arcproxy (1) - Linux Manuals
arcproxy: ARC Credentials Proxy generation utility
NAME
arcproxy - ARC Credentials Proxy generation utilitySYNOPSIS
arcproxy [OPTION]DESCRIPTION
arcproxy generates proxy credentials (general proxy certificate, or proxy certificate with VOMS AC extenstion) from private key and certificate of user.
OPTIONS
- -h
-
prints short usage description
- -P filename
-
location of the generated proxy file
- -C
-
location of X509 certificate file, the file can be either pem, der, or pkcs12 formated; if this option is not set,
then env X509_USER_CERT will be searched; if X509_USER_CERT env is not set, then certificatepath item in client.conf
will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
- -K
-
location of private key file, if the certificate is in pkcs12 format, then no need to give private key; if this option is not set,
then env X509_USER_KEY will be searched; if X509_USER_KEY env is not set, then keypath item in client.conf
will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
- -T
-
path to trusted certificate directory, only needed for VOMS client functionality; if this option is not set,
then env X509_CERT_DIR will be searched; if X509_CERT_DIR env is not set, then cacertificatesdirectory item in client.conf
will be searched.
- -s
-
path to top directory of VOMS *.lsc files, only needed for VOMS client functionality
- -V
-
path to VOMS server configuration file, only needed for VOMS client functionality
if the path is a directory rather than a file, all of the files under this directory will be searched
- -S
-
voms<:command>. Specify VOMS server.
:command is optional, and is used to ask for specific attributes(e.g: roles)
command option is:
all --- put all of this DN's attributes into AC;
list ---list all of the DN's attribute,will not create AC extension;
/Role=yourRole --- specify the role, if this DN
has such a role, the role will be put into AC
/voname/groupname/Role=yourRole --- specify the vo,group and role if this DN
has such a role, the role will be put into AC - -o
- group<:role>. Specify ordering of attributes.
Example: --order /knowarc.eu/coredev:Developer,/knowarc.eu/testers:Tester
or: --order /knowarc.eu/coredev:Developer --order /knowarc.eu/testers:Tester
Note that it does not make sense to specify the order if you have two or more different VOMS server specified - -G
- use GSI communication protocol for contacting VOMS services
- -H
- use HTTP communication protocol for contacting VOMS services that provide RESTful access
Note for RESTful access, 'list' command and multiple VOMS server are not supported - -O
- use GSI proxy (RFC 3820 compliant proxy is default)
- -I
- print all information about this proxy.
In order to show the Identity (DN without CN as subfix for proxy)
of the certificate, the 'trusted certdir' is needed. - -i
- print selected information about this proxy. Currently following information items are supported:
subject - subject name of proxy certificate.
identity - identity subject name of proxy certificate.
issuer - issuer subject name of proxy certificate.
ca - subject name of CA which issued initial certificate.
path - file system path to file containing proxy.
type - type of proxy certificate.
validityStart - timestamp when proxy validity starts.
validityEnd - timestamp when proxy validity ends.
validityPeriod - duration of proxy validity in seconds.
validityLeft - duration of proxy validity left in seconds.
vomsVO - VO name represented by VOMS attribute.
vomsSubject - subject of certificate for which VOMS attribute is issued.
vomsIssuer - subject of service which issued VOMS certificate.
vomsACvalidityStart - timestamp when VOMS attribute validity starts.
vomsACvalidityEnd - timestamp when VOMS attribute validity ends.
vomsACvalidityPeriod - duration of VOMS attribute validity in seconds.
vomsACvalidityLeft - duration of VOMS attribute validity left in seconds.
proxyPolicy
keybits - size of proxy certificate key in bits.
signingAlgorithm - algorithm used to sign proxy certificate.
Items are printed in requested order and are separated by newline. If item has multiple values they are printed in same line separated by |.
- -r
- Remove the proxy file.
- -U
- Username to myproxy server.
- -N
- don't prompt for a credential passphrase, when retrieve a credential from on MyProxy server.
The precondition of this choice is the credential is PUT onto
the MyProxy server without a passphrase by using -R (--retrievable_by_cert)
option when being PUTing onto Myproxy server.
This option is specific for the GET command when contacting Myproxy server. - -R
- Allow specified entity to retrieve credential without passphrase.
This option is specific for the PUT command when contacting Myproxy server. - -L
- hostname of myproxy server optionally followed by colon and port number, e.g.
example.org:7512. If the port number has not
been specified, 7512 is used by default. - -M
- command to myproxy server. The command can be PUT and GET.
PUT/put -- put a delegated credential to myproxy server;
GET/get -- get a delegated credential from myproxy server,
credential (certificate and key) is not needed in this case;