arcproxy (1) Linux Manual Page
arcproxy – ARC Credentials Proxy generation utility
Synopsis
arcproxy [OPTION]Description
arcproxy generates proxy credentials (general proxy certificate, or proxy certificate with VOMS AC extenstion) from private key and certificate of user.Options
- -h
- prints short usage description
- -P filename
- location of the generated proxy file
- -C
- location of X509 certificate file, the file can be either pem, der, or pkcs12 formated; if this option is not set, then env X509_USER_CERT will be searched; if X509_USER_CERT env is not set, then certificatepath item in client.conf will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
- -K
- location of private key file, if the certificate is in pkcs12 format, then no need to give private key; if this option is not set, then env X509_USER_KEY will be searched; if X509_USER_KEY env is not set, then keypath item in client.conf will be searched; if the location still is not found, then ~/.arc/, ~/.globus/, ./etc/arc, and ./ will be searched.
- -T
- path to trusted certificate directory, only needed for VOMS client functionality; if this option is not set, then env X509_CERT_DIR will be searched; if X509_CERT_DIR env is not set, then cacertificatesdirectory item in client.conf will be searched.
- -s
- path to top directory of VOMS *.lsc files, only needed for VOMS client functionality
- -V
- path to VOMS server configuration file, only needed for VOMS client functionality if the path is a directory rather than a file, all of the files under this directory will be searched
- -S
- voms<:command>. Specify VOMS server.
:command is optional, and is used to ask for specific attributes(e.g: roles)
command option is:
all — put all of this DN’s attributes into AC;
list —list all of the DN’s attribute,will not create AC extension;
/Role=yourRole — specify the role, if this DN
has such a role, the role will be put into AC
/voname/groupname/Role=yourRole — specify the vo,group and role if this DN
has such a role, the role will be put into AC - -o
- group<:role>. Specify ordering of attributes.
Example: –order /knowarc.eu/coredev:Developer,/knowarc.eu/testers:Tester
or: –order /knowarc.eu/coredev:Developer –order /knowarc.eu/testers:Tester
Note that it does not make sense to specify the order if you have two or more different VOMS server specified - -G
- use GSI communication protocol for contacting VOMS services
- -H
- use HTTP communication protocol for contacting VOMS services that provide RESTful access
Note for RESTful access, ‘list’ command and multiple VOMS server are not supported - -O
- use GSI proxy (RFC 3820 compliant proxy is default)
- -I
- print all information about this proxy.
In order to show the Identity (DN without CN as subfix for proxy)
of the certificate, the ‘trusted certdir’ is needed. - -i
- print selected information about this proxy. Currently following information items are supported:
subject – subject name of proxy certificate.
identity – identity subject name of proxy certificate.
issuer – issuer subject name of proxy certificate.
ca – subject name of CA which issued initial certificate.
path – file system path to file containing proxy.
type – type of proxy certificate.
validityStart – timestamp when proxy validity starts.
validityEnd – timestamp when proxy validity ends.
validityPeriod – duration of proxy validity in seconds.
validityLeft – duration of proxy validity left in seconds.
vomsVO – VO name represented by VOMS attribute.
vomsSubject – subject of certificate for which VOMS attribute is issued.
vomsIssuer – subject of service which issued VOMS certificate.
vomsACvalidityStart – timestamp when VOMS attribute validity starts.
vomsACvalidityEnd – timestamp when VOMS attribute validity ends.
vomsACvalidityPeriod – duration of VOMS attribute validity in seconds.
vomsACvalidityLeft – duration of VOMS attribute validity left in seconds.
proxyPolicy
keybits – size of proxy certificate key in bits.
signingAlgorithm – algorithm used to sign proxy certificate.
Items are printed in requested order and are separated by newline. If item has multiple values they are printed in same line separated by |.
- -r
- Remove the proxy file.
- -U
- Username to myproxy server.
- -N
- don’t prompt for a credential passphrase, when retrieve a credential from on MyProxy server.
The precondition of this choice is the credential is PUT onto
the MyProxy server without a passphrase by using -R (–retrievable_by_cert)
option when being PUTing onto Myproxy server.
This option is specific for the GET command when contacting Myproxy server. - -R
- Allow specified entity to retrieve credential without passphrase.
This option is specific for the PUT command when contacting Myproxy server. - -L
- hostname of myproxy server optionally followed by colon and port number, e.g.
example.org:7512. If the port number has not
been specified, 7512 is used by default. - -M
- command to myproxy server. The command can be PUT and GET.
PUT/put — put a delegated credential to myproxy server;
GET/get — get a delegated credential from myproxy server,
- -o