DACSAUTH(1)                  DACS Commands Manual                  DACSAUTH(1)



[1mNAME[0m
       dacsauth - authentication check

[1mSYNOPSIS[0m
       [1mdacsauth [22m[[1m-m [4m[22mauth-module-spec[24m] [...] [[1m-r [4m[22mroles-module-spec[24m] [...]
                [[1m-D[4m[22mdirective[24m[1m=[4m[22mvalue[24m] [[1m-aux[22m]
                [[1m-fj [4m[22mjurname[24m] [[1m-fn [4m[22mfedname[24m] [[1m-h [22m| [1m-help[22m] [[1m-id[22m] [[1m-ll [4m[22mlog_level[24m]
                [[1m-p [4m[22mpassword[24m]
                [[1m-pf [4m[22mfile[24m] [[1m-prompt[22m] [[1m-promptwith [4m[22mprompt[24m] [[1m-q[22m]
                [{[1m-u [22m| [1m-user[22m} [4musername[24m] [[1m-v[22m]

       [1mdacsauth -modules[0m

       [1mdacsauth --version[0m

[1mDESCRIPTION[0m
       This program is part of the [1mDACS [22msuite.

       The [1mdacsauth [22mutility tests whether given authentication material
       satisfies authentication requirements and indicates the outcome through
       the process's exit status. It is similar to [34m[1mdacs_authenticate(8)[0m[1m[22m[1] and
       [34m[1mdacscred(1)[0m[1m[22m[2].

       [1mdacsauth [22mprovides a way for scripts and other programs to leverage the
       [1mDACS [22mauthentication infrastructure. They might use successful
       authentication as a coarse form of authorization; only a user that
       provides a correct password might be allowed to run the program, for
       instance. Or they might return some type of credentials after
       successful authentication, or perhaps use [34m[1mdacs_auth_agent(8)[0m[1m[22m[3] to
       return [1mDACS [22mcredentials.

       [1mdacsauth [22mcan also be used to retrieve role information associated with
       a given user.

       [1mdacsauth [22mdoes not read any [1mDACS [22mconfiguration files. Everything needed
       to perform the test must be specified as an argument.

           [1mTip[0m
           If [1mdacsauth [22muses a built-in module to perform authentication, or
           look up roles, [4mno[24m [4mserver[24m [4mcomponent[24m [4mis[24m [4mrequired[24m. This means that you
           can use [1mdacsauth [22mwithout having to access or even configure a web
           server, including Apache.

[1mOPTIONS[0m
       The following command line flags are recognized. At least one [1m-m [22mflag
       (to perform authentication testing), or at least one [1m-r [22mflag must be
       specified (to form a role descriptor string for the identity and print
       it to stdout). A combination of both flags is allowed, in which case a
       role descriptor string is output only if the authentication test is
       successful.

       [1m-D[4m[22mdirective[24m[1m=[4m[22mvalue[0m
           This is equivalent to setting [4mdirective[24m, a general [1mDACS[0m
           configuration directive, to [4mvalue[24m. See [34m[1mdacs.conf(5)[0m[1m[22m[4].

       [1m-aux[0m
           The next string provided by the [1m-p[22m, [1m-pf[22m, [1m-prompt[22m, or [1m-promptwith[0m
           flag will be the value of the [4mAUXILIARY[24m authentication argument.
           This provides a secure way to pass sensitive auxiliary information,
           such as a PIN, to the program. A flag to obtain the password, if
           any, must precede this flag on the command line.

       [1m-fj [4m[22mjurname[0m
           Use [4mjurname[24m, which must be syntactically valid, as the jurisdiction
           name. If required but not provided, a value derived from the host's
           domain name will be used.

       [1m-fn [4m[22mfedname[0m
           Use [4mfedname[24m, which must be syntactically valid, as the federation
           name. If required but not provided, a value derived from the host's
           domain name will be used.

       [1m-h[0m
       [1m-help[0m
           Display a help message and exit.

       [1m-id[0m
           If successful, print the authenticated [1mDACS [22midentity to the
           standard output.

       [1m-ll [4m[22mlog_level[0m
           Set the debugging output level to [4mlog_level[24m (see [34m[1mdacs(1)[0m[1m[22m[5]). The
           default level is warn.

