SCF design for iSCSI target
===========================

High Level:
   -All configuration files (target_config.xml, config.xml, param.N) are moved
	to SCF.

   -Keeping the current incore XML database
	-the incore database is created from the SCF (need functions to 
	   convert SCF->incore)
	-the incore database will change as follow:
	   -the target_config.xml, config.xml and param.N will merged into 
		1 database

   -Need to convert existing configuration to SCF if old configuration files
	(config.xml, target_config.xml) existed, after converting to SCF, the
	old configurations are deleted.  This would mean keeping some of 
	the existing codes that read in the configuration files and build 
	the incore database, and then use the tgt_dump2scf() to build the SCF. 

   -All the pgroups/properties are create dynamically, the only exception 
	is the iscsitgt pgroup, the properties in this pgroup can be 
	populated with the default value on install.  A value_authorization
        property will be added to a new pgroup, if the new pgroup is
        chap_secret, a read_authorization property will be added to the
        chap_secret pgroup.

   -The CLI still uses the door interface to the daemon, the mgmt 
	interfaces are used to create incore database and then use the 
	mgmt_scf interfaces to create/modify/delete the SCF database.

   -At startup a mgmt_scf function will open the SCF database and read in 
	the iscsitgt pgroup, and the target pgroups, the SCF data are 
	converted to incore database.

   -The incore database will have a new property for the target, it will 
	contains param propertes for each LUN.  Example of an incore target 
	configuration:

	<target>
	   t1
	   <lun-list>
		<lun>0</lun>
		<lun>1</lun>
	   </lun-list>
	   <iscsi-name>
		iqn.1986-03.com.sun:02:...
	   </iscsi-name>
	   <param-list>
		<0>
			<params version='1.0'>
				<size>0x10000</size>
					.
					.
				<guid>039384947504</guid>
			</params>
		</0>
		<1>
			<params version='1.0'>
				<size>0x10000</size>
					.
					.
				<guid>039377777504</guid>
			</params>
		
		</1>
	   </param-list>
	</target>


API
===
-pgroup
   -create
   -modify
   -delete
   -find

-property per pgroup
   -create
   -modify
   -delete
   -find

-Find pgroup (initiator_name, tpgt_num, param_targetname_lun)
   -Get properties
   -convert to incore database

Startup
-------
-Find iscsitgt pgroup (default)
   -iterate for properties in pgroup
   -convert to local database

-Iterate target_name pgroup
   -iterate target property
      -Find initiator_name pgroup
         -iterate initiator property (iscsi_name, chap_name, chap_secret)
      -Find tpgt_num group
         -iterate tpgt property (ip_address)
   -convert to local database



Create pgroup/property
----------------------
-create in core database
-create new pgroup (target, initiator, tgpt, param, chap_secret)
   -create target
      -create target_name pgroup
      -create local_name prop
      -create iscsi_name prop
      -create .... prop
      -create value_authorization prop (solaris.smf.value.iscsitgt)
      -commit
   -create initiator
      -create initiator_name pgroup
      -create local_name prop
      -create value_authorization prop (solaris.smf.value.iscsitgt)
      -commit
   -create tpgt
      -create ip_addr prop
      -create value_authorization prop (solaris.smf.value.iscsitgt)
      -commit
   -create chap_secret
      -create chap_secret pgroup
      -create value_authorization prop (solaris.smf.value.iscsitgt)
      -create read_authorization prop (solaris.smf.read.iscsitgt)
      -commit

Modify property
---------------
-modify in core database
-find pgroup
   -find property
      -modify property
-commit

Delete pgroup/property
----------------------
-delete pgroup name
   -find pgroup name
   -delete properties and then pgroup
-delete property on a given pgroup
   -find pgroup
   -find prperty
   -delete property
-commit

Find pgroup/property
--------------------
-find pgroup name
-find property given pgroup handle

Issue
======
The property CHAP SECRETS is converted to SCF after PSARC 2007/177
is putback.

We will implement the CHAP SECRET using the pgroup SCF_GROUP_APPLICATION 
type (SCF_GROUP_APPLICATION is an existing group type which will be used
by 2007/177 to protect underneath properties), and store the CHAP SECRETs
in this pgroup, this pgroup will only contain protected data.  The CHAP
SECRET pgroup will have a read_authorization property to implement the
protected data authorization.

Notes:  The CHAP SECRET is default to a NULL string during install, it
        is set after the user modify the CHAP SECRET.

Example:

passwords (pgroup type SCF_GROUP_APPLICATION) 
   main-screct		xyzfasfasfasfas
   radius-secret	kfsakfjasfsadfkasd
   initiator-one	jsfsafasfasfasfasf
   initiator-two	uuuuufuasufuasfuuu


Iscsi Target RBAC authorization
Tim Szeto
08/07/2007

1.  Iscsitgt service

Iscsitgt service consists of iscsitgtd daemon and iscsitadm(1M)
iscsi target administration command.  The authorization is
required for the following activities:

-Managing the iscsitgt service include enable/disable/restart
-Change the SMF properties.  The properties are normally 
 created/modified/deleted using the iscsitadm(1M), this is the
 prefer method.
-Read permission for protected SMF properties, dependent on 
 PSARC 2007/177.

The following authorizations are added to the auth_attr(4) file:

solaris.smf.action.iscsitgt:::Action ISCSITGT Service::help=SmfIscsitgtStates.html
solaris.smf.value.iscsitgt:::Change ISCSITGT Service Properties::help=SmfValueIscsitgt.html
solaris.smf.read.iscsitgt:::Read Protected ISCSITGT Properties::help=SmfReadIscsitgt.html

The following profile is added to the prof_attr(4) file:

Iscsi Target Management:::iSCSI Target Management:help=RtIscsitgtMngmnt.html:auths=solaris.smf.manage.iscsitgt,solaris.smf.value.iscsitgt,solaris.smf.read.iscsitgt

2. Iscsitgt service manifest

<property_group name='iscsitgt' type='application'>
                <propval name='action_authorization' type='astring'
                    value='solaris.smf.action.iscsitgt' />
                <propval name='value_authorization' type='astring'
                    value='solaris.smf.value.iscsitgt' />
                <!-- To read and modify protected properties -->
                <propval name='read_authorization' type='astring'
                        value='solaris.smf.read.iscsitgt' />
</property_group>