Software Links
Getting Started
- A Globus Primer
- Globus Is Modular!
- Quickstart
- Installing GT
- Platform Notes
- GT Developer's Guide
- GT User's Guide
- Migrating Guides
Reference
Manuals
Common Runtime
Security
- GSI C
- GSI Java
- Java WS A&A
- C WS A&A (coming soon)
- CAS
- Delegation Service
- MyProxy
- GSI-OpenSSH
- SimpleCA
Data Mgt
WS MDS
Execution Mgt
Name
cas-enroll — Enroll a CAS Object
Synopsis
cas-enroll [common options] trustAnchor userGpName nickname authMethod authData cas-enroll [common options] namespace userGpName nickname basename comparisonAlg cas-enroll [common options] object userGpName objectName namespaceNick cas-enroll [common options] serviceType userGpName serviceTypeName
Tool description
This command line client is used to enroll a CAS Object, which includes trust anchors, namespaces, objects and service types.
Enrolling Trust Anchors
To enroll a trust anchor, the user must have cas/enroll_trustAnchor permission on that CAS server object (that is, the user must have permission to perform the enroll_trustAnchor action on the CAS service type).
The enroll operation allows the user to choose a user group to which cas/grantAll permission on the enrolled object should be granted. The nickname should be unique across the CAS database and is used to refer to this trust anchor.
To enroll trust anchors:
casAdmin$cas-enroll [common options] trustAnchoruserGpNamenicknameauthMethodauthData
where:
userGpName- Indicates the user group to which cas/grantAll permission should be granted on this trust anchor entity.
nickname- Indicates the trust anchor nickname.
authMethod- Indicates the authentication method used by the trust anchor.
-
authData - Indicates the data used for authentication, typically the DN.
Enrolling Namespaces
To enroll a namespace, the user must have cas/enroll_namespace permission (that is, the user must have permission to perform the enroll_namespace action on the cas service type).
The enroll operation allows the user to choose a userGroup to have cas/grantAll permission on the enrolled object. The comparison algorithm specified should be the name of the Comparison class that needs to be used to compare objects that belong to this namespace. The nickname should be unique across the CAS database and is used to refer to this user.
Also, two namespaces are added to the CAS database at boot up time, other than the inherent CAS Namespace:
FTPDirectoryTreeuses the WildCardComparison Algorithm and has the base URL set to the current directory.FTPExactuses the ExactComparison Algorithm and has the base URL set to the current directory.
To enroll namespaces:
casAdmin$cas-enroll [common options] namespaceuserGpNamenicknamebasenamecomparisonAlg
where:
-
userGpName - Indicates the user group to which cas/grantAll permission should be granted on this trust anchor entity.
nicknameIndicates the nickname of the namespace to be unenrolled.
If the trust anchor nickname specified does not exist, an error is not thrown. If the unenroll operation is successful, all policy data on that trust anchor is purged.
basename- Indicates the base URL for the namespace.
comparisonAlgIndicates the comparison algorithm to be used. Unless the standard comparison algorithms described below are used, the fully qualified name of the class that needs to be used should be given. The class needs to extend from the abstract class
org.globus.cas.impl.service.ObjectComparison.The two comparison classes provided as a part of the distribution are:
ExactComparison: This class does a case-sensitive exact comparison of the object names. IfcomparisonAlgin the above method is set toExactComparison, the class in the distribution is loaded and used.WildcardComparison: This class does wild card matching as described in CAS Simple Policy Language. It assumes that the wild card character is "*" and that the file separator is "/". IfcomparisonAlgin the above method is set toWildCardComparison, the class in the distribution is loaded and used.
Enrolling Objects
To enroll an object, the user must have cas/enroll_object permission (that is, the use must have permission to perform the enroll_object action on the cas service type).
The enroll operation allows the user to choose a userGroup to have cas/grantAll permission on the enrolled object. The name of the object and the namespace this object belongs to identify an object in the database and should be unique across the CAS database.
To enroll objects:
casAdmin$cas-enroll [common options] objectuserGpNameobjectNamenamespaceNick
where:
userGpName- Indicates the user group to which cas/grantAll permission should be granted on this trust anchor entity.
objectName- Indicates the name of the object.
namespaceNick- Indicates the nickname of the namespace to which this object belongs.
Enrolling Service Types
To enroll a service type, the user must have cas/enroll_serviceType permission (that is, the user must have permission to perform the enroll_serviceType action on the cas service type).
The enroll operation allows the user to choose a userGroup to have cas/grantAll permission on the enrolled service type. The service type name should be unique across the CAS database.
To enroll service types:
casAdmin$cas-enroll [common options] serviceTypeuserGpNameserviceTypeName
where:
userGpName- Indicates the user group to which cas/grantAll permission should be granted on this trust anchor entity.
serviceTypeName- Indicates the service type name.
Options
Important
If you have an asterisk (*) in your command, you might need to escape it with a backslash ( \ ).
- -a, --anonymous
Enables anonymous authentication. Only supported with transport security or the GSI Secure Conversation authentication mechanism.
- -c, --serverCertificate
<file> Specifies the server's certificate file used for encryption. Only needed for the GSI Secure Message authentication mechanism.
- -debug
Runs the client with debug message traces and error stack traces.
- -f, --descriptor
<file> Specifies a client security descriptor. Overrides all other security settings.
- -help
Prints the usage message for the client.
- -l, --contextLifetime
<value> Sets the lifetime of the client security context.
valueis in milliseconds. Only supported with the GSI Secure Conversation authentication mechanism.- -m, --securityMech
<type> Specifies the authentication mechanism. The value
typecan be:msgfor GSI Secure Message, orconvfor GSI Secure Conversation.
- -p, --protection
<type> Specifies the protection level.
typecan be:sigfor signature, orencfor encryption.
- -s
cas-url Sets the CAS Service instance, where
cas-urlis the URL of the CAS service instance. Alternatively, an environment variable can be set as shown here.The instance URL typically looks like
http://Host:Port/wsrf/services/CASService, whereHostandPortare the host and port where the container with the CAS service is running.- -v
Prints the version number.
- -x, --proxyFilename
<value> Sets the proxy file to use as client credential.
- -z
authorization Specifies the type of authorization used, such as
selforhost.If you cannot use a standard method for authorization, you can use the specific CAS server's identity as the value.
Alternatively, an environment variable can be set as shown here.
If none of the above are set, host authorization is done by default and the expected server credential is
cas/, where<fqdn><fqdn>is the fully qualified domain name of the host on which the CAS service is up.![[Note]](/docbook-images/note.gif)
Note If the service being contacted is using GSI Secure Transport , then the container credentials configured for the service will be used, even if service/resource level credentials are configured. Hence authorization needs to be done based on the DN of the container credentials.