cosign - The cosign component
Component to configure/start/stop the Cosign Service and also to configure client-side cosign-protected web servers.
The user the cosign daemon should run as, defaults to cosign.
The group the cosign daemon should run on, defaults to cosign.
Location of cosignd daemon.
Location of monster daemon.
Location of the cosignd daemon directory, where all cookies are stored. See cosigndb option in cosign.conf(5).
Location where cosign.cgi stores kerberos tickets on successful kerberos logins. See cosignticketcache in cosign.conf(5).
Location of templates used by cosign.cgi for generating web pages. See cosigntmpldir in cosign.conf(5).
Location of the SSL server certificate for use by cosignd. See cosigncert in cosign.conf(5).
Location of SSL key file for use by cosignd. See cosignkey in cosign.conf(5).
Location of CA certificates in hashed form, used for validating client certificates. See cosigncadir in cosign.conf(5).
Length of the subdirectory hash used for cosignd's cookie cache. See cosigndbhashlen in cosign.conf(5).
Location of keytab file with principal of cosign/hostname. See cosignkeytab in cosign.conf(5).
The fully qualified hostname of a server to replicate to. This will enable the monster process to do replication and clearout. Note that the cosign.conf(5) man page claims this can be set via the cosignhost option - this is erroneous - the replica is set only by using the -h option to cosignd/monster.
The cosign url for logout, defaults to http://SERVER/. See cosignlogouturl in cosign.conf(5).
The cosign url on looping, defaults to http://SERVER/looping.html. See cosignloopurl in cosign.conf(5).
The cosign connection timeout, defaults to 300 seconds. See cosignnettimeout in cosign.conf(5).
The cosign daemon port, defaults to 6663. See cosignport in cosign.conf(5).
A list of client names, there must be at least one with a role of cgi and corresponding to the server name. The following resources can be specified for each entry in the list. See the cosignd(8) man page for more information.
Role of client which can be cgi or service.
Subject CN of client, normally fully qualified server name.
Flags for the client.
Reference to proxy configuration file for the client if the flags indicate proxying - these are not currently configurable via this component.
When set to 1, enable the storage of Kerberos tickets for all clients, and the distribution of those tickets to requesting services
When set, enable negotiate auth support. This should be set to a string matching the description of the negotiate directive in the cosign.conf(5) man page.
A list of tags for Cosign passwd entries, which can be used to allow cosign to authenticate against multiple backend databases.
The type of authentication store to use for this password entry. Cosign currently supports either 'kerberos' or 'mysql'.
The regular expression to match login names against to determine whether they should use this authentication store.
The value to use to lookup the 'username' of a user that matches this regular expression. May contain references to matches in the regular expression.
The value to set for the realm/factor of users that are authenticated through this entry. May contain references to matches in the regular expression.
List of clients, imported from spanning map, which offer web services protected by this cosignd.
The location of the keytab to be used by the HTTP server to authenticate incoming HTTP-Negotiate requests.
The name of the principal from the keytab to use to authenticate incoming requests. Leave blank for the default (HTTP@hostname), or set to Any to allow any principal in the keytab to be used.
Root location of login webserver files.
Location of html files used by login webserver.
Location of cgi applications used by login webserver.
Location of LCFG template file to be used to dynamically generate web page with list of services protected by this cosign server.
Boolean value, if set to true, component will only configure client-side filter (i.e. no cosignd, etc. server-side setup).
Configuration details of the service a client wants to use the cosign server to authenticate against. It is used on the cosign server via an LCFG spanning map. Because of spanning map limitations the service is an encoded group with the syntax cn;flags;proxy;info;url where the first three fields are as described above for the clients resource and as in the cosignd manpage. The client will always default to being a service. The final two fields represent a text description and the URL of the service, to be used when dynamically generating the page listing cosign-enabled services. Note that this resource is somewhat confusingly named as plural, rather than singular - which dates from our original intention to support multiple services per client. This is impractical due to the way the clients are specified in cosign.conf(5).
Location used by client-side filter for storing cosign cookies.
Location of apache server root.
A list of factors that a user must satisfy. Used by CosignRequireFactor directive in apache configuration.
Name of component to configure when cosign configuration has changed.
Unique service name used by client application service. Maps to CosignService directive in apache configuration.
The fully qualified hostname of the cosign server. Used by CosignHostname in apache configuration.
The fully qualified hostname of the login CGI server. Used by CosignRedirect and CosignPostErrorRedirect in apache configuration.
Location of SSL server certificate used by client. Used by CosignCrypto directive in apache configuration.
Location of SSL key file used by client. Used by CosignCrypto directive in apache configuration.
Location of CA certificates in hashed form. Used by CosignCrypto directive in apache configuration.
The cosign component publishes and subscribes to a spanning map. This distributes the list of clients and services allowed to connect to the cosign server.
importcluster
exportcluster
Names of the spanning map for a client to publish to and for server to retrieve the set of clients and services from.
Fedora5
Tim Colles <timc@inf.ed.ac.uk>, George Ross <gdmr@inf.ed.ac.uk>, Toby Blake <toby@inf.ed.ac.uk>, Simon Wilkinson <simon@sxw.org.uk>
Hey! The above document had some coding errors, which are explained below:
You forgot a '=back' before '=head2'
'=item' outside of any '=over'
You forgot a '=back' before '=head2'
'=item' outside of any '=over'
You forgot a '=back' before '=head2'
'=item' outside of any '=over'
You forgot a '=back' before '=head2'
'=item' outside of any '=over'
You can't have =items (as at line 281) unless the first thing after the =over is an =item