       [1m-m [4m[22mauth-module-spec[0m
           Each type of authentication test that is required is described by
           an [4mauth-module-spec[24m that immediately follows the [1m-m [22mflag. Each
           [4mauth-module-spec[24m is essentially an alternate representation of an
           [34m[1mAuth clause[0m[1m[22m[6] and its directives, which are used by
           [34m[1mdacs_authenticate(8)[0m[1m[22m[1]. Just as the order in which Auth clauses
           appear in a [1mDACS [22mconfiguration file, the order in which the [1m-m[0m
           flags appear may be significant, depending on the [4mcontrol[24m keywords.
           During processing, successive [1m-m [22mcomponents are automatically
           assigned names, auth_module_1, auth_module_2, and so on, mainly for
           error reporting purposes.

           An [4mauth-module-spec[24m has the following syntax:

           The [4mmodule[24m begins with either the name of a built-in module, or a
           valid abbreviation thereof, or the (absolute) URL of an external
           authentication module (equivalent to the [34m[1mURL[0m[1m[22m[7] directive). Next
           must appear a recognized authentication style keyword specifier
           (equivalent to the [34m[1mSTYLE[0m[1m[22m[8] directive). Next, the [4mcontrol[24m keyword
           follows, which is identical to the [34m[1mCONTROL[0m[1m[22m[9] directive in the Auth
           clause. After the [4mcontrol[24m keyword, the flags described below may
           follow, in any order.

           An [4mauth-module-spec[24m ends when the first invalid flag (or the end of
           flags) is encountered.

           The [1m-O [22mflag is equivalent to an [34m[1mOPTION[0m[1m[22m[10] directive.

           The [1m-Of [22mflag is followed by the name of a file from which to read
           options, one per line, in the format [4mname[24m=[4mvalue[24m. Blank lines and
           lines beginning with a '#' are ignored. These lines do not begin
           with "-O" and quotes are simply copied and not interpreted. A line
           can be continued by ending it with a backslash. The [1m-Of [22mflag can be
           used to avoid putting passwords on the command line and makes it
           easier to write expressions that would otherwise have to be
           carefully escaped to prevent interpretation by the shell.

           The [1m-expr [22mflag is equivalent to the [34m[1mEXPR[0m[1m[22m[11] directive. The [1m-vfs[0m
           flag is used to configure [34m[1mVFS[0m[1m[22m[12] directives required by this
           module.

       [1m-modules[0m
           Display a list of built-in authentication modules and roles
           modules, one per line, and then exit. The canonical module name is
           printed, followed by zero or more equivalent abbreviations. For
           authentication modules, the authentication style is shown. To list
           the available modules, run the command:

               % dacsauth -modules

           The set of available (enabled) built-in authentication and roles
           modules is determined when [1mDACS [22mis built.

       [1m-p [4m[22mpassword[0m
           Specify the password to use (equivalent to the [4mPASSWORD[24m argument to
           [1mdacs_authenticate[22m).

               [1mSecurity[0m
               A password given on the command line may be visible to other
               users on the same system.

       [1m-pf [4m[22mfile[0m
           Read the password to use from [4mfile[24m (equivalent to the [4mPASSWORD[0m
           argument to [1mdacs_authenticate[22m). If [4mfile[24m is "-", then the password
           is read from the standard input without prompting.

       [1m-prompt[0m
           Prompt for the password and read it from stdin (equivalent to the
           [4mPASSWORD[24m argument to [1mdacs_authenticate[22m). The password is not
           echoed.

       [1m-promptwith [4m[22mprompt[0m
           Prompt for the password using the given string ([4mprompt[24m) and read it
           from stdin (equivalent to the [4mPASSWORD[24m argument to
           [1mdacs_authenticate[22m). The password is not echoed.

       [1m-q[0m
           Be more quiet by reducing the debugging output level.

       [1m-r [4m[22mrole-module-spec[0m
           Roles for [4musername[24m can be determined by giving this flag, which is
           immediately followed by a [4mroles-module-spec[24m. The [1m-r [22mflag may be
           repeated, and the resulting roles are combined. Each
           [4mroles-module-spec[24m is essentially an alternate representation of a
           Roles clause that is used by [34m[1mdacs_authenticate(8)[0m[1m[22m[13]. Successive
           [1m-r [22mcomponents are assigned names, roles_module_1, roles_module_2,
           and so on, mainly for error reporting purposes.

