar(255),
+  oh_new varchar(255),
+  oh_by varchar(255) NOT NULL,
+  oh_from varchar(255) NOT NULL,
+  oh_on datetime NOT NULL,
+  FOREIGN KEY (oh_type, oh_name) REFERENCES objects(ob_type, ob_name)
+);
+
+CREATE INDEX object_history_idx_oh_type_oh_name ON object_history (oh_type, oh_name);
+
+COMMIT;
diff --git a/perl/t/data/duo/integration.json b/perl/t/data/duo/integration.json
new file mode 100644
index 0000000..6e569d6
--- /dev/null
+++ b/perl/t/data/duo/integration.json
@@ -0,0 +1,11 @@
+{
+    "enroll_policy": "enroll",
+    "greeting": "",
+    "groups_allowed": [],
+    "integration_key": "DIRWIH0ZZPV4G88B37VQ",
+    "name": "Integration for UNIX PAM",
+    "notes": "",
+    "secret_key": "QO4ZLqQVRIOZYkHfdPDORfcNf8LeXIbCWwHazY7o",
+    "type": "unix",
+    "visual_style": "default"
+}
diff --git a/perl/t/data/duo/keys.json b/perl/t/data/duo/keys.json
new file mode 100644
index 0000000..0de11ff
--- /dev/null
+++ b/perl/t/data/duo/keys.json
@@ -0,0 +1,5 @@
+{
+    "integration_key": "VWFQIFMA9E79ZFG0ABIQ",
+    "secret_key": "BAbja87NB8AmzlgalGAm09abNqpGZVva985al1zF",
+    "api_hostname": "example-admin.duosecurity.com"
+}
diff --git a/perl/t/duo.t b/perl/t/duo.t
new file mode 100755
index 0000000..12fee3a
--- /dev/null
+++ b/perl/t/duo.t
@@ -0,0 +1,157 @@
+#!/usr/bin/perl
+#
+# Tests for the Duo integration object implementation.
+#
+# Written by Russ Allbery <eagle@eyrie.org>
+# Copyright 2014
+#     The Board of Trustees of the Leland Stanford Junior University
+#
+# See LICENSE for licensing terms.
+
+use strict;
+use warnings;
+
+use POSIX qw(strftime);
+use Test::More;
+
+BEGIN {
+    eval 'use Net::Duo';
+    plan skip_all => 'Net::Duo required for testing duo'
+      if $@;
+    eval 'use Net::Duo::Mock::Agent';
+    plan skip_all => 'Net::Duo::Mock::Agent required for testing duo'
+      if $@;
+}
+
+BEGIN {
+    use_ok('Wallet::Admin');
+    use_ok('Wallet::Config');
+    use_ok('Wallet::Object::Duo');
+}
+
+use lib 't/lib';
+use Util;
+
+# Some global defaults to use.
+my $user = 'admin@EXAMPLE.COM';
+my $host = 'localhost';
+my @trace = ($user, $host, time);
+my $date = strftime ('%Y-%m-%d %H:%M:%S', localtime $trace[2]);
+
+# Flush all output immediately.
+$| = 1;
+
+# Use Wallet::Admin to set up the database.
+db_setup;
+my $admin = eval { Wallet::Admin->new };
+is ($@, '', 'Database connection succeeded');
+is ($admin->reinitialize ($user), 1, 'Database initialization succeeded');
+my $schema = $admin->schema;
+
+# Create a mock object to use for Duo calls.
+my $mock = Net::Duo::Mock::Agent->new ({ key_file => 't/data/duo/keys.json' });
+
+# Test error handling in the absence of configuration.
+my $object = eval {
+    Wallet::Object::Duo->new ('duo', 'test', $schema);
+};
+is ($object, undef, 'Wallet::Object::Duo new with no config failed');
+is ($@, "duo object implementation not configured\n", '...with correct error');
+$object = eval {
+    Wallet::Object::Duo->create ('duo', 'test', $schema, @trace);
+};
+is ($object, undef, 'Wallet::Object::Duo creation with no config failed');
+is ($@, "duo object implementation not configured\n", '...with correct error');
+
+# Set up the Duo configuration.
+$Wallet::Config::DUO_AGENT    = $mock;
+$Wallet::Config::DUO_KEY_FILE = 't/data/duo/keys.json';
+
+# Test creating an integration.
+note ('Test creating an integration');
+my $expected = {
+    name  => 'test',
+    notes => 'Managed by wallet',
+    type  => 'unix',
+};
+$mock->expect (
+    {
+        method        => 'POST',
+        uri           => '/admin/v1/integrations',
+        content       => $expected,
+        response_file => 't/data/duo/integration.json',
+    }
+);
+$object = Wallet::Object::Duo->create ('duo', 'test', $schema, @trace);
+isa_ok ($object, 'Wallet::Object::Duo');
+
+# Check the metadata about the new wallet object.
+$expected = <<"EOO";
+           Type: duo
+           Name: test
+        Duo key: DIRWIH0ZZPV4G88B37VQ
+     Created by: $user
+   Created from: $host
+     Created on: $date
+EOO
+is ($object->show, $expected, 'Show output is correct');
+
+# Test retrieving the integration information.
+note ('Test retrieving an integration');
+$mock->expect (
+    {
+        method        => 'GET',
+        uri           => '/admin/v1/integrations/DIRWIH0ZZPV4G88B37VQ',
+        response_file => 't/data/duo/integration.json',
+    }
+);
+my $data = $object->get (@trace);
+ok (defined ($data), 'Retrieval succeeds');
+$expected = <<'EOO';
+[duo]
+ikey = DIRWIH0ZZPV4G88B37VQ
+skey = QO4ZLqQVRIOZYkHfdPDORfcNf8LeXIbCWwHazY7o
+host = example-admin.duosecurity.com
+EOO
+is ($data, $expected, '...and integration data is correct');
+
+# Ensure that we can't retrieve the object when locked.
+is ($object->flag_set ('locked', @trace), 1,
+    'Setting object to locked succeeds');
+is ($object->get, undef, '...and now get fails');
+is ($object->error, 'cannot get duo:test: object is locked',
+    '...with correct error');
+is ($object->flag_clear ('locked', @trace), 1,
+    '...and clearing locked flag works');
+
+# Create a new object by wallet type and name.
+$object = Wallet::Object::Duo->new ('duo', 'test', $schema);
+
+# Test deleting an integration.  We can't test this entirely properly because
+# currently Net::Duo::Mock::Agent doesn't support stacking multiple expected
+# calls and delete makes two calls.
+note ('Test deleting an integration');
+$mock->expect (
+    {
+        method        => 'GET',
+        uri           => '/admin/v1/integrations/DIRWIH0ZZPV4G88B37VQ',
+        response_file => 't/data/duo/integration.json',
+    }
+);
+TODO: {
+    local $TODO = 'Net::Duo::Mock::Agent not yet capable';
+
+    is ($object->destroy (@trace), 1, 'Duo object deletion succeeded');
+    $object = eval { Wallet::Object::Duo->new ('duo', 'test', $schema) };
+    is ($object, undef, '...and now object cannot be retrieved');
+    is ($@, "cannot find duo:test\n", '...with correct error');
+}
+
+# Clean up.
+$admin->destroy;
+undef $admin;
+undef $object;
+unlink ('wallet-db');
+
+# Done testing.
+done_testing ();
diff --git a/tests/server/admin-t b/tests/server/admin-t
index 3c80d81..f025d98 100755
--- a/tests/server/admin-t
+++ b/tests/server/admin-t
@@ -3,7 +3,7 @@
 # Tests for the wallet-admin dispatch code.
 #
 # Written by Russ Allbery <eagle@eyrie.org>
-# Copyright 2008, 2009, 2010, 2011
+# Copyright 2008, 2009, 2010, 2011, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # See LICENSE for licensing terms.
@@ -142,7 +142,7 @@ is ($err, "invalid admin principal rra\n", 'Initialize requires a principal');
 is ($out, "new\n", ' and nothing was run');
 ($out, $err) = run_admin ('initialize', 'eagle@eyrie.org');
 is ($err, '', 'Initialize succeeds with a principal');
-is ($out, "new\ninitialize rra\@stanford.edu\n", ' and runs the right code');
+is ($out, "new\ninitialize eagle\@eyrie.org\n", ' and runs the right code');
 
