DACS Docs - Technical Documentation

Version 1.4.28b

Release date 1-Mar-2013 10:51:43

Contents

Section 1: Tools and Utilities
Section 5: Formats and Conventions
Section 7: Miscellaneous
Section 8: Web Services and CGI
HTTP Server: Apache
Articles: Using InfoCards With DACS
Project: HOME // README // ACKNOWLEDGEMENTS // HISTORY // INSTALL // LICENSE // NOTICES // DTDs
Indexes: Configuration Directives // Functions // Authentication Modules // Concepts // Annotations // Variables // Third-Party Packages

Section 1: Tools and Utilities

dacs

- a distributed access control system

dacsacl

- list, check, or re-index access control rules

dacsauth

- authentication check

dacscheck

- authorization check

dacsconf

- display configuration directives

dacscookie

- create BDACS R credentials and emit as a cookie

dacscred

- acquire and manage BDACS R credentials

dacsemail

- Simple outgoing email agent

dacsexpr

- BDACS R expression language shell and interpreter

dacsgrid

- administer grid-based one-time passwords

dacshttp

- perform an HTTP/HTTPS request

dacsinfocard

- manage InfoCard accounts

dacsinit

- Configure a minimal DACS federation interactively

dacskey

- generate encryption keys for BDACS R

dacslist

- list jurisdictions

dacspasswd

- manage BDACS R accounts

dacsrlink

- create and administer rule links

dacssched

- rule-based command scheduling

dacstoken

- administer hash-based one-time passwords

dacstransform

- rule-based document transformation

dacsversion

- display version information

dacsvfs

- access objects through the BDACS R virtual filestore

sslclient

- an SSL client

Section 3: Functions and Libraries

ds

- Dynamic strings and vectors

Section 5: Formats and Conventions

dacs.acls

- BDACS R access control rules

dacs.conf

- BDACS R configuration files and directives

dacs.exprs

- BDACS R expression language

dacs.groups

- BDACS R groups

dacs.nat

- Notice Acknowledgement Token specification

dacs.vfs

- the BDACS R virtual filestore

Section 7: Miscellaneous

dacs.install

- BDACS R installation guide

dacs.java

- BDACS R Java support

dacs.quick

- BDACS R Quick Start Tutorial

dacs.readme

- BDACS R README

Section 8: Web Services and CGI

autologin

- Convert an Apache identity to a BDACS R identity

cgiparse

- CGI argument parsing utility

dacs.services

- BDACS R web services

dacs_acs

- BDACS R access control service

dacs_admin

- BDACS R administration service

dacs_auth_agent

- BDACS R delegated authentication service

dacs_auth_transfer

- transfer credentials between federations

dacs_authenticate

- BDACS R authentication service

dacs_autologin_ssl

- use an SSL client certificate to automatically obtain BDACS R credentials

dacs_conf

- display BDACS R configuration directives

dacs_current_credentials

- display BDACS R credentials

dacs_error

- simple error handling utility for BDACS R

dacs_group

- BDACS R group administration

dacs_infocard

- Information Card administration

dacs_list_jurisdictions

- display information about BDACS R jurisdictions

dacs_managed_infocard

- create a managed Information Card

dacs_mex

- WS-MetadataExchange responder for Information Cards

dacs_notices

- BDACS R notice presentation and acknowledgement handler

dacs_passwd

- manage private BDACS R passwords

dacs_prenv

- CGI program that displays its environment

dacs_select_credentials

- temporarily disable BDACS R credentials

dacs_signout

- BDACS R signout service

dacs_sts

- Secure Token Service for managed Information Cards

dacs_token

- manage DACS one-time password token accounts

dacs_transform

- rule-based document transformation

dacs_uproxy

- minimal HTTP proxying

dacs_version

- display BDACS R version information

dacs_vfs

- access objects through the BDACS R virtual filestore

pamd

- PAM transaction server

HTTP Server: Apache

mod_auth_dacs

- Apache/DACS authentication and authorization module

Annotations

Security Notes

Accessibility of dacs_auth_transfer Limiting access to dacstoken
Access to dacs_auth_transfer Limiting access to dacsvfs
Aspects of NAT security Limiting access to Rlinks
Authentication modules Moving credentials to another host
Authorization caching considered experimental Multiple Auth clauses
AuthType DACS and the Require directive Multiple credentials for the same identity
CAS-based authentication Password in a URI
Configuration based on arguments Passwords and local_passwd_authenticate
Configuration of dacs_auth_transfer Password visibility and dacsauth