           A [4mroles-module-spec[24m has the following syntax: The [4mmodule[24m component
           is equivalent to the Roles clause's [34m[1mURL[0m[1m[22m[14] directive and is either
           the name of an available built-in roles module, a valid
           abbreviation thereof, or the (absolute) URL of an external roles
           module.

           Flags may follow the [4mmodule[24m component, in any order. A
           [4mroles-module-spec[24m ends when the first invalid flag (or the end of
           flags) is encountered.

           The [1m-O [22mflag is equivalent to an [34m[1mOPTION[0m[1m[22m[10] directive.

           The [1m-Of [22mflag is followed by an argument that is the name of a file
           from which to read options, one per line, in the format [4mname[24m=[4mvalue[24m.
           Blank lines and lines beginning with a '#' are ignored; note that
           these lines do not begin with "-O" and quotes are simply copied and
           not interpreted. The [1m-Of [22mflag can be used to avoid putting
           passwords on the command line and makes it easier to write
           expressions that would otherwise have to be carefully escaped to
           prevent interpretation by the shell, for example.

           The [1m-expr [22mflag is equivalent to the [34m[1mEXPR[0m[1m[22m[11] directive. The [1m-vfs[0m
           flag is used to configure [34m[1mVFS[0m[1m[22m[12] directives required by [4mmodule[24m.

       [1m-u [4m[22musername[0m
       [1m-user [4m[22musername[0m
           The username to authenticate against (equivalent to the [4mUSERNAME[0m
           argument to [1mdacs_authenticate[22m). This username is implicitly
           associated with the effective federation and jurisdiction (see the
           [34m[1m-fn[0m[1m[22m[15] and [34m[1m-fj[0m[1m[22m[16] flags).

       [1m-v[0m
           The [1m-v [22mflag bumps the debugging output level to debug or (if
           repeated) trace.

       [1m--version[0m
           Display the program's version information and then exit.

[1mEXAMPLES[0m
           [1mSecurity[0m
           If [1mdacsauth [22muses a built-in module to perform authentication, it
           must run setuid or setgid to obtain sufficient privileges to access
           the required password file (the same is true for built-in roles
           modules). If it uses an external module, that module will need to
           execute with sufficient privileges to access [1mDACS [22mcryptographic
           keys, specifically federation_keys and possibly [1mDACS [22mor system
           password files; the external module will then need to execute with
           sufficient privileges to access any files it requires.

           Be sure to use the federation_keys that are correct for your
           federation. Referencing authentication modules in two or more
           federations will probably not work.

           [1mdacsauth [22mshould therefore not ordinarily run as the UID of the user
           that invokes it (unless that happens to be root) because it will
           not be able to access the information it requires. This will also
           prevent a user from "cheating" (e.g., by attaching to the running
           module with a debugger).

           [1mNote[0m
           Examples in this section that involve NTLM and LDAP were tested
           against Windows Server 2012. Names and URLs will likely be
           different on your system. Refer to the descriptions of
           [34m[1mlocal_ldap_authenticate[0m[1m[22m[17] and [34m[1mlocal_ldap_roles[0m[1m[22m[18] for additional
           information.

       This example authenticates user "bobo" with password "test" against the
       [1mDACS [22mpassword file /usr/local/dacs/conf/passwd:

           % dacsauth -m passwd passwd required
             -vfs "[passwds]dacs-kwv-fs:/usr/local/dacs/conf/passwd" -q -u bobo -p test

       If the command's exit status is zero, the authentication test
       succeeded, otherwise it failed.

       The following example attempts to authenticate "bobo" against her Unix
       password file. The program prompts for the password. It will probably
       need to be run as root.

           % sudo dacsauth -m unix passwd required -u bobo -prompt

       In the next example, [1mdacsauth [22mattempts to authenticate "bobo" via NTLM
       on winders.example.com:

           % dacsauth -m ntlm passwd suff -OSAMBA_SERVER="winders.example.com" \
               -prompt -u bobo

       This example is similar to the previous one, except that an external
       authentication module is used and the password is read from a file.
       Because of the external module, additional configuration must be
       provided; in particular, the location of federation_keys and the
       federation and jurisdiction names must be specified.

