<commit_before>.TH myproxy-server.config 5 "2007-07-17" "NCSA" "MyProxy"
.SH NAME
myproxy-server.config \- myproxy-server configuration file
.SH DESCRIPTION
The
.B myproxy-server.config
file sets the policy for the 
.BR myproxy-server (8),
specifying what credentials may be stored in the server's
repository, who is authorized to retrieve credentials,
and other configurable server behaviors.
By default, the
.BR myproxy-server (8)
looks for this file in
.I /etc/myproxy-server.config
and if it is not found there, it looks in
.IR $GLOBUS_LOCATION/etc/myproxy-server.config .
A template is provided at
.IR $GLOBUS_LOCATION/share/myproxy/myproxy-server.config .
The
.B myproxy-server -c
option can be used to specify an alternative location.
.PP
The following lines in the configuration file use limited regular expressions
for matching the distinguished names (DNs) of classes of users.
The limited regular expressions support the shell-stype characters '*'
and '?', where '*' matches any number of characters and '?' matches
any single character.
The DN limited regexes should be delimited with double quotes 
(\*(lqDN regex\*(rq).
.TP
.BI accepted_credentials " \*(lqDN regex\*(rq"
Each of these lines allows any clients whose DNs match the
given limited regex to connect to the myproxy-server and store
credentials with it for future retrieval.  Any number of these
lines may appear.  For backwards compatibility, these lines
can also start with 
.B allowed_clients 
instead of
.BR accepted_credentials .
If no 
.B accepted_credentials
lines are specified, the server will not allow any clients to store
credentials.
.TP
.BI authorized_retrievers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide policies for credential retrievers. If the client
DN does not match the given limited regex, the client is not
allowed to retrieve credentials from the server.  
In addition to the server-wide policy, myproxy also
provides support for per-credential policy. The user can
specify the regex DN of the allowed retrievers of the
credential when uploading the credential (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
The retrieval client
DN must also match the user specified regex. In order to
retrieve credentials the client also needs to know the name
and pass phrase provided by the client when the credentials
were stored. Any number of these lines may appear.  For
backwards compatibility, these lines can also start with
.B allowed_services 
instead of 
.BR authorized_retrievers .
If no 
.B authorized_retrievers
lines are specified, the server will not allow any clients to retrieve
credentials.
.TP
.BI default_retrievers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide default policies. The regex specifies the clients
who can access the credentials. The default retriever policy
is enforced if a per-credential policy is not specified on
upload (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
In other words, the client can override this policy
for a credential on upload.  The per-credential policy is
enforced in addition to the server-wide policy specified by
the authorized_retrievers line (which clients can not
override).  Any number of these lines may be present.  For
backwards compatibility, if no 
.B default_retrievers 
line is
specified, the default policy is "*", which allows any client
to pass the per-credential policy check.  (The client must
still pass the 
.B authorized_retrievers 
check.)
.TP
.BI authorized_renewers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide policies for authorized renewers. If the client DN
does not match the given limited regex the client is not
allowed to renew the credentials previously stored by a
client.  In addition to the server-wide policy, myproxy also
provides support for per-credential policy. The user can
specify the regex DN of the allowed renewers of the credential
on upload (using
.BR myproxy-init (1)).
The renewal client DN must match both this regex
and the user specified regex. In this case, the client must
also already have a credential with a DN matching the DN of
the credentials to be retrieved, to be used in a second
authorization step (see the
.B -a
options for
.BR myproxy-logon (1)
and
.BR myproxy-retrieve (1)).
.TP
.BI default_renewers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide default renewer policies. The regex specifies the
clients who can renew the credentials. The default renewer
policy is enforced if a per-credential policy is not specified
on upload (using
.BR myproxy-init (1)).
This is enforced in addition to the server-wide
policy specified by the 
.B authorized_renewers 
line. Any number
of these lines may appear.  For backwards compatibility, if no
default_renewers line is specified, the default policy is "*",
which allows any client to pass the per-credential policy
check.  (The client must still pass the 
.B authorized_renewers
check.)