 # Test register.
 ($out, $err) = run_admin ('register', 'foo', 'foo', 'Foo::Bar');
@@ -172,7 +172,7 @@ is ($out, "new\n"
     . '  Are you sure (N/y)? ' . "destroy\n", ' and calls the right methods');
 ($out, $err) = run_admin ('initialize', 'eagle@eyrie.org');
 is ($err, "some error\n", 'Error handling succeeds for initialize');
-is ($out, "new\ninitialize rra\@stanford.edu\n",
+is ($out, "new\ninitialize eagle\@eyrie.org\n",
     ' and calls the right methods');
 ($out, $err) = run_admin ('register', 'object', 'foo', 'Foo::Object');
 is ($err, "some error\n", 'Error handling succeeds for register object');
-- 
cgit v1.2.3


From f1b9938282d80179dc793aadeb123fb7cbed2e45 Mon Sep 17 00:00:00 2001
From: Russ Allbery <eagle@eyrie.org>
Date: Fri, 11 Jul 2014 19:26:46 -0700
Subject: Clean up foreign keys and indices for history tables

Previous versions had erroneous foreign key constraints between the
object history table and the objects table.  Remove those constraints,
and an incorrect linkage in the schema for the ACL history, and add
indices for the object type, name, and ACL instead.

Change-Id: Ie0ff2448caa82c7a533a1b9ff5c13029bb6ae4ef
Reviewed-on: https://gerrit.stanford.edu/1526
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
---
 NEWS                                            |  5 +++
 perl/Wallet/Schema/Result/AclHistory.pm         | 13 +++----
 perl/Wallet/Schema/Result/ObjectHistory.pm      | 14 ++++----
 perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql      | 13 ++++---
 perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql |  3 ++
 perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql     |  2 ++
 perl/sql/Wallet-Schema-0.08-PostgreSQL.sql      |  5 +--
 perl/sql/Wallet-Schema-0.09-MySQL.sql           | 46 ++++++++++++------------
 perl/sql/Wallet-Schema-0.09-PostgreSQL.sql      | 43 +++++++++++-----------
 perl/sql/Wallet-Schema-0.09-SQLite.sql          | 47 +++++++++++++------------
 10 files changed, 103 insertions(+), 88 deletions(-)

(limited to 'perl/sql')

diff --git a/NEWS b/NEWS
index a7cab7e..7864311 100644
--- a/NEWS
+++ b/NEWS
@@ -34,6 +34,11 @@ wallet 1.1 (unreleased)
     until the keys have been randomized, the password should not need to
     be secure (and indeed is not cryptographically random).
 
