Projects/Extensible Policy - Revision history

Ghudson at 23:14, 30 July 2012

2012-07-30T23:14:52Z

Nico at 21:50, 24 July 2012

2012-07-24T21:50:27Z

Ghudson at 23:44, 19 July 2012

2012-07-19T23:44:02Z

Ghudson at 23:42, 19 July 2012

2012-07-19T23:42:01Z

Ghudson at 23:40, 19 July 2012

2012-07-19T23:40:50Z

Nico: /* Implementation */

2012-07-19T23:08:49Z

‎Implementation

Nico: /* Testing */

2012-07-19T23:05:43Z

‎Testing

Nico: /* Implementation */

2012-07-19T23:04:25Z

‎Implementation

Nico: /* Implementation */

2012-07-19T22:59:20Z

‎Implementation

Nico: /* Implementation */

2012-07-19T22:53:17Z

‎Implementation

← Older revision		Revision as of 23:14, 30 July 2012
Line 1:		Line 1:
−	{{project-~~review~~\|~~2012-07-27~~}}	+	{{project-rel\|1.11}}
−	{{project-target\|1.11}}

	This project adds new extensions to policy records and makes them extensible in the future with less effort by adding a TL data extension.		This project adds new extensions to policy records and makes them extensible in the future with less effort by adding a TL data extension.

@@ Line 17: / Line 17: @@
 ; max_life : holds max ticket life (not implemented at this time)
 ; max_renewable_life : holds max ticket renewable lifetime (not implemented at this time)
-; keygen_enctypes : key/salt type list that the principal is allowed to have keys of
+; allowed_keysalts : key/salt type list that the principal is allowed to have keys of
 ; tl_data : sequence of {type, length, octet string} values just as in principal records
 User interface changes:
-* The kadmin addpol and modpol commands get a new argument: -keygenenctypes keysalt-list.
+* The kadmin addpol and modpol commands get a new argument: -allowedkeysalts keysalt-list.
 * The kdb5_util dump and load commansd get a new argument: -r18 (request 1.8 dump format).
@@ Line 49: / Line 49: @@
 Add "?w=1" to get the github equivalent of diff(1)'s -w flag.
-We leave implementation of the 'attributes', 'max_life', and 'max_renewable_life' to future projects.  Because these will provide defaults for corresponding fields of principals the impact on interfaces and implementation will be somewhat larger than that of the keygen_enctypes field.
+We leave implementation of the 'attributes', 'max_life', and 'max_renewable_life' to future projects.  Because these will provide defaults for corresponding fields of principals the impact on interfaces and implementation will be somewhat larger than that of the allowed_keysalts field.
 ==Testing==
-One test is added: tests/t_keygen_enctypes.py.  All tests pass.
+One test is added: tests/t_allowed_keysalts.py.  All tests pass.
 NOTE: dump/load of policy TL data is not tested for lack of any policy elements that use TL data.

@@ Line 18: / Line 18: @@
 ; max_renewable_life : holds max ticket renewable lifetime (not implemented at this time)
 ; keygen_enctypes : key/salt type list that the principal is allowed to have keys of
-; tk_data : sequence of {type, length, octet string} values just as in principal records
+; tl_data : sequence of {type, length, octet string} values just as in principal records
 User interface changes:

← Older revision		Revision as of 23:42, 19 July 2012
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2012-07-27}}
	{{project-target\|1.11}}		{{project-target\|1.11}}

@@ Line 1: / Line 1: @@
-{{project-rel|1.11}}
+{{project-early}}
 This project adds new extensions to policy records and makes them extensible in the future with less effort by adding a TL data extension.
@@ Line 21: / Line 21: @@
 User interface changes:
-* The kadmin addpol and modpol commands get a new argument: -kegenenctypes keysalt-list.
+* The kadmin addpol and modpol commands get a new argument: -keygenenctypes keysalt-list.
 * The kdb5_util dump and load commansd get a new argument: -r18 (request 1.8 dump format).
@@ Line 30: / Line 30: @@
 * Added KADM5_POLICY_{ATTRIBUTES, ...} flags for use in the 'mask' argument to various kadm5 functions
-Note that as with the change in 1.8 it will not be safe to downgrade a KDC from 1.11 to an earlier version without reloading the policy DB from a dump format that the older version understands.  We hope this will be the last time that policies are extended in this manner: by using TL data for future extensions we can obtain the same downgrade semantics as for the principal database.
+Note that, as with the change in 1.8, it will not be safe to downgrade a KDC from 1.11 to an earlier version without reloading the policy DB from a dump format that the older version understands.  We hope this will be the last time that policies are extended in this manner; by using TL data for future extensions, we can obtain the same downgrade semantics as for the principal database.
 ==Implementation==

@@ Line 41: / Line 41: @@
 * Add and use check_and_set_ks_tuple_policy(), a utility function for validating and editing key/salt tuples in src/lib/kadm5/srv/svr_principal.c
-[https://github.com/nicowilliams/krb5/compare/kadm5_policy_exts-squashed2 Implementation with history squashed.]
+* [https://github.com/nicowilliams/krb5/compare/kadm5_policy_exts-squashed2 Implementation with history squashed.]
-[https://github.com/nicowilliams/krb5/compare/kadm5_policy_exts Implementation with complete history]
+* [https://github.com/nicowilliams/krb5/compare/kadm5_policy_exts Implementation with complete history]
 We leave implementation of the 'attributes', 'max_life', and 'max_renewable_life' to future projects.  Because these will provide defaults for corresponding fields of principals the impact on interfaces and implementation will be somewhat larger than that of the keygen_enctypes field.

← Older revision		Revision as of 23:05, 19 July 2012
Line 51:		Line 51:

	One test is added: tests/t_keygen_enctypes.py. All tests pass.		One test is added: tests/t_keygen_enctypes.py. All tests pass.
		+
		+	NOTE: dump/load of policy TL data is not tested for lack of any policy elements that use TL data.

	==Documentation==		==Documentation==

@@ Line 34: / Line 34: @@
 ==Implementation==
- * Bump the KADM5 API version number everywhere that it should be, with fallback negotiation to versions 3 and 2
+* Bump the KADM5 API version number everywhere that it should be, with fallback negotiation to versions 3 and 2
- * Extend the relevant structures (see above)
+* Extend the relevant structures (see above)
- * Refactor kadmin.c functions for adding and updating tl data (not needed now, but will be needed eventually)
+* Refactor kadmin.c functions for adding and updating tl data (not needed now, but will be needed eventually)
- * Add KADM5_POLICY_{ATTRIBUTES, ...} #defines for use in kadm5 masks
+* Add KADM5_POLICY_{ATTRIBUTES, ...} #defines for use in kadm5 masks
- * Update XDR functions for encoding/decoding/freeing kadm5_policy_ent_rec and osa_policy_ent_rec structures
+* Update XDR functions for encoding/decoding/freeing kadm5_policy_ent_rec and osa_policy_ent_rec structures
- * Add and use check_and_set_ks_tuple_policy(), a utility function for validating and editing key/salt tuples in src/lib/kadm5/srv/svr_principal.c
+* Add and use check_and_set_ks_tuple_policy(), a utility function for validating and editing key/salt tuples in src/lib/kadm5/srv/svr_principal.c
 ==Testing==