.TP
.BI authorized_key_retrievers " \*(lqDN regex\*(rq"
This policy controls who can retrieve credentials (certificates and
keys) directly from the repository using
.BR myproxy-retrieve (1).
Clients must also match the
.B authorized_retrievers
policy.
If no 
.B authorized_key_retrievers
lines are specified, the server will not allow any clients to retrieve
keys directly from the repository.
.TP
.BI default_key_retrievers " \*(lqDN regex\*(rq"
This policy applies if a per-credential policy is not specified on
upload (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
In other words, the client can override this policy
for a credential on upload.  The per-credential policy is
enforced in addition to the server-wide policy specified by
the authorized_key_retrievers line (which clients can not
override).  Any number of these lines may be present.  
If no 
.B default_key_retrievers 
line is
specified, the default policy is "*", which allows any client
to pass the per-credential policy check.  (The client must
still pass the 
.B authorized_key_retrievers 
check.)
.TP
.BI trusted_retrievers " \*(lqDN regex\*(rq"
This policy controls who can retrieve credentials without further
authentication.
By default, clients that match 
.B authorized_retrievers 
must perform additional authentication (such as passphrase, PAM, or
SASL) to retrieve credentials.  However, authenticated clients that
match 
.B trusted_retrievers 
do not need to perform additional authentication.
.TP
.BI default_trusted_retrievers " \*(lqDN regex\*(rq"
If a user doesn't set a trusted retrieval policy with the credential
on upload (via 
.B 'myproxy-init 
.BR -Z' ), <commit_msg>Clarify behavior of trusted_retrievers setting: - authorized_retrievers is still required - passphrase is still required for encrypted credentials<commit_after>.TH myproxy-server.config 5 "2007-08-20" "NCSA" "MyProxy"
.SH NAME
myproxy-server.config \- myproxy-server configuration file
.SH DESCRIPTION
The
.B myproxy-server.config
file sets the policy for the 
.BR myproxy-server (8),
specifying what credentials may be stored in the server's
repository, who is authorized to retrieve credentials,
and other configurable server behaviors.
By default, the
.BR myproxy-server (8)
looks for this file in
.I /etc/myproxy-server.config
and if it is not found there, it looks in
.IR $GLOBUS_LOCATION/etc/myproxy-server.config .
A template is provided at
.IR $GLOBUS_LOCATION/share/myproxy/myproxy-server.config .
The
.B myproxy-server -c
option can be used to specify an alternative location.
.PP
The following lines in the configuration file use limited regular expressions
for matching the distinguished names (DNs) of classes of users.
The limited regular expressions support the shell-stype characters '*'
and '?', where '*' matches any number of characters and '?' matches
any single character.
The DN limited regexes should be delimited with double quotes 
(\*(lqDN regex\*(rq).
.TP
.BI accepted_credentials " \*(lqDN regex\*(rq"
Each of these lines allows any clients whose DNs match the
given limited regex to connect to the myproxy-server and store
credentials with it for future retrieval.  Any number of these
lines may appear.  For backwards compatibility, these lines
can also start with 
.B allowed_clients 
instead of
.BR accepted_credentials .
If no 
.B accepted_credentials
lines are specified, the server will not allow any clients to store
credentials.
.TP
.BI authorized_retrievers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide policies for credential retrievers. If the client
DN does not match the given limited regex, the client is not
allowed to retrieve credentials from the server.  
In addition to the server-wide policy, myproxy also
provides support for per-credential policy. The user can
specify the regex DN of the allowed retrievers of the
credential when uploading the credential (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
The retrieval client
DN must also match the user specified regex. In order to
retrieve credentials the client also needs to know the name
and pass phrase provided by the client when the credentials
were stored. Any number of these lines may appear.  For
backwards compatibility, these lines can also start with
.B allowed_services 
instead of 
.BR authorized_retrievers .
