Changes between Version 37 and Version 38 of FeddCommands

Timestamp:

Jun 12, 2014 3:24:53 PM (10 years ago)

Author:

faber

Comment:

--

FeddCommands

@@ -371 +371 @@
 
 There are several utilities for converting text-based configurations to ABAC and manipulating ABAC logic statements directly.
-
-=== fedd_to_abac.py ===
-
-{{{fedd_to_abac.py}}} converts an fedd experiment controller configuration into an ABAC configuration.  A certificate and key are required as well as an output directory for the ABAC authorizer (target of the '''auth_dir''' parameter in the configuration file.
-
-It takes the following arguments:
-  {{{--cert=}}}''file''::
-    A file containing an X.509 certificate in pem format.  This is the identity that will assert the attributes and should probably be the same as the experiment controller's identity.  It may be a combination certificate and key file.
-  {{{--key=}}}''file''::
-    The key for signing attributes.  It should be a pem file with an RSA key in it.  This can be omitted if {{{--cert}}} specifies a combination file.
-  {{{--dir=}}}''dir''::
-    The output directory for the authorizer.   (This must be an absolute pathname).
-
-  {{{--make_dir}}}::
-    If given, make the output directory.
-  {{{--debug}}}::
-    Just output the creddy commands that would be issued to create the certificates.
-  {{{--policy_only}}}::
-    Only output the ABAC certificates, not the full ABAC authorizer.  This is primarily for debugging.
-  {{{--update}}}::
-    Update the output directory rather than creating it.  This allows the authorizer to remember credentials it has learned or issued while updating the policy.
-
-After the named arguments are given, the [FeddDatabases#ExperimentControlComponentAccessDB aceess DB file] is a required argument.
 
 === access_to_abac.py ===
@@ -426 +403 @@
 If {{{--file}}} is not given, the [FeddDatabases#AccessComponentAccessDB accessDB] to convert must follow.
 
+
+
+=== cert_to_fedid.py ===
+
+The fedd tools expect the identity of the user to be a self-signed certificate.  This is accomplished using the command:
+
+{{{
+$ cert_to_fedid.py --cn $USER --out $HOME/.ssl/fedid.pem $HOME/.ssl/emulab.pem
+}}}
+
+The '''cert_to_fedid.py''' utility will list other parameters, but most are not needed for users.  The fedid_tools search for {{{.ssl/fedid.pem}}} as a default identity, so putting the output there will make things simple.
+
+
+=== creddy_split.py ===
+
+Split a combination PEM file (that contains both a key and a certificate) into a key and a certificate file.  Early versions of ABAC were finicky about combination PEM files.  It takes a single parameter, the combination to split.  By default the output files are `./cert.pem` and `./key.pem`.
+
+The arguments are:
+
+ '''--cert='''''filename'''::
+  Store the certificate in ''filename''
+ '''--force'''::
+  Overwrite existing output files
+ '''--key='''''filename''::
+  Store the key in ''filename''
+
 === dump_abac_authorizer.py ===
 
@@ -440 +443 @@
 }}}
 
+=== fedd_to_abac.py ===
+
+{{{fedd_to_abac.py}}} converts an fedd experiment controller configuration into an ABAC configuration.  A certificate and key are required as well as an output directory for the ABAC authorizer (target of the '''auth_dir''' parameter in the configuration file.
+
+It takes the following arguments:
+  {{{--cert=}}}''file''::
+    A file containing an X.509 certificate in pem format.  This is the identity that will assert the attributes and should probably be the same as the experiment controller's identity.  It may be a combination certificate and key file.
+  {{{--key=}}}''file''::
+    The key for signing attributes.  It should be a pem file with an RSA key in it.  This can be omitted if {{{--cert}}} specifies a combination file.
+  {{{--dir=}}}''dir''::
+    The output directory for the authorizer.   (This must be an absolute pathname).
+
+  {{{--make_dir}}}::
+    If given, make the output directory.
+  {{{--debug}}}::
+    Just output the creddy commands that would be issued to create the certificates.
+  {{{--policy_only}}}::
+    Only output the ABAC certificates, not the full ABAC authorizer.  This is primarily for debugging.
+  {{{--update}}}::
+    Update the output directory rather than creating it.  This allows the authorizer to remember credentials it has learned or issued while updating the policy.
+
+After the named arguments are given, the [FeddDatabases#ExperimentControlComponentAccessDB aceess DB file] is a required argument.
+
 === import_abac_creds.py ===
 
@@ -455 +481 @@
 You can confirm the addition of the certificates using dump_abac_authorizer.py.
 
-=== cert_to_fedid.py ===
-
-The fedd tools expect the identity of the user to be a self-signed certificate.  This is accomplished using the command:
-
-{{{
-$ cert_to_fedid.py --cn $USER --out $HOME/.ssl/fedid.pem $HOME/.ssl/emulab.pem
-}}}
-
-The '''cert_to_fedid.py''' utility will list other parameters, but most are not needed for users.  The fedid_tools search for {{{.ssl/fedid.pem}}} as a default identity, so putting the output there will make things simple.
-
-
-
-