1. 18 Mar, 2014 1 commit
    • Stephane Glondu's avatar
      Changes in metadata handling · 789b20c1
      Stephane Glondu authored
       - metadata is specific to web, move it there
       - create Web_serializable, and also move randomness there
       - metadata is not optional (but its components can be)
       - rename user_type into user_domain
       - serializable version of ACLs
  2. 17 Mar, 2014 3 commits
  3. 14 Mar, 2014 1 commit
    • Stephane Glondu's avatar
      Split MAIN_SERVICES · 1b56c42b
      Stephane Glondu authored
      The signature is split into:
       - SITE_SERVICES: site-wide services, with single instances
       - ELECTION_SERVICES: per-unarchived-election services
       - VOTING_SERVICES: per-open-election services
      For the moment, per-election services are still site-wide with single
      Other changes:
       - the "global continuation" getter is renamed to "cont", so that its
         container module can be directly cast into CONT_SERVICE
       - move remaining service declarations out of Services
       - move service registration code close to service declarations,
         following the same Services/Register pattern as in Auth_common
       - various simplifications in Registration
  4. 11 Mar, 2014 4 commits
  5. 10 Mar, 2014 4 commits
  6. 07 Mar, 2014 2 commits
    • Stephane Glondu's avatar
      Handle configuration locally in each auth system · 05bc228a
      Stephane Glondu authored
       - move rewrite_prefix to Web_common
       - each auth system now has an $init function that registers its
         configuration spec and an $exec function to Auth_common
       - an auth system may support multiple instances via configuration;
         user_type is specific to each instance
       - when parsing is done, each $exec is called with an $instantiate
         callback; $exec is supposed to call $instantiate for each instance
       - default fallback when there are several instances
       - generic login should do security_log
       - auth system instances should not set user_type themselves
       - it should not be possible to login twice
       - admin login
       - update doc
    • Stephane Glondu's avatar
      Change of topology in Auth_common · d4b71428
      Stephane Glondu authored
      We want to be able to share private variables between service
      definition time and registration time, so we put both as submodules of
      the Make functor.
  7. 06 Mar, 2014 4 commits
  8. 05 Mar, 2014 3 commits
    • Stephane Glondu's avatar
      CAS: remove /cas/ from external service paths · c94fbdee
      Stephane Glondu authored
      This prefix is not in the CAS spec and seems specific to some
      instances. People can add "/cas" to the server path in their config if
    • Stephane Glondu's avatar
      Generic authentication · b0e97728
      Stephane Glondu authored
      This revision should be bisimilar to the previous one.
       - each auth system registers $name and $service
       - $service stores a logout handler in Auth_common.user
       - the generic login service redirects to $service if its parameter
         matches $name
       - the generic logout service clears out Auth_common.user and invokes
         the stored logout handler
       - the default auth system is the one registered last
       - Templates directly query Auth_common for available auth systems
       - enforce user_type = $name (currently not the case for CAS)
       - export Auth_common.register_auth_system
       - move existing auth systems out of Auth_common
       - integrate with config parsing
       - rework CAS
       - generic login should do security_log
       - do admin login
    • Stephane Glondu's avatar
      Add login dispatch service · ac1999b9
      Stephane Glondu authored
      Currently, it takes the auth_system name as an optional parameter, and
      redirects to the existing services. This revision should have the same
      behaviour as the previous one, except for login links and the
      associated additional redirections.
       - Auth_common.Make is now split in two functors: one for declaring
         services (Make) and one for registering them (Register)
       - auth_systems moved to its own signature
       - login and logout are in their own signature
       - new signature ALL_SERVICES
  9. 04 Mar, 2014 1 commit
    • Stephane Glondu's avatar
      Move authentication-related stuff to its own module · 07dbc36d
      Stephane Glondu authored
      This is preliminary work to make the authentication system more
      flexible. This big refactoring should be semantically equivalent to
      the previous commit.
       - create Auth_common and Web_signatures
       - split Web_election out of Web_common (to cut dep cycle)
       - move service definitions out of Services
       - functorize Templates
  10. 26 Feb, 2014 3 commits
    • Stephane Glondu's avatar
      Rename BALLOT_BOX into MONADIC_MAP_RO · d8467999
      Stephane Glondu authored
      It is used for ballots as well as records...
    • Stephane Glondu's avatar
      BALLOT_BOX: remove records, add receipts · 02259d1f
      Stephane Glondu authored
      A record (i.e. who voted, when and with which credential in the
      context of the web server) is a notion that does not exist in the
      cryptographic protocol and does not really make sense in the context
      of the command-line tool.
      By the way, we add the notion of receipt which, in the context of the
      web server, is the ballot hash computed by the server.
      Bonus: when a ballot is accepted, we compute its hash only once.
    • Stephane Glondu's avatar
      Remove dead code · 3ac7a8c9
      Stephane Glondu authored
  11. 12 Feb, 2014 8 commits
  12. 06 Feb, 2014 2 commits
  13. 05 Feb, 2014 4 commits