DACS Docs - Technical Documentation

Version 1.4.27b

Release date 19-Mar-2012 09:54:16

Contents

Section 1: Tools and Utilities
Section 5: Formats and Conventions
Section 7: Miscellaneous
Section 8: Web Services and CGI
HTTP Server: Apache
Articles: Using InfoCards With DACS
Project: HOME // README // ACKNOWLEDGEMENTS // HISTORY // INSTALL // LICENSE // NOTICES // DTDs
Indexes: Configuration Directives // Functions // Authentication Modules // Concepts // Annotations // Variables

Section 1: Tools and Utilities

dacs

- a distributed access control system

dacsacl

- list, check, or re-index access control rules

dacsauth

- authentication check

dacscheck

- authorization check

dacsconf

- display configuration directives

dacscookie

- create BDACS R credentials and emit as a cookie

dacscred

- acquire and manage BDACS R credentials

dacsemail

- Simple outgoing email agent

dacsexpr

- BDACS R expression language shell and interpreter

dacsgrid

- administer grid-based one-time passwords

dacsinfocard

- manage InfoCard accounts

dacsinit

- Configure a minimal DACS federation interactively

dacskey

- generate encryption keys for BDACS R

dacslist

- list jurisdictions

dacspasswd

- manage BDACS R accounts

dacsrlink

- create and administer rule links

dacssched

- rule-based command scheduling

dacstoken

- administer hash-based one-time passwords

dacstransform

- rule-based document transformation

dacsversion

- display version information

dacsvfs

- access objects through the BDACS R virtual filestore

http

- perform an HTTP/HTTPS request

sslclient

- an SSL client

Section 3: Functions and Libraries

ds

- Dynamic strings and vectors

Section 5: Formats and Conventions

dacs.acls

- BDACS R access control rules

dacs.conf

- BDACS R configuration files and directives

dacs.exprs

- BDACS R expression language

dacs.groups

- BDACS R groups

dacs.nat

- Notice Acknowledgement Token specification

dacs.vfs

- the BDACS R virtual filestore

Section 7: Miscellaneous

dacs.install

- BDACS R installation guide

dacs.java

- BDACS R Java support

dacs.quick

- BDACS R Quick Start Tutorial

dacs.readme

- BDACS R README

Section 8: Web Services and CGI

autologin

- Convert an Apache identity to a BDACS R identity

cgiparse

- CGI argument parsing utility

dacs.services

- BDACS R web services

dacs_acs

- BDACS R access control service

dacs_admin

- BDACS R administration service

dacs_auth_agent

- BDACS R delegated authentication service

dacs_auth_transfer

- transfer credentials between federations

dacs_authenticate

- BDACS R authentication service

dacs_autologin_ssl

- use an SSL client certificate to automatically obtain BDACS R credentials

dacs_conf

- display BDACS R configuration directives

dacs_current_credentials

- display BDACS R credentials

dacs_error

- simple error handling utility for BDACS R

dacs_group

- BDACS R group administration

dacs_infocard

- Information Card administration

dacs_list_jurisdictions

- display information about BDACS R jurisdictions

dacs_managed_infocard

- create a managed Information Card

dacs_mex

- WS-MetadataExchange responder for Information Cards

dacs_notices

- BDACS R notice presentation and acknowledgement handler

dacs_passwd

- manage private BDACS R passwords

dacs_prenv

- CGI program that displays its environment

dacs_select_credentials

- temporarily disable BDACS R credentials

dacs_signout

- BDACS R signout service

dacs_sts

- Secure Token Service for managed Information Cards

dacs_token

- manage DACS one-time password token accounts

dacs_transform

- rule-based document transformation

dacs_uproxy

- minimal HTTP proxying

dacs_version

- display BDACS R version information

dacs_vfs

- access objects through the BDACS R virtual filestore

pamd

- PAM transaction server

HTTP Server: Apache

mod_auth_dacs

- Apache/DACS authentication and authorization module

Annotations

Security Notes

Access to dacs_auth_transfer Password in a URI
Accessibility of dacs_auth_transfer Password visibility and dacsauth
Aspects of NAT security Password visibility and dacspasswd
Authentication modules Passwords and local_passwd_authenticate
Authorization caching considered experimental Permissions for dacs_acs
CAS-based authentication Potential password logging when debugging
Configuration based on arguments Privacy of the federation key
Configuration of dacs_auth_transfer Reliance on cookie names