           % dacsauth -m https://example.example.com/cgi-bin/dacs/local_ntlm_authenticate \
              passwd sufficient -OSAMBA_SERVER="winders.example.com" \
             -fn EXAMPLE -fj FEDROOT -u bobo -pf mypass \
             -DVFS="[federation_keys]dacs-fs:/usr/local/dacs/federations/example/federation_keys"

       To authenticate "bobo" via a RADIUS server, a command line similar to
       this might be used:

           % dacsauth -m radius passwd required -ORADIUS_SERVER=radius.example.com -ORADIUS_SECRET=testing123 -u bobo -p hello

       To authenticate against the [34m[1mGoogle[0m[1m[22m[19](TM) account nobody@gmail.com,
       one might use:

           % dacsauth -m http passwd suff \
             -OAUTH_URL="https://www.google.com/accounts/ClientLogin" \
             -OUSERNAME_PARAMETER=Email -OPASSWORD_PARAMETER=Passwd \
             -Oservice=xapi -Osource=DSS-DACS-1.4 -prompt -u nobody@gmail.com

       In the following example, an expression is evaluated to determine
       whether authentication should succeed. The user ("bobo") is prompted
       for a password. Only if the string "foo" is given will authentication
       succeed. A more realistic example might call another program to help
       make the determination, for instance.

           % dacsauth -m expr expr suffi \
            -expr '${Args::PASSWORD} eq "foo" ? ${Args::USERNAME} : ""' \
               -user bobo -prompt

       Authentication against an Apache [1mhtdigest [22mpassword file is performed in
       the following example, where the password is read from stdin:

           % echo "test" | dacsauth -m apache digest sufficient \
             -OAUTH_MODULE=mod_auth_digest \
             -OAUTH_FILE=/usr/local/apache2/conf/passwords.digest \
             -OAUTH_REALM="DACS Digest Auth Area" \
             -u bobo -pf -

       Authentication via the PAM module works differently than the other
       modules - and is more complicated to use - because [1mdacsauth [22mmay need to
       be run several times, depending on what information PAM requires.
       Instead of returning a yes/no decision, [1mdacsauth [22mmay print prompts for
       more information to stdout. Please review the operational details
       presented in [34m[1mdacs_authenticate(8)[0m[1m[22m[20] and [34m[1mpamd(8)[0m[1m[22m[21] before attempting
       to use this module.

       The following example demonstrates use of the module from the command
       line. Once the basic ideas are understood, it should be apparent how to
       write a script to performed the necessary iterations. Details in the
       example, such as paths, may need to be adjusted for your environment.
       Note that in this example the username is not specified the first time
       [1mdacsauth [22mis run, although it could be if it were known.

           % dacsauth -m pam prompted suffic \
            -vfs "[federation_keys]dacs-fs:/usr/local/dacs/federations/dss/federation_keys" \
            -OPAMD_HOST=localhost -OPAMD_PORT=dacs-pamd -fj EXAMPLE -fn TEST
           AUTH_PROMPT_VAR1="Login:"
           AUTH_TRANSID="10.0.0.124:57849:85748:9997c5588a6239e3"
           % dacsauth -m pam prompted suffic \
            -vfs "[federation_keys]dacs-fs:/usr/local/dacs/federations/dss/federation_keys" \
            -OAUTH_PROMPT_VAR1="bobo" \
            -OAUTH_TRANSID="10.0.0.124:57849:85748:9997c5588a6239e3"-fj EXAMPLE -fn TEST
           AUTH_PROMPT_VAR2="Password:"
           AUTH_TRANSID="10.0.0.124:52188:88417:5ffb0015f21ea546"
           % dacsauth -m pam prompted suffic \
            -vfs "[federation_keys]dacs-fs:/usr/local/dacs/federations/dss/federation_keys" \
            -OAUTH_PROMPT_VAR2="apassword" \
            -OAUTH_TRANSID="10.0.0.124:57849:85748:9997c5588a6239e3"-fj EXAMPLE -fn TEST

       The first time [1mdacsauth [22mis run in the example it returns a prompt for
       the username ("Login:") that is associated with the transaction
       variable [4mAUTH_PROMPT_VAR1[24m and a transaction identifier ([4mAUTH_TRANSID[24m).
       The latter must be passed to the subsequent executions of [1mdacsauth[22m. The
       second run of [1mdacsauth [22mpasses the username ("bobo") and returns another
       prompt ("Password:") that is associated with the transaction variable
       [4mAUTH_PROMPT_VAR2[24m. The third run passes the password ("apassword") but
       no prompt is returned, indicating that the session is complete and the
       program's exit status reflects the outcome of authentication.

