source: doc/creddy.1 @ b02d665

abac0-leakabac0-meicompt_changesgec13mei-idmei-rt0-nmei_rt0mei_rt2mei_rt2_fix_1meiyap-rt1meiyap1rt2tvf-new-xml
Last change on this file since b02d665 was b02d665, checked in by Mike Ryan <mikeryan@…>, 15 years ago

creddy man page

  • Property mode set to 100644
File size: 3.0 KB
Line 
1.TH creddy 1 "July 2010" "ABAC 0.1.0"
2
3.SH NAME
4creddy \- ABAC X.509 identity and attribute certificate manager (for cool kids)
5
6.SH SYNOPSIS
7
8.B creddy [ --<mode> ] --help
9
10.SH DESCRIPTION
11
12creddy is an awesome and wonderful ABAC credential management tool. It
13creates, verifies, and otherwise frobnicates X.509 identity and
14attribute certificates. The output of the tool is suitable for use with
15ABAC. Additionally, the self-signed X.509 identity certs (with
16associated private keys) can be used with OpenSSL.
17
18.SH OPTIONS
19
20.SS --generate
21Generate an X.509 identity cert and private key pair. The certificate is saved in ${cn}_id.pem and the private key is saved in ${cn}_private.pem.
22.P
23Note that private key generation is slow and uses a lot of entropy. You can generate entropy by moving your mouse a lot or running large find commands on your local file systems.
24
25.TP
26.B --cn
27common name used on certificate, provided as a convenience and ignored by ABAC
28
29.TP
30.B --validity
31optional certificate validity in days, default is 1080
32
33.SS --verify
34verify the signature on a self-signed X.509 identity cert or an X.509 attribute cert
35
36.TP
37.B --cert
38self-signed X.509 identity cert
39
40.TP
41.B --attrcert
42optional X.509 attribute cert. If omitted the self-signature of the ID cert is checked
43
44.SS --keyid
45extract the subjectKeyIdentifier (SHA1 hash) from an X.509 identity cert
46
47.TP
48.B --cert
49X.509 identity cert
50
51.SS --attribute
52generate an X.509 attribute cert representing an ABAC credential
53
54.TP
55.B --issuer
56X.509 identity cert issuing the credential
57
58.TP
59.B --key
60private key associated with issuer cert
61
62.TP
63.B --role
64role in issuer's local attribute space
65
66.TP
67.B --subject-cert
68X.509 identity cert representing the principal to which the role is being issued. This is mutually exclusive to --subject-id.
69
70.TP
71.B --subject-id
72public key identifier (SHA1 hash) of the principal to which the role is being issued. This is mutually exclusive to --subject-cert.
73
74.TP
75.B --subject-role
76optional role in subject's local attribute space. If the issuer is A, role is r1, subject is B and the subject-role is r2, the attribute issued will be A.r1 <- B.r2.
77
78.TP
79.B --validity
80optional certificate validity in days, default is 365
81
82.TP
83.B --out
84where to save DER-encoded attribute cert. In order to interoperate with the rest of ABAC, this name should end in _attr.der.
85
86.SS --roles
87Extract the roles from an X.509 attribute cert
88
89.TP
90.B --cert
91X.509 attribute cert containing ABAC roles
92
93.SH EXAMPLES
94
95.TP
96Generate ID cert and private key pairs:
97
98.B creddy --generate --cn Alice
99.br
100.B creddy --generate --cn Bob
101
102.TP
103Issue the credential Alice.friend <- Bob
104
105creddy --attribute \\
106       --issuer Alice_ID.pem --key Alice_private.pem \\
107       --role friend --subject-cert Bob_ID.pem \\
108       --out Alice_friend__Bob_attr.der
109
110.SH AUTHOR
111
112Written by Mike Ryan <mikeryan@ISI.EDU>. Like what you see? Buy me a beer!
113
114.SH BUGS
115
116None yet. Report to http://abac.deterlab.net/
117
118.SH COPYRIGHT
119
120Copyright (c) 2010 USC/ISI. Released under MIT license. See COPYING included with source for details.
Note: See TracBrowser for help on using the repository browser.