+    Previous versions had erroneous foreign key constraints between the
+    object history table and the objects table.  Remove those constraints,
+    and an incorrect linkage in the schema for the ACL history, and add
+    indices for the object type, name, and ACL instead.
+
 wallet 1.0 (2013-03-27)
 
     Owners of wallet objects are now allowed to destroy them.  In previous
diff --git a/perl/Wallet/Schema/Result/AclHistory.pm b/perl/Wallet/Schema/Result/AclHistory.pm
index d3ef901..11593b7 100644
--- a/perl/Wallet/Schema/Result/AclHistory.pm
+++ b/perl/Wallet/Schema/Result/AclHistory.pm
@@ -1,7 +1,7 @@
 # Wallet schema for ACL history.
 #
 # Written by Jon Robertson <jonrober@stanford.edu>
-# Copyright 2012, 2013
+# Copyright 2012, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # See LICENSE for licensing terms.
@@ -103,10 +103,11 @@ __PACKAGE__->add_columns(
 );
 __PACKAGE__->set_primary_key("ah_id");
 
-__PACKAGE__->might_have(
-                        'acls',
-                        'Wallet::Schema::Result::Acl',
-                        { 'foreign.ac_id' => 'self.ah_id' },
-                       );
+# Add an index on the ACL.
+sub sqlt_deploy_hook {
+    my ($self, $sqlt_table) = @_;
+    my $name = 'acl_history_idx_ah_acl';
+    $sqlt_table->add_index (name => $name, fields => [qw(ah_acl)]);
+}
 
 1;
diff --git a/perl/Wallet/Schema/Result/ObjectHistory.pm b/perl/Wallet/Schema/Result/ObjectHistory.pm
index 9cbb159..5e9c8bd 100644
--- a/perl/Wallet/Schema/Result/ObjectHistory.pm
+++ b/perl/Wallet/Schema/Result/ObjectHistory.pm
@@ -1,7 +1,7 @@
 # Wallet schema for object history.
 #
 # Written by Jon Robertson <jonrober@stanford.edu>
-# Copyright 2012, 2013
+# Copyright 2012, 2013, 2014
 #     The Board of Trustees of the Leland Stanford Junior University
 #
 # See LICENSE for licensing terms.
@@ -125,11 +125,11 @@ __PACKAGE__->add_columns(
 );
 __PACKAGE__->set_primary_key("oh_id");
 
-__PACKAGE__->might_have(
-                        'objects',
-                        'Wallet::Schema::Result::Object',
-                        { 'foreign.ob_type' => 'self.oh_type',
-                          'foreign.ob_name' => 'self.oh_name' },
-                       );
+# Add an index on object type and object name.
+sub sqlt_deploy_hook {
+    my ($self, $sqlt_table) = @_;
+    my $name = 'object_history_idx_oh_type_oh_name';
+    $sqlt_table->add_index (name => $name, fields => [qw(oh_type oh_name)]);
+}
 
 1;
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
index acc517e..8127613 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
@@ -4,14 +4,19 @@ BEGIN;
 
 SET foreign_key_checks=0;
 
-CREATE TABLE `duo` (
-  `du_name` varchar(255) NOT NULL,
-  `du_key` varchar(255) NOT NULL,
-  PRIMARY KEY (`du_name`)
+CREATE TABLE duo (
+  du_name varchar(255) NOT NULL,
+  du_key varchar(255) NOT NULL,
+  PRIMARY KEY (du_name)
 );
 
 SET foreign_key_checks=1;
 
+ALTER TABLE acl_history ADD INDEX acl_history_idx_ah_acl (ah_acl);
+
+ALTER TABLE object_history DROP FOREIGN KEY object_history_fk_oh_type_oh_name,
+                           ALTER TABLE object_history;
+
 
 COMMIT;
 
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
index 0384f67..66603f7 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
@@ -8,5 +8,8 @@ CREATE TABLE "duo" (
   PRIMARY KEY ("du_name")
 );
 
+CREATE INDEX acl_history_idx_ah_acl on acl_history (ah_acl);
+
+
 COMMIT;
 
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
index 9964a17..42f4ea5 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
@@ -8,4 +8,6 @@ CREATE TABLE duo (
   PRIMARY KEY (du_name)
 );
 
+CREATE INDEX acl_history_idx_ah_acl ON acl_history (ah_acl);
+
 COMMIT;
diff --git a/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
index 296909f..4347de8 100644
--- a/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-PostgreSQL.sql
@@ -2,7 +2,7 @@
 -- Created by SQL::Translator::Producer::PostgreSQL
 -- Created on Fri Jan 25 14:12:02 2013
 --
--- Copyright 2012, 2013
+-- Copyright 2012, 2013, 2014
 --     The Board of Trustees of the Leland Stanford Junior University
 --
 -- Permission is hereby granted, free of charge, to any person obtaining a
@@ -218,6 +218,3 @@ ALTER TABLE "objects" ADD FOREIGN KEY ("ob_acl_store")
 ALTER TABLE "objects" ADD FOREIGN KEY ("ob_type")
   REFERENCES "types" ("ty_name") DEFERRABLE;
 
