LCMAPS-PLUGINS-VERIFY-PROXY(8)

NAME
lcmaps_verify_proxy.mod - Verification plug-in for LCMAPS

SYNOPSIS
lcmaps-plugins-verify-proxy [{-cadir|-certdir} path] [--discard_private_key_absence] [--never_discard_private_key_absence] [--allow-limited-proxy] [--only-enforce-lifetime-checks] [--max-voms-ttl timespec] [--max-proxy-level-ttl timespec]

DESCRIPTION
The Verify Proxy module will verify the validity of the proxy (with its chain) or any other X.509 certificate chain that has been used in the LCMAPS framework. The module will report to the LCMAPS framework the validity of the chain.

OPTIONS

-cadir path
-certdir path
    The directory with the trusted CA certificates.

--discard_private_key_absence
    specifying this flag indicates that the verification will not check if the proxy file contains the private key to match the last element in the proxy chain. Normally a proxy needs to have a private key to do anything useful with it, such as further delegations or SSL handshakes. Certainly a proxy without a private key can never be accepted as a proof of identity.

--never_discard_private_key_absence
    This option overrules the previous one, and also excludes the use of the environment variable to the same effect.

--allow-limited-proxy
    A limited proxy may not be used for doing further delegations, and e.g. job submission, but it can still be used to access grid storage systems. This flag should be specified for systems for which such proxies are acceptable to use.

--only-enforce-lifetime-checks
    This option will skip all verifications of the proxy chain, except for the lifetime. This option should not be used unless authentication is enforced through other means.

--max-voms-ttl timespec
    The maximum allowed lifetime of the VOMS attributes (if present) in the proxy. The timespec is of the form [n d-] hh:mm which means n days, hh hours and mm minutes, e.g. 2d-20:00.

--max-proxy-level-ttl timespec
    Specifies the maximum allowed lifetime of the last element in the proxy chain; for timespec see --max-voms-ttl.

ENVIRONMENT

VERIFY_PROXY_DISCARD_PRIVATE_KEY_ABSENCE
    Setting this environment variable has the same effect as the --discard_private_key_absence option.

RETURN VALUES

LCMAPS_MOD_SUCCESS
    Success.

LCMAPS_MOD_FAIL
    Failure.

BUGS
Please report any errors to the Nikhef Grid Middleware Security Team <grid-mw-security-support@nikhef.nl>.

SEE ALSO
lcmaps.db(5), lcmaps(3).

AUTHORS
LCMAPS and the LCMAPS plug-ins were written by the Grid Middleware Security Team <grid-mw-security@nikhef.nl>.