NAME

nisaddcred − create NIS+ credentials

SYNOPSIS

nisaddcred [ −p principal ] [ −P nis_principal ] [ domain_name ] auth_type

nisaddcred −r nis_principal

AVAILABILITY

SUNWnisu

DESCRIPTION

The nisaddcred command is used to create security credentials for NIS+ principals. 

When the nisaddcred command is run these credentials get created and stored in a table named cred.org_dir in the default NIS+ domain.  If domain_name is specified, the entries are stored in the cred.org_dir of the specified domain.  Note that this is applicable only for the host NIS+ principal names and not for normal users. 

NIS+ credentials serve two purposes. The first is to provide authentication information to various services; the second is to map the authentication service name into a NIS+ principal name. 

NIS+ principal names are used in specifying clients that have access rights to NIS+ objects.  See nischmod(1), nischown(1), nis_objects(3N), and nis_groups(3N).  Various other services can also implement access control based on these principal names. 

The cred.org_dir table is organized as follows :

The cname column contains a canonical representation of the NIS+ principal name.  By convention, this name is the login name of a user, or the host name of a machine, followed by a dot (“.”) followed by the fully qualified “home” domain of that principal.  For users the home domain is defined to be the domain where their password record is kept, for hosts their home domain is defined to be the domain name returned by the domainname(1M) command executed on that host. 

There are two types of entries in the cred.org_dir table.  Those with authentication type LOCAL, and those with authentication type DES. 

Entries of type LOCAL are used by the NIS+ service to determine the correspondence between fully qualified NIS+ principal names and users identified by UIDs in the domain containing the cred.org_dir table.  This correspondence is required when associating requests made using the AUTH_SYS RPC authentication flavor (see rpc_clnt_auth(3N)) to a NIS+ principal name.  It is also required for mapping a UID in one domain to its fully qualified NIS+ principal name whose home domain may be elsewhere.  The principal’s credentials for any authentication flavor may then be sought for within the cred.org_dir table in the principal’s home domain (extracted from the principal name).  The same NIS+ principal may have LOCAL credential entries in more than one domain. 

The auth_name associated with the LOCAL type entry is a UID that is valid for the principal in the domain containing the cred.org_dir table.  This may differ from that in the principal’s home domain.  The public information stored in public_data for this type contains a list of GIDs for groups in which the user is a member.  The GIDs also apply to the domain in which the table resides.  There is no private data associated with this type.  Neither a UID nor a principal name should appear more than once among the LOCAL entries in any one cred.org_dir table. 

The DES authentication type is used for the AUTH_DES flavor of Secure RPC authentication (see secure_rpc(3N)). 

The authentication name associated with the AUTH_DES flavor is a Secure RPC netname. A Secure RPC netname has the form unix.id@domain, where domain must be the same as the domain of the principal.  For principals that are users the id must be the UID of the principal in the principal’s home domain.  For principals that are hosts, the id is the host’s name.  In Secure RPC, processes running under effective UID 0 (root) are identified with the host principal.  Unlike LOCAL, there cannot be more than one DES credential entry for one NIS+ principal in the NIS+ namespace. 

The public information in an entry of authentication type DES is the public key for the principal.  The private information in this entry is the private key of the principal encrypted by the principal’s network password. 

Clients of NIS+ should have credentials of both types in their home domain.  In addition, a principal must have a LOCAL entry in the cred.org_dir table of each domain from which the principal wishes to make authenticated requests.  A client of NIS+ that makes a request from a domain in which it does not have a LOCAL entry will be unable to acquire AUTH_DES credentials.  A NIS+ service running at security level 2 or higher will consider such users unauthenticated and assign them the name nobody for determining access rights. 

This command can only be run by those NIS+ principals who are authorized to add or delete the entries in the that cred table. 

OPTIONS

−p principal Use the principal name principal to fill the auth_name field for this entry.  For LOCAL credentials, the name supplied with this option should be a string specifying a UID .  For DES credentials, the name should be a Secure RPC netname of the form unix.id@domain, as described earlier.   If the −p option is not specified, the auth_name field is constructed from the effective UID of the current process and the name of the local domain. 

−P nis_principal
Use the NIS+ principal name nis_principal.  This option should be used when creating LOCAL credentials for users whose home domain is different than the local machine’s default domain.  Whenever the −P option is not specified, nisaddcred constructs a principal name for the entry as follows.  When it is not creating an entry of type LOCAL, nisaddcred calls nis_local_principal, which looks for an existing LOCAL entry for the effective UID of the current process in the cred.org_dir table and uses the associated principal name for the new entry.  To avoid circularity, when creating of an entry of authentication type LOCAL, nisaddcred constructs a default NIS+ principal name by taking the login name of the effective UID for its own process, and appending to it a dot (“.”) followed by the local machine’s default domain. 

−r Remove all credentials associated with the principal nis_principal from the cred.org_dir table.  This option can be used when removing a client or user from the system. 

EXIT CODES

This command returns 0 on success and 1 on failure. 

EXAMPLES

In their home domain, users of NIS+ should have both types of credential. These can be set up by executing the nisaddcred command in this sequence. 

example% nisaddcred local
example% nisaddcred des
Network password:
Reenter password:
example% keylogin
Network Password:

The system administrator can add a DES credential for a user, using this example:

example% nisaddcred −p unix.2970@some.domain −P fredw.some.domain. des

Here, 2970 is the UID assigned to the user, fredw, some.domain comes from the user’s home domain, and fredw comes from the password file. 

Note that the secure RPC netname does not end with a dot (“.”) while the NIS+ principal name (specified with the −P option) does.  This command should be executed from a machine in the same domain. 

The following example would add a LOCAL entry with a UID 2970 for the NIS+ principal name fredw.some.domain. 

example% nisaddcred −p 2970 −P fredw.some.domain. local

Note that credentials are always added in the cred.org_dir table in the domain where nisaddcred is run, unless domainname is specified as the last parameter on the command line.  If credentials are being added from the domain server for its clients, then domainname should be specified. 

The following example would add a LOCAL entry with the UID of the current user and the NIS+ principal name of tony.some.other.domain. 

example% nisaddcred −P tony.some.other.domain. local

You can list all of the cred entries for a particular principal with nismatch(1). 

SEE ALSO

chkey(1), keylogin(1), nischmod(1), nischown(1), nismatch(1), nistbladm(1), nis_local_names(3N), rpc_clnt_auth(3N), secure_rpc(3N), nis_objects(3N), nis_groups(3N)

NOTES

The cred.org_dir NIS+ table replaces the maps publickey.byname and netid.byname used in NIS (YP). 

SunOS 5.1  —  Last change: 25 Sep 1992