---ALTER TABLE "object_history" ADD FOREIGN KEY ("oh_type", "oh_name")
---  REFERENCES "objects" ("ob_type", "ob_name") DEFERRABLE;
-
diff --git a/perl/sql/Wallet-Schema-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.09-MySQL.sql
index eb582e5..86eeec4 100644
--- a/perl/sql/Wallet-Schema-0.09-MySQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-MySQL.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::MySQL
--- Created on Fri Jul 11 16:33:47 2014
+-- Created on Fri Jul 11 19:17:16 2014
 -- 
 SET foreign_key_checks=0;
 
@@ -18,6 +18,7 @@ CREATE TABLE `acl_history` (
   `ah_by` varchar(255) NOT NULL,
   `ah_from` varchar(255) NOT NULL,
   `ah_on` datetime NOT NULL,
+  INDEX `acl_history_idx_ah_acl` (`ah_acl`),
   PRIMARY KEY (`ah_id`)
 );
 
@@ -99,6 +100,27 @@ CREATE TABLE `keytab_sync` (
   PRIMARY KEY (`ks_name`, `ks_target`)
 );
 
+DROP TABLE IF EXISTS `object_history`;
+
+--
+-- Table: `object_history`
+--
+CREATE TABLE `object_history` (
+  `oh_id` integer NOT NULL auto_increment,
+  `oh_type` varchar(16) NOT NULL,
+  `oh_name` varchar(255) NOT NULL,
+  `oh_action` varchar(16) NOT NULL,
+  `oh_field` varchar(16) NULL,
+  `oh_type_field` varchar(255) NULL,
+  `oh_old` varchar(255) NULL,
+  `oh_new` varchar(255) NULL,
+  `oh_by` varchar(255) NOT NULL,
+  `oh_from` varchar(255) NOT NULL,
+  `oh_on` datetime NOT NULL,
+  INDEX `object_history_idx_oh_type_oh_name` (`oh_type`, `oh_name`),
+  PRIMARY KEY (`oh_id`)
+);
+
 DROP TABLE IF EXISTS `sync_targets`;
 
 --
@@ -178,27 +200,5 @@ CREATE TABLE `objects` (
   CONSTRAINT `objects_fk_ob_type` FOREIGN KEY (`ob_type`) REFERENCES `types` (`ty_name`)
 ) ENGINE=InnoDB;
 
-DROP TABLE IF EXISTS `object_history`;
-
---
--- Table: `object_history`
---
-CREATE TABLE `object_history` (
-  `oh_id` integer NOT NULL auto_increment,
-  `oh_type` varchar(16) NOT NULL,
-  `oh_name` varchar(255) NOT NULL,
-  `oh_action` varchar(16) NOT NULL,
-  `oh_field` varchar(16) NULL,
-  `oh_type_field` varchar(255) NULL,
-  `oh_old` varchar(255) NULL,
-  `oh_new` varchar(255) NULL,
-  `oh_by` varchar(255) NOT NULL,
-  `oh_from` varchar(255) NOT NULL,
-  `oh_on` datetime NOT NULL,
-  INDEX `object_history_idx_oh_type_oh_name` (`oh_type`, `oh_name`),
-  PRIMARY KEY (`oh_id`),
-  CONSTRAINT `object_history_fk_oh_type_oh_name` FOREIGN KEY (`oh_type`, `oh_name`) REFERENCES `objects` (`ob_type`, `ob_name`)
-) ENGINE=InnoDB;
-
 SET foreign_key_checks=1;
 
diff --git a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
index a7b8881..38fc6ca 100644
--- a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::PostgreSQL
--- Created on Fri Jul 11 16:33:49 2014
+-- Created on Fri Jul 11 19:17:17 2014
 -- 
 --
 -- Table: duo.
@@ -27,6 +27,7 @@ CREATE TABLE "acl_history" (
   "ah_on" timestamp NOT NULL,
   PRIMARY KEY ("ah_id")
 );
+CREATE INDEX "acl_history_idx_ah_acl" on "acl_history" ("ah_acl");
 
 --
 -- Table: acl_schemes.
@@ -89,6 +90,26 @@ CREATE TABLE "keytab_sync" (
   PRIMARY KEY ("ks_name", "ks_target")
 );
 
+--
+-- Table: object_history.
+--
+DROP TABLE "object_history" CASCADE;
+CREATE TABLE "object_history" (
+  "oh_id" serial NOT NULL,
+  "oh_type" character varying(16) NOT NULL,
+  "oh_name" character varying(255) NOT NULL,
+  "oh_action" character varying(16) NOT NULL,
+  "oh_field" character varying(16),
+  "oh_type_field" character varying(255),
+  "oh_old" character varying(255),
+  "oh_new" character varying(255),
+  "oh_by" character varying(255) NOT NULL,
+  "oh_from" character varying(255) NOT NULL,
+  "oh_on" timestamp NOT NULL,
+  PRIMARY KEY ("oh_id")
+);
+CREATE INDEX "object_history_idx_oh_type_oh_name" on "object_history" ("oh_type", "oh_name");
+
 --
 -- Table: sync_targets.
 --
@@ -155,26 +176,6 @@ CREATE INDEX "objects_idx_ob_acl_show" on "objects" ("ob_acl_show");
 CREATE INDEX "objects_idx_ob_acl_store" on "objects" ("ob_acl_store");
 CREATE INDEX "objects_idx_ob_type" on "objects" ("ob_type");
 