Configuring COOKIE_PATH Password visibility and dacspasswd
Constraints on new passwords Permissions for dacs_acs
Contradictory rules Potential password logging when debugging
dacs_admin disabled by default Privacy of the federation key
DACS advisory Reliance on cookie names
dacs_auth_agent disabled by default Reporting authentication failure
dacs_authenticate security issues Restrict access to dacs_uproxy
DACS configuration files Restrict access to dacs_vfs
dacskey and accessibility of keyfiles Restricted access to dacs_conf
Defining new item types Restricted access to dacs_passwd
Disabled or restricted web services Restricted access to dacs_token
Disabling SECURE_MODE Restricting access to dacs_auth_transfer
Enabling authentication modules Running dacs_acs setuid/setgid
exec() target UID/GID Running dacsauth, dacs_authenticate setuid/setgid
Execution privileges and dacsauth Secure NTLM communication
Exporting OTP Accounts Security aspects of access tokens
File and directory permissions Security implications of dacsinfocard
Hierarchical independence in ACL paths Security implications of dacspasswd
Honouring imported credentials Security implications of PERMIT_CHAINING
Implications of delegation Security issues and dacsgrid
Importation of identities Security issues and dacstransform
InfoCard identity Security issues and pamd
Input directory for dacs_transform Setting the lifetime of credentials
Insecurity of local_simple_authenticate Supported Devices
Isolation requirements for dacscheck Tagging mod_auth_dacs
ldaps scheme unavailable Tokens and secret keys
Lifetime of credentials and cert-based authentication TOTP Drift Window Size
Limitations of ACS_CREDENTIALS_LIMIT TOTP Drift Window Size
Limitations of AUTH_SINGLE_COOKIE Tracking anonymous users
Limitations of COMPAT_MODE Upgrading
Limitations of constraints Use of MD5
Limitations of COOKIE_HTTPONLY Use of the REFEDERATE directive
Limitations of NAME_COMPARE Using dacs_admin()
Limitations of VERIFY_UA Using SSL with dacs_auth_transfer
Limitations on CGI arguments Verification of DACS-wrapping
Limiting access to dacsconf Verify checksums after downloading
Limiting access to dacscookie Weakening of credentials
Limiting access to dacslist  

Important Notes

AuthType DACS and the Require directive Limitations on CGI arguments
Converting ACL format NO WARRANTY
DACS advisory NO WARRANTY
dacsauth() considered experimental PAM authentication
dacscheck() considered experimental Potential import/export restrictions
Definition of jurisdiction metadata Potential password logging when debugging
File permissions of autologin Third-party packages
Hiding the DACS_ACS argument Unique jurisdiction sections
Installation notes Upgrading DACS
Installing Apache user() returning False
Interaction between dacshttp and sslclient  

Other Notes

AuthType DACS and the Require directive Limitations on CGI arguments
DACS advisory Potential password logging when debugging

Tips

AuthType DACS and the Require directive local_unix_authenticate and setuid
Begin by reviewing dacs.quick(7) Obtaining Berkeley DB
Begin with a basic DACS install Omitting braces in a variable reference
Building standalone components Potential password logging when debugging
Built-in authentication modules Problems while building with shared libraries
Built-in roles modules Redirection after authentication
CAS protocol Remember to make public files accessible
Configuration of mod_ssl in httpd.conf Remember to restart httpd
Configuring HTTP authentication Reviewing build notes
DACS advisory Rotate log files
DACS self tests Save your config.nice
dacs_transform and the 'insert' directive Selecting characters and substrings
DEFAULT_JURISDICTION environment variable Selecting new credentials
Displaying CGI arguments Short links
Displaying DACS environment variables Testing LDAP authentication
Domain attributes in cookies Testing NTLM authentication
Easier upgrades Testing where a client authenticated
Escaping space characters Try dacsexpr
Failed internal HTTP requests Use site.conf-std
Filenames for rulesets Using dacsinit
Filename suffixes for CGI programs Using user()
Generated directory listings, internal redirects Validating ruleset syntax
How to choose better passwords Value of an if statement
InfoCard authentication using an expression Variable substitution in dacs_transform
Initial configuration using dacsinit Verify web server version
Installing a subset of DACS Viewing DACS documentation via Apache
Limitations on CGI arguments Whitespace in a variable reference