           [1mTip[0m
           Whether [1mdacsauth [22mrequires a password to retrieve roles depends on
           the particular roles module being used. For example, a password is
           not required by [34m[1mlocal_unix_roles[0m[1m[22m[22] or [34m[1mlocal_roles[0m[1m[22m[23] to obtain
           roles, but [34m[1mlocal_ldap_roles[0m[1m[22m[18] will probably need a password to
           bind to the directory and obtain roles.

       This example prints the role string for user "bobo" by calling the
       built-in [34m[1mlocal_unix_roles[0m[1m[22m[22] module:

           % dacsauth -r unix -u bobo
           bobo,wheel,www,users

       The next example is similar to the previous one, except an external
       roles module is used:

           % dacsauth -r https://example.example.com/cgi-bin/dacs/local_unix_roles \
             -DVFS="[federation_keys]dacs-fs:/usr/local/dacs/federations/federation_keys" \
             -fn EXAMPLE -u bobo
           bobo,wheel,www,users

       The external roles module might be executed on a different host than
       the one running [1mdacsauth[22m. Provided [1mdacsauth [22mhas been installed and a
       matching federation_keys file is available on the local host, the local
       host need not be a [1mDACS [22mjurisdiction or have any other [1mDACS[0m
       configuration.

       The following example prints the [34m[1mrole string[0m[1m[22m[24] for user "bobo"
       (sAMAccountName), known within the directory by the Common Name "Bobo
       Baggins", using the (external) [34m[1mlocal_ldap_roles[0m[1m[22m[18] module and the
       "direct" binding method:

           % dacsauth -r https://example.example.com/cgi-bin/dacs/local_ldap_roles \
               -Of /usr/local/dacs/ldap_roles_options_direct -u "bobo" \
               -DVFS="[federation_keys]dacs-fs:/usr/local/dacs/federations/federation_keys" \
                -fn EXAMPLE -fj FEDROOT -prompt
           Password?
           RA_AllowMediaAccess,WSSUsers,RA_AllowHomePageLinks,RA_AllowAddInAccess,RA_AllowComputerAccess,RA_AllowRemoteAccess

       Because there would be a lot of flags to place on the command line, the
       options that are needed in this example are instead read from a file
       that is specified using the [1m-Of [22mflag. This is also a more secure way to
       pass passwords to the program. Ensure that access to the file is
       restricted appropriately. In this example, the file
       /usr/local/dacs/ldap_roles_options_direct might contain configuration
       such as this:

           LDAP_BIND_METHOD=direct
           LDAP_USERNAME_URL*="ldap://example.com/cn=" . encode(url, ${Args::DACS_USERNAME}) . ",cn=Users,dc=Example,dc=local"
           LDAP_USERNAME_EXPR*="${LDAP::sAMAccountName}"

           LDAP_ROLES_SELECTOR*="${LDAP::attrname}" eq "memberOf" ? strtr(ldap(rdn_attrvalue, \
               ldap(dn_index, "${LDAP::attrvalue}", 1)), " ", "_") : ""

       Notice that in this context the variable that denotes an authenticated
       username is referenced ([4m${Args::DACS_USERNAME}[24m) rather than the
       variable that denotes a purported username ([4m${Args::USERNAME}[24m).

       The following example is like the previous one, except that it uses the
       "indirect" binding method and therefore is not given the specific URL
       for the user:

           % dacsauth -r https://example.example.com/cgi-bin/dacs/local_ldap_roles \
               -Of /usr/local/dacs/ldap_roles_options_indirect -u bobo \
               -DVFS="[federation_keys]dacs-fs:/usr/local/dacs/federations/federation_keys" \
                -fn EXAMPLE -fj FEDROOT -p bobospassword
           RA_AllowMediaAccess,WSSUsers,RA_AllowHomePageLinks,RA_AllowAddInAccess,RA_AllowComputerAccess,RA_AllowRemoteAccess

       The file /usr/local/dacs/ldap_roles_options_indirect might contain
       configuration similar to this:

