{"push_id":910355385,"size":5,"distinct_size":5,"ref":"refs/heads/kadmin_keydata","head":"b966f2bce6a1971b2855dae4be56e3dfc7b88d07","before":"725301cd0b0b92ac080472cbb4be0a63961eb13f","commits":[{"sha":"b0225b445cc3acc38766bf5aa8ee6f910e1e57a1","author":{"email":"65f99581a93cf30dafc32b5c178edc6b0294a07f@redhat.com","name":"Simo Sorce"},"message":"Expose get_principal_keys\n\nMake kadm5_get_principal_keys() available over the kadmin network protocol.\nIn order to use this API the ACL_EXTRACT (e) permission must be explicitly\ngranted. This ACL is not included in the general x/* ACL.\n\nSigned-off-by: Simo Sorce <simo@redhat.com>","distinct":true,"url":"https://api.github.com/repos/simo5/krb5/commits/b0225b445cc3acc38766bf5aa8ee6f910e1e57a1"},{"sha":"64b12394890755975e44a424ef3a61bd42d90096","author":{"email":"65f99581a93cf30dafc32b5c178edc6b0294a07f@redhat.com","name":"Simo Sorce"},"message":"Test get_principal_keys over the protocol\n\nSigned-off-by: Simo Sorce <simo@redhat.com>","distinct":true,"url":"https://api.github.com/repos/simo5/krb5/commits/64b12394890755975e44a424ef3a61bd42d90096"},{"sha":"ba3931bd0ed19175bc75c96e05163cc9dad01441","author":{"email":"65f99581a93cf30dafc32b5c178edc6b0294a07f@redhat.com","name":"Simo Sorce"},"message":"Add the ability to lock down principal keys.\n\nA new attribute named KRB5_KDC_LOCKDOWN_KEYS can be set on principals.\nThis will indicate that keys for this principal can never be extracted\nvia the kadmin protocol.\nAny operation that would cause potential disclosure of keys for the\nnamed principal is disallowed when this attribiute is set and an\nauthorization error is returned.\n\nWhen this attribute is set, the principal cannot be deleted or renamed,\nkeys cannot be set, all chpass operations are denied while chrand\noperations are allowed, but in this case keys are note returned.\n\nThis attribute can be set via the modify operation but cannot be reset,\nan autorization error is resturned if an attempt to reset it is performed.\n\nSigned-off-by: Simo Sorce <simo@redhat.com>","distinct":true,"url":"https://api.github.com/repos/simo5/krb5/commits/ba3931bd0ed19175bc75c96e05163cc9dad01441"},{"sha":"ece14b83b94770c6cc7c7ab2fd0484879ce31527","author":{"email":"65f99581a93cf30dafc32b5c178edc6b0294a07f@redhat.com","name":"Simo Sorce"},"message":"Add documentation for new kadmin features\n\nAdd docs for the new 'extract' acl, andfor the new 'lockdown_keys'\nprincipal attribute.\n\nSigned-off-by: Simo Sorce <simo@redhat.com>","distinct":true,"url":"https://api.github.com/repos/simo5/krb5/commits/ece14b83b94770c6cc7c7ab2fd0484879ce31527"},{"sha":"b966f2bce6a1971b2855dae4be56e3dfc7b88d07","author":{"email":"65f99581a93cf30dafc32b5c178edc6b0294a07f@redhat.com","name":"Simo Sorce"},"message":"Add more tests for extract and lockdown features\n\nSigned-off-by: Simo Sorce <simo@redhat.com>","distinct":true,"url":"https://api.github.com/repos/simo5/krb5/commits/b966f2bce6a1971b2855dae4be56e3dfc7b88d07"}]}