If no 
.B authorized_retrievers
lines are specified, the server will not allow any clients to retrieve
credentials.
.TP
.BI default_retrievers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide default policies. The regex specifies the clients
who can access the credentials. The default retriever policy
is enforced if a per-credential policy is not specified on
upload (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
In other words, the client can override this policy
for a credential on upload.  The per-credential policy is
enforced in addition to the server-wide policy specified by
the authorized_retrievers line (which clients can not
override).  Any number of these lines may be present.  For
backwards compatibility, if no 
.B default_retrievers 
line is
specified, the default policy is "*", which allows any client
to pass the per-credential policy check.  (The client must
still pass the 
.B authorized_retrievers 
check.)
.TP
.BI authorized_renewers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide policies for authorized renewers. If the client DN
does not match the given limited regex the client is not
allowed to renew the credentials previously stored by a
client.  In addition to the server-wide policy, myproxy also
provides support for per-credential policy. The user can
specify the regex DN of the allowed renewers of the credential
on upload (using
.BR myproxy-init (1)).
The renewal client DN must match both this regex
and the user specified regex. In this case, the client must
also already have a credential with a DN matching the DN of
the credentials to be retrieved, to be used in a second
authorization step (see the
.B -a
options for
.BR myproxy-logon (1)
and
.BR myproxy-retrieve (1)).
.TP
.BI default_renewers " \*(lqDN regex\*(rq"
Each of these lines allows the server administrator to set
server-wide default renewer policies. The regex specifies the
clients who can renew the credentials. The default renewer
policy is enforced if a per-credential policy is not specified
on upload (using
.BR myproxy-init (1)).
This is enforced in addition to the server-wide
policy specified by the 
.B authorized_renewers 
line. Any number
of these lines may appear.  For backwards compatibility, if no
default_renewers line is specified, the default policy is "*",
which allows any client to pass the per-credential policy
check.  (The client must still pass the 
.B authorized_renewers
check.)
.TP
.BI authorized_key_retrievers " \*(lqDN regex\*(rq"
This policy controls who can retrieve credentials (certificates and
keys) directly from the repository using
.BR myproxy-retrieve (1).
Clients must also match the
.B authorized_retrievers
policy.
If no 
.B authorized_key_retrievers
lines are specified, the server will not allow any clients to retrieve
keys directly from the repository.
.TP
.BI default_key_retrievers " \*(lqDN regex\*(rq"
This policy applies if a per-credential policy is not specified on
upload (using
.BR myproxy-init (1)
or
.BR myproxy-store (1)).
In other words, the client can override this policy
for a credential on upload.  The per-credential policy is
enforced in addition to the server-wide policy specified by
the authorized_key_retrievers line (which clients can not
override).  Any number of these lines may be present.  
If no 
.B default_key_retrievers 
line is
specified, the default policy is "*", which allows any client
to pass the per-credential policy check.  (The client must
still pass the 
.B authorized_key_retrievers 
check.)
.TP
.BI trusted_retrievers " \*(lqDN regex\*(rq"
This policy controls who can retrieve credentials without further
authentication.
By default, clients that match 
.B authorized_retrievers 
must perform additional authentication (such as passphrase, PAM, or
SASL) to retrieve credentials.  However, authenticated clients that
match both
.B authorized_retrievers 
and
.B trusted_retrievers 
do not need to perform additional authentication,
unless the credentials are protected by a passphrase,
in which case the passphrase is still required.
.TP
.BI default_trusted_retrievers " \*(lqDN regex\*(rq"
If a user doesn't set a trusted retrieval policy with the credential
on upload (via 
.B 'myproxy-init 
.BR -Z' ), 
{'fraction_non_alphanumeric': 0.05560826096475224, 'fraction_numerical': 0.003210975698752098, 'mean_word_length': 4.514688128772636, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5306679', 'n_tokens_mistral': 3796, 'n_tokens_neox': 3689, 'n_words': 1957}