           LDAP_BIND_METHOD=indirect
           LDAP_ADMIN_URL=ldap://example.com/cn=admin,cn=Users,dc=Example,dc=local
           LDAP_ADMIN_PASSWORD=thESecreTAdmiNPassworD

           # Search under Users...
           LDAP_SEARCH_ROOT_DN=cn=Users,dc=Example,dc=local

           LDAP_SEARCH_FILTER*="(userPrincipalName=${Args::DACS_USERNAME}@Example.local)"

           LDAP_ROLES_SELECTOR*="${LDAP::attrname}" eq "memberOf" ? strtr(ldap(rdn_attrvalue, \
               ldap(dn_index, "${LDAP::attrvalue}", 1)), " ", "_") : ""

       Suppose one wanted to use [1mdacsauth [22mto authenticate a user via LDAP in a
       way analogous to this dacs.conf configuration:

           <Auth id="ldap">
           URL "http://example.example.com/cgi-bin/dacs/local_ldap_authenticate"
           STYLE "password,add_roles"
           CONTROL "required"
           LDAP_BIND_METHOD "direct"
           LDAP_USERNAME_URL* '"ldap://winders.example.com/cn=" . encode(url, ${Args::USERNAME}) . ",cn=Users,dc=example,dc=local"'
           LDAP_USERNAME_EXPR* '"${LDAP::sAMAccountName}"'
           LDAP_ROLES_SELECTOR* '"${LDAP::attrname}" eq "memberOf" \
               ? strtr(ldap(rdn_attrvalue, ldap(dn_index, "${LDAP::attrvalue}", 1)), " ", "_") : ""'
           </Auth>

       A file like this (e.g., /usr/local/dacs/ldap_auth_options_direct) would
       contain the following directives:

           LDAP_BIND_METHOD=direct
           LDAP_USERNAME_URL*="ldap://winders.example.com/cn=" . encode(url, ${Args::USERNAME}) . ",cn=Users,dc=example,dc=local"
           LDAP_USERNAME_EXPR*="${LDAP::sAMAccountName}"
           LDAP_ROLES_SELECTOR*="${LDAP::attrname}" eq "memberOf" \
               ? strtr(ldap(rdn_attrvalue, ldap(dn_index, "${LDAP::attrvalue}", 1)), " ", "_") : ""

       Authentication could then be performed using a command like this:

           % dacsauth -fj FEDROOT \
             -m http://example.example.com/cgi-bin/dacs/local_ldap_authenticate passwd suff \
             -Of /usr/local/dacs/ldap_auth_options_direct \
             -DVFS="[federation_keys]dacs-fs:/usr/local/dacs/federations/federation_keys" \
             -fn EXAMPLE -u bobo -prompt

       For indirect authentication, a configuration file similar to this could
       be used:

           LDAP_BIND_METHOD=indirect
           LDAP_USERNAME_EXPR*=regsub(${LDAP::userPrincipalName},"@.*","")

           LDAP_ADMIN_URL=ldap://winders.example.com/cn=admin,cn=Users,dc=example,dc=local
           LDAP_ADMIN_PASSWORD=MySecretAdminPasswordGoesHere
           LDAP_SEARCH_ROOT_DN=cn=Users,dc=Example,dc=local
           LDAP_SEARCH_FILTER*="(userPrincipalName=${Args::USERNAME}@Example.local)"

           LDAP_ROLES_SELECTOR*="${LDAP::attrname}" eq "memberOf" \
           ? strtr(ldap(rdn_attrvalue, ldap(dn_index, "${LDAP::attrvalue}", 1)), " ", "_") : ""


   [1mEnhancing SSH Security[0m
       The OpenSSH SSH daemon [34m[1msshd(8)[0m[1m[22m[25] provides a hook, executed after
       normal authentication, that allows an arbitrary command to be executed
       rather than the user's shell. Refer to the description of the
       ForceCommand and Match keywords in [34m[1msshd_config(5)[0m[1m[22m[26]. This feature can
       be used to insert [1mDACS [22mauthentication capabilities into [1msshd [22mfor users
       that sign on through [1mssh[22m. To do this, the ForceCommand keyword names a
       small program that runs [1mdacsauth[22m, which might prompt the user for an
       additional password or codeword, validate it, and return the result of
       authentication through its exit status. Depending on the result of
       authentication, the small program can execute the user's shell or other
       program. In a similar way, [34m[1mdacscheck(1)[0m[1m[22m[27] can be called by the small
       program to consult [1mDACS [22maccess control rules. Note that it seems that
       in some contexts the program run by ForceCommand cannot disable
       keyboard echo, which might make this approach inappropriate sometimes.