Variables

APACHE_HOME ${DACS::CONTENT_ENCODING} ${DACS::USER_AGENT}
${Args::DACS_USERNAME} ${DACS::CONTENT_LENGTH} ${DACS::USERNAME}
${Args::RNAME} ${DACS::CONTENT_TYPE} DACS_USERNAME
${Args::USERNAME} ${DACS::CURRENT_URI} DACS_VERSION
argv[0] ${DACS::CURRENT_URI_NO_QUERY} DACS_VERSION
${Auth::ABORT} DACS_DEFAULT_CONSTRAINT DOCUMENT_ROOT
${Auth::CREDENTIALS_LIFETIME_SECS} ${DACS::FEDERATION} ${Env::REMOTE_USER}
${Auth::CURRENT_ROLES} DACS_FEDERATION ${Env::REQUEST_URI}
${Auth::CURRENT_USERNAME} ${DACS::FILENAME} EXE_SUFFIX
${Auth::DACS_IDENTITY} DACS_HOME FEDERATIONS_ROOT
${Auth::DACS_JURISDICTION} ${DACS::IDENTITY} HTTP_HOST
${Auth::DACS_USERNAME} DACS_IDENTITY HTTP_USER_AGENT
${Auth::DACS_VERSION} ${DACS::INTERACTIVE} infocard_card_image_card
${Auth::LAST_ROLES} ${DACS::IP} infocard_card_image_cert
${Auth::MODULE_SKIP} ${DACS::JURISDICTION} infocard_card_image_passwd
${Auth::ROLES} DACS_JURISDICTION infocard_sts_password
CGI_SUFFIX ${DACS::METHOD} infocard_sts_password
${Conf::dacs_approval_digest_name} DACS_MOD_AUTH_DACS infocard_sts_title
${Conf::FEDERATION_DOMAIN} ${DACS::PATH_INFO} infocard_sts_username_password_prompt_fmt
${Conf::http_auth_401} ${DACS::POSTDATA} JURISDICTION_URI
${Conf::LOG_LEVEL} ${DACS::PROXYREQ} JURISDICTION_URI_PREFIX
${Conf::prompt_submit_label} ${DACS::QUERY} ${LDAP::attrname}
${DACS::ACS} DACS_RELEASE ${LDAP::attrvalue}
DACS_ACS_JURISDICTION ${DACS::REMOTE_ADDR} ${LDAP::USERNAME}
DACS_APPROVAL ${DACS::REMOTE_HOST} OPENSSL_PROG
${DACS::ARG_COUNT} ${DACS::RIDENT} ${Options::AUXILIARY}
${DACS::ARGS} ${DACS::RIPTR} ${Options::DACS_JURISDICTION}
${DACS::ARGS_TRUNCATED} ${DACS::RNAME} ${Options::DACS_USERNAME}
${DACS::AUTHORIZATION} ${DACS::ROLES} ${Options::DACS_VERSION}
DACS_BINDIR DACS_ROLES ${Options::PASSWORD}
DACS_CGIBINDIR DACS_SBINDIR ${Options::USERNAME}
DACS_CONCISE_IDENTITY DACS_SITE_CONF SERVER_ADDR
DACS_CONF DACS_SITE_CONF SERVER_NAME
DACS_CONF DACS_SITE_CONF_SPEC SERVER_PORT
DACS_CONF_SPEC ${DACS::URI} SSL variables
DACS_CONSTRAINT ${DACS::URI} URI_SCHEME

