Update the comment in README about supported ACL types

Change-Id: I171722d03bebc812bb113d1366457d75a94e468a
Reviewed-on: https://gerrit.stanford.edu/991
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
admin.t: Fixed problem with not upgrading from unversioned db

Since we were reinstalling a fresh database via the same DBIx::Class
functions, the database we installed to upgrade from a non-versioned
setup was still getting a version table.  Switched to delete the
database and reload it fresh from the sqlite3 command itself.

Change-Id: Ia09bbc279ab834b5d17453b4282e18dd3a36f857
Reviewed-on: https://gerrit.stanford.edu/993
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Make t/admin.t test robust against missing sqlite3 binary

If we can't find the sqlite3 binary, just skip the upgrade test.

Change-Id: I20e9ad1978a189cf059756e15794ea4d954f3867
Reviewed-on: https://gerrit.stanford.edu/994
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update the wallet ACL for its-apps in Stanford policy

Change-Id: Ie4c0af7b218fcd00fc6f39514967c9e38e12b1be
Reviewed-on: https://gerrit.stanford.edu/1023
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update stanford.conf to latest production version

Update the example wallet.conf from Stanford's configuration to our
latest production version.

Change-Id: Ic652b7a2fadb53a688a0c0c16b5ea7e429cff79e
Reviewed-on: https://gerrit.stanford.edu/1024
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update stanford.conf example to use Wallet::Policy::Stanford

Eliminate all the verification code that moved into the policy
object.  Update coding style and remove some settings that were
no longer used at Stanford.

Change-Id: I3a098bc318abe4bc9dd82e86186da012e5c2cd27
Reviewed-on: https://gerrit.stanford.edu/1025
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Further clarify the ssl-key Stanford naming policy

Adam requested some clarification on whether the name of the object
should be fully-qualified or not (since we didn't in the legacy
naming scheme).

Change-Id: I52fcab71e54aee38f0c03eff774f927c5836ad03
Reviewed-on: https://gerrit.stanford.edu/1054
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Allow afs/* principals in the Stanford naming policy

Change-Id: I59db1e8638a602d9c118ac01da17280c9ed7d005
Reviewed-on: https://gerrit.stanford.edu/1067
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Populate the enctype table by default on new install

We actually know the enctypes that are in most common use, so rather
than making the user poke them into the database manually, save them
a step and put them in.  We still need some mechanism to remove the
DES enctype and add new ones, though.

Change-Id: I2eda7e29897ec16a04a10f0c7289878c853b7531
Reviewed-on: https://gerrit.stanford.edu/1068
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Improve the keytab enctype test suite

Fix recognition of the syntax error from Heimdal's klist -ke, which
doesn't exit with status 1.  Assume that if we didn't see any known
enctypes, we're dealing with Heimdal.  Remove the code to populate the
enctype table, since we do that in Wallet::Admin now.  Show the error
if adding an enctype fails.

Change-Id: I40da967ef6868e5cd51a1238e1c6324386468134
Reviewed-on: https://gerrit.stanford.edu/1069
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix several bugs in Wallet::Object::Keytab enctype handling

There was a missing resultset() call in one place and the wrong
resultset used in a different place, causing the enctype management
code to not work.

Change-Id: I796169c5968ec164f90f3cd75541dd346dd50fdf
Reviewed-on: https://gerrit.stanford.edu/1070
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix documentation of ldap_map_principal hook

Fix the Wallet::Config documentation for the ldap-attr verifier to
reference an ldap_map_principal hook, not ldap_map_attribute, matching
the implementation.

Change-Id: I258edcf69d4dcb3d2ec8dc66db4b768d91645fc4
Reviewed-on: https://gerrit.stanford.edu/1204
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add use Wallet::Config to Wallet::ACL::LDAP::Attribute

Normally this will already be loaded, but since we use it directly,
make sure it is loaded.

Change-Id: Ibc4ca874b659f316268957cbf77ead9d49bc3ca0
Reviewed-on: https://gerrit.stanford.edu/1205
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Clarify use of the tivoli-key file type in Stanford policy

tivoli-key used to always contain the entirety of the TSM.PWD file,
but it's more useful to store only the encryption key in password
form.

Change-Id: Id770691fb756b7675ec0fe2eee1308a8974c9c3f
Reviewed-on: https://gerrit.stanford.edu/1309
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Changed postgres schema file to remove reference

The reference from object_history to the objects table needed to be
removed.  We still want the relationship in the DBIx::Class files, but
we don't want the relationship enforced as we want to keep history
entries for deleted objects.

Change-Id: Id927404b996fe171a8f5fc0747ccb0abddcbe1f2
Reviewed-on: https://gerrit.stanford.edu/1324
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
ACL.pm: Fix a place where the acl history was getting raw timestamp

The acl_history table needed to get the DateTime object rather than the
raw epoch timestamp in one place.  This was causing errors adding new
lines to the history.

Change-Id: I9c971819484cd0b26cb2561549246c284afc55a1
Reviewed-on: https://gerrit.stanford.edu/1325
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Flesh out TODO with lots more work

Change-Id: I8f63cfd9692039f37ecfd46ab6072aa2f71c344d
Reviewed-on: https://gerrit.stanford.edu/1328
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Fix wallet-rekey on keytabs containing multiple principals

Fix wallet-rekey on keytabs containing multiple principals.  Previous
versions assumed one could concatenate keytab files together to make a
valid keytab file, which doesn't work with some Kerberos libraries.
This caused new keys downloaded for principals after the first to be
discarded.  As a side effect of this fix, wallet-rekey always appends
new keys directly to the existing keytab file, and never creates a
backup copy of that file.

Change-Id: I5f863239ce4ebba66b35ff09454f2897367bd359
Reviewed-on: https://gerrit.stanford.edu/1369
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Add AM_PROG_AR to configure.ac for newer Automake

Change-Id: I422a014c3a2611324c2cdebd364d81f2e91aadd7
Reviewed-on: https://gerrit.stanford.edu/1370
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>
Update Test::RRA modules from the current rra-c-util

Further documentation of the changes will come later when the rest
of rra-c-util files have been updated and the package makes more
use of these modules, but this fixes a spelling error test failure.

Change-Id: Ia885c4ab103235a1f6a2bf2b86d5a32c93751d89
Reviewed-on: https://gerrit.stanford.edu/1371
Reviewed-by: Russ Allbery <rra@stanford.edu>
Tested-by: Russ Allbery <rra@stanford.edu>