[1mDIAGNOSTICS[0m
       The program exits 0 if authentication was successful or with 1 if
       authentication failed or an error occurred.

[1mBUGS[0m
       This command only supplies partial support for interacting with
       [1mdacs_authenticate[22m. It may not be possible for an authentication module
       to return role information, as can be done by [1mdacs_authenticate[22m.

       It would be better if the [1m-m [22mflag were instead [1m-a [22m(for "authenticate").

[1mSEE ALSO[0m
       [34m[1mdacscred(1)[0m[1m[22m[2], [34m[1mdacs_authenticate(8)[0m[1m[22m[1], [34m[1mdacs.exprs(5)[0m[1m[22m[28]

[1mAUTHOR[0m
       Distributed Systems Software ([34m[1mwww.dss.ca[0m[1m[22m[29])

[1mCOPYING[0m
       Copyright (C) 2003-2018 Distributed Systems Software. See the
       [34m[1mLICENSE[0m[1m[22m[30] file that accompanies the distribution for licensing
       information.

[1mNOTES[0m
        1. dacs_authenticate(8)
           http://dacs.dss.ca/man/dacs_authenticate.8.html

        2. dacscred(1)
           http://dacs.dss.ca/man/dacscred.1.html

        3. dacs_auth_agent(8)
           http://dacs.dss.ca/man/dacs_auth_agent.8.html

        4. dacs.conf(5)
           http://dacs.dss.ca/man/dacs.conf.5.html

        5. dacs(1)
           http://dacs.dss.ca/man/dacs.1.html

        6. Auth clause
           http://dacs.dss.ca/man/dacs_authenticate.8.html#auth_clause

        7. URL
           http://dacs.dss.ca/man/dacs_authenticate.8.html#URL

        8. STYLE
           http://dacs.dss.ca/man/dacs_authenticate.8.html#STYLE

        9. CONTROL
           http://dacs.dss.ca/man/dacs_authenticate.8.html#CONTROL

       10. OPTION
           http://dacs.dss.ca/man/dacs_authenticate.8.html#OPTION

       11. EXPR
           http://dacs.dss.ca/man/dacs_authenticate.8.html#EXPR

       12. VFS
           http://dacs.dss.ca/man/dacs.conf.5.html#VFS

       13. dacs_authenticate(8)
           http://dacs.dss.ca/man/dacs_authenticate.8.html#roles_clause

       14. URL
           http://dacs.dss.ca/man/dacs_authenticate.8.html#r_URL

       15. -fn
           http://dacs.dss.ca/man/#fn_flag

       16. -fj
           http://dacs.dss.ca/man/#fj_flag

       17. local_ldap_authenticate
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_ldap_authenticate

       18. local_ldap_roles
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_ldap_roles

       19. Google
           http://www.google.com

       20. dacs_authenticate(8)
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_pam_authenticate

       21. pamd(8)
           http://dacs.dss.ca/man/pamd.8.html

       22. local_unix_roles
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_unix_roles

       23. local_roles
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_roles

       24. role string
           http://dacs.dss.ca/man/dacs.1.html#roles

       25. sshd(8)
           https://www.freebsd.org/cgi/man.cgi?query=sshd&apropos=0&sektion=8&manpath=FreeBSD+10.3-RELEASE&format=html

       26. sshd_config(5)
           https://www.freebsd.org/cgi/man.cgi?query=sshd_config&apropos=0&sektion=5&manpath=FreeBSD+10.3-RELEASE&format=html

       27. dacscheck(1)
           http://dacs.dss.ca/man/dacscheck.1.html

       28. dacs.exprs(5)
           http://dacs.dss.ca/man/dacs.exprs.5.html

       29. www.dss.ca
           http://www.dss.ca

       30. LICENSE
           http://dacs.dss.ca/man/../misc/LICENSE



DACS 1.4.40                       02/01/2018                       DACSAUTH(1)
