strongSwan

h1. openac



*openac* is intended to be used by an _Authorization Authority (AA)_ to generate and sign X.509 attribute
certificates. Currently only the inclusion of _group attributes_ is supported. An attribute certificate is linked
to a holder by including the issuer and serial number of the holder's X.509 certificate.



h3. Parameters



The following command line options are supported:

--help
p(. _--help_
display the usage message.

--version
p(. _--version_
display the version of _openac_.

--optionsfrom <filename>
p(. _--optionsfrom <filename>_
adds the contents of the file to the argument list. If _<filename>_ is a relative path then the
file is searched in the _/etc/openac_ directory.

--debug <level>
p(. _--debug <level>_
sets the debug level to 0 (none), 1 (normal), 2 (more), 3 (raw), and 4 (private), the default level being 1.

--quiet
p(. _--quiet_
By default _openac_ logs all control output both to syslog and stderr. With the --quiet _--quiet_ option no
output is written to stderr.

--days <days>
p(. _--days <days>_
Validity of the X.509 attribute certificate in days. If neither the --days _--days_ nor the --hours _--hours_ option
is specified then a default validity interval of 1 day is assumed. The --days _--days_ option can be
combined with the --hours _--hours_ option.

--hours <hours>
p(. _--hours <hours>_
Validity of the X.509 attribute certificate in hours. If neither the --hours _--hours_ nor the --days _--days_ option
is specified then a default validity interval of 24 hours is assumed. The --hours _--hours_ option can be
combined with the --days _--days_ option.

--startdate YYYYMMDDHHMMSSZ
p(. _--startdate YYYYMMDDHHMMSSZ_
defines the _notBefore_ date when the X.509 attribute certificate becomes valid. The date _YYYYMMDDHHMMSS_
must be specified in UTC (Zulu time). If the --startdate _--startdate_ option is not specified then
the current time is taken as a default.

--stopdate YYYYMMDDHHMMSSZ
p(. _--stopdate YYYYMMDDHHMMSSZ_
defines the _notAfter_ date when the X.509 attribute certificate will expire. The date _YYYYMMDDHHMMSS_
must be specified in UTC (Zulu time). If the --stopdate _--stopdate_ option is not specified then the default
_notAfter_ value is computed by adding the validity interval specified by the --days _--days_ and/or
--days _--days_ options to the _notBefore_ date.

--cert <certfile>
p(. _--cert <certfile>_
specifies the file containing the X.509 certificate of the Authorization Authority.
Thanks to the automatic format recognition the certificate can be stored either in PEM or DER format.

--key <keyfile>
p(. _--key <keyfile>_
specifies the encrypted file containing the private RSA key of the Authoritzation Authority.
The private key is stored in PKCS#1 format.

--password <password>
p(. _--password <password>_
specifies the password with which the private RSA keyfile defined by the --key _--key_ option has been
protected. If the option is missing then the password is prompted for on the command line.

--usercert <certfile>
p(. _--usercert <certfile>_
specifies file containing the X.509 certificate of the user to which the generated attribute
certificate will apply. Thanks to the automatic format recognition the certificate file can be
stored either in PEM or DER format.

--groups <attr1>,<attr2>
p(. _--groups <attr1>,<attr2>_
specifies a comma-separated list of _group attributes_ that will go into the X.509 attribute
certificate.

--out _--out <filename>
p(.
specifies the file where the generated X.509 attribute certificate will be stored to in binary
DER format.



h3. Examples



Common options can be stored in a file and be loaded via the --optionsfrom _--optionsfrom_ parameter:
<pre>

moon# cat /etc/openac/default.conf
--cert /etc/ipsec.d/aacerts/aaCert.pem
--key /etc/openac/aaKey.pem
--hours 8
</pre>



First the attribute certificate for _carol_ is generated. She is member of the
_Research_ group.
<pre>

moon# ipsec openac --optionsfrom default.conf --usercert /etc/openac/carolCert.pem \
--groups Research --out /etc/ipsec.d/acerts/carolAC.pem
loaded private key file '/etc/openac/aaKey.pem' (1675 bytes)
loaded signer cert file '/etc/ipsec.d/aacerts/aaCert.pem' (1505 bytes)
loaded user cert file '/etc/openac/carolCert.pem' (1493 bytes)
file '/etc/openac/serial' does not exist yet - serial number set to 01
written attribute cert file '/etc/ipsec.d/acerts/carolAC.pem' (784 bytes)
serial number is 01
</pre>



The second attribute certificate is issued to _dave_ who belongs to the _Sales_
and _Accounting_ groups.
<pre>

moon# ipsec openac --optionsfrom default.conf --usercert /etc/openac/daveCert.pem \
--groups "Sales, Accounting" --out /etc/ipsec.d/acerts/daveAC.pem
loaded private key file '/etc/openac/aaKey.pem' (1675 bytes)
loaded signer cert file '/etc/ipsec.d/aacerts/aaCert.pem' (1505 bytes)
loaded user cert file '/etc/openac/daveCert.pem' (1493 bytes)
written attribute cert file '/etc/ipsec.d/acerts/daveAC.pem' (787 bytes)
serial number is 02
</pre>