Configuring COOKIE_PATH Reporting authentication failure
Constraints on new passwords Restrict access to dacs_uproxy
Contradictory rules Restrict access to dacs_vfs
DACS advisory Restricted access to dacs_conf
DACS configuration files Restricted access to dacs_passwd
Defining new item types Restricted access to dacs_token
Disabled or restricted web services Restricting access to dacs_auth_transfer
Disabling SECURE_MODE Running dacs_acs setuid/setgid
Enabling authentication modules Running dacsauth, dacs_authenticate setuid/setgid
Execution privileges and dacsauth Secure NTLM communication
Exporting OTP Accounts Security aspects of access tokens
File and directory permissions Security implications of PERMIT_CHAINING
Hierarchical independence in ACL paths Security implications of dacsinfocard
Honouring imported credentials Security implications of dacspasswd
Implications of delegation Security issues and dacsgrid
Importation of identities Security issues and dacstransform
InfoCard identity Security issues and pamd
Input directory for dacs_transform Setting the lifetime of credentials
Insecurity of local_simple_authenticate Supported Devices
Isolation requirements for dacscheck TOTP Drift Window Size
Lifetime of credentials and cert-based authentication TOTP Drift Window Size
Limitations of ACS_CREDENTIALS_LIMIT Tagging mod_auth_dacs
Limitations of AUTH_SINGLE_COOKIE Tokens and secret keys
Limitations of COMPAT_MODE Tracking anonymous users
Limitations of COOKIE_HTTPONLY Upgrading
Limitations of NAME_COMPARE Use of MD5
Limitations of VERIFY_UA Use of the REFEDERATE directive
Limitations of constraints Using SSL with dacs_auth_transfer
Limitations on CGI arguments Using dacs_admin()
Limiting access to Rlinks Verification of DACS-wrapping
Limiting access to dacsconf Verify checksums after downloading
Limiting access to dacscookie Weakening of credentials
Limiting access to dacslist dacs_admin disabled by default
Limiting access to dacstoken dacs_auth_agent disabled by default
Limiting access to dacsvfs dacs_authenticate security issues
Moving credentials to another host dacskey and accessibility of keyfiles
Multiple Auth clauses exec() target UID/GID
Multiple credentials for the same identity ldaps scheme unavailable

Important Notes

Converting ACL format NO WARRANTY
DACS advisory PAM authentication
Definition of jurisdiction metadata Potential import/export restrictions
File permissions of autologin Potential password logging when debugging
Hiding the DACS_ACS argument Third-party packages
Installation notes Unique jurisdiction sections
Installing Apache Upgrading DACS
Interaction between http and sslclient dacsauth() considered experimental
Limitations on CGI arguments dacscheck() considered experimental
NO WARRANTY user() returning False

Other Notes

DACS advisory Potential password logging when debugging
Limitations on CGI arguments  

Tips

Begin by reviewing dacs.quick(7) Potential password logging when debugging
Begin with a basic DACS install Problems while building with shared libraries
Building standalone components Redirection after authentication
Built-in authentication modules Remember to make public files accessible
Built-in roles modules Remember to restart httpd
CAS protocol Reviewing build notes
Configuration of mod_ssl in httpd.conf Rotate log files
Configuring HTTP authentication Save your config.nice
DACS advisory Selecting characters and substrings
DACS self tests Selecting new credentials
DEFAULT_JURISDICTION environment variable Short links
Displaying CGI arguments Testing LDAP authentication
Displaying DACS environment variables Testing NTLM authentication
Domain attributes in cookies Testing where a client authenticated
Easier upgrades Try dacsexpr
Escaping space characters Use site.conf-std
Failed internal HTTP requests Using dacsinit
Filename suffixes for CGI programs Using user()
Filenames for rulesets Validating ruleset syntax
Generated directory listings, internal redirects Value of an if statement
How to choose better passwords Variable substitution in dacs_transform
InfoCard authentication using an expression Verify web server version
Initial configuration using dacsinit Viewing DACS documentation via Apache
Installing a subset of DACS Whitespace in a variable reference
Limitations on CGI arguments dacs_transform and the 'insert' directive
Omitting braces in a variable reference local_unix_authenticate and setuid