---
--- Table: object_history.
---
-DROP TABLE "object_history" CASCADE;
-CREATE TABLE "object_history" (
-  "oh_id" serial NOT NULL,
-  "oh_type" character varying(16) NOT NULL,
-  "oh_name" character varying(255) NOT NULL,
-  "oh_action" character varying(16) NOT NULL,
-  "oh_field" character varying(16),
-  "oh_type_field" character varying(255),
-  "oh_old" character varying(255),
-  "oh_new" character varying(255),
-  "oh_by" character varying(255) NOT NULL,
-  "oh_from" character varying(255) NOT NULL,
-  "oh_on" timestamp NOT NULL,
-  PRIMARY KEY ("oh_id")
-);
-CREATE INDEX "object_history_idx_oh_type_oh_name" on "object_history" ("oh_type", "oh_name");
-
 --
 -- Foreign Key Definitions
 --
diff --git a/perl/sql/Wallet-Schema-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.09-SQLite.sql
index fbde466..97db821 100644
--- a/perl/sql/Wallet-Schema-0.09-SQLite.sql
+++ b/perl/sql/Wallet-Schema-0.09-SQLite.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::SQLite
--- Created on Fri Jul 11 16:33:48 2014
+-- Created on Fri Jul 11 19:17:16 2014
 -- 
 
 BEGIN TRANSACTION;
@@ -32,6 +32,8 @@ CREATE TABLE acl_history (
   ah_on datetime NOT NULL
 );
 
+CREATE INDEX acl_history_idx_ah_acl ON acl_history (ah_acl);
+
 --
 -- Table: acl_schemes
 --
@@ -99,6 +101,27 @@ CREATE TABLE keytab_sync (
   PRIMARY KEY (ks_name, ks_target)
 );
 
+--
+-- Table: object_history
+--
+DROP TABLE IF EXISTS object_history;
+
+CREATE TABLE object_history (
+  oh_id INTEGER PRIMARY KEY NOT NULL,
+  oh_type varchar(16) NOT NULL,
+  oh_name varchar(255) NOT NULL,
+  oh_action varchar(16) NOT NULL,
+  oh_field varchar(16),
+  oh_type_field varchar(255),
+  oh_old varchar(255),
+  oh_new varchar(255),
+  oh_by varchar(255) NOT NULL,
+  oh_from varchar(255) NOT NULL,
+  oh_on datetime NOT NULL
+);
+
+CREATE INDEX object_history_idx_oh_type_oh_name ON object_history (oh_type, oh_name);
+
 --
 -- Table: sync_targets
 --
@@ -187,26 +210,4 @@ CREATE INDEX objects_idx_ob_acl_store ON objects (ob_acl_store);
 
 CREATE INDEX objects_idx_ob_type ON objects (ob_type);
 
---
--- Table: object_history
---
-DROP TABLE IF EXISTS object_history;
-
-CREATE TABLE object_history (
-  oh_id INTEGER PRIMARY KEY NOT NULL,
-  oh_type varchar(16) NOT NULL,
-  oh_name varchar(255) NOT NULL,
-  oh_action varchar(16) NOT NULL,
-  oh_field varchar(16),
-  oh_type_field varchar(255),
-  oh_old varchar(255),
-  oh_new varchar(255),
-  oh_by varchar(255) NOT NULL,
-  oh_from varchar(255) NOT NULL,
-  oh_on datetime NOT NULL,
-  FOREIGN KEY (oh_type, oh_name) REFERENCES objects(ob_type, ob_name)
-);
-
-CREATE INDEX object_history_idx_oh_type_oh_name ON object_history (oh_type, oh_name);
-
 COMMIT;
-- 
cgit v1.2.3


From b1bd88daea1dde6de9e6a8688c6190cdc0b5c617 Mon Sep 17 00:00:00 2001
From: Russ Allbery <eagle@eyrie.org>
Date: Tue, 15 Jul 2014 20:29:19 -0700
Subject: Record the ACL name in the acl_history table

Store the current name of the ACL with each history row, and index
the name.  This will eventually allow retrieval of history by name
for ACLs that have been deleted, although the rest of the code is
not yet in place.

The initial creation and membership of the ADMIN ACL during database
initialization or reinitialization is no longer recorded in the
acl_history table, since otherwise it produces errors due to the
missing ah_name field when building the database with schema 0.07.
There should be some better solution to this, but this will be okay
for the time being.

Change-Id: I015a00c972e0c2730c3d449952fcfe9b79c6e54f
Reviewed-on: https://gerrit.stanford.edu/1553
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
---
 NEWS                                            |  5 +++++
 perl/lib/Wallet/ACL.pm                          |  5 ++++-
 perl/lib/Wallet/Admin.pm                        | 19 ++++++++++++++-----
 perl/lib/Wallet/Schema/Result/AclHistory.pm     | 10 ++++++++++
 perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql      |  4 +++-
 perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql |  4 ++++
 perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql     |  4 ++++
 perl/sql/Wallet-Schema-0.09-MySQL.sql           |  4 +++-
 perl/sql/Wallet-Schema-0.09-PostgreSQL.sql      |  4 +++-
 perl/sql/Wallet-Schema-0.09-SQLite.sql          |  5 ++++-
 perl/t/general/server.t                         | 18 ++++--------------
 11 files changed, 58 insertions(+), 24 deletions(-)

(limited to 'perl/sql')

diff --git a/NEWS b/NEWS
index beddf7f..f6e3fdd 100644
--- a/NEWS
+++ b/NEWS
@@ -46,6 +46,11 @@ wallet 1.1 (unreleased)
     the DateTime::Format::* module corresponding to the DBD::* module used
     for the server database.
 
