arcproxy (1) Linux Manual Page
NAME
arcproxy – ARC Credentials Proxy generation utility
SYNOPSIS
arcproxy [OPTION]
DESCRIPTION
arcproxy generates proxy credentials (general proxy certificate, or proxy certificate with VOMS AC extenstion) from private key and certificate of user.
OPTIONS
-h- prints short usage description
-Pfilename- location of the generated proxy file
-C- location of X509 certificate file, the file can be either pem, der, or pkcs12 formated; if this option is not set, then env X509_USER_CERT will be searched; if X509_USER_CERT env is not set, then certificatepath item in client.conf will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
-K- location of private key file, if the certificate is in pkcs12 format, then no need to give private key; if this option is not set, then env X509_USER_KEY will be searched; if X509_USER_KEY env is not set, then keypath item in client.conf will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
-T- path to trusted certificate directory, only needed for VOMS client functionality; if this option is not set, then env X509_CERT_DIR will be searched; if X509_CERT_DIR env is not set, then cacertificatesdirectory item in client.conf will be searched.
-s- path to top directory of VOMS *.lsc files, only needed for VOMS client functionality
-V- path to VOMS server configuration file, only needed for VOMS client functionality if the path is a directory rather than a file, all of the files under this directory will be searched
-S- voms<:command>. Specify VOMS server.
:command is optional, and is used to ask for specific attributes(e.g: roles)
command option is:
all — put all of this DN’s attributes into AC;
list —list all of the DN’s attribute,will not create AC extension;
/Role=yourRole — specify the role, if this DN
has such a role, the role will be put into AC
/voname/groupname/Role=yourRole — specify the vo,group and role if this DN
has such a role, the role will be put into AC -o- group<:role>. Specify ordering of attributes.
Example: –order /knowarc.eu/coredev:Developer,/knowarc.eu/testers:Tester
or: –order /knowarc.eu/coredev:Developer –order /knowarc.eu/testers:Tester
Note that it does not make sense to specify the order if you have two or more different VOMS server specified -G- use GSI communication protocol for contacting VOMS services
-H- use HTTP communication protocol for contacting VOMS services that provide RESTful access
Note for RESTful access, ‘list’ command and multiple VOMS server are not supported -O- use GSI proxy (RFC 3820 compliant proxy is default)
-I- print all information about this proxy.
In order to show the Identity (DN without CN as subfix for proxy)
of the certificate, the ‘trusted certdir’ is needed. -i- print selected information about this proxy. Currently following information items are supported:
subject– subject name of proxy certificate.identity– identity subject name of proxy certificate.issuer– issuer subject name of proxy certificate.ca– subject name of CA which issued initial certificate.path– file system path to file containing proxy.type– type of proxy certificate.validityStart– timestamp when proxy validity starts.validityEnd– timestamp when proxy validity ends.validityPeriod– duration of proxy validity in seconds.validityLeft– duration of proxy validity left in seconds.vomsVO– VO name represented by VOMS attribute.vomsSubject– subject of certificate for which VOMS attribute is issued.vomsIssuer– subject of service which issued VOMS certificate.vomsACvalidityStart– timestamp when VOMS attribute validity starts.vomsACvalidityEnd– timestamp when VOMS attribute validity ends.vomsACvalidityPeriod– duration of VOMS attribute validity in seconds.vomsACvalidityLeft– duration of VOMS attribute validity left in seconds.proxyPolicykeybits– size of proxy certificate key in bits.signingAlgorithm– algorithm used to sign proxy certificate.Items are printed in requested order and are separated by newline. If item has multiple values they are printed in same line separated by |.
-r- Remove the proxy file.
-U- Username to myproxy server.
-N- don’t prompt for a credential passphrase, when retrieve a credential from on MyProxy server.
The precondition of this choice is the credential is PUT onto
the MyProxy server without a passphrase by using -R (–retrievable_by_cert)
option when being PUTing onto Myproxy server.
This option is specific for the GET command when contacting Myproxy server. -R- Allow specified entity to retrieve credential without passphrase.
This option is specific for the PUT command when contacting Myproxy server. -L- hostname of myproxy server optionally followed by colon and port number, e.g.
example.org:7512. If the port number has not
been specified, 7512 is used by default. -M- command to myproxy server. The command can be PUT and GET.
PUT/put — put a delegated credential to myproxy server;
GET/get — get a delegated credential from myproxy server,