


File Formats                                          authuser(4)



NAME
     authuser - authorized user object for  SunScreen  configura-
     tion

DESCRIPTION
     An authuser object is one of the data objects which  defines
     a SunScreen configuration.  It is manipulated via the confi-
     guration editor or SunScreen administration  GUI.   authuser
     objects  are  the  repositories for authentication and demo-
     graphic information used to identify individual users.  This
     information  is  used  to  authenticate  users  by SunScreen
     access control facilities.

OBJECT STRUCTURE
     authuser objects  store  information  describing  individual
     users of interest to various SunScreen access control facil-
     ities.  The data contained  within  its  entries  fall  into
     three general groups: authentication, demographics, and con-
     trol.

     Each authuser object has a name.  The name may  not  contain
     "!",  "#", "$", "%", "^", "&", "*", "{", "}", "[", "]", "<",
     ">", """, "\", "?", "`", "/", "@", or NUL characters.  Names
     can  be  administrator-chosen  to  coincide  with  existing,
     real-world   naming   schemes   for   individuals.     Thus,
     "harold.bovis",  "Sally  Ann  Studebaker", and "Rundum, Karr
     Bo" are all examples  of  legitimate  authuser  names.   The
     namespace  of  the  authusers is disjoint from all others in
     the SunScreen.  (In particular, authuser names are different
     from those that name proxyuser objects.)

     Authentication information is employed by the processing  in
     the  SunScreen  to confirm the identity of a potential user.
     Three types of authentication are  supported:  simple  pass-
     word,  SecurID(R),  and  RADIUS.  RADIUS authentication does
     not (yet) utilize authuser objects.  A given user object can
     specify  the  use  of  either or both of the other two types
     simultaneously.  Authentication processing attempts to match
     any password or passcode entered against each type specified
     in the order present within the entry's record.

     (The preceding statement is true within  some  limits.   For
     example,  a  password  that  cannot  possibly  be  a SecurID
     passcode will never be presented to that mechanism  even  if
     SecurID  is  specified.   If  you  use  the SecurID type, it
     should be given after all other types.)

     Note also that the Java-based graphical configuration  tools
     allow for only a single, simple password type and/or a Secu-
     rID type, in that order.  Both the authuser objects and  the
     SunScreen  authentication  processing allow multiple, simple
     password types to be specified, and each will  be  tried  in



                   Last change: 20 April 1999                   1






File Formats                                          authuser(4)



     the  order  present.  However, entries with multiple, simple
     password types will not be properly displayed or  edited  by
     the Java-based tools.)

     Demographic information stored in authuser objects  is  used
     to  better  identify users and to improve and possibly auto-
     mate user contact.


     DESCRIPTION="desc"
          Specifies a plain-text description string  desc  to  be
          associated with the user entry.

     REAL_NAME="namestr"
          Specifies an optional real name string to be associated
          with the authuser object.

     CONTACT_INFO="contactstr"
          Specifies an optional contact information string to  be
          associated  with  the  authuser object (for example, e-
          mail address).

     OTHER='nativeargs'
          Allows for other arguments to be  given  and  retained.
          nativeargs is a string in the native-mode syntax.

   There are control items which are used by  the  authentication
   logic  to  restrict processing, etc.  Each authentication item
   may have an individual enablement  tag,  which  determines  if
   that  particular  item  is to be processed.  The entire object
   also has such an enablement tag, allowing a user's entry to be
   turned-off  without  deleting it.  (Technically, the structure
   which stores the name is also a control item.)

     ENABLED
          Allows  authentication  processing  to  consider   this
          user's  entry.   This  is  the default.  (See also DIS-
          ABLED.)

     DISABLED
          Disallows authentication  processing  from  considering
          this user's entry.

     PASSWORD={ "pwd" pwdarg ... }
          Specifies a simple  password  method  to  be  used  for
          authentication.  The pwd field is the user password, in
          plain-text.  The processing for  the  PASSWORD  keyword
          automatically  translates  this  string from plain-text
          into crypto-text, and causes a CRYPT_PASSWORD  sub-item
          to  represent pwd.  Thereafter, the plain-text password
          will  be  displayed  as  an  empty  string,  with   the
          CRYPT_PASSWORD sub-item retaining the password.



                   Last change: 20 April 1999                   2






File Formats                                          authuser(4)



          The sub-items given for pwdargs can be:

          CRYPT_PASSWORD="cryptpwd"
               The DES-encrypted version of the user's  password.
               This  value  retains  the  password in a form that
               avoids its compromise.  When presenting this value
               to  the add verb, the value of pwd should be empty
               ("").  (The password encryption mechanism  is  the
               same  one  used  by  Solaris' native user password
               scheme.)

          VALID_START=startntp
               Gives  the  time  at  which  this  password  entry
               becomes  valid  for  use.  startntp is an unsigned
               long  integer  in  NTP  time.   This  sub-item  is
               optional; the default is that the entry has always
               been valid.

          VALID_END=endntp
               Gives  the  time  at  which  this  password  entry
               becomes  invalid  for  use.  endntp is an unsigned
               long  integer  in  NTP  time.   This  sub-item  is
               optional;  the  default  is  that  the  entry will
               always be valid.

          OTHER='nativeargs'
               Allows  for  other  arguments  to  be  given   and
               retained.   nativeargs  is a string in the native-
               mode syntax.

          ENABLED
               Allows authentication  processing  to  attempt  to
               match  this  password  item.  This is the default.
               (See also DISABLED immediately below.)

          DISABLED
               Disallows authentication processing from  attempt-
               ing to match this password item.

     SECURID={ "sidname" sidarg ... } Specifies a SecurID  method
     to be used for authentication.  The sidname is the string in
     the "login:" or  "Default  login:"   field  in  the  SecurID
     server entry for this user.

          The sub-items given within sidargs can be:

          OTHER='nativeargs'
               Allows  for  other  arguments  to  be  given   and
               retained.   nativeargs  is a string in the native-
               mode syntax.

          ENABLED



                   Last change: 20 April 1999                   3






File Formats                                          authuser(4)



               Allows authentication  processing  to  attempt  to
               match  this  SecurID  item.   This is the default.
               (See also DISABLED immediately below.)

          DISABLED
               Disallows authentication processing from  attempt-
               ing to match this SecurID item.

SEE ALSO
     ssadm-edit(1M),   accesslocal(4),   accessremote(4),   prox-
     yuser(4)












































                   Last change: 20 April 1999                   4



