puppetlabs/puppet — pull request #1353 by branan (2012-12-28 19:28:00+00:00)
Title: (#18288) Allow multiple stanzas for the same endpoint in auth.conf

Prior to this commit, a stanza for an API endpoint would implicitly deny any cert not explicitly allowed. This makes it difficult to use the concat pattern to manage auth.conf. The original behavior also violates the principle of least surprise by not behaving like the firewall rules that auth.conf is similar to.

With this change, auth.conf rules now "waterfall", meaning if a cert is not explicitly allowed or denied in a rule further rules will be checked until a match is found.

This commit also changes the behavior of the fileserver authorization to ensure it does not allow on a `:dunno` result.