Variables

${Args::DACS_USERNAME} ${DACS::PATH_INFO} DACS_DEFAULT_CONSTRAINT
${Args::RNAME} ${DACS::POSTDATA} DACS_FEDERATION
${Args::USERNAME} ${DACS::PROXYREQ} DACS_HOME
${Auth::ABORT} ${DACS::QUERY} DACS_IDENTITY
${Auth::CREDENTIALS_LIFETIME_SECS} ${DACS::REMOTE_ADDR} DACS_JURISDICTION
${Auth::CURRENT_ROLES} ${DACS::REMOTE_HOST} DACS_MOD_AUTH_DACS
${Auth::CURRENT_USERNAME} ${DACS::RIDENT} DACS_RELEASE
${Auth::DACS_IDENTITY} ${DACS::RIPTR} DACS_ROLES
${Auth::DACS_JURISDICTION} ${DACS::RNAME} DACS_SBINDIR
${Auth::DACS_USERNAME} ${DACS::ROLES} DACS_SITE_CONF
${Auth::DACS_VERSION} ${DACS::URI} DACS_SITE_CONF
${Auth::LAST_ROLES} ${DACS::URI} DACS_SITE_CONF_SPEC
${Auth::MODULE_SKIP} ${DACS::USERNAME} DACS_USERNAME
${Auth::ROLES} ${DACS::USER_AGENT} DACS_VERSION
${Conf::FEDERATION_DOMAIN} ${Env::REMOTE_USER} DACS_VERSION
${Conf::LOG_LEVEL} ${Env::REQUEST_URI} DOCUMENT_ROOT
${Conf::dacs_approval_digest_name} ${LDAP::USERNAME} EXE_SUFFIX
${Conf::http_auth_401} ${LDAP::attrname} FEDERATIONS_ROOT
${Conf::prompt_submit_label} ${LDAP::attrvalue} HTTP_HOST
${DACS::ACS} ${Options::AUXILIARY} HTTP_USER_AGENT
${DACS::ARGS_TRUNCATED} ${Options::DACS_JURISDICTION} JURISDICTION_URI
${DACS::ARGS} ${Options::DACS_USERNAME} JURISDICTION_URI_PREFIX
${DACS::ARG_COUNT} ${Options::DACS_VERSION} OPENSSL_PROG
${DACS::AUTHORIZATION} ${Options::PASSWORD} SERVER_ADDR
${DACS::CONTENT_ENCODING} ${Options::USERNAME} SERVER_NAME
${DACS::CONTENT_LENGTH} APACHE_HOME SERVER_PORT
${DACS::CONTENT_TYPE} CGI_SUFFIX SSL variables
${DACS::CURRENT_URI_NO_QUERY} DACS_ACS_JURISDICTION URI_SCHEME
${DACS::CURRENT_URI} DACS_APPROVAL argv[0]
${DACS::FEDERATION} DACS_BINDIR infocard_card_image_card
${DACS::FILENAME} DACS_CGIBINDIR infocard_card_image_cert
${DACS::IDENTITY} DACS_CONCISE_IDENTITY infocard_card_image_passwd
${DACS::INTERACTIVE} DACS_CONF infocard_sts_password
${DACS::IP} DACS_CONF infocard_sts_password
${DACS::JURISDICTION} DACS_CONF_SPEC infocard_sts_title
${DACS::METHOD} DACS_CONSTRAINT infocard_sts_username_password_prompt_fmt