Configuration Directives

ACCEPT_ALIEN_CREDENTIALS FEDERATION_NAME NOTICES_SECURE_HANDLER
ACS_ACCESS_TOKEN_ENABLE FLAGS NOTICES_WORKFLOW_LIFETIME_SECS
ACS_ACCESS_TOKEN_LIFETIME_LIMIT HTTP_AUTH OPTION
ACS_ACCESS_TOKEN_LIFETIME_SECS HTTP_AUTH_ENABLE OPTION
ACS_AUTHENTICATED_ONLY HTTP_PROG OPTION*
ACS_CREDENTIALS_LIMIT IMPORT_FROM OPTION*
ACS_EMIT_APPROVAL IMPORT_ROLES PAMD_HOST
ACS_ERROR_HANDLER IMPORT_URL PAMD_PORT
ACS_FAIL INFOCARD_AUDIENCE PASSWORD_AUDIT
ACS_INACTIVITY_LIMIT_SECS INFOCARD_AUDIENCE_RESTRICTION PASSWORD_CONSTRAINTS
ACS_POST_BUFFER_LIMIT INFOCARD_CARD_DATETIME_EXPIRES PASSWORD_DIGEST
ACS_POST_EXCEPTION_MODE INFOCARD_CARD_DEFS_URL PASSWORD_OPS_NEED_PASSWORD
ACS_PRE_AUTH INFOCARD_CARD_FILL_URL PASSWORD_SALT_PREFIX
ACS_SUCCESS INFOCARD_CARDID_BASE_URL PERMIT_CHAINING
ACS_TRACK_ACTIVITY INFOCARD_CARDID_SUFFIX PREDICATE
ADMIN_IDENTITY INFOCARD_CARD_IMAGE_BASE_URL PREDICATE
ALLOW_HTTP_COOKIE INFOCARD_CARD_LIFETIME_SECS PREDICATE
AUTH_AGENT_ALLOW_ADMIN_IDENTITY INFOCARD_CARD_OUTPUTDIR PROXY_EXEC_DOCUMENT_ROOT
AUTH_CREDENTIALS_ADMIN_LIFETIME_SECS INFOCARD_CARD_VERSION PROXY_EXEC_MAPPER_DEFAULT_ACTION
AUTH_CREDENTIALS_DEFAULT_LIFETIME_SECS INFOCARD_DIGEST PROXY_EXEC_MAPPER_LOG_FILE
AUTH_ERROR_HANDLER INFOCARD_IP_PRIVACY_URL PROXY_EXEC_MAPPER_LOGGING
AUTH_FAIL INFOCARD_IP_PRIVACY_VERSION PROXY_EXEC_MAPPER_RULES_FILE
AUTH_FAIL_DELAY_SECS INFOCARD_ISSUER_INFO_ENTRY PROXY_EXEC_PROG_URI
AUTH_SINGLE_COOKIE INFOCARD_MEX_URL REFEDERATE
AUTH_SUCCESS INFOCARD_REQUIRE_APPLIES_TO RLINK
AUTH_SUCCESS_HANDLER INFOCARD_STRONG_RP_IDENTITY ROLES*
AUTH_TRANSFER_EXPORT INFOCARD_STS_AUTH_TYPE ROLE_STRING_MAX_LENGTH
AUTH_TRANSFER_TOKEN_LIFETIME_SECS INFOCARD_STS_CACERTFILE SECURE_MODE
claim_name INFOCARD_STS_CERTFILE SIGNOUT_HANDLER
claim_name INFOCARD_STS_KEYFILE SSL_PROG
claim_type INFOCARD_STS_KEYFILE_PASSWORD SSL_PROG_ARGS
claim_type INFOCARD_STS_PASSWORD_METHOD SSL_PROG_CA_CRT
claim_uri_prefix INFOCARD_STS_RP_ENDPOINT SSL_PROG_CLIENT_CRT
claim_uri_prefix INFOCARD_TOKEN_DRIFT_SECS STATUS_LINE
claim_uri_prefix_abbrev INFOCARD_TOKEN_ISSUER STYLE
claim_value INFOCARD_TOKEN_LIFETIME_SECS SUCCESS_URL
COMPAT_MODE INFOCARD_TOKEN_MAX_LENGTH TEMP_DIRECTORY
CONTROL INFOCARD_USERNAME_SELECTOR TOKEN_HOTP_ACCEPT_WINDOW
COOKIE_HTTPONLY INIT* TOKEN_REQUIRES_PIN
COOKIE_NO_DOMAIN INIT* TRACE_LEVEL
COOKIE_PATH JURISDICTION_NAME UNAUTH_ROLES
CREDENTIALS_LIFETIME_SECS LOG_FILE UPROXY_APPROVED
CREDENTIALS_LIFETIME_SECS LOG_FILTER URL
CSS_PATH LOG_FORMAT URL
DTD_BASE_URL LOGINGEN_FILE URL*
ERROR_URL LOGINGEN_PROG URL*
EVAL LOG_LEVEL VERBOSE_LEVEL
EXIT* LOG_SENSITIVE VERIFY_IP
EXIT* NAME_COMPARE VERIFY_UA
EXIT* NOTICES_ACCEPT_HANDLER VFS
EXPR NOTICES_ACK_HANDLER XSD_BASE_URL
EXPR NOTICES_DECLINE_HANDLER FEDERATION_DOMAIN
NOTICES_NAT_NAME_PREFIX   

DTDs

These XML DTD skeletons are used only to help document information used by DACS.

Configuration.dtd, access_token.dtd, acl.dtd, acl_index.dtd, auth_reply.dtd, common.dtd, credentials.dtd, dacs_acs.dtd, dacs_admin.dtd, dacs_auth_agent.dtd, dacs_auth_reply.dtd, dacs_auth_transfer.dtd, dacs_conf_reply.dtd, dacs_current_credentials.dtd, dacs_group.dtd, dacs_infocard.dtd, dacs_list_jurisdictions.dtd, dacs_notices.dtd, dacs_passwd.dtd, dacs_select_credentials.dtd, dacs_user_info.dtd, dacs_version.dtd, groups.dtd, roles_reply.dtd, selected_credentials.dtd, store_reply.dtd


This documentation was created on Wed Jul 17 21:31:05 CEST 2013 using DocBook and libxslt.
Font:
−− Set ++