+    The initial creation and membership of the ADMIN ACL during database
+    initialization or reinitialization is no longer recorded in the
+    acl_history table.  (This is fallout from making a specific type of
+    upgrade testable, and may be fixed in the future.)
+
     The wallet server now requires Perl 5.8 or later (instead of 5.006 in
     previous versions) and is now built with Module::Build instead of
     ExtUtils::MakeMaker.  This should be transparent to anyone not working
diff --git a/perl/lib/Wallet/ACL.pm b/perl/lib/Wallet/ACL.pm
index 57097c0..6f5172a 100644
--- a/perl/lib/Wallet/ACL.pm
+++ b/perl/lib/Wallet/ACL.pm
@@ -80,6 +80,7 @@ sub create {
         # Add to the history table.
         my $date = DateTime->from_epoch (epoch => $time);
         %record = (ah_acl    => $id,
+                   ah_name   => $name,
                    ah_action => 'create',
                    ah_by     => $user,
                    ah_from   => $host,
@@ -165,6 +166,7 @@ sub log_acl {
     }
     my $date = DateTime->from_epoch (epoch => $time);
     my %record = (ah_acl        => $self->{id},
+                  ah_name       => $self->{name},
                   ah_action     => $action,
                   ah_scheme     => $scheme,
                   ah_identifier => $identifier,
@@ -243,7 +245,8 @@ sub destroy {
 
         # Create new history line for the deletion.
         my $date = DateTime->from_epoch (epoch => $time);
-        my %record = (ah_acl => $self->{id},
+        my %record = (ah_acl    => $self->{id},
+                      ah_name   => $self->{name},
                       ah_action => 'destroy',
                       ah_by     => $user,
                       ah_from   => $host,
diff --git a/perl/lib/Wallet/Admin.pm b/perl/lib/Wallet/Admin.pm
index 29b2f21..b07c7d1 100644
--- a/perl/lib/Wallet/Admin.pm
+++ b/perl/lib/Wallet/Admin.pm
@@ -98,13 +98,22 @@ sub initialize {
     $self->default_data;
 
     # Create a default admin ACL.
-    my $acl = Wallet::ACL->create ('ADMIN', $self->{schema}, $user,
-                                   'localhost');
-    unless ($acl->add ('krb5', $user, $user, 'localhost')) {
-        $self->error ($acl->error);
+    eval {
+        my $guard = $self->{schema}->txn_scope_guard;
+        $self->{schema}->resultset ('Acl')->populate ([
+            [ qw/ac_id ac_name/ ],
+            [ 1, 'ADMIN'        ],
+        ]);
+        $self->{schema}->resultset ('AclEntry')->populate ([
+            [ qw/ae_id ae_scheme ae_identifier/ ],
+            [ 1, 'krb5', $user                  ],
+        ]);
+        $guard->commit;
+    };
+    if ($@) {
+        $self->error ("cannot add ADMIN ACL: $@");
         return;
     }
-
     return 1;
 }
 
diff --git a/perl/lib/Wallet/Schema/Result/AclHistory.pm b/perl/lib/Wallet/Schema/Result/AclHistory.pm
index 11593b7..82e18a9 100644
--- a/perl/lib/Wallet/Schema/Result/AclHistory.pm
+++ b/perl/lib/Wallet/Schema/Result/AclHistory.pm
@@ -41,6 +41,12 @@ __PACKAGE__->table("acl_history");
   data_type: 'integer'
   is_nullable: 0
 
+=head2 ah_name
+
+  data_type: 'varchar'
+  is_nullable: 1
+  size: 255
+
 =head2 ah_action
 
   data_type: 'varchar'
@@ -84,6 +90,8 @@ __PACKAGE__->add_columns(
   { data_type => "integer", is_auto_increment => 1, is_nullable => 0 },
   "ah_acl",
   { data_type => "integer", is_nullable => 0 },
+  "ah_name",
+  { data_type => "varchar", is_nullable => 1, size => 255 },
   "ah_action",
   { data_type => "varchar", is_nullable => 0, size => 16 },
   "ah_scheme",
@@ -108,6 +116,8 @@ sub sqlt_deploy_hook {
     my ($self, $sqlt_table) = @_;
     my $name = 'acl_history_idx_ah_acl';
     $sqlt_table->add_index (name => $name, fields => [qw(ah_acl)]);
+    $name = 'acl_history_idx_ah_name';
+    $sqlt_table->add_index (name => $name, fields => [qw(ah_name)]);
 }
 
 1;
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
index 8127613..f6b1abe 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-MySQL.sql
@@ -12,7 +12,9 @@ CREATE TABLE duo (
 
 SET foreign_key_checks=1;
 
-ALTER TABLE acl_history ADD INDEX acl_history_idx_ah_acl (ah_acl);
+ALTER TABLE acl_history ADD COLUMN ah_name varchar(255) NULL,
+                        ADD INDEX acl_history_idx_ah_acl (ah_acl),
+                        ADD INDEX acl_history_idx_ah_name (ah_name);
 
 ALTER TABLE object_history DROP FOREIGN KEY object_history_fk_oh_type_oh_name,
                            ALTER TABLE object_history;
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
index 66603f7..a1d3fa3 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-PostgreSQL.sql
@@ -8,8 +8,12 @@ CREATE TABLE "duo" (
   PRIMARY KEY ("du_name")
 );
 