Configuration Directives

ACCEPT_ALIEN_CREDENTIALS INFOCARD_AUDIENCE PASSWORD_AUDIT
ACS_ACCESS_TOKEN_ENABLE INFOCARD_AUDIENCE_RESTRICTION PASSWORD_CONSTRAINTS
ACS_ACCESS_TOKEN_LIFETIME_LIMIT INFOCARD_CARDID_BASE_URL PASSWORD_DIGEST
ACS_ACCESS_TOKEN_LIFETIME_SECS INFOCARD_CARDID_SUFFIX PASSWORD_OPS_NEED_PASSWORD
ACS_AUTHENTICATED_ONLY INFOCARD_CARD_DATETIME_EXPIRES PASSWORD_SALT_PREFIX
ACS_CREDENTIALS_LIMIT INFOCARD_CARD_DEFS_URL PERMIT_CHAINING
ACS_EMIT_APPROVAL INFOCARD_CARD_FILL_URL PREDICATE
ACS_ERROR_HANDLER INFOCARD_CARD_IMAGE_BASE_URL PREDICATE
ACS_FAIL INFOCARD_CARD_LIFETIME_SECS PREDICATE
ACS_INACTIVITY_LIMIT_SECS INFOCARD_CARD_OUTPUTDIR PROXY_EXEC_DOCUMENT_ROOT
ACS_POST_BUFFER_LIMIT INFOCARD_CARD_VERSION PROXY_EXEC_MAPPER_DEFAULT_ACTION
ACS_POST_EXCEPTION_MODE INFOCARD_DIGEST PROXY_EXEC_MAPPER_LOGGING
ACS_PRE_AUTH INFOCARD_IP_PRIVACY_URL PROXY_EXEC_MAPPER_LOG_FILE
ACS_SUCCESS INFOCARD_IP_PRIVACY_VERSION PROXY_EXEC_MAPPER_RULES_FILE
ACS_TRACK_ACTIVITY INFOCARD_ISSUER_INFO_ENTRY PROXY_EXEC_PROG_URI
ADMIN_IDENTITY INFOCARD_MEX_URL REFEDERATE
ALLOW_HTTP_COOKIE INFOCARD_REQUIRE_APPLIES_TO RLINK
AUTH_AGENT_ALLOW_ADMIN_IDENTITY INFOCARD_STRONG_RP_IDENTITY ROLES*
AUTH_CREDENTIALS_ADMIN_LIFETIME_SECS INFOCARD_STS_AUTH_TYPE ROLE_STRING_MAX_LENGTH
AUTH_CREDENTIALS_DEFAULT_LIFETIME_SECS INFOCARD_STS_CACERTFILE SECURE_MODE
AUTH_ERROR_HANDLER INFOCARD_STS_CERTFILE SIGNOUT_HANDLER
AUTH_FAIL INFOCARD_STS_KEYFILE SSL_PROG
AUTH_FAIL_DELAY_SECS INFOCARD_STS_KEYFILE_PASSWORD SSL_PROG_ARGS
AUTH_SINGLE_COOKIE INFOCARD_STS_PASSWORD_METHOD SSL_PROG_CA_CRT
AUTH_SUCCESS INFOCARD_STS_RP_ENDPOINT SSL_PROG_CLIENT_CRT
AUTH_SUCCESS_HANDLER INFOCARD_TOKEN_DRIFT_SECS STATUS_LINE
AUTH_TRANSFER_EXPORT INFOCARD_TOKEN_ISSUER STYLE
AUTH_TRANSFER_TOKEN_LIFETIME_SECS INFOCARD_TOKEN_LIFETIME_SECS SUCCESS_URL
COMPAT_MODE INFOCARD_TOKEN_MAX_LENGTH TEMP_DIRECTORY
CONTROL INFOCARD_USERNAME_SELECTOR TOKEN_HOTP_ACCEPT_WINDOW
COOKIE_HTTPONLY INIT* TOKEN_REQUIRES_PIN
COOKIE_NO_DOMAIN INIT* TRACE_LEVEL
COOKIE_PATH JURISDICTION_NAME UNAUTH_ROLES
CREDENTIALS_LIFETIME_SECS LOGINGEN_FILE UPROXY_APPROVED
CREDENTIALS_LIFETIME_SECS LOGINGEN_PROG URL
CSS_PATH LOG_FILE URL
DTD_BASE_URL LOG_FILTER URL*
ERROR_URL LOG_FORMAT URL*
EVAL LOG_LEVEL VERBOSE_LEVEL
EXIT* LOG_SENSITIVE VERIFY_IP
EXIT* NAME_COMPARE VERIFY_UA
EXIT* NOTICES_ACCEPT_HANDLER VFS
EXPR NOTICES_ACK_HANDLER XSD_BASE_URL
EXPR NOTICES_DECLINE_HANDLER claim_name
FEDERATION_DOMAIN NOTICES_NAT_NAME_PREFIX claim_name
FEDERATION_NAME NOTICES_SECURE_HANDLER claim_type
FLAGS NOTICES_WORKFLOW_LIFETIME_SECS claim_type
HTTP_AUTH OPTION claim_uri_prefix
HTTP_AUTH_ENABLE OPTION claim_uri_prefix
HTTP_PROG OPTION* claim_uri_prefix_abbrev
IMPORT_FROM OPTION* claim_value
IMPORT_ROLES PAMD_HOST IMPORT_URL
PAMD_PORT   

DTDs

These XML DTD skeletons are used only to help document information used by DACS.

Configuration.dtd, access_token.dtd, acl.dtd, acl_index.dtd, auth_reply.dtd, common.dtd, credentials.dtd, dacs_acs.dtd, dacs_admin.dtd, dacs_auth_agent.dtd, dacs_auth_reply.dtd, dacs_auth_transfer.dtd, dacs_conf_reply.dtd, dacs_current_credentials.dtd, dacs_group.dtd, dacs_infocard.dtd, dacs_list_jurisdictions.dtd, dacs_notices.dtd, dacs_passwd.dtd, dacs_select_credentials.dtd, dacs_user_info.dtd, dacs_version.dtd, groups.dtd, roles_reply.dtd, selected_credentials.dtd, store_reply.dtd


This documentation was created on Mon Oct 29 00:32:17 UTC 2012 using DocBook and libxslt.
Font:
−− Set ++