'\" te
.\" Copyright (c) 1998, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH GSSCRED 8 "Feb 11, 2004"
.SH NAME
gsscred \- add, remove, and list gsscred table entries
.SH SYNOPSIS
.LP
.nf
\fBgsscred\fR [\fB-n\fR \fIuser\fR [\fB-o\fR \fIoid\fR] [\fB-u\fR \fIuid\fR]] [\fB-c\fR \fIcomment\fR] \fB-m\fR \fImech\fR \fB-a\fR
.fi

.LP
.nf
\fBgsscred\fR [\fB-n\fR \fIuser\fR [\fB-o\fR \fIoid\fR]] [\fB-u\fR \fIuid\fR] [\fB-m\fR \fImech\fR] \fB-r\fR
.fi

.LP
.nf
\fBgsscred\fR [\fB-n\fR \fIuser\fR [\fB-o\fR \fIoid\fR]] [\fB-u\fR \fIuid\fR] [\fB-m\fR \fImech\fR] \fB-l\fR
.fi

.SH DESCRIPTION
.sp
.LP
The \fBgsscred\fR utility is used to create and maintain a mapping between a
security principal name and a local UNIX \fIuid\fR. The format of the user name
is assumed to be \fBGSS_C_NT_USER_NAME\fR. You can use the \fB-o\fR option to
specify the object identifier of the \fIname\fR type. The \fBOID\fR must be
specified in dot-separated notation, for example: \fB1.2.3.45464.3.1\fR
.sp
.LP
The \fBgsscred\fR table is used on server machines to lookup the \fIuid\fR of
incoming clients connected using \fBRPCSEC_GSS\fR.
.sp
.LP
When adding users, if no \fIuser\fR name is specified, an entry is created in
the table for each user from the \fBpasswd\fR table. If no \fIcomment\fR is
specified, the \fBgsscred\fR utility inserts a comment that specifies the user
name as an \fBASCII\fR string and the \fBGSS-API\fRsecurity mechanism that
applies to it. The security mechanism will be in string representation as
defined in the \fB/etc/gss/mech\fR file.
.sp
.LP
The parameters are interpreted the same way by the \fBgsscred\fR utility to
delete users as they are to create users. At least one of the following options
must be specified: \fB-n\fR, \fB-u\fR, or \fB-m\fR. If no security mechanism is
specified, then all entries will be deleted for the user identified by either
the \fIuid\fR or \fIuser\fR name. If only the security mechanism is specified,
then all \fIuser\fR entries for that security mechanism will be deleted.
.sp
.LP
Again, the parameters are interpreted the same way by the \fBgsscred\fR utility
to search for users as they are to create users. If no options are specified,
then the entire table is returned. If the \fIuser\fR name or \fIuid\fR is
specified, then all entries for that \fIuser\fR are returned. If a security
mechanism is specified, then all \fIuser\fR entries for that security mechanism
are returned.
.SH OPTIONS
.sp
.ne 2
.na
\fB\fB-a\fR\fR
.ad
.RS 14n
Add a table entry.
.RE

.sp
.ne 2
.na
\fB\fB-c\fR \fIcomment\fR\fR
.ad
.RS 14n
Insert comment about this table entry.
.RE

.sp
.ne 2
.na
\fB\fB-l\fR\fR
.ad
.RS 14n
Search table for entry.
.RE

.sp
.ne 2
.na
\fB\fB-m\fR \fImech\fR\fR
.ad
.RS 14n
Specify the mechanism for which this name is to be translated.
.RE

.sp
.ne 2
.na
\fB\fB-n\fR \fIuser\fR\fR
.ad
.RS 14n
Specify the optional principal name.
.RE

.sp
.ne 2
.na
\fB\fB-o\fR \fIoid\fR\fR
.ad
.RS 14n
Specify the OID indicating the name type of the user.
.RE

.sp
.ne 2
.na
\fB\fB-r\fR\fR
.ad
.RS 14n
Remove the entry from the table.
.RE

.sp
.ne 2
.na
\fB\fB-u\fR \fIuid\fR\fR
.ad
.RS 14n
Specify the \fIuid\fR for the \fIuser\fR if the \fIuser\fR is not local.
.RE

.SH EXAMPLES
.LP
\fBExample 1 \fRCreating a \fBgsscred\fR Table for the Kerberos v5 Security
Mechanism
.sp
.LP
The following shows how to create a \fBgsscred\fR table for the kerberos v5
security mechanism. \fBgsscred\fR obtains \fIuser\fR names and \fIuid\fR's from
the \fBpasswd\fR table to populate the table.

.sp
.in +2
.nf
example% \fBgsscred -m kerberos_v5 -a\fR
.fi
.in -2
.sp

.LP
\fBExample 2 \fRAdding an Entry for \fBroot/host1\fR for the Kerberos v5
Security Mechanism
.sp
.LP
The following shows how to add an entry for \fBroot/host1\fR with a specified
\fIuid\fR of \fB0\fR for the kerberos v5 security mechanism.

.sp
.in +2
.nf
example% \fBgsscred -m kerberos_v5 -n root/host1 -u 0 -a\fR
.fi
.in -2
.sp

.LP
\fBExample 3 \fRListing All User Mappings for the Kerberos v5 Security
Mechanism
.sp
.LP
The following lists all user mappings for the kerberos v5 security mechanism.

.sp
.in +2
.nf
example% \fBgsscred -m kerberos_v5 -l\fR
.fi
.in -2
.sp

.LP
\fBExample 4 \fRListing All Mappings for All Security Mechanism for a Specified
User
.sp
.LP
The following lists all mappings for all security mechanisms for the user
\fBbsimpson\fR.

.sp
.in +2
.nf
example% \fBgsscred -n bsimpson -l\fR
.fi
.in -2
.sp

.SH EXIT STATUS
.sp
.LP
The following exit values are returned:
.sp
.ne 2
.na
\fB\fB0\fR\fR
.ad
.RS 6n
Successful completion.
.RE

.sp
.ne 2
.na
\fB>\fB0\fR\fR
.ad
.RS 6n
An error occurred.
.RE

.SH ATTRIBUTES
.sp
.LP
See \fBattributes\fR(7) for descriptions of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
Interface Stability	Evolving
.TE

.SH SEE ALSO
.sp
.LP
.BR gsscred.conf (5),
.BR attributes (7),
.BR gssd (8)
.SH NOTES
.sp
.LP
Some GSS mechanisms, such as \fBkerberos_v5\fR, provide their own
authenticated-name-to-local-name (uid) mapping and thus do not usually have to
be mapped using \fBgsscred\fR. See \fBgsscred.conf\fR(5) for more information.