+ALTER TABLE acl_history ADD COLUMN ah_name character varying(255);
+
 CREATE INDEX acl_history_idx_ah_acl on acl_history (ah_acl);
 
+CREATE INDEX acl_history_idx_ah_name on acl_history (ah_name);
+
 
 COMMIT;
 
diff --git a/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
index 42f4ea5..df0fa09 100644
--- a/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
+++ b/perl/sql/Wallet-Schema-0.08-0.09-SQLite.sql
@@ -8,6 +8,10 @@ CREATE TABLE duo (
   PRIMARY KEY (du_name)
 );
 
+ALTER TABLE acl_history ADD ah_name varchar(255) default null;
+
 CREATE INDEX acl_history_idx_ah_acl ON acl_history (ah_acl);
 
+CREATE INDEX acl_history_idx_ah_name ON acl_history (ah_name);
+
 COMMIT;
diff --git a/perl/sql/Wallet-Schema-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.09-MySQL.sql
index 86eeec4..200b941 100644
--- a/perl/sql/Wallet-Schema-0.09-MySQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-MySQL.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::MySQL
--- Created on Fri Jul 11 19:17:16 2014
+-- Created on Tue Jul 15 17:41:01 2014
 -- 
 SET foreign_key_checks=0;
 
@@ -12,6 +12,7 @@ DROP TABLE IF EXISTS `acl_history`;
 CREATE TABLE `acl_history` (
   `ah_id` integer NOT NULL auto_increment,
   `ah_acl` integer NOT NULL,
+  `ah_name` varchar(255) NULL,
   `ah_action` varchar(16) NOT NULL,
   `ah_scheme` varchar(32) NULL,
   `ah_identifier` varchar(255) NULL,
@@ -19,6 +20,7 @@ CREATE TABLE `acl_history` (
   `ah_from` varchar(255) NOT NULL,
   `ah_on` datetime NOT NULL,
   INDEX `acl_history_idx_ah_acl` (`ah_acl`),
+  INDEX `acl_history_idx_ah_name` (`ah_name`),
   PRIMARY KEY (`ah_id`)
 );
 
diff --git a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
index 38fc6ca..a66f0b1 100644
--- a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::PostgreSQL
--- Created on Fri Jul 11 19:17:17 2014
+-- Created on Tue Jul 15 17:41:03 2014
 -- 
 --
 -- Table: duo.
@@ -19,6 +19,7 @@ DROP TABLE "acl_history" CASCADE;
 CREATE TABLE "acl_history" (
   "ah_id" serial NOT NULL,
   "ah_acl" integer NOT NULL,
+  "ah_name" character varying(255),
   "ah_action" character varying(16) NOT NULL,
   "ah_scheme" character varying(32),
   "ah_identifier" character varying(255),
@@ -28,6 +29,7 @@ CREATE TABLE "acl_history" (
   PRIMARY KEY ("ah_id")
 );
 CREATE INDEX "acl_history_idx_ah_acl" on "acl_history" ("ah_acl");
+CREATE INDEX "acl_history_idx_ah_name" on "acl_history" ("ah_name");
 
 --
 -- Table: acl_schemes.
diff --git a/perl/sql/Wallet-Schema-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.09-SQLite.sql
index 97db821..19a77c2 100644
--- a/perl/sql/Wallet-Schema-0.09-SQLite.sql
+++ b/perl/sql/Wallet-Schema-0.09-SQLite.sql
@@ -1,6 +1,6 @@
 -- 
 -- Created by SQL::Translator::Producer::SQLite
--- Created on Fri Jul 11 19:17:16 2014
+-- Created on Tue Jul 15 17:41:02 2014
 -- 
 
 BEGIN TRANSACTION;
@@ -24,6 +24,7 @@ DROP TABLE IF EXISTS acl_history;
 CREATE TABLE acl_history (
   ah_id INTEGER PRIMARY KEY NOT NULL,
   ah_acl integer NOT NULL,
+  ah_name varchar(255),
   ah_action varchar(16) NOT NULL,
   ah_scheme varchar(32),
   ah_identifier varchar(255),
@@ -34,6 +35,8 @@ CREATE TABLE acl_history (
 
 CREATE INDEX acl_history_idx_ah_acl ON acl_history (ah_acl);
 
+CREATE INDEX acl_history_idx_ah_name ON acl_history (ah_name);
+
 --
 -- Table: acl_schemes
 --
diff --git a/perl/t/general/server.t b/perl/t/general/server.t
index 0a527a5..b270733 100755
--- a/perl/t/general/server.t
+++ b/perl/t/general/server.t
@@ -54,18 +54,8 @@ is ($server->acl_show ('ADMIN'),
 is ($server->acl_show (1),
     "Members of ACL ADMIN (id: 1) are:\n  krb5 $admin\n",
     ' including by number');
-my $history = <<"EOO";
-DATE  create
-    by $admin from $host
-DATE  add krb5 $admin
-    by $admin from $host
-EOO
-my $result = $server->acl_history ('ADMIN');
-$result =~ s/^\d{4}-\d\d-\d\d \d\d:\d\d:\d\d/DATE/gm;
-is ($result, $history, ' and displaying history works');
-$result = $server->acl_history (1);
-$result =~ s/^\d{4}-\d\d-\d\d \d\d:\d\d:\d\d/DATE/gm;
-is ($result, $history, ' including by number');
+is ($server->acl_history ('ADMIN'), '', ' and initial history is empty');
+is ($server->acl_history (1), '', ' including by number');
 is ($server->acl_create (3), undef, 'Cannot create ACL with a numeric name');
 is ($server->error, 'ACL name may not be all numbers',
     ' and returns the right error');
@@ -117,7 +107,7 @@ is ($server->acl_add ('both', 'krb5', $user2), 1,
 is ($server->acl_show ('both'),
     "Members of ACL both (id: 4) are:\n  krb5 $user1\n  krb5 $user2\n",
     ' and show returns the correct result');
-$history = <<"EOO";
+my $history = <<"EOO";
 DATE  create
     by $admin from $host
 DATE  add krb5 $user1
@@ -125,7 +115,7 @@ DATE  add krb5 $user1
 DATE  add krb5 $user2
     by $admin from $host
 EOO
-$result = $server->acl_history ('both');
+my $result = $server->acl_history ('both');
 $result =~ s/^\d{4}-\d\d-\d\d \d\d:\d\d:\d\d/DATE/gm;
 is ($result, $history, ' as does history');
 is ($server->acl_add ('empty', 'krb5', $user1), 1, ' and another to empty');
-- 
cgit v1.2.3


From 5ca1f68de068be987e539b65f92db710d3432876 Mon Sep 17 00:00:00 2001
From: Russ Allbery <eagle@eyrie.org>
Date: Wed, 16 Jul 2014 11:18:44 -0700
Subject: Add license statements to new SQL files

Change-Id: I518a175998aa77920b08c43e3a6b890bbab59280
Reviewed-on: https://gerrit.stanford.edu/1561
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
---
 perl/sql/Wallet-Schema-0.09-MySQL.sql      | 23 +++++++++++++++++++++++
 perl/sql/Wallet-Schema-0.09-PostgreSQL.sql | 23 +++++++++++++++++++++++
 perl/sql/Wallet-Schema-0.09-SQLite.sql     | 24 +++++++++++++++++++++++-
 3 files changed, 69 insertions(+), 1 deletion(-)

(limited to 'perl/sql')

diff --git a/perl/sql/Wallet-Schema-0.09-MySQL.sql b/perl/sql/Wallet-Schema-0.09-MySQL.sql
index 200b941..a9aa745 100644
--- a/perl/sql/Wallet-Schema-0.09-MySQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-MySQL.sql
@@ -2,6 +2,29 @@
 -- Created by SQL::Translator::Producer::MySQL
 -- Created on Tue Jul 15 17:41:01 2014
 -- 
+-- Copyright 2012, 2013, 2014
+--     The Board of Trustees of the Leland Stanford Junior University
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a
+-- copy of this software and associated documentation files (the
+-- "Software"), to deal in the Software without restriction, including
+-- without limitation the rights to use, copy, modify, merge, publish,
+-- distribute, sublicense, and/or sell copies of the Software, and to
+-- permit persons to whom the Software is furnished to do so, subject to
+-- the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included
+-- in all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-- OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+-- IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+-- CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+-- TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+-- SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+--
+
 SET foreign_key_checks=0;
 
 DROP TABLE IF EXISTS `acl_history`;
diff --git a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
index a66f0b1..67f4a1b 100644
--- a/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
+++ b/perl/sql/Wallet-Schema-0.09-PostgreSQL.sql
@@ -2,6 +2,29 @@
 -- Created by SQL::Translator::Producer::PostgreSQL
 -- Created on Tue Jul 15 17:41:03 2014
 -- 
+-- Copyright 2012, 2013, 2014
+--     The Board of Trustees of the Leland Stanford Junior University
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a
+-- copy of this software and associated documentation files (the
+-- "Software"), to deal in the Software without restriction, including
+-- without limitation the rights to use, copy, modify, merge, publish,
+-- distribute, sublicense, and/or sell copies of the Software, and to
+-- permit persons to whom the Software is furnished to do so, subject to
+-- the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included
+-- in all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-- OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+-- IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+-- CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+-- TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+-- SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+--
+
 --
 -- Table: duo.
 --
diff --git a/perl/sql/Wallet-Schema-0.09-SQLite.sql b/perl/sql/Wallet-Schema-0.09-SQLite.sql
index 19a77c2..9ce9b08 100644
--- a/perl/sql/Wallet-Schema-0.09-SQLite.sql
+++ b/perl/sql/Wallet-Schema-0.09-SQLite.sql
@@ -1,7 +1,29 @@
 -- 
 -- Created by SQL::Translator::Producer::SQLite
 -- Created on Tue Jul 15 17:41:02 2014
--- 
+--
+-- Copyright 2012, 2013, 2014
+--     The Board of Trustees of the Leland Stanford Junior University
+--
+-- Permission is hereby granted, free of charge, to any person obtaining a
+-- copy of this software and associated documentation files (the
+-- "Software"), to deal in the Software without restriction, including
+-- without limitation the rights to use, copy, modify, merge, publish,
+-- distribute, sublicense, and/or sell copies of the Software, and to
+-- permit persons to whom the Software is furnished to do so, subject to
+-- the following conditions:
+--
+-- The above copyright notice and this permission notice shall be included
+-- in all copies or substantial portions of the Software.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+-- OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+-- MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+-- IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+-- CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+-- TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+-- SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+--
 
 BEGIN TRANSACTION;
 
-- 
cgit v1.2.3