


File Formats                                         proxyuser(4)



NAME
     proxyuser - proxy user object for SunScreen configuration

DESCRIPTION
     A proxyuser object is one of the data objects that defines a
     SunScreen configuration.  It is manipulated through the con-
     figuration editor or SunScreen administration GUI.

     proxyuser  objects  store  associations   between   authuser
     objects  and  a userID (or other host-based user identifier)
     to be used by a proxy to authenticate and establish a user's
     identity  on a "backend" server system.  These associations,
     or "mappings", allow for reuse of the authentication  infor-
     mation  within  authuser  objects; by creating multiple map-
     pings, any given authuser can be cast into  different  roles
     with  respect  to  his/her  identity  on different "backend"
     servers to be proxied.  These mapping proxyuser objects  are
     dubbed "simple" ones.

     In addition to simple entries, proxyuser objects  also  pro-
     vide  for  the creation of groups of sibling objects.  These
     "group" objects may contain zero or more references to other
     simple or group proxyuser objects.  The group structures are
     maintained hierarchically, not flattened.

     Finally, some proxyuser objects are considered to  be  "spe-
     cial"  ones.  Such objects are similar to simple objects but
     provide access paths to one or more user entities which  can
     be authenticated by an external mechanism.  RADIUS and Secu-
     rID are the two such external mechanisms supported  in  this
     release.

     proxyuser objects are referenced in SunScreen  proxy  policy
     rules.


OBJECT STRUCTURE
     Each proxyuser object has a name.  The name may not  contain
     "!",  "#", "$", "%", "^", "&", "*", "{", "}", "[", "]", "<",
     ">", """, "\", "?", "`", "/", "@", or NUL characters.  Names
     can  be administrator-chosen to coincide with existing real-
     world naming schemes  for  individuals,  existing  computer-
     based  naming,  or  any  other scheme.  Thus, "hbovis (mech-
     engg)",   "sally.ann.studebaker",   and   "Rundum, Karr Bo -
      security"  are  all examples of legitimate proxyuser object
     names.  The namespace of the proxyuser objects  is  disjoint
     from all others in the SunScreen.  (In particular, proxyuser
     names are different from those that name authuser objects.)

     Each proxyuser object has an enablement tag, allowing it  to
     be turned-off for processing purposes without deleting it.




                   Last change: 20 April 1999                   1






File Formats                                         proxyuser(4)



     ENABLED
          Allows  authentication  processing  to  consider   this
          object.  This is the default.  (See also DISABLED.)

     DISABLED
          Disallows authentication  processing  from  considering
          this object.

   The two portions of the simple object mapping are: an authuser
   object  reference  and backend user name.  Each of these is an
   optional field.

     AUTH_USER_NAME="authusername"
          Specifies a reference to an authuser  object  with  the
          given  authusername.  If this item is not present, then
          the proxyuser object does  not  require  authentication
          when it is used.

     BACKEND_USER_NAME="backendname"
          Specifies the system-dependent name, to be supplied  to
          the  backend server as the identity of the user of this
          mapping.  (At  present,  this  item  should  always  be
          defined.)

     If the authuser reference is empty, then the mapping  is  an
     "unauthenticated"  one  (the only authentication is the men-
     tion of  the  name).   An  example  of  such  usage  is  the
     "anonymous" proxy_user, often used by the FTP protocol.

     At present,  the  backend  user  name  should  not  be  left
     unspecified.

     For group proxyuser objects:

     GROUP          Identifies a group object.

     MEMBER_NAME="mname"
                    Makes a reference to another proxyuser object
                    mname  by  the  one containing it.  This item
                    can be repeated as many times  as  needed  to
                    make references to all group members.

     Any proxyuser object, regardless of type, may have the  fol-
     lowing optional attributes:

     DESCRIPTION="desc"
          Specifies a plain-text description string  desc  to  be
          associated with the user entry.

     OTHER='nativeargs'
          Allows for other arguments to be  given  and  retained.
          nativeargs is a string in the native-mode syntax.



                   Last change: 20 April 1999                   2






File Formats                                         proxyuser(4)



SEE ALSO
     ssadm-edit(1M), authuser(4)





















































                   Last change: